Pgs internet blokées, pubs, dso exploit
Résolu
Eric
-
13 déc. 2005 à 21:09
Utilisateur anonyme -
Utilisateur anonyme -
A voir également:
- Pgs internet blokées, pubs, dso exploit
- Bloquer les pubs youtube - Accueil - Streaming
- Gps sans internet - Guide
- Supprimer les pubs - Guide
- Complete internet repair - Télécharger - Web & Internet
- Mon pc rame sur internet - Guide
25 réponses
Utilisateur anonyme
13 déc. 2005 à 21:16
13 déc. 2005 à 21:16
salut telecharge et execute ces antispywares ( pense a les mettre a jour avant de les lancées)
(1) ad-aware version 1.06
(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo
http://pageperso.aol.fr/balltrap34/adwseflash.zip
***
(2) spybot version 1.4
(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo d utilisation
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm
***
et aussi ceci
(3) CleanUp40.exe
http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo
http://pageperso.aol.fr/balltrap34/democleanup.htm
***
(4) a2
http://www.emsisoft.net/fr/
penser a le metre a jour avant de scanner le pc
***
ps : un grand merci a balltrap pour les lien :)
(5) Edwido
http://download.ewido.net/ewido-setup.exe
Pendant l'installation, sur la page "Additional Options", décoche les deux options "Install background guard" et "Install scan via context menu Ewido Security Suite. Clique sur mise à jour.
Clique sur scanner puis sur scan complet du système.
(6)SmitfraudFix
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.
ensuite telecharge hijackthis et colle le raport ici
http://www.infos-du-net.com/telecharger/HijackThis.html
demo :
http://pageperso.aol.fr/balltrap34/demohijack.htm
@++++++++
(1) ad-aware version 1.06
(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo
http://pageperso.aol.fr/balltrap34/adwseflash.zip
***
(2) spybot version 1.4
(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo d utilisation
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm
***
et aussi ceci
(3) CleanUp40.exe
http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo
http://pageperso.aol.fr/balltrap34/democleanup.htm
***
(4) a2
http://www.emsisoft.net/fr/
penser a le metre a jour avant de scanner le pc
***
ps : un grand merci a balltrap pour les lien :)
(5) Edwido
http://download.ewido.net/ewido-setup.exe
Pendant l'installation, sur la page "Additional Options", décoche les deux options "Install background guard" et "Install scan via context menu Ewido Security Suite. Clique sur mise à jour.
Clique sur scanner puis sur scan complet du système.
(6)SmitfraudFix
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.
ensuite telecharge hijackthis et colle le raport ici
http://www.infos-du-net.com/telecharger/HijackThis.html
demo :
http://pageperso.aol.fr/balltrap34/demohijack.htm
@++++++++
Utilisateur anonyme
13 déc. 2005 à 23:27
13 déc. 2005 à 23:27
salut tout d'abord il faut desactiver ce service O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\eric\LOCALS~1\Temp\hpdj.exe (file missing)
donc va dans :
Menu Démarrer/Panneau de Configuration/Outils d'administration/Services
Dans la fenêtre qui s'ouvre, double-clique sur la ligne "hpdj ".
Dans le champ "Type de démarrage" de l'onglet "Général", sélectionne "Desactivé".
Clique sur "Arrêter".
Clique ensuite sur "OK" pour valider la configuration.
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1022.dll,InstantAccess
1.redemarre en mode sans echec (redemarage + tapotte sans arret sur F8 desque l'ordi s'allume)
2. desactive ta restauration (pour win xp ) comme ceci :
clike droit sur post de travaille/proprietes/restauration system et la tu coche desactiver la restauration du systeme tu applique
3. affiche les fichier cacher comme ceci :
clicker sur demarrer/panneau de configuration/option des dossiers/affichage
Cocher afficher les dossiers cacher
Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Puis fais «Ok» pour valider les changements.
Decocher masquer les extentions dont le type est connues
4.ensuite va dans demarrer/rechercher et tape:
p2esocks_1022.dll
suprime le et vide ta corebeille
reactive la restauration et masque les fichiers caché en suivant le meme chemin
toujour en mode sans echec execute smitfraud et cette fois ci choisi l'option 2 et colle le rapport ici
@+++++++
donc va dans :
Menu Démarrer/Panneau de Configuration/Outils d'administration/Services
Dans la fenêtre qui s'ouvre, double-clique sur la ligne "hpdj ".
Dans le champ "Type de démarrage" de l'onglet "Général", sélectionne "Desactivé".
Clique sur "Arrêter".
Clique ensuite sur "OK" pour valider la configuration.
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1022.dll,InstantAccess
1.redemarre en mode sans echec (redemarage + tapotte sans arret sur F8 desque l'ordi s'allume)
2. desactive ta restauration (pour win xp ) comme ceci :
clike droit sur post de travaille/proprietes/restauration system et la tu coche desactiver la restauration du systeme tu applique
3. affiche les fichier cacher comme ceci :
clicker sur demarrer/panneau de configuration/option des dossiers/affichage
Cocher afficher les dossiers cacher
Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Puis fais «Ok» pour valider les changements.
Decocher masquer les extentions dont le type est connues
4.ensuite va dans demarrer/rechercher et tape:
p2esocks_1022.dll
suprime le et vide ta corebeille
reactive la restauration et masque les fichiers caché en suivant le meme chemin
toujour en mode sans echec execute smitfraud et cette fois ci choisi l'option 2 et colle le rapport ici
@+++++++
Voila, voila,
Concernant "p2esocks_1022.dll", la recherche a été infructueuse. Il faut savoir que depusi qqs tps (bien avant ce pb de virus), le message suivant apparait à l'entrée de windows :
Erreur de chargement de p2esocks_1022.dll
Le module spécifié est introuvable.
Sinon, voici le rapport de smitfraud :
SmitFraudFix v2.08
Rapport fait à 23:51:43,29 le 13/12/2005
Executé à partir de C:\Documents and Settings\eric\Bureau\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
C:\WINDOWS\system32\msvol.tlb supprimé
C:\WINDOWS\system32\ncompat.tlb supprimé
C:\WINDOWS\system32\ot.ico supprimé
C:\WINDOWS\system32\ts.ico supprimé
C:\WINDOWS\system32\1024\ supprimé
C:\Program Files\SpyKiller\ supprimé
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
Nettoyage terminé.
»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
Concernant "p2esocks_1022.dll", la recherche a été infructueuse. Il faut savoir que depusi qqs tps (bien avant ce pb de virus), le message suivant apparait à l'entrée de windows :
Erreur de chargement de p2esocks_1022.dll
Le module spécifié est introuvable.
Sinon, voici le rapport de smitfraud :
SmitFraudFix v2.08
Rapport fait à 23:51:43,29 le 13/12/2005
Executé à partir de C:\Documents and Settings\eric\Bureau\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
C:\WINDOWS\system32\msvol.tlb supprimé
C:\WINDOWS\system32\ncompat.tlb supprimé
C:\WINDOWS\system32\ot.ico supprimé
C:\WINDOWS\system32\ts.ico supprimé
C:\WINDOWS\system32\1024\ supprimé
C:\Program Files\SpyKiller\ supprimé
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
Nettoyage terminé.
»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
Utilisateur anonyme
14 déc. 2005 à 00:12
14 déc. 2005 à 00:12
remet un hijack stp
ou en ai tu avec tes problemes?
@+++++++
ou en ai tu avec tes problemes?
@+++++++
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Voilà :
Logfile of HijackThis v1.99.1
Scan saved at 00:11:11, on 14/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\cpuidle.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
C:\Program Files\Classic PhoneTools\CapFax.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe
C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Harrap's Multimédia\Shorter\bin\HiHarrapsTray.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fourni par chello broadband n.v.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.chello.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Agent] C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SCM] c:\program files\silver crest memory adapter tools2.93\scma.exe sys_auto_run C:\Program Files\Silver Crest Memory Adapter Tools2.93
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe"
O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1022.dll,InstantAccess
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Ask Harrap's Shorter.lnk = ?
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://home.fra.chello.be/ssi/welcome/welcome.php?url=home
O16 - DPF: ChatSpace Full Java Client 3.1.0.235 - http://irc.chatway.com:8059/Java/cfs31235.cab
O16 - DPF: Interface Chat Voila - http://chat9.x-echo.com/version5/Applet/vchatsign.cab
O16 - DPF: ServerPushBox - http://www.spot.be/servp12.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/0489b35107d6b53e9b21/netzip/RdxIE601_fr.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120293400015
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {AE775D48-49AA-11D1-8F1C-00C04FB67063} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v5/ticker.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: cpuidle - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Logfile of HijackThis v1.99.1
Scan saved at 00:11:11, on 14/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\cpuidle.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
C:\Program Files\Classic PhoneTools\CapFax.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe
C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Harrap's Multimédia\Shorter\bin\HiHarrapsTray.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fourni par chello broadband n.v.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.chello.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Agent] C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SCM] c:\program files\silver crest memory adapter tools2.93\scma.exe sys_auto_run C:\Program Files\Silver Crest Memory Adapter Tools2.93
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe"
O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1022.dll,InstantAccess
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Ask Harrap's Shorter.lnk = ?
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://home.fra.chello.be/ssi/welcome/welcome.php?url=home
O16 - DPF: ChatSpace Full Java Client 3.1.0.235 - http://irc.chatway.com:8059/Java/cfs31235.cab
O16 - DPF: Interface Chat Voila - http://chat9.x-echo.com/version5/Applet/vchatsign.cab
O16 - DPF: ServerPushBox - http://www.spot.be/servp12.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/0489b35107d6b53e9b21/netzip/RdxIE601_fr.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120293400015
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {AE775D48-49AA-11D1-8F1C-00C04FB67063} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v5/ticker.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: cpuidle - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
En fait, le virus semble être supprimé... plus aucun message quelconque n'apparait à ce propos.
Il est bien parti ou pas ?
merci
Il est bien parti ou pas ?
merci
Utilisateur anonyme
14 déc. 2005 à 00:24
14 déc. 2005 à 00:24
re ton log est propre y'a just un truc que j'ai oublié de precisé c'est de fixer cette ligne avec hijack
tu lance hijack clike sur le 2eme bouton / coche cette ligne et clike sur fix checked
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1022.dll,InstantAccess
apres t'aura plus ce message au demarage : Erreur de chargement de p2esocks_1022.dll
Le module spécifié est introuvable.
sinon apart ca tout est clean lance les antispyware au moin une fois par semaine .
installe un parfeu pour renforcé la securité perso je te conseille kerio
@+++++++
tu lance hijack clike sur le 2eme bouton / coche cette ligne et clike sur fix checked
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1022.dll,InstantAccess
apres t'aura plus ce message au demarage : Erreur de chargement de p2esocks_1022.dll
Le module spécifié est introuvable.
sinon apart ca tout est clean lance les antispyware au moin une fois par semaine .
installe un parfeu pour renforcé la securité perso je te conseille kerio
@+++++++
Yes, un très grand merci en tt cas !!!!
Juste une petite chose. Spybot S&D trouve encore :
Smitfraud-C.: Réglages utilisateur (Modification du registre, nothing done)
HKEY_USERS\S-1-5-21-1715567821-1547161642-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-spy-cam.net\*!=W=4
--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---
Pas possible de le supprimer "sans doute parce que les fichiers concernés sont tjs actifs (en mémoire)"
Qu'est-ce ??
Et pr le pare-feu, celui de windowx xp pack2 ne suffit dc pas selon toi ??
Quoiqu'il en soit, encore un tt grand merci à toi !
Juste une petite chose. Spybot S&D trouve encore :
Smitfraud-C.: Réglages utilisateur (Modification du registre, nothing done)
HKEY_USERS\S-1-5-21-1715567821-1547161642-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-spy-cam.net\*!=W=4
--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---
Pas possible de le supprimer "sans doute parce que les fichiers concernés sont tjs actifs (en mémoire)"
Qu'est-ce ??
Et pr le pare-feu, celui de windowx xp pack2 ne suffit dc pas selon toi ??
Quoiqu'il en soit, encore un tt grand merci à toi !
Utilisateur anonyme
14 déc. 2005 à 01:01
14 déc. 2005 à 01:01
salut
supprime la direct du registre voici le chemin
demarrer/executer/tape : regedit
ensuite supprime la clée en suivent son chemin d acces HKEY_USERS\S-1-5-21-1715567821-1547161642-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-spy-cam.net\*!=W=4
si t'arrive pas en mode normal essay en mode sans echec
nb faut faire attention avec le registre c'est a dire supprime la bonne clée sinon plantage du pc !!
pour le parefeu de windows je connais pas bien donc je peu pas donné un avi la dessu .perso j'utlise kerio il est trés bien :) .si tu te sent protegé avec la parefeu de windows alors garde le :)
@++++++
bonne nuit !! :)
supprime la direct du registre voici le chemin
demarrer/executer/tape : regedit
ensuite supprime la clée en suivent son chemin d acces HKEY_USERS\S-1-5-21-1715567821-1547161642-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-spy-cam.net\*!=W=4
si t'arrive pas en mode normal essay en mode sans echec
nb faut faire attention avec le registre c'est a dire supprime la bonne clée sinon plantage du pc !!
pour le parefeu de windows je connais pas bien donc je peu pas donné un avi la dessu .perso j'utlise kerio il est trés bien :) .si tu te sent protegé avec la parefeu de windows alors garde le :)
@++++++
bonne nuit !! :)
balltrap34
Messages postés
16240
Date d'inscription
jeudi 8 janvier 2004
Statut
Contributeur sécurité
Dernière intervention
28 novembre 2009
332
14 déc. 2005 à 01:16
14 déc. 2005 à 01:16
salut
pour cela utilise ceci avec l option 3
telecharge
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
tu le decompresse tu double clik dessus sur smitfraudfix.cmd et tu choisi l option 3
pour cela utilise ceci avec l option 3
telecharge
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
tu le decompresse tu double clik dessus sur smitfraudfix.cmd et tu choisi l option 3
hollowspy
Messages postés
30
Date d'inscription
mercredi 15 février 2006
Statut
Membre
Dernière intervention
23 juin 2009
18 févr. 2006 à 13:33
18 févr. 2006 à 13:33
Bonjour à tous !
Je viens de faire une recherche sur le forum et il s'avère ke je viens de trouver un sujet ou j'ai exactement le même problème. J'ai également des pages internets qui s'ouvrent disons toutes les 5-10 minutes (soit en me disant ke mon systme est infecté et que fo ke j'achete et scan en ligne, soit des pubs), ce qui s'avère très très pénible.
Je viens alors de faire ce que tu a dit Jess pour la personne d'avant, c'est à dire que dl les programmes que je n'avais pas (j'utilisais seulement kaspersky en anti-virus + ad aware et spybot, mais pas le reste), voici le rapport des deux derniers
SmitFraudFix v2.21
Rapport fait à 13:20:03,79 le 18/02/2006
Executé à partir de C:\Documents and Settings\Uilisateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32
C:\WINDOWS\system32\paradise.raw.exe PRESENT !
»»»»»»»»»»»»»»»»»»»»»»»» Recherche ...\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
[HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
[HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
.............................................................................................
Logfile of HijackThis v1.99.1
Scan saved at 13:25:59, on 18/02/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Documents and Settings\Uilisateur\Bureau\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\RunServices: [Windows mod Verifier] Windows-mod.exe
O4 - HKLM\..\RunServices: [AdobeReaderPro] svxhost.exe
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\en48l1hu1.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Microsoft Windows Update Service (Windows Update Service) - Unknown owner - C:\WINDOWS\services.exe (file missing)
Si quelqu'un peut m'aider à régler cette affaire, j'avoue que ca m'aiderait vraiment beaucoup, car c super pénible.
Merci d'avance
Je viens de faire une recherche sur le forum et il s'avère ke je viens de trouver un sujet ou j'ai exactement le même problème. J'ai également des pages internets qui s'ouvrent disons toutes les 5-10 minutes (soit en me disant ke mon systme est infecté et que fo ke j'achete et scan en ligne, soit des pubs), ce qui s'avère très très pénible.
Je viens alors de faire ce que tu a dit Jess pour la personne d'avant, c'est à dire que dl les programmes que je n'avais pas (j'utilisais seulement kaspersky en anti-virus + ad aware et spybot, mais pas le reste), voici le rapport des deux derniers
SmitFraudFix v2.21
Rapport fait à 13:20:03,79 le 18/02/2006
Executé à partir de C:\Documents and Settings\Uilisateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32
C:\WINDOWS\system32\paradise.raw.exe PRESENT !
»»»»»»»»»»»»»»»»»»»»»»»» Recherche ...\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
[HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
[HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
.............................................................................................
Logfile of HijackThis v1.99.1
Scan saved at 13:25:59, on 18/02/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Documents and Settings\Uilisateur\Bureau\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\RunServices: [Windows mod Verifier] Windows-mod.exe
O4 - HKLM\..\RunServices: [AdobeReaderPro] svxhost.exe
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\en48l1hu1.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Microsoft Windows Update Service (Windows Update Service) - Unknown owner - C:\WINDOWS\services.exe (file missing)
Si quelqu'un peut m'aider à régler cette affaire, j'avoue que ca m'aiderait vraiment beaucoup, car c super pénible.
Merci d'avance
hollowspy
Messages postés
30
Date d'inscription
mercredi 15 février 2006
Statut
Membre
Dernière intervention
23 juin 2009
18 févr. 2006 à 13:36
18 févr. 2006 à 13:36
Bonjour à tous !
Je viens de faire une recherche sur le forum et il s'avère ke je viens de trouver un sujet ou j'ai exactement le même problème. J'ai également des pages internets qui s'ouvrent disons toutes les 5-10 minutes (soit en me disant ke mon systme est infecté et que fo ke j'achete et scan en ligne, soit des pubs), ce qui s'avère très très pénible.
Je viens alors de faire ce que tu a dit Jess pour la personne d'avant, c'est à dire que dl les programmes que je n'avais pas (j'utilisais seulement kaspersky en anti-virus + ad aware et spybot, mais pas le reste), voici le rapport des deux derniers
SmitFraudFix v2.21
Rapport fait à 13:20:03,79 le 18/02/2006
Executé à partir de C:\Documents and Settings\Uilisateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32
C:\WINDOWS\system32\paradise.raw.exe PRESENT !
»»»»»»»»»»»»»»»»»»»»»»»» Recherche ...\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
[HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
[HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
.............................................................................................
Logfile of HijackThis v1.99.1
Scan saved at 13:25:59, on 18/02/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Documents and Settings\Uilisateur\Bureau\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\RunServices: [Windows mod Verifier] Windows-mod.exe
O4 - HKLM\..\RunServices: [AdobeReaderPro] svxhost.exe
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\en48l1hu1.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Microsoft Windows Update Service (Windows Update Service) - Unknown owner - C:\WINDOWS\services.exe (file missing)
Je viens de faire une recherche sur le forum et il s'avère ke je viens de trouver un sujet ou j'ai exactement le même problème. J'ai également des pages internets qui s'ouvrent disons toutes les 5-10 minutes (soit en me disant ke mon systme est infecté et que fo ke j'achete et scan en ligne, soit des pubs), ce qui s'avère très très pénible.
Je viens alors de faire ce que tu a dit Jess pour la personne d'avant, c'est à dire que dl les programmes que je n'avais pas (j'utilisais seulement kaspersky en anti-virus + ad aware et spybot, mais pas le reste), voici le rapport des deux derniers
SmitFraudFix v2.21
Rapport fait à 13:20:03,79 le 18/02/2006
Executé à partir de C:\Documents and Settings\Uilisateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32
C:\WINDOWS\system32\paradise.raw.exe PRESENT !
»»»»»»»»»»»»»»»»»»»»»»»» Recherche ...\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
[HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
[HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
.............................................................................................
Logfile of HijackThis v1.99.1
Scan saved at 13:25:59, on 18/02/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Documents and Settings\Uilisateur\Bureau\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\RunServices: [Windows mod Verifier] Windows-mod.exe
O4 - HKLM\..\RunServices: [AdobeReaderPro] svxhost.exe
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\en48l1hu1.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Microsoft Windows Update Service (Windows Update Service) - Unknown owner - C:\WINDOWS\services.exe (file missing)
Salut,
Redemarre ton pc, des l'allumage, tapotes la touche f8, un ecran va apparaitre, choisis "mode sans echec" attends un peu..puis relance smithfraudfix et choisis l'option 2, enregistre le rapport.
clique sur demarrer, executer, tape: msconfig ,vas dans l'onglet "services" coches la case "masquer les services microsoft" puis decoche la case devant ces lignes:
[Windows mod Verifier] Windows-mod.exe
[AdobeReaderPro] svxhost.exe
cliques sur demarrer, rechercher, cherches et supprimes ces fichiers:
en48l1hu1.dll
svxhost.exe
Windows-mod.exe
vides ta corbeille et redemarres normalement.
A++
Redemarre ton pc, des l'allumage, tapotes la touche f8, un ecran va apparaitre, choisis "mode sans echec" attends un peu..puis relance smithfraudfix et choisis l'option 2, enregistre le rapport.
clique sur demarrer, executer, tape: msconfig ,vas dans l'onglet "services" coches la case "masquer les services microsoft" puis decoche la case devant ces lignes:
[Windows mod Verifier] Windows-mod.exe
[AdobeReaderPro] svxhost.exe
cliques sur demarrer, rechercher, cherches et supprimes ces fichiers:
en48l1hu1.dll
svxhost.exe
Windows-mod.exe
vides ta corbeille et redemarres normalement.
A++
Utilisateur anonyme
18 févr. 2006 à 13:56
18 févr. 2006 à 13:56
salut
1.redemarre en mode sans echec (redemarage + tapotte sans arret sur F8 desque l'ordi s'allume)
2. lance smitfraud et choisi l'option 2 et 3 et colle le rapport ici
redemare en mode normal
1/ Télécharge l2mfix.exe ici http://www.downloads.subratam.org/l2mfix.exe
Mets-le sur ton bureau.
Double-clic sur l2mfix.exe
A la 1ère question clic sur Accept, ensuite clic sur Install
2/ Ouvre le dossier l2mfix créé sur le bureau puis double-clic sur L2Mfix.bat
Ensuite choisis l'option 1 puis Entrée
Poste ce 1er rapport.
@+++++++++
1.redemarre en mode sans echec (redemarage + tapotte sans arret sur F8 desque l'ordi s'allume)
2. lance smitfraud et choisi l'option 2 et 3 et colle le rapport ici
redemare en mode normal
1/ Télécharge l2mfix.exe ici http://www.downloads.subratam.org/l2mfix.exe
Mets-le sur ton bureau.
Double-clic sur l2mfix.exe
A la 1ère question clic sur Accept, ensuite clic sur Install
2/ Ouvre le dossier l2mfix créé sur le bureau puis double-clic sur L2Mfix.bat
Ensuite choisis l'option 1 puis Entrée
Poste ce 1er rapport.
@+++++++++
hollowspy
Messages postés
30
Date d'inscription
mercredi 15 février 2006
Statut
Membre
Dernière intervention
23 juin 2009
18 févr. 2006 à 14:18
18 févr. 2006 à 14:18
Merci de ta réponse si rapide :)
Alors, j'ai fais ce que tu m'a demandé de faire, voici le rapport de smitfraud :
SmitFraudFix v2.21
Rapport fait à 14:07:48,42 le 18/02/2006
Executé à partir de C:\Documents and Settings\Uilisateur\Mes documents\barre d'outil\logiciel nettoyage\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
C:\WINDOWS\system32\paradise.raw.exe supprimé
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage Fichiers Temporaires
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
Nettoyage terminé.
»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
..............................................................................................
Et voici celui de l2mfix
L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Explorer]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\k0260afsed260.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
**********************************************************************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{63D8F587-E691-CB83-B3E6-1D1878372757}"=""
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
"{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Extension de la page de propri‚t‚s de mise … jour automatique"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{5E2121EE-0300-11D4-8D3B-444553540000}"="Catalyst Context Menu extension"
"{1768500D-8668-40FA-A94E-A3FF196EE7FA}"=""
"{84B3EB00-958F-4B9A-901D-1AC522237412}"=""
"{DE164912-8F55-453D-AB05-EECE2F028371}"=""
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}"=""
"{C37031C3-A4DA-4433-A70A-AFD735BB42DE}"=""
"{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}"=""
"{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}"=""
"{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}"=""
"{618900C2-7E1A-4F78-9C73-DBC91607FB9D}"=""
"{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}"=""
"{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}"=""
"{9443DF74-6C07-4C5F-837B-5A6B1692656D}"=""
"{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}"=""
**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\InprocServer32]
@="C:\\WINDOWS\\system32\\cMtsrv.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\InprocServer32]
@="C:\\WINDOWS\\system32\\jcmd400.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\InprocServer32]
@="C:\\WINDOWS\\system32\\ktdgr.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\InprocServer32]
@="C:\\WINDOWS\\system32\\msxclu.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\InprocServer32]
@="C:\\WINDOWS\\system32\\mccorier.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\InprocServer32]
@="C:\\WINDOWS\\system32\\clmdlg32.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\InprocServer32]
@="C:\\WINDOWS\\system32\\mqtime.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\InprocServer32]
@="C:\\WINDOWS\\system32\\whhisn.dll"
"ThreadingModel"="Apartment"
**********************************************************************************
Files Found are not all bad files:
C:\WINDOWS\SYSTEM32\
ati2cqag.dll Wed 25 Jan 2006 4:10:38 A.... 258 048 252,00 K
ati2dvag.dll Wed 25 Jan 2006 4:52:48 A.... 255 488 249,50 K
ati2edxx.dll Wed 25 Jan 2006 4:46:50 A.... 41 472 40,50 K
ati2evxx.dll Wed 25 Jan 2006 4:46:38 A.... 61 440 60,00 K
ati3duag.dll Wed 25 Jan 2006 4:36:50 A.... 2 604 128 2,48 M
atiddc.dll Wed 25 Jan 2006 4:44:58 A.... 53 248 52,00 K
atidemgr.dll Wed 25 Jan 2006 3:29:40 A.... 282 624 276,00 K
atiiiexx.dll Wed 25 Jan 2006 4:28:12 A.... 307 200 300,00 K
atikvmag.dll Wed 25 Jan 2006 4:16:50 A.... 151 552 148,00 K
atioglx1.dll Wed 25 Jan 2006 4:30:28 A.... 6 684 672 6,38 M
atioglxx.dll Wed 25 Jan 2006 4:13:54 A.... 5 115 904 4,88 M
atipdlxx.dll Wed 25 Jan 2006 4:47:18 A.... 114 688 112,00 K
atitvo32.dll Wed 25 Jan 2006 4:16:08 A.... 17 408 17,00 K
ativvaxx.dll Wed 25 Jan 2006 4:30:18 A.... 860 192 840,03 K
divx.dll Thu 26 Jan 2006 19:36:02 A.... 574 976 561,50 K
divxwm~1.dll Tue 24 Jan 2006 19:08:30 A.... 12 288 12,00 K
divx_x~1.dll Thu 26 Jan 2006 19:36:00 A.... 679 936 664,00 K
divx_x~2.dll Thu 26 Jan 2006 19:36:00 A.... 679 936 664,00 K
divx_x~3.dll Thu 26 Jan 2006 19:36:00 A.... 663 552 648,00 K
dpl100.dll Mon 9 Jan 2006 20:32:02 A.... 86 016 84,00 K
dpu10.dll Mon 9 Jan 2006 20:32:02 A.... 294 912 288,00 K
dpu11.dll Mon 9 Jan 2006 20:32:02 A.... 294 912 288,00 K
dpugui11.dll Mon 9 Jan 2006 20:32:02 A.... 593 920 580,00 K
dpus11.dll Mon 9 Jan 2006 20:32:02 A.... 339 968 332,00 K
dpv11.dll Mon 9 Jan 2006 20:32:02 A.... 57 344 56,00 K
dtu100.dll Mon 9 Jan 2006 20:32:02 A.... 200 704 196,00 K
i4lo0e~1.dll Sat 18 Feb 2006 14:07:16 ..S.R 234 183 228,69 K
k0260a~1.dll Sat 18 Feb 2006 14:05:40 ..S.R 237 195 231,63 K
oemdspif.dll Wed 25 Jan 2006 4:47:04 A.... 77 824 76,00 K
sirenacm.dll Tue 24 Jan 2006 19:34:24 A.... 118 784 116,00 K
whhisn.dll Sat 18 Feb 2006 14:10:22 ..S.R 237 195 231,63 K
31 items found: 31 files (3 H/S), 0 directories.
Total of file sizes: 22 191 709 bytes 21,16 M
Locate .tmp files:
C:\WINDOWS\SYSTEM32\
guard.tmp Sat 18 Feb 2006 14:10:28 A.... 234 131 228,64 K
1 item found: 1 file, 0 directories.
Total of file sizes: 234 131 bytes 228,64 K
**********************************************************************************
Directory Listing of system files:
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est C81C-1F92
R‚pertoire de C:\WINDOWS\System32
18/02/2006 14:10 237ÿ195 whhisn.dll
18/02/2006 14:07 234ÿ183 i4lo0e33eh.dll
18/02/2006 14:05 237ÿ195 k0260afsed260.dll
18/02/2006 13:49 <REP> dllcache
3 fichier(s) 708ÿ573 octets
1 R‚p(s) 53ÿ991ÿ952ÿ384 octets libres
Alors, j'ai fais ce que tu m'a demandé de faire, voici le rapport de smitfraud :
SmitFraudFix v2.21
Rapport fait à 14:07:48,42 le 18/02/2006
Executé à partir de C:\Documents and Settings\Uilisateur\Mes documents\barre d'outil\logiciel nettoyage\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
C:\WINDOWS\system32\paradise.raw.exe supprimé
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage Fichiers Temporaires
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
Nettoyage terminé.
»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
..............................................................................................
Et voici celui de l2mfix
L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Explorer]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\k0260afsed260.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
**********************************************************************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{63D8F587-E691-CB83-B3E6-1D1878372757}"=""
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
"{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Extension de la page de propri‚t‚s de mise … jour automatique"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{5E2121EE-0300-11D4-8D3B-444553540000}"="Catalyst Context Menu extension"
"{1768500D-8668-40FA-A94E-A3FF196EE7FA}"=""
"{84B3EB00-958F-4B9A-901D-1AC522237412}"=""
"{DE164912-8F55-453D-AB05-EECE2F028371}"=""
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}"=""
"{C37031C3-A4DA-4433-A70A-AFD735BB42DE}"=""
"{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}"=""
"{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}"=""
"{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}"=""
"{618900C2-7E1A-4F78-9C73-DBC91607FB9D}"=""
"{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}"=""
"{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}"=""
"{9443DF74-6C07-4C5F-837B-5A6B1692656D}"=""
"{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}"=""
**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\InprocServer32]
@="C:\\WINDOWS\\system32\\cMtsrv.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\InprocServer32]
@="C:\\WINDOWS\\system32\\jcmd400.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\InprocServer32]
@="C:\\WINDOWS\\system32\\ktdgr.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\InprocServer32]
@="C:\\WINDOWS\\system32\\msxclu.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\InprocServer32]
@="C:\\WINDOWS\\system32\\mccorier.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\InprocServer32]
@="C:\\WINDOWS\\system32\\clmdlg32.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\InprocServer32]
@="C:\\WINDOWS\\system32\\mqtime.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\InprocServer32]
@="C:\\WINDOWS\\system32\\whhisn.dll"
"ThreadingModel"="Apartment"
**********************************************************************************
Files Found are not all bad files:
C:\WINDOWS\SYSTEM32\
ati2cqag.dll Wed 25 Jan 2006 4:10:38 A.... 258 048 252,00 K
ati2dvag.dll Wed 25 Jan 2006 4:52:48 A.... 255 488 249,50 K
ati2edxx.dll Wed 25 Jan 2006 4:46:50 A.... 41 472 40,50 K
ati2evxx.dll Wed 25 Jan 2006 4:46:38 A.... 61 440 60,00 K
ati3duag.dll Wed 25 Jan 2006 4:36:50 A.... 2 604 128 2,48 M
atiddc.dll Wed 25 Jan 2006 4:44:58 A.... 53 248 52,00 K
atidemgr.dll Wed 25 Jan 2006 3:29:40 A.... 282 624 276,00 K
atiiiexx.dll Wed 25 Jan 2006 4:28:12 A.... 307 200 300,00 K
atikvmag.dll Wed 25 Jan 2006 4:16:50 A.... 151 552 148,00 K
atioglx1.dll Wed 25 Jan 2006 4:30:28 A.... 6 684 672 6,38 M
atioglxx.dll Wed 25 Jan 2006 4:13:54 A.... 5 115 904 4,88 M
atipdlxx.dll Wed 25 Jan 2006 4:47:18 A.... 114 688 112,00 K
atitvo32.dll Wed 25 Jan 2006 4:16:08 A.... 17 408 17,00 K
ativvaxx.dll Wed 25 Jan 2006 4:30:18 A.... 860 192 840,03 K
divx.dll Thu 26 Jan 2006 19:36:02 A.... 574 976 561,50 K
divxwm~1.dll Tue 24 Jan 2006 19:08:30 A.... 12 288 12,00 K
divx_x~1.dll Thu 26 Jan 2006 19:36:00 A.... 679 936 664,00 K
divx_x~2.dll Thu 26 Jan 2006 19:36:00 A.... 679 936 664,00 K
divx_x~3.dll Thu 26 Jan 2006 19:36:00 A.... 663 552 648,00 K
dpl100.dll Mon 9 Jan 2006 20:32:02 A.... 86 016 84,00 K
dpu10.dll Mon 9 Jan 2006 20:32:02 A.... 294 912 288,00 K
dpu11.dll Mon 9 Jan 2006 20:32:02 A.... 294 912 288,00 K
dpugui11.dll Mon 9 Jan 2006 20:32:02 A.... 593 920 580,00 K
dpus11.dll Mon 9 Jan 2006 20:32:02 A.... 339 968 332,00 K
dpv11.dll Mon 9 Jan 2006 20:32:02 A.... 57 344 56,00 K
dtu100.dll Mon 9 Jan 2006 20:32:02 A.... 200 704 196,00 K
i4lo0e~1.dll Sat 18 Feb 2006 14:07:16 ..S.R 234 183 228,69 K
k0260a~1.dll Sat 18 Feb 2006 14:05:40 ..S.R 237 195 231,63 K
oemdspif.dll Wed 25 Jan 2006 4:47:04 A.... 77 824 76,00 K
sirenacm.dll Tue 24 Jan 2006 19:34:24 A.... 118 784 116,00 K
whhisn.dll Sat 18 Feb 2006 14:10:22 ..S.R 237 195 231,63 K
31 items found: 31 files (3 H/S), 0 directories.
Total of file sizes: 22 191 709 bytes 21,16 M
Locate .tmp files:
C:\WINDOWS\SYSTEM32\
guard.tmp Sat 18 Feb 2006 14:10:28 A.... 234 131 228,64 K
1 item found: 1 file, 0 directories.
Total of file sizes: 234 131 bytes 228,64 K
**********************************************************************************
Directory Listing of system files:
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est C81C-1F92
R‚pertoire de C:\WINDOWS\System32
18/02/2006 14:10 237ÿ195 whhisn.dll
18/02/2006 14:07 234ÿ183 i4lo0e33eh.dll
18/02/2006 14:05 237ÿ195 k0260afsed260.dll
18/02/2006 13:49 <REP> dllcache
3 fichier(s) 708ÿ573 octets
1 R‚p(s) 53ÿ991ÿ952ÿ384 octets libres
hollowspy
Messages postés
30
Date d'inscription
mercredi 15 février 2006
Statut
Membre
Dernière intervention
23 juin 2009
18 févr. 2006 à 14:48
18 févr. 2006 à 14:48
Bon bah voilà, je vous ai donné les rapports sur le messages précédents, et pour l'instant, j'ai toujours les pages internets qui s'ouvrent toutes les 5 min :p.
Merci quand même de l'aide, c vraiment sympa, que dois je faire now ??
Merci quand même de l'aide, c vraiment sympa, que dois je faire now ??
hollowspy
Messages postés
30
Date d'inscription
mercredi 15 février 2006
Statut
Membre
Dernière intervention
23 juin 2009
18 févr. 2006 à 14:53
18 févr. 2006 à 14:53
Bah voilà, j'ai fais ce que vous m'aviez dit, mais bon ca marche toujours pas snif, ces pages internets s'ouvrent toujours toutes les cinq minutes.
Je dois par contre signaler qu'il m'a été impossible de supprimer les trois fichiers que tu as dit, car ils n'ont pas été trouvé (bizar quand je c que svxhost, il é bel et bien dans l'ordi). Enfin, je vous dit tout ki pourrait vs etre utile .
Merci encore de votre aide, et que dois je faire maintenant ?
Je dois par contre signaler qu'il m'a été impossible de supprimer les trois fichiers que tu as dit, car ils n'ont pas été trouvé (bizar quand je c que svxhost, il é bel et bien dans l'ordi). Enfin, je vous dit tout ki pourrait vs etre utile .
Merci encore de votre aide, et que dois je faire maintenant ?
hollowspy
Messages postés
30
Date d'inscription
mercredi 15 février 2006
Statut
Membre
Dernière intervention
23 juin 2009
18 févr. 2006 à 15:12
18 févr. 2006 à 15:12
nan nan je n'ai pas eu le tps de faire la manipulation, enfin maintenant si. Je pensais que mon message ne s'affichait pas alors j'en avais fait un 2eme et en plus j'avais oublié de parler des fichiers non supprimé. Désolé s'il y a eu une mauvaise compréhension. Toujours est il que maintenant je viens de relancer l2mfix.bat et voici le rapport en choississant l'option 2
L2mfix 010406
Creating Account.
La commande s'est termin‚e correctement.
Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful
Running From:
C:\WINDOWS\system32
Killing Processes!
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 440 'smss.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 560 'winlogon.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1760 'explorer.exe'
Killing PID 1760 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1220 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrateurs ... successful
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
Deleting: C:\WINDOWS\system32\iHsads.dll
Successfully Deleted: C:\WINDOWS\system32\iHsads.dll
Deleting: C:\WINDOWS\system32\iuetmib1.dll
Successfully Deleted: C:\WINDOWS\system32\iuetmib1.dll
Deleting: C:\WINDOWS\system32\lvr0099me.dll
Successfully Deleted: C:\WINDOWS\system32\lvr0099me.dll
Deleting: C:\WINDOWS\system32\p0p60a7sed.dll
Successfully Deleted: C:\WINDOWS\system32\p0p60a7sed.dll
Deleting: C:\WINDOWS\system32\pamjpg21.dll
Successfully Deleted: C:\WINDOWS\system32\pamjpg21.dll
Deleting: C:\WINDOWS\system32\whhisn.dll
Successfully Deleted: C:\WINDOWS\system32\whhisn.dll
Deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp
msg11?.dll
0 fichier(s) copi‚(s).
Restoring Windows Update Certificates.:
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\lvr0099me.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
The following are the files found:
****************************************************************************
C:\WINDOWS\system32\iHsads.dll
C:\WINDOWS\system32\iuetmib1.dll
C:\WINDOWS\system32\lvr0099me.dll
C:\WINDOWS\system32\p0p60a7sed.dll
C:\WINDOWS\system32\pamjpg21.dll
C:\WINDOWS\system32\whhisn.dll
C:\WINDOWS\system32\guard.tmp
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\InprocServer32]
@="C:\\WINDOWS\\system32\\cMtsrv.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\InprocServer32]
@="C:\\WINDOWS\\system32\\jcmd400.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\InprocServer32]
@="C:\\WINDOWS\\system32\\ktdgr.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\InprocServer32]
@="C:\\WINDOWS\\system32\\msxclu.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\InprocServer32]
@="C:\\WINDOWS\\system32\\mccorier.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\InprocServer32]
@="C:\\WINDOWS\\system32\\clmdlg32.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\InprocServer32]
@="C:\\WINDOWS\\system32\\mqtime.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\InprocServer32]
@="C:\\WINDOWS\\system32\\whhisn.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}\InprocServer32]
@="C:\\WINDOWS\\system32\\iHsads.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}\InprocServer32]
@="C:\\WINDOWS\\system32\\pamjpg21.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}\InprocServer32]
@="C:\\WINDOWS\\system32\\iuetmib1.dll"
"ThreadingModel"="Apartment"
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{1768500D-8668-40FA-A94E-A3FF196EE7FA}"=-
"{84B3EB00-958F-4B9A-901D-1AC522237412}"=-
"{DE164912-8F55-453D-AB05-EECE2F028371}"=-
"{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}"=-
"{C37031C3-A4DA-4433-A70A-AFD735BB42DE}"=-
"{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}"=-
"{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}"=-
"{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}"=-
"{618900C2-7E1A-4F78-9C73-DBC91607FB9D}"=-
"{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}"=-
"{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}"=-
"{9443DF74-6C07-4C5F-837B-5A6B1692656D}"=-
"{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}"=-
"{7E44E393-51C8-41F7-A0EC-889769420A16}"=-
"{E004A98C-FA99-4C68-BC55-33B50BF19977}"=-
"{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}"=-
[-HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}]
[-HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}]
[-HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}]
[-HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}]
[-HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}]
[-HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}]
[-HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}]
[-HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}]
[-HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}]
[-HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}]
[-HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}]
[-HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}]
[-HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}]
[-HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}]
[-HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}]
[-HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}]
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/guard.tmp (164 bytes security) (deflated 4%)
adding: dlls/iHsads.dll (164 bytes security) (deflated 6%)
adding: dlls/iuetmib1.dll (164 bytes security) (deflated 4%)
adding: dlls/lvr0099me.dll (164 bytes security) (deflated 4%)
adding: dlls/p0p60a7sed.dll (164 bytes security) (deflated 4%)
adding: dlls/pamjpg21.dll (164 bytes security) (deflated 6%)
adding: dlls/whhisn.dll (164 bytes security) (deflated 6%)
adding: backregs/1768500D-8668-40FA-A94E-A3FF196EE7FA.reg (212 bytes security) (deflated 69%)
adding: backregs/256C44BD-6B1C-47A0-861B-2A116BC4FBAE.reg (212 bytes security) (deflated 70%)
adding: backregs/4B0CEDDE-A42F-43D9-A15B-D6BA47196310.reg (212 bytes security) (deflated 70%)
adding: backregs/52AAC8C1-C512-4E61-BAFC-F84AF45AB877.reg (212 bytes security) (deflated 70%)
adding: backregs/618900C2-7E1A-4F78-9C73-DBC91607FB9D.reg (212 bytes security) (deflated 70%)
adding: backregs/61CBD7B2-A25B-49BE-A326-A2FC11B15DC7.reg (212 bytes security) (deflated 70%)
adding: backregs/7E44E393-51C8-41F7-A0EC-889769420A16.reg (212 bytes security) (deflated 70%)
adding: backregs/84B3EB00-958F-4B9A-901D-1AC522237412.reg (212 bytes security) (deflated 70%)
adding: backregs/9443DF74-6C07-4C5F-837B-5A6B1692656D.reg (212 bytes security) (deflated 70%)
adding: backregs/AD65B027-A9BD-4BF5-AA7C-6D04F48038DB.reg (212 bytes security) (deflated 70%)
adding: backregs/C37031C3-A4DA-4433-A70A-AFD735BB42DE.reg (212 bytes security) (deflated 70%)
adding: backregs/D25F1A6C-D09E-445D-8BCF-C5C37DBBF695.reg (212 bytes security) (deflated 70%)
adding: backregs/DDD2998D-E903-47F5-94A6-A8AA255F7FFE.reg (212 bytes security) (deflated 70%)
adding: backregs/DE164912-8F55-453D-AB05-EECE2F028371.reg (212 bytes security) (deflated 70%)
adding: backregs/E004A98C-FA99-4C68-BC55-33B50BF19977.reg (212 bytes security) (deflated 70%)
adding: backregs/F0EE6E86-C42A-4A5D-A83B-40950FD9A86A.reg (212 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)
L2mfix 010406
Creating Account.
La commande s'est termin‚e correctement.
Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful
Running From:
C:\WINDOWS\system32
Killing Processes!
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 440 'smss.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 560 'winlogon.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1760 'explorer.exe'
Killing PID 1760 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1220 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrateurs ... successful
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
Deleting: C:\WINDOWS\system32\iHsads.dll
Successfully Deleted: C:\WINDOWS\system32\iHsads.dll
Deleting: C:\WINDOWS\system32\iuetmib1.dll
Successfully Deleted: C:\WINDOWS\system32\iuetmib1.dll
Deleting: C:\WINDOWS\system32\lvr0099me.dll
Successfully Deleted: C:\WINDOWS\system32\lvr0099me.dll
Deleting: C:\WINDOWS\system32\p0p60a7sed.dll
Successfully Deleted: C:\WINDOWS\system32\p0p60a7sed.dll
Deleting: C:\WINDOWS\system32\pamjpg21.dll
Successfully Deleted: C:\WINDOWS\system32\pamjpg21.dll
Deleting: C:\WINDOWS\system32\whhisn.dll
Successfully Deleted: C:\WINDOWS\system32\whhisn.dll
Deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp
msg11?.dll
0 fichier(s) copi‚(s).
Restoring Windows Update Certificates.:
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\lvr0099me.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
The following are the files found:
****************************************************************************
C:\WINDOWS\system32\iHsads.dll
C:\WINDOWS\system32\iuetmib1.dll
C:\WINDOWS\system32\lvr0099me.dll
C:\WINDOWS\system32\p0p60a7sed.dll
C:\WINDOWS\system32\pamjpg21.dll
C:\WINDOWS\system32\whhisn.dll
C:\WINDOWS\system32\guard.tmp
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}\InprocServer32]
@="C:\\WINDOWS\\system32\\cMtsrv.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}\InprocServer32]
@="C:\\WINDOWS\\system32\\jcmd400.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}\InprocServer32]
@="C:\\WINDOWS\\system32\\ktdgr.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}\InprocServer32]
@="C:\\WINDOWS\\system32\\msxclu.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}\InprocServer32]
@="C:\\WINDOWS\\system32\\mccorier.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}\InprocServer32]
@="C:\\WINDOWS\\system32\\clmdlg32.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}\InprocServer32]
@="C:\\WINDOWS\\system32\\mqtime.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}\InprocServer32]
@="C:\\WINDOWS\\system32\\whhisn.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}\InprocServer32]
@="C:\\WINDOWS\\system32\\iHsads.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}\InprocServer32]
@="C:\\WINDOWS\\system32\\pamjpg21.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}\InprocServer32]
@="C:\\WINDOWS\\system32\\iuetmib1.dll"
"ThreadingModel"="Apartment"
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{1768500D-8668-40FA-A94E-A3FF196EE7FA}"=-
"{84B3EB00-958F-4B9A-901D-1AC522237412}"=-
"{DE164912-8F55-453D-AB05-EECE2F028371}"=-
"{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}"=-
"{C37031C3-A4DA-4433-A70A-AFD735BB42DE}"=-
"{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}"=-
"{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}"=-
"{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}"=-
"{618900C2-7E1A-4F78-9C73-DBC91607FB9D}"=-
"{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}"=-
"{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}"=-
"{9443DF74-6C07-4C5F-837B-5A6B1692656D}"=-
"{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}"=-
"{7E44E393-51C8-41F7-A0EC-889769420A16}"=-
"{E004A98C-FA99-4C68-BC55-33B50BF19977}"=-
"{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}"=-
[-HKEY_CLASSES_ROOT\CLSID\{1768500D-8668-40FA-A94E-A3FF196EE7FA}]
[-HKEY_CLASSES_ROOT\CLSID\{84B3EB00-958F-4B9A-901D-1AC522237412}]
[-HKEY_CLASSES_ROOT\CLSID\{DE164912-8F55-453D-AB05-EECE2F028371}]
[-HKEY_CLASSES_ROOT\CLSID\{4B0CEDDE-A42F-43D9-A15B-D6BA47196310}]
[-HKEY_CLASSES_ROOT\CLSID\{C37031C3-A4DA-4433-A70A-AFD735BB42DE}]
[-HKEY_CLASSES_ROOT\CLSID\{D25F1A6C-D09E-445D-8BCF-C5C37DBBF695}]
[-HKEY_CLASSES_ROOT\CLSID\{DDD2998D-E903-47F5-94A6-A8AA255F7FFE}]
[-HKEY_CLASSES_ROOT\CLSID\{61CBD7B2-A25B-49BE-A326-A2FC11B15DC7}]
[-HKEY_CLASSES_ROOT\CLSID\{618900C2-7E1A-4F78-9C73-DBC91607FB9D}]
[-HKEY_CLASSES_ROOT\CLSID\{AD65B027-A9BD-4BF5-AA7C-6D04F48038DB}]
[-HKEY_CLASSES_ROOT\CLSID\{F0EE6E86-C42A-4A5D-A83B-40950FD9A86A}]
[-HKEY_CLASSES_ROOT\CLSID\{9443DF74-6C07-4C5F-837B-5A6B1692656D}]
[-HKEY_CLASSES_ROOT\CLSID\{52AAC8C1-C512-4E61-BAFC-F84AF45AB877}]
[-HKEY_CLASSES_ROOT\CLSID\{7E44E393-51C8-41F7-A0EC-889769420A16}]
[-HKEY_CLASSES_ROOT\CLSID\{E004A98C-FA99-4C68-BC55-33B50BF19977}]
[-HKEY_CLASSES_ROOT\CLSID\{256C44BD-6B1C-47A0-861B-2A116BC4FBAE}]
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/guard.tmp (164 bytes security) (deflated 4%)
adding: dlls/iHsads.dll (164 bytes security) (deflated 6%)
adding: dlls/iuetmib1.dll (164 bytes security) (deflated 4%)
adding: dlls/lvr0099me.dll (164 bytes security) (deflated 4%)
adding: dlls/p0p60a7sed.dll (164 bytes security) (deflated 4%)
adding: dlls/pamjpg21.dll (164 bytes security) (deflated 6%)
adding: dlls/whhisn.dll (164 bytes security) (deflated 6%)
adding: backregs/1768500D-8668-40FA-A94E-A3FF196EE7FA.reg (212 bytes security) (deflated 69%)
adding: backregs/256C44BD-6B1C-47A0-861B-2A116BC4FBAE.reg (212 bytes security) (deflated 70%)
adding: backregs/4B0CEDDE-A42F-43D9-A15B-D6BA47196310.reg (212 bytes security) (deflated 70%)
adding: backregs/52AAC8C1-C512-4E61-BAFC-F84AF45AB877.reg (212 bytes security) (deflated 70%)
adding: backregs/618900C2-7E1A-4F78-9C73-DBC91607FB9D.reg (212 bytes security) (deflated 70%)
adding: backregs/61CBD7B2-A25B-49BE-A326-A2FC11B15DC7.reg (212 bytes security) (deflated 70%)
adding: backregs/7E44E393-51C8-41F7-A0EC-889769420A16.reg (212 bytes security) (deflated 70%)
adding: backregs/84B3EB00-958F-4B9A-901D-1AC522237412.reg (212 bytes security) (deflated 70%)
adding: backregs/9443DF74-6C07-4C5F-837B-5A6B1692656D.reg (212 bytes security) (deflated 70%)
adding: backregs/AD65B027-A9BD-4BF5-AA7C-6D04F48038DB.reg (212 bytes security) (deflated 70%)
adding: backregs/C37031C3-A4DA-4433-A70A-AFD735BB42DE.reg (212 bytes security) (deflated 70%)
adding: backregs/D25F1A6C-D09E-445D-8BCF-C5C37DBBF695.reg (212 bytes security) (deflated 70%)
adding: backregs/DDD2998D-E903-47F5-94A6-A8AA255F7FFE.reg (212 bytes security) (deflated 70%)
adding: backregs/DE164912-8F55-453D-AB05-EECE2F028371.reg (212 bytes security) (deflated 70%)
adding: backregs/E004A98C-FA99-4C68-BC55-33B50BF19977.reg (212 bytes security) (deflated 70%)
adding: backregs/F0EE6E86-C42A-4A5D-A83B-40950FD9A86A.reg (212 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)
Oki merci, redemarre l'ordi s'il ne s'est pas effectué tout seul puis fais ceci:
¤Telecharge et installe ceci, dans la colonne de gauche clique sur "erreurs" coche toute les cases, puis clique en bas sur "chercher des erreurs" une fois finit, clique sur "reparer les erreurs" et tu aura un message pour sauvegarder ta base de registre tu dis "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs
CCleaner:(à telecharger à côté de la fléche verte en haut à droite)
http://www.filehippo.com/download_ccleaner/
¤Relance Ccleaner ,vas dans l'onglet "nettoyeur" present sur la gauche, decoche la derniere case (Avancé si elle est cochée) puis clique sur "lancer le nettoyage"
Puis:
Telecharge, installe puis mets à jour ce logiciel, une fois que c'est fait, fais un scan complet de ton systeme et colle le rapport ici avec un nouveau rapport hijackthis
Ewido:
http://www.01net.com/telecharger/windows/Utilitaire/antivirus/fiches/31851.html
A++
¤Telecharge et installe ceci, dans la colonne de gauche clique sur "erreurs" coche toute les cases, puis clique en bas sur "chercher des erreurs" une fois finit, clique sur "reparer les erreurs" et tu aura un message pour sauvegarder ta base de registre tu dis "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs
CCleaner:(à telecharger à côté de la fléche verte en haut à droite)
http://www.filehippo.com/download_ccleaner/
¤Relance Ccleaner ,vas dans l'onglet "nettoyeur" present sur la gauche, decoche la derniere case (Avancé si elle est cochée) puis clique sur "lancer le nettoyage"
Puis:
Telecharge, installe puis mets à jour ce logiciel, une fois que c'est fait, fais un scan complet de ton systeme et colle le rapport ici avec un nouveau rapport hijackthis
Ewido:
http://www.01net.com/telecharger/windows/Utilitaire/antivirus/fiches/31851.html
A++
hollowspy
Messages postés
30
Date d'inscription
mercredi 15 février 2006
Statut
Membre
Dernière intervention
23 juin 2009
18 févr. 2006 à 15:47
18 févr. 2006 à 15:47
Voilà, j'ai fais ce que tu viens de me suggerer, tout s'est apparament bien passé, et visiblement le problème se saurait résolé (je dis visiblement par encore sûr). Donc franchement, si ca confirmait, merci beaucoup à vous, ca fait plaisir de voire de voir que des personnes comme ca utilisent de leur tps perso pr aider les autres. Désolé les gars, je ne peux que vs remercier sans vous proposer un quelquonque retour. Enfin, voici tout de même le rapport, dites mwa si y'a encore quelque chose à faire. Si le pb persiste, je reviendrais sur le message, sinon je vous confirmerais que c bien fini disons ce soir ou demain :)
Logfile of HijackThis v1.99.1
Scan saved at 15:42:10, on 18/02/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Uilisateur\Mes documents\barre d'outil\logiciel nettoyage\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [KAVPersonal50]
Logfile of HijackThis v1.99.1
Scan saved at 15:42:10, on 18/02/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Uilisateur\Mes documents\barre d'outil\logiciel nettoyage\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [KAVPersonal50]
13 déc. 2005 à 23:07
Voici donc les deux rapports demandés :
1) SmitfraudFix
SmitFraudFix v2.08
Rapport fait à 22:59:42,20 le 13/12/2005
Executé à partir de C:\Documents and Settings\eric\Local Settings\Temporary Internet Files\Content.IE5\QZEZQZY1\SmitfraudFix[1]\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32
C:\WINDOWS\system32\msvol.tlb PRESENT !
C:\WINDOWS\system32\ncompat.tlb PRESENT !
C:\WINDOWS\system32\ot.ico PRESENT !
C:\WINDOWS\system32\ts.ico PRESENT !
C:\WINDOWS\system32\1024\ PRESENT!
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\eric\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files
C:\Program Files\SpyKiller\ PRESENT !
»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pr‚-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="D‚mon de cache des cat‚gories de composant"
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
2) HiJackThis
Logfile of HijackThis v1.99.1
Scan saved at 23:00:48, on 13/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
C:\Program Files\Classic PhoneTools\CapFax.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe
C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Harrap's Multimédia\Shorter\bin\HiHarrapsTray.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/yme/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/yme/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fourni par chello broadband n.v.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.chello.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HomepageBHO - {1ca480cd-c0e5-4548-874e-b85b17905b3a} - C:\WINDOWS\system32\hp9608.tmp (file missing)
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Agent] C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SCM] c:\program files\silver crest memory adapter tools2.93\scma.exe sys_auto_run C:\Program Files\Silver Crest Memory Adapter Tools2.93
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe"
O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1022.dll,InstantAccess
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Ask Harrap's Shorter.lnk = ?
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://home.fra.chello.be/ssi/welcome/welcome.php?url=home
O16 - DPF: ChatSpace Full Java Client 3.1.0.235 - http://irc.chatway.com:8059/Java/cfs31235.cab
O16 - DPF: Interface Chat Voila - http://chat9.x-echo.com/version5/Applet/vchatsign.cab
O16 - DPF: ServerPushBox - http://www.spot.be/servp12.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/0489b35107d6b53e9b21/netzip/RdxIE601_fr.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120293400015
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {AE775D48-49AA-11D1-8F1C-00C04FB67063} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v5/ticker.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: cpuidle - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\CPUIDLE\srvany.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\eric\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe