Trojan Horse - Tradedaubler.com???

Question

Bonjour,

J'ai une saleté de trojan horse sur mon ordinateur... Ben vi j'ai fais la connerie de downloadé un jeu mais pas vérifier s'il avait un virus. Bon. Là, j'ai faite scanné mon ordi avec Avast Familiale dernière mise à jour, j'ai faite le scan le plus minutieux, rien a changé. J'ai download Ad-Aware, il trouve, il a supprimé/réparé certain trucs, mais mon problème persiste toujours. J'explique. Quand j'allume mon ordinateur, les pop-ups apparaissent pas nécessairement toute suite. C'est plutôt quand je commence à naviguer sur internet, après un certain temps ça commence (je vais seulement sur Youtube, ou Deviantart ou Wowhead ou Hotmail). Voilà ce qui est écrit sur la pop-up (c'est une fenêtre qui s'ouvre avec un bouton OK de Windows Internet Explorer)

Warning!!! Your computer is infected!
To check your system and remove all harmful software write down this link
TRADEDAUBLER.COM
Open a new Internet Explorer window and type the adress manually
Go to website, download and run downloaded file.
FOR FREE!!!

Je l'ai retranscrit tel quel. Sinon une fois de temps en temps, ca fait 3 jours que je l'ai et ça m'ai seulement arrivé une fois par jour, une page internet explorer s'ouvrait et ensuite le virus en fait ouvrir pleins d'autres sans arrêt. Et le virus fait parfois ouvrir des pages internet. Si, par exemple, je suis sur une page et qui a une publicité, une fois de temps à autre le virus va l'ouvrir... 

Si Avast et Ad-Aware peuvent rien faire, jfais quoi?

kevin05 · Answer

Salut, 

- Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau. 

- Double-clique sur RSIT.exe afin de lancer le programme. 

- Clique sur Continue à l'écran Disclaimer. 

- Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence. 

- Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches). 

Note : Les rapports sont sauvegardés dans le dossier C:\rsit.

Sathirel · Answer

Logfile of random's system information tool 1.05 (written by random/random)
Run by Caroline at 2009-02-09 01:02:17
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 26 GB (35%) free of 75 GB
Total RAM: 1919 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:02:25, on 09/02/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\Ideazon\ZEngine\Zboard.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
c:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
C:\Mabinogi
pkcmsvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Documents and Settings\Caroline\Bureau\RSIT.exe
C:\Program Files	rend micro\Caroline.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {4DBF1010-836F-46C0-B009-0E1AC06D279D} - C:\WINDOWS\system32\vtUlLfDV.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\ljJdbyVL.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {E907A067-EF80-4390-BACE-38BDC2F0A489} - C:\WINDOWS\system32\yayxxvtR.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [LifeCam] "c:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [Zboard] C:\Program Files\Ideazon\ZEngine\Zboard.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AntiMalwareProMFCT] C:\Program Files\AdwarePro\StartApp.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648)" -"http://www.interactive.toyota.ca/shock/corolla2009/checker_l2.htm"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: ljJdbyVL - C:\WINDOWS\SYSTEM32\ljJdbyVL.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: MySQL4 - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\Mabinogi
pkcmsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

kevin05 · Answer

Salut

&#x25B6; Télécharge Combofix de sUBs 


&#x25B6; et enregistre le sur le Bureau. 

  
&#x25B6; désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware) 


Voici le tutoriel officiel de Bleeping Computer pour savoir l utiliser :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix


&#x25B6; Je te conseille d'installer la console de récupération !!

navarro49 · Answer

salut j' ai le meme virus 
je poste tout ça se soir
a+

navarro49 · Answer

Logfile of random's system information tool 1.05 (written by random/random)
Run by corinne at 2009-02-09 18:05:55
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 31 GB (20%) free of 150 GB
Total RAM: 1022 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:06:10, on 09/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32	askmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\corinne\Bureau\RSIT.exe
C:\Program Files	rend micro\corinne.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://gamespace.daemon-tools.cc/fra/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: (no name) - {66568e46-5edc-4e7f-96fb-7197dfc57747} - C:\WINDOWS\system32\awtrQGxV.dll
O2 - BHO: (no name) - {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - C:\WINDOWS\system32\geBuUlIX.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1165772605\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [ContentTransferWMDetector.exe] C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\corinne\LOCALS~1\Temp\winlognn.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [yeqmgwa] "c:\documents and settings\corinne\local settings\application data\yeqmgwa.exe" yeqmgwa
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\corinne\LOCALS~1\Temp\winlognn.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\corinne\LOCALS~1\Temp\csrssc.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUClient.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\corinne\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: geBuUlIX - C:\WINDOWS\SYSTEM32\geBuUlIX.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O24 - Desktop Component 0: (no name) - http://www.chrisfarnsworth.com/images/101-0182_IMG.JPG

sebas00011 · Answer

j'ai le même problème donc je poste se que vous m'aviez dit de poster:

Logfile of random's system information tool 1.05 (written by random/random)
Run by Sébastien Laneuville at 2009-02-10 17:37:17
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 249 GB (81%) free of 305 GB
Total RAM: 1022 MB (39% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:38:56, on 2009-02-10
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Microsoft IntelliType Pro	ype32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Documents and Settings\Sébastien Laneuville\Application Data\advantage\AdVantage.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wpabaln.exe
C:\WINDOWS\system32\cmd.execf
C:\Documents and Settings\Sébastien Laneuville\Bureau\RSIT.exe
C:\32788R22FWJFW\NirCmd.cfexe
C:\WINDOWS\system32undll32.exe
C:\Program Files	rend micro\Sébastien Laneuville.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://sebas009.skyrock.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\cbXPfEVp.dll
O2 - BHO: (no name) - {748E6C81-DC7D-4974-BE84-016C7A71A0D2} - C:\WINDOWS\system32\jkkighf.dll (file missing)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {7F648DBB-819F-4EAB-A7A0-38B148B4E6AC} - C:\WINDOWS\system32\iifddeCT.dll (file missing)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: (no name) - {B688255E-A1E3-4424-B2C9-346CB1E7A12D} - C:\WINDOWS\system32\mllmk.dll (file missing)
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro	ype32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [c0068aac] rundll32.exe "C:\WINDOWS\system32\icaxjcxk.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [city dupe] C:\DOCUME~1\SBASTI~1\APPLIC~1\UPLOAD~1\PlusStyle.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AdVantage] C:\Documents and Settings\Sébastien Laneuville\Application Data\advantage\AdVantage.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15-3.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O20 - Winlogon Notify: cbXPfEVp - C:\WINDOWS\SYSTEM32\cbXPfEVp.dll
O20 - Winlogon Notify: jkkighf - jkkighf.dll (file missing)
O20 - Winlogon Notify: mllmk - C:\WINDOWS\system32\mllmk.dll (file missing)
O20 - Winlogon Notify: opnnoppP - opnnoppP.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\oodahplx.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O24 - Desktop Component 0: (no name) - http://www.runescape.com/img/files/wallpaper_attack/attack_1440x900.jpg

kevin05 · Answer

Pourquoi cette avalanche de rapport ?!!!

crées votre propre topique !

loloetseb · Answer

Salut kevin ,tu croule sous l'avalanche de rapport,c 'est un virus replicateur ou quoi?

kevin05 · Answer

Salut seb 

Il se clone vite alors XD

kevin05 · Answer

Re j'vais avoir du boulot ;-) xd

sebas00011 · Answer

mais va tu touse nous aider quand meme a se qui parait moi sa se clone vite

kevin05 · Answer

D'accord lol j'analyze ton rapport et je dit la suite ... ;-)

kevin05 · Answer

Re tu es bien infecter...


télécharge smitfraudfix et enregistre le sur le bureau 

? Ensuite double clique sur smitfraudfix puis exécuter 

? Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection. 

(attention : N utilises pas l option 2 si je ne te l'ai pas demandé !!) 

? copier/coller le rapport dans la réponse. 


TUTO si problème



(Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool". 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, 
cet utilitaire pourrait arrêter des logiciels de sécurité.)

sebas00011 · Answer

SmitFraudFix v2.395

Rapport fait à 21:30:52,11, 2009-02-10
Executé à partir de C:\Documents and Settings\Sébastien Laneuville\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Microsoft IntelliType Pro	ype32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Documents and Settings\Sébastien Laneuville\Application Data\advantage\AdVantage.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wpabaln.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sébastien Laneuville\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1 mpa.one.microsoft.com

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sébastien Laneuville


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sébastien Laneuville\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SBASTI~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="http://www.runescape.com/img/files/wallpaper_attack/attack_1440x900.jpg"
"SubscribedURL"="http://www.runescape.com/img/files/wallpaper_attack/attack_1440x900.jpg"
"FriendlyName"=""
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!



»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte Fast Ethernet compatible VIA - Miniport d'ordonnancement de paquets
DNS Server Search Order: 206.123.6.230
DNS Server Search Order: 199.84.54.230

HKLM\SYSTEM\CCS\Services\Tcpip\..\{7AA4847D-0644-4590-9954-876AAF008E8A}: DhcpNameServer=206.123.6.230 199.84.54.230
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7AA4847D-0644-4590-9954-876AAF008E8A}: DhcpNameServer=206.123.6.230 199.84.54.230
HKLM\SYSTEM\CS3\Services\Tcpip\..\{7AA4847D-0644-4590-9954-876AAF008E8A}: DhcpNameServer=206.123.6.230 199.84.54.230
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=206.123.6.230 199.84.54.230
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=206.123.6.230 199.84.54.230
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=206.123.6.230 199.84.54.230


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

kevin05 · Answer

Salut dans l'ordre ! :

Télécharge cet outil de SiRi sur ton bureau : 

RHost 

Double-clique dessus pour le lancer . 

-> clique sur " Restore original Hosts " et attendre un court instant ... 

( ps : c'est normal que rien ne se passe ... ) 

----------------------------------------------------------------------------

Relance smitfraudfix choisie l'option 2

Repond oui a tous

Poste le rapport...

sebas00011 · Answer

ça ne fonctionne pas se programe sa fait absolument rien et je n'ai pas plusieur option seulement restaurer.Ques ce que je dois faire.

kevin05 · Answer

Suit ce que l'on te dit de faire !!!!!!!!!

sebas00011 · Answer

SmitFraudFix v2.395

Rapport fait à 19:31:29,96, 2009-02-11
Executé à partir de C:\Documents and Settings\Sébastien Laneuville\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte Fast Ethernet compatible VIA - Miniport d'ordonnancement de paquets
DNS Server Search Order: 206.123.6.230
DNS Server Search Order: 199.84.54.230

HKLM\SYSTEM\CCS\Services\Tcpip\..\{7AA4847D-0644-4590-9954-876AAF008E8A}: DhcpNameServer=206.123.6.230 199.84.54.230
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7AA4847D-0644-4590-9954-876AAF008E8A}: DhcpNameServer=206.123.6.230 199.84.54.230
HKLM\SYSTEM\CS3\Services\Tcpip\..\{7AA4847D-0644-4590-9954-876AAF008E8A}: DhcpNameServer=206.123.6.230 199.84.54.230
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=206.123.6.230 199.84.54.230
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=206.123.6.230 199.84.54.230
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=206.123.6.230 199.84.54.230


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

kevin05 · Answer

Bien

&#x25B6; Télécharge Combofix de sUBs 


&#x25B6; et enregistre le sur le Bureau. 

  
&#x25B6; désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware) 


Voici le tutoriel officiel de Bleeping Computer pour savoir l utiliser :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix


&#x25B6; Je te conseille d'installer la console de récupération !! après a toi de voir...

sebas00011 · Answer

ComboFix 09-02-12.03 - Sébastien Laneuville 2009-02-12 16:35:29.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.620 [GMT -5:00]
Lancé depuis: c:\documents and settings\Sébastien Laneuville\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1201 [VPS 090212-0] *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Sébastien Laneuville\Application Data\inst.exe
c:\documents and settings\Sébastien Laneuville\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat
c:\program files\FunWebProducts
c:\program files\FunWebProducts\Shared\46EE38B3.dat
c:\windows\cookies.ini
c:\windows\system32\404Fix.exe
c:\windows\system32\abckftvm.ini
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\algxevyv.ini
c:\windows\system32\asfaafrg.ini
c:\windows\system32\bafjkfpu.ini
c:\windows\system32\bflgevtu.dll
c:\windows\system32\bkeskrls.ini
c:\windows\system32\bkgysbnw.dll
c:\windows\system32\bpwerprr.ini
c:\windows\system32\bqcbakpu.ini
c:\windows\system32\brhywa.dll
c:\windows\system32\bruerodl.ini
c:\windows\system32\bwfjmygb.ini
c:\windows\system32\cbXPfEVp.dll
c:\windows\system32\cltgistf.ini
c:\windows\system32\dumphive.exe
c:\windows\system32\ejaheoas.ini
c:\windows\system32\elvaixpd.ini
c:\windows\system32\evmbvlcn.ini
c:\windows\system32\fdequrfu.ini
c:\windows\system32\fiyhnc.dll
c:\windows\system32\fxtycp.dll
c:\windows\system32\GhhRBcdd.ini
c:\windows\system32\GhhRBcdd.ini2
c:\windows\system32\giwcmveg.ini
c:\windows\system32\gugnawsl.dll
c:\windows\system32\hhgqufip.ini
c:\windows\system32\icaxjcxk.dll
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\itripvoh.ini
c:\windows\system32\jcfxhtkc.dll
c:\windows\system32\jrbwxlbs.ini
c:\windows\system32\kedcrtdb.dll
c:\windows\system32\kejopunw.dll
c:\windows\system32\khgjpcvd.ini
c:\windows\system32\kmllm.bak1
c:\windows\system32\kmllm.bak2
c:\windows\system32\kmllm.ini
c:\windows\system32\kxcjxaci.ini
c:\windows\system32\lmesmckm.ini
c:\windows\system32\mairvjad.ini
c:\windows\system32\mchcquty.ini
c:\windows\system32\mcrh.tmp
c:\windows\system32\mdeqewxk.ini
c:\windows\system32\mgsqonws.ini
c:\windows\system32\miflqlvw.ini
c:\windows\system32\mllppbfx.dll
c:\windows\system32\mtoxlnot.ini
c:\windows\system32\niadjtel.ini
c:\windows\system32\o4Patch.exe
c:\windows\system32\onftbgag.ini
c:\windows\system32\opoxnqbo.ini
c:\windows\system32\Process.exe
c:\windows\system32\qcjqtnys.ini
c:\windows\system32\qhhaosou.ini
c:\windows\system32\rgqkdlev.ini
c:\windows\system32\saoehaje.dll
c:\windows\system32\snraur.dll
c:\windows\system32\snwumoaj.ini
c:\windows\system32\SrchSTS.exe
c:\windows\system32\TCeddfii.ini
c:\windows\system32\TCeddfii.ini2
c:\windows\system32\tmp.reg
c:\windows\system32\tuvvVLda.dll
c:\windows\system32\urobpl.dll
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\vgnkqbsb.ini
c:\windows\system32\vtmsbxgt.ini
c:\windows\system32\WS2Fix.exe
c:\windows\system32\wufsnbsc.dll
c:\windows\system32\wwjxqaum.ini
c:\windows\system32\xfbppllm.ini
c:\windows\system32\yraydddt.ini
c:\windows\system32\yspxas.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DOMAINSERVICE
-------\Service_DomainService

((((((((((((((((((((((((((((( Fichiers créés du 2009-01-12 au 2009-02-12 ))))))))))))))))))))))))))))))))))))
.

2009-02-10 17:20 . 2009-02-10 17:22 <REP> d-------- C:\rsit
2009-02-10 17:20 . 2009-02-10 17:38 <REP> d-------- c:\program files\trend micro
2009-02-05 22:02 . 2006-11-25 09:08 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau
2009-02-05 22:02 . 2006-11-25 09:08 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression
2009-02-05 22:02 . 2006-11-25 14:48 <REP> d--h----- c:\documents and settings\Administrateur\Modèles
2009-02-05 22:02 . 2006-11-25 09:08 <REP> d-------- c:\documents and settings\Administrateur\Mes documents
2009-02-05 22:02 . 2006-11-25 09:08 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer
2009-02-05 22:02 . 2006-11-25 09:08 <REP> d-------- c:\documents and settings\Administrateur\Favoris
2009-02-05 22:02 . 2006-11-25 09:08 <REP> d-------- c:\documents and settings\Administrateur\Bureau
2009-02-05 22:02 . 2009-02-05 22:02 <REP> d-------- c:\documents and settings\Administrateur
2009-02-03 16:26 . 2009-02-03 16:26 72,704 --a------ c:\windows\system32\nfxbppyq.dll
2009-01-27 22:31 . 2008-04-13 21:33 159,232 --a------ c:\windows\system32\ptpusd.dll
2009-01-27 22:31 . 2001-08-23 17:47 5,632 --a------ c:\windows\system32\ptpusb.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-12 21:45 --------- d-----w c:\documents and settings\Sébastien Laneuville\Application Data\advantage
2009-02-11 23:00 --------- d-----w c:\program files\Norton Security Scan
2009-02-07 15:38 --------- d-----w c:\documents and settings\Sébastien Laneuville\Application Data\UPLOAD NOUN
2009-02-07 15:31 --------- d-----w c:\documents and settings\NetworkService\Application Data\UPLOAD NOUN
2009-01-31 03:56 --------- d-----w c:\documents and settings\Sébastien Laneuville\Application Data\LimeWire
2009-01-17 20:59 --------- d-----w c:\program files\Google
2008-12-31 02:54 --------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2008-12-30 05:50 --------- d-----w c:\documents and settings\Sébastien Laneuville\Application Data\Apple Computer
2008-12-28 08:09 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-12-28 00:06 --------- d-----w c:\program files\Java
2008-12-27 18:30 --------- d-----w c:\program files\Circle Developement
2008-12-27 18:29 --------- d-----w c:\program files\MSN Messenger
2008-12-27 18:29 --------- d-----w c:\program files\Messenger Plus! Live
2008-12-22 19:42 --------- d-----w c:\program files\Microsoft Silverlight
2008-12-22 19:42 --------- d-----w c:\program files\iTunes
2008-12-22 19:31 --------- d-----w c:\program files\Bonjour
2008-12-22 19:28 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-22 19:26 --------- d-----w c:\program files\iPod
2008-12-22 19:26 --------- d-----w c:\program files\Fichiers communs\Apple
2008-12-22 19:16 --------- d-----w c:\program files\QuickTime
2008-12-22 18:54 --------- d-----w c:\program files\Safari
2008-12-12 21:40 --------- d-----w c:\documents and settings\Sébastien Laneuville\Application Data\Vso
2008-12-12 21:36 47,360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2008-12-12 21:36 47,360 ----a-w c:\documents and settings\Sébastien Laneuville\Application Data\pcouffin.sys
2008-12-12 21:36 --------- d-----w c:\program files\VSO
2008-12-12 21:22 --------- d-----w c:\program files\Kingdia Software
2008-09-11 01:00 23,256 ----a-w c:\documents and settings\Sébastien Laneuville\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-10 68856]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2007-11-16 190024]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"AdVantage"="c:\documents and settings\Sébastien Laneuville\Application Data\advantage\AdVantage.exe" [2008-10-22 174928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-15 79224]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-27 136600]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 196608]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2005-03-23 217088]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [19/02/2006 03:21:22 288472]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [23/09/2005 21:05:26 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [13/02/2001 04:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-20 23:34 24576 c:\program files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Documents and Settings\\Sébastien Laneuville\\Mes documents\\Nouveau dossier\\SwiftSwitch.exe"=
"c:\\Program Files\\MSN Messenger\\msrr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Java\\jre1.6.0_02\\bin\\javaw.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [02/06/2008 20:40:06 78416]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [25/11/2006 17:08:13 13696]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [02/06/2008 20:40:06 20560]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [18/09/2008 18:24:49 16512]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contenu du dossier 'Tâches planifiées'

2009-02-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-02-11 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe [2008-01-09 03:08]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{28a74bb3-ac11-4cff-9864-209e489f9aea} - c:\windows\system32\brhywa.dll
BHO-{7F648DBB-819F-4EAB-A7A0-38B148B4E6AC} - c:\windows\system32\iifddeCT.dll
BHO-{B688255E-A1E3-4424-B2C9-346CB1E7A12D} - c:\windows\system32\mllmk.dll
HKCU-Run-city dupe - c:\docume~1\SBASTI~1\APPLIC~1\UPLOAD~1\PlusStyle.exe
Notify-mllmk - c:\windows\system32\mllmk.dll
Notify-jkkighf - jkkighf.dll
Notify-opnnoppP - opnnoppP.dll
Notify-WgaLogon - (no file)

.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-12 16:44:45
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1993962763-1957994488-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(676)
c:\program files\AlienGUIse\fastload.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\ehome\ehRecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\dllhost.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqnrs08.exe
c:\windows\system32\wpabaln.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\msiexec.exe
.
**************************************************************************
.
Heure de fin: 2009-02-12 16:53:03 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-02-12 21:52:19

Avant-CF: 262 764 584 960 octets libres
Après-CF: 264,999,682,048 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

285 --- E O F --- 2008-12-29 23:47:32

loloetseb · Answer

Fais un scan rsit et postes moi les deux rapports:

Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau. 

-> http://images.malwareremoval.com/random/RSIT.exe 

! Déconnecte toi et ferme toutes tes applications en cours ! 

Double-clique sur " RSIT.exe " pour le lancer . 

-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " . 

* Devant l'option "List files/folders created ..." , tu choisis : 2 months 

* clique ensuite sur " Continue " pour lancer l'analyse ... 


-> laisse faire le scan et ne touche pas au PC ... 


Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-note). 

Poste le contenu de " log.txt " (c'est celui qui apparait à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ... 

Important : poste un rapport, puis l'autre dans la réponse suivante
Si tu essaies de poster les deux en même temps, cela risque d'être trop long pour le forum 


( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit )

loloetseb · Answer

Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
  - Coche    Afficher les fichiers et dossiers cachés
  - Décoche Masquer les extensions des fichiers dont le type est connu
  - Décoche Masquer les fichiers protégés du système d'exploitation (recommandé)
clique sur Appliquer, puis OK.

N'oublie pas de recacher à nouveau les fichiers cachés et protégés du système d'exploitation en fin de désinfection, c'est important

Fais analyser le(s) fichier(s) suivants sur Virustotal :

c:\Program Files\MSN Messenger\msrr.exe"= 
c:\documents and settings\Sébastien Laneuville\Application Data\advantage 
c:\program files\Circle Developement 



http://www.virustotal.com/flash/index_en.html

    * Clique sur Parcourir en haut, choisis Poste de travail et cherche ce fichier : Chemin\Fichier
    * Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
    * Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
    * Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté
    * Une nouvelle fenêtre de ton navigateur va apparaître
    * Clique alors sur les deux fleches
    * Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
    * Enfin colle le résultat dans ta prochaine réponse.


    * Fais la même chose avec ces fichiers : Chemin\Fichier


Note : Pour analyser un autre fichier, clique en bas sur Autre fichier.

sebas00011 · Answer

Fichier msnmsgr.exe reçu le 2009.02.11 00:42:16 (CET)Antivirus Version Dernière mise à jour Résultat a-squared 4.0.0.93 2009.02.10 - AhnLab-V3 5.0.0.2 2009.02.10 - AntiVir 7.9.0.76 2009.02.10 - Authentium 5.1.0.4 2009.02.10 - Avast 4.8.1335.0 2009.02.10 - AVG 8.0.0.229 2009.02.10 - BitDefender 7.2 2009.02.11 - CAT-QuickHeal 10.00 2009.02.10 - ClamAV 0.94.1 2009.02.10 - Comodo 973 2009.02.10 - DrWeb 4.44.0.09170 2009.02.11 - eSafe 7.0.17.0 2009.02.09 - eTrust-Vet 31.6.6348 2009.02.10 - F-Prot 4.4.4.56 2009.02.10 - F-Secure 8.0.14470.0 2009.02.10 - Fortinet 3.117.0.0 2009.02.11 - GData 19 2009.02.11 - Ikarus T3.1.1.45.0 2009.02.10 - K7AntiVirus 7.10.626 2009.02.10 - Kaspersky 7.0.0.125 2009.02.11 - McAfee 5522 2009.02.10 - McAfee+Artemis 5522 2009.02.10 - Microsoft 1.4306 2009.02.10 - NOD32 3843 2009.02.10 - Norman 6.00.02 2009.02.09 - nProtect 2009.1.8.0 2009.02.10 - Panda 10.0.0.10 2009.02.10 - PCTools 4.4.2.0 2009.02.10 - Prevx1 V2 2009.02.11 - Rising 21.16.12.00 2009.02.10 - SecureWeb-Gateway 6.7.6 2009.02.10 - Sophos 4.38.0 2009.02.10 - Sunbelt 3.2.1851.2 2009.02.10 - Symantec 10 2009.02.11 - TheHacker 6.3.1.5.252 2009.02.11 - TrendMicro 8.700.0.1004 2009.02.10 - VBA32 3.12.8.12 2009.02.10 - ViRobot 2009.2.10.1599 2009.02.10 - VirusBuster 4.5.11.0 2009.02.10 - Information additionnelle File size: 5674352 bytes MD5...: a7efc7ea7ef6fb022a8a95813edcbe5d SHA1..: 3a61f9696cc34fd4863f07c9aa70e54621bb4c77 SHA256: 98247c844f9d9c165787f830e5c8850046565d3775833334987dad7377843005 SHA512: 5ec5bcb26e0921d1aa20cfef9384a08c91ae36a28b6ba2afd28a6b01ece40dd6
e5ad39a51a1deabc3c35a6878be06a5e21f7dce5dae14f25db91b07bc25c4ef5
ssdeep: 49152:+nRgOM5CKhm4W1nf5IWbDmGdq0HSHnBY2lWtoK/r3uoWfKrPR5Z4a+v3Xk
9SEBoz:+nRNMBO1f1bilESicQTr2KzR8apVCD
PEiD..: - TrID..: File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1708ed
timedatestamp.....: 0x45b12d6a (Fri Jan 19 20:43:22 2007)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x4b1029 0x4b1200 6.32 8d3146f757440806d5803f1d0d94b2b7
.data 0x4b3000 0x88824 0x87e00 5.05 08b16b3222aaf04e0a2d978fd1d8fa4c
.rsrc 0x53c000 0x2db10 0x2dc00 4.88 ee608aaa6b1f77f4951050802ea41f10

( 28 imports )
> MSVCR80.dll: __3@YAXPAX@Z, ___V@YAXPAX@Z, memcpy_s, _CxxThrowException, memmove_s, wcschr, rand, _wcsdup, ceil, _wtol, memmove, free, isxdigit, isalpha, isdigit, realloc, atol, _difftime64, _wcsupr_s, floor, _callnewh, _amsg_exit, __getmainargs, _cexit, _exit, _XcptFilter, _ismbblead, _acmdln, _initterm, _initterm_e, _configthreadlocale, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, _encode_pointer, __set_app_type, _terminate@@YAXXZ, _except_handler4_common, _unlock, __dllonexit, _lock, _onexit, _decode_pointer, _invoke_watson, _controlfp_s, __type_info_dtor_internal_method@type_info@@QAEXXZ, _crt_debugger_hook, tolower, wcspbrk, _wgetenv, wcstol, wcsncpy_s, strtoul, _mbsrchr, _mbsupr_s, _ismbcspace, _mbsinc, _wfullpath, _gmtime64_s, _aligned_malloc, _aligned_free, _scwprintf, wcsncmp, towupper, srand, atoi, _mbschr, _stricmp, _wcsrev, wcsftime, isspace, _purecall, malloc, __CxxFrameHandler3, memset, memchr, _wcsicmp, wcsrchr, _wcslwr_s, calloc, _recalloc, _resetstkoflw, memcpy, _mktime64, _localtime64_s, _time64, wcsstr, _beginthreadex, _vscwprintf, _strnicmp, wprintf, vswprintf_s, _mbscmp, wcsspn, strtol, _wcstoui64, wcscpy_s, _strnicoll, _strrev, strncmp, _mbspbrk, _localtime64, wcstoul, __RTDynamicCast, qsort, _mbscspn, _mbsspn, _wcsncoll, iswdigit, iswalpha, _set_purecall_handler, _wcsnicmp, exit, _vsnwprintf, qsort_s, _mbsstr, fopen, fprintf, fclose, _vsnprintf, strstr, strrchr, _wcsnicoll, _wtoi, _strlwr, vsprintf_s, _vscprintf, _mbsicmp, swprintf_s, iswspace, strchr, _ltoa, wcscspn, _mbslwr_s
> ADVAPI32.dll: CryptAcquireContextW, ConvertStringSecurityDescriptorToSecurityDescriptorW, TraceEvent, RegCloseKey, CryptGenRandom, RegEnumKeyExW, RegCreateKeyExW, RegOpenKeyExW, RegDeleteValueW, CryptDecrypt, CryptEncrypt, CryptDeriveKey, CryptDestroyKey, OpenSCManagerW, OpenServiceW, CloseServiceHandle, QueryServiceStatusEx, CryptGetHashParam, CryptHashData, RegQueryValueExW, CryptCreateHash, CryptDestroyHash, CryptReleaseContext, ImpersonateSelf, RegSetValueExW, GetTraceEnableFlags, GetTraceEnableLevel, OpenThreadToken, OpenProcessToken, InitializeSecurityDescriptor, GetLengthSid, InitializeAcl, AddAccessAllowedAce, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, FreeSid, CheckTokenMembership, MakeAbsoluteSD, SetSecurityDescriptorDacl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, IsValidSecurityDescriptor, CryptImportKey, CryptSetHashParam, RegEnumKeyA, RegEnumValueA, RegQueryInfoKeyW, RegDeleteValueA, RegQueryValueExA, RegSetValueExA, RegCreateKeyExA, RegOpenKeyExA, AccessCheck, RevertToSelf, RegDeleteKeyA, AllocateAndInitializeSid
> KERNEL32.dll: VirtualAlloc, VirtualFree, IsProcessorFeaturePresent, GetThreadLocale, GetLocaleInfoA, HeapSize, HeapDestroy, AddAtomW, SetThreadPriority, CreateToolhelp32Snapshot, Process32First, Process32Next, lstrcpynA, GetLocaleInfoW, GetACP, GetSystemDefaultLCID, FormatMessageA, GetVolumeInformationW, FileTimeToLocalFileTime, GetVersionExW, SetErrorMode, GetUserDefaultLCID, CreateMutexA, OpenEventA, GetProcessTimes, GetSystemInfo, GetWindowsDirectoryW, GetUserDefaultUILanguage, QueryDepthSList, InterlockedFlushSList, InitializeSListHead, InterlockedPushEntrySList, InterlockedPopEntrySList, GetTempFileNameW, GetCurrentThread, QueueUserWorkItem, CompareStringA, GetSystemTimeAsFileTime, SetFileTime, FindFirstFileA, MoveFileExA, GetFullPathNameW, GetTimeZoneInformation, lstrcpyW, WaitForMultipleObjects, GetOverlappedResult, CancelIo, ReadDirectoryChangesW, SetEndOfFile, RemoveDirectoryW, SystemTimeToTzSpecificLocalTime, GetFileAttributesExW, FindFirstFileExW, FindNextFileW, FreeResource, FindAtomW, InterlockedCompareExchange, SystemTimeToFileTime, FindFirstFileW, FindClose, TerminateProcess, SetFilePointer, SetProcessWorkingSetSize, SetCurrentDirectoryW, GetModuleFileNameA, GetDiskFreeSpaceExW, CompareStringW, OpenFileMappingW, MapViewOfFileEx, LoadLibraryExW, CopyFileW, CreateFileMappingW, CreateMutexW, DuplicateHandle, GetCurrentProcessId, ReleaseMutex, GetVersionExA, CreateEventA, GetCommandLineA, GetModuleHandleA, GlobalMemoryStatus, ExitProcess, CreateFileMappingA, OpenFileMappingA, MapViewOfFile, UnmapViewOfFile, ExpandEnvironmentStringsA, DeleteFileA, GetSystemDirectoryW, LoadLibraryW, ExpandEnvironmentStringsW, GetStartupInfoA, lstrcmpiA, lstrcmpA, ReadFile, RtlMoveMemory, MoveFileW, MoveFileExW, GetProcAddress, GetSystemTime, FileTimeToSystemTime, GetDateFormatW, GetTimeFormatW, GetLocalTime, FreeLibrary, GetTempPathW, GlobalFree, TlsGetValue, GetSystemDirectoryA, LoadLibraryA, GetModuleFileNameW, lstrlenA, Sleep, CreateThread, GetModuleHandleW, LocalAlloc, ResumeThread, GetExitCodeThread, TerminateThread, SetEvent, ResetEvent, CreateEventW, CreateProcessW, WaitForSingleObject, GetExitCodeProcess, CompareFileTime, SetThreadExecutionState, InterlockedDecrement, InterlockedIncrement, HeapReAlloc, HeapAlloc, GetProcessHeap, HeapFree, CreateDirectoryW, SetLastError, GetCurrentProcess, FlushInstructionCache, RaiseException, GetTickCount, GetFileAttributesW, SetFileAttributesW, DeleteFileW, GetShortPathNameW, GlobalAlloc, GlobalLock, GlobalSize, GlobalUnlock, lstrcmpW, lstrcpynW, lstrcmpiW, lstrlenW, MulDiv, GetFileSize, InterlockedExchange, WideCharToMultiByte, FlushFileBuffers, WriteFile, CreateFileW, FormatMessageW, MultiByteToWideChar, CloseHandle, GetLastError, LocalFree, GetCurrentThreadId, FindResourceExW, FindResourceW, LoadResource, LockResource, SizeofResource, DeleteCriticalSection, InitializeCriticalSection, LeaveCriticalSection, EnterCriticalSection, GetStringTypeExA, IsDBCSLeadByteEx, lstrcatA, lstrcpyA, SetCurrentDirectoryA, GetCurrentDirectoryA, GetPrivateProfileIntA, GetDriveTypeW, GetLogicalDriveStringsW, IsWow64Process, QueryPerformanceCounter, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, OpenMutexW, DebugBreak, LoadLibraryExA, VirtualQuery, VirtualProtect, GetThreadContext, SetThreadContext, SuspendThread, GetCurrentDirectoryW
> GDI32.dll: GetDIBits, SetBitmapBits, SetPixel, EnumFontFamiliesExW, CreateRectRgn, OffsetViewportOrgEx, SetDIBColorTable, SetLayout, GetRgnBox, SetStretchBltMode, CreateDIBSection, PatBlt, CreatePen, MoveToEx, LineTo, CreateFontIndirectW, ExtTextOutW, GetPixel, SetBkColor, GetTextMetricsW, LPtoDP, SetMapMode, SetViewportOrgEx, CreateDCW, CreateMetaFileW, SaveDC, SetWindowOrgEx, SetWindowExtEx, RestoreDC, CloseMetaFile, DeleteMetaFile, CreateRectRgnIndirect, CreateRoundRectRgn, GetStockObject, GetObjectW, CreateCompatibleBitmap, GetClipRgn, CreateCompatibleDC, DeleteDC, SelectObject, GetDIBColorTable, GetDeviceCaps, CreateSolidBrush, DeleteObject, SetBkMode, SetTextColor, SelectClipRgn, ExtSelectClipRgn, StretchBlt, BitBlt
> USER32.dll: GetScrollInfo, GetDlgCtrlID, GetDlgItemTextW, IsWindowEnabled, MapDialogRect, DrawFocusRect, CreateDialogParamW, GetNextDlgTabItem, SendMessageA, SetActiveWindow, RedrawWindow, SetDlgItemTextW, SetProcessDefaultLayout, ModifyMenuW, GetLastActivePopup, GetClassNameA, SetCursorPos, InsertMenuW, GetAsyncKeyState, TrackPopupMenu, GetClassInfoExA, RegisterClassW, RegisterWindowMessageA, GetDoubleClickTime, SetMenuDefaultItem, MoveWindow, LoadImageW, CheckDlgButton, EnableWindow, CheckRadioButton, GetMessageW, SetRectEmpty, GetProcessDefaultLayout, GetClassNameW, GetWindow, GetDlgItem, FindWindowA, MessageBoxW, PostQuitMessage, AdjustWindowRectEx, GetMenuStringW, AppendMenuW, FindWindowW, FindWindowExW, DrawAnimatedRects, CreateWindowExW, RegisterClassExW, UnionRect, CallWindowProcW, GetClassInfoExW, GetWindowLongW, BeginPaint, EndPaint, IntersectRect, SetWindowRgn, IsMenu, IsZoomed, SetMenu, MessageBeep, GetMenu, CheckMenuItem, SetWindowPlacement, SetMenuItemInfoW, IsIconic, CheckMenuRadioItem, IsWindowVisible, LoadIconA, SetWindowTextW, GetWindowPlacement, LoadCursorA, FlashWindow, GetForegroundWindow, UpdateWindow, GetKeyState, ClientToScreen, GetSystemMetrics, GetSysColor, GetClientRect, EqualRect, GetWindowTextLengthW, GetWindowTextW, SetWindowPos, GetWindowRect, SetForegroundWindow, IsWindow, MapWindowPoints, CopyRect, LoadMenuA, TrackPopupMenuEx, GetDesktopWindow, SetCapture, ReleaseCapture, SetWindowsHookExW, UnhookWindowsHookEx, PostThreadMessageW, CallNextHookEx, PeekMessageW, MsgWaitForMultipleObjects, TranslateMessage, DispatchMessageW, PostMessageW, CreateMenu, DestroyMenu, CreatePopupMenu, DeleteMenu, GetMenuItemCount, SendMessageW, SystemParametersInfoW, RemoveMenu, GetSubMenu, GetMenuItemInfoW, InsertMenuItemW, GetActiveWindow, DialogBoxParamW, IsDlgButtonChecked, LoadIconW, SendDlgItemMessageW, SetWindowLongW, EndDialog, LoadCursorW, SetCursor, GetCursorPos, DestroyWindow, InvalidateRect, GetParent, GetFocus, IsChild, SetFocus, DrawTextW, FrameRect, FillRect, GetSysColorBrush, DrawIconEx, DestroyIcon, EnableMenuItem, OffsetRect, InflateRect, SetRect, GetDC, ReleaseDC, ShowWindow, SetTimer, SetParent, DefWindowProcW, KillTimer, GetCapture, GetTopWindow, MessageBoxIndirectW, EnumChildWindows, UnregisterClassA, CharNextA, CharLowerA, CharNextW, CharLowerW, GetKeyboardLayoutList, MonitorFromRect, RegisterClipboardFormatW, GetMenuItemID, GetMenuState, ScreenToClient, SetDlgItemInt, GetDlgItemInt, IsRectEmpty, GetWindowRgn, AdjustWindowRect, MonitorFromWindow, GetMonitorInfoW, GetIconInfo, GetWindowThreadProcessId, IsDialogMessageW, CharLowerBuffW, CharPrevW, LoadStringA, LoadStringW, IsClipboardFormatAvailable, RegisterWindowMessageW, EnumWindows, EnumThreadWindows, RegisterClassExA, CreateWindowExA, GetWindowDC, PtInRect, DestroyAcceleratorTable, UnregisterClassW
> WSOCK32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> SHELL32.dll: -, -, ShellExecuteExW, -, -, SHGetDesktopFolder, -, SHChangeNotify, SHCreateDirectoryExW, ExtractIconExW, SHBrowseForFolderW, SHGetPathFromIDListW, -, SHGetFolderPathAndSubDirW, -, Shell_NotifyIconW, Shell_NotifyIconA, SHAppBarMessage, ShellExecuteExA, ShellExecuteW, -, SHGetFileInfoW, SHFileOperationW, SHGetFolderPathW, ShellExecuteA, SHGetMalloc, DragQueryFileW
> ole32.dll: CreateOleAdviseHolder, OleRegGetMiscStatus, OleRegGetUserType, CreateDataAdviseHolder, OleRegEnumVerbs, WriteClassStm, OleSaveToStream, CoSuspendClassObjects, ReleaseStgMedium, OleFlushClipboard, StringFromCLSID, CLSIDFromString, CoInitializeEx, CoGetInterfaceAndReleaseStream, CoMarshalInterThreadInterfaceInStream, CoAllowSetForegroundWindow, CoCreateGuid, StgCreateDocfileOnILockBytes, CreateILockBytesOnHGlobal, OleSetClipboard, CoFreeUnusedLibraries, CoSetProxyBlanket, CLSIDFromProgID, CoFileTimeNow, CoCreateFreeThreadedMarshaler, CoFreeLibrary, CoLoadLibrary, StgOpenStorageOnILockBytes, CoTaskMemAlloc, OleLockRunning, StringFromGUID2, OleRun, CoRevokeClassObject, OleInitialize, OleUninitialize, CoInitializeSecurity, CoRegisterClassObject, CoInitialize, CoUninitialize, CreateStreamOnHGlobal, GetHGlobalFromStream, CoCreateInstance, OleLoadFromStream, CoTaskMemFree
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> SHLWAPI.dll: PathStripToRootW, SHCreateStreamOnFileEx, PathFindFileNameW, PathAppendA, PathFindExtensionW, SHCopyKeyA, SHStrDupW, UrlGetPartW, PathUnquoteSpacesW, PathStripPathW, PathCommonPrefixW, PathCanonicalizeW, SHCreateStreamOnFileW, PathRelativePathToW, PathIsDirectoryW, StrCmpNIW, PathFileExistsW, PathRemoveFileSpecW, PathAppendW
> MSIMG32.dll: AlphaBlend, TransparentBlt
> gdiplus.dll: GdipGetImageHeight, GdipGetImageRawFormat, GdipGetImagePixelFormat, GdipGetImagePaletteSize, GdipGetImagePalette, GdipImageGetFrameDimensionsList, GdipImageGetFrameCount, GdipImageSelectActiveFrame, GdipGetPropertyItemSize, GdipGetPropertyItem, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipBitmapLockBits, GdipBitmapUnlockBits, GdiplusShutdown, GdipFree, GdipAlloc, GdipDisposeImage, GdipSaveImageToStream, GdipCreateBitmapFromScan0, GdipCreateBitmapFromHBITMAP, GdipGetImageEncodersSize, GdipGetImageEncoders, GdiplusStartup, GdipCloneImage, GdipSaveImageToFile, GdipGetImageWidth
> MSNCore.dll: _CSAddFile@@YGJIPB_W0IK@Z, _RMPruneResourceSet@@YG_NKPB_W@Z, _FrameTitleProp@DialogHost@@2PAUPropertyInfo@DirectUI@@A, _Class@DialogHost@@2PAUIClassInfo@DirectUI@@A, _CreateGraphic@Value@DirectUI@@SGPAV12@PAUHBITMAP__@@EI_N1I1@Z, _FontSizeProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _LPARAMProp@CmdButton@@2PAUPropertyInfo@DirectUI@@A, _Open@CPerfMonitor@@QAEXXZ, _Close@CPerfMonitor@@QAEXXZ, GetHRESULTString, _Create@VerticalFlowLayout@DirectUI@@SGJHIIIPAPAVLayout@2@@Z, _CSGetElementInnerText@@YGJPAUIXMLDOMNode@@PB_WAAVCComBSTR@ATL@@@Z, _m_pMsgFilter@CMsgFilterHolder@@1PAVCMsgFilter@@A, _CSConfigGetDownloadState@@YG_AW4tagCONFIGSERVERCLIENT_DOWNLOAD_STATE@@PA_N@Z, _CSConfigNotify@@YGXJ@Z, _CSConfigDownload@@YGJPB_W000IK_NPADIW4tagCONFIGSERVERCLIENT_EVENT_TYPE@@00@Z, _CSGetAttributeValue@@YGJPAUIXMLDOMNode@@PB_WAAVCComBSTR@ATL@@@Z, _CSAdd@@YGJIPB_W00IK_NW4tagCONFIGSERVERCLIENT_EVENT_TYPE@@00@Z, _CSRemove@@YGJI@Z, _CSReset@@YGXXZ, _CSConfigReleaseXML@@YGXXZ, _CSSelectNode@@YGJIPB_WPAPAUIXMLDOMNode@@@Z, _CSLoadFromFile@@YGJPB_WPAPAUIXMLDOMNode@@@Z, _CSConfigIsInfoReady@@YG_NXZ, _CSSelectNode@@YGJPAUIXMLDOMNode@@PB_WPAPAU1@@Z, _CSConfigSelectNode@@YGJPB_WPAPAUIXMLDOMNode@@@Z, _CSConfigGetAttributeValue@@YGJPB_W0AAK@Z, _CSConfigGetElementInnerText@@YGJPAUIXMLDOMNode@@PB_WAAV_$CStringT@_WV_$StrTraitATL@_WV_$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z, _CSConfigGetElementInnerText@@YGJPB_WAAV_$CStringT@_WV_$StrTraitATL@_WV_$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z, _GetPageInc@ScrollBar@DirectUI@@IAEHXZ, _LineProp@ScrollBar@DirectUI@@2PAUPropertyInfo@2@A, _MinimumProp@ScrollBar@DirectUI@@2PAUPropertyInfo@2@A, _MaximumProp@ScrollBar@DirectUI@@2PAUPropertyInfo@2@A, _Create@NativeHWNDHost@DirectUI@@SGJPB_W0PAUHWND__@@PAUHICON__@@HHHHHHPAUHINSTANCE__@@IPAPAV12@@Z, _WM_PRIVATE_UPDATEFRAME@CFramelessHost@@2IB, MapGadgetPoints, SetGadgetOrder, _Initialize@ScrollViewer@DirectUI@@QAEJXZ, _OnListenedPropertyChanged@ScrollViewer@DirectUI@@UAEXPAVElement@2@PAUPropertyInfo@2@HPAVValue@2@2@Z, _CreateScrollBars@ScrollViewer@DirectUI@@MAEJXZ, _Add@ScrollViewer@DirectUI@@UAEJPAPAVElement@2@I@Z, _OnEvent@ScrollViewer@DirectUI@@UAEXPAUEvent@2@@Z, _OnInput@ScrollViewer@DirectUI@@UAEXPAUInputEvent@2@@Z, _OnPropertyChanged@ScrollViewer@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z, _OnPropertyChanging@ScrollViewer@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z, _Class@Combobox@DirectUI@@2PAUIClassInfo@2@A, _Class@ScrollViewer@DirectUI@@2PAUIClassInfo@2@A, _Class@Viewer@DirectUI@@2PAUIClassInfo@2@A, _Class@Thumb@DirectUI@@2PAUIClassInfo@2@A, _Class@RepeatButton@DirectUI@@2PAUIClassInfo@2@A, InitGadgetComponent, _Register@HWNDContainer@@SGJXZ, _Register@PNGGraphic@@SGJXZ, _Register@CmdButton@@SGJXZ, _Register@Clipper@@SGJXZ, _Register@CExpando@@SGJXZ, _Register@ClipperH@@SGJXZ, _Register@CExpandoH@@SGJXZ, _Register@DialogHost@@SGJXZ, UninitGadgetComponent, _Enter@Edit@DirectUI@@2PAEA, _StateChange@Checkbox@DirectUI@@2PAEA, _FindFirstDescendentByClass@DirectUI@@YGPAVElement@1@PAV21@PAUIClassInfo@1@@Z, _StateProp@Checkbox@DirectUI@@2PAUPropertyInfo@2@A, _IsIMEActive@WLEditT@@IAE_NXZ, _RemoveEllipsis@WLEditT@@IAEXXZ, _ForceDSChanged@WLEditT@@IAEXXZ, SetGadgetMessageFilter, _AnimationProp@Element@DirectUI@@2PAUPropertyInfo@2@A, GetGadget, _OnDragEnterEvent@CDropTargetGadgetAdaptor@@2PAEA, _FontFaceProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _FontWeightProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _FontStyleProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _GetTextServices@CRichEditAccessible@@IAE_AV_$CComPtr@VITextServices@@@ATL@@XZ, _EmbededOleToText@CRichEditAccessible@@IAEXAAV_$CStringT@_WV_$StrTraitATL@_WV_$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@U_charrange@@@Z, _Initialize@CRichEditAccessible@@QAEXPAVElement@DirectUI@@@Z, _PinBottomEnabledProp@WLEditT@@2PAUPropertyInfo@DirectUI@@A, _SetReadOnly@WLEditT@@QAEJH@Z, _SetPinBottom@WLEditT@@QAEJ_N@Z, _GetPinBottomEnabled@WLEditT@@QBE_NXZ, _ShowEndProp@ScrollBar@DirectUI@@2PAUPropertyInfo@2@A, _ContextSensitiveHelp@DuiAccessible@DirectUI@@UAGJH@Z, _GetWindow@DuiAccessible@DirectUI@@UAGJPAPAUHWND__@@@Z, _Clone@DuiAccessible@DirectUI@@UAGJPAPAUIEnumVARIANT@@@Z, _Reset@DuiAccessible@DirectUI@@UAGJXZ, _Skip@DuiAccessible@DirectUI@@UAGJK@Z, _Next@DuiAccessible@DirectUI@@UAGJKPAUtagVARIANT@@PAK@Z, _Disconnect@CRichEditAccessible@@UAEJXZ, _put_accValue@CRichEditAccessible@@UAGJUtagVARIANT@@PA_W@Z, _put_accName@DuiAccessible@DirectUI@@UAGJUtagVARIANT@@PA_W@Z, _accDoDefaultAction@DuiAccessible@DirectUI@@UAGJUtagVARIANT@@@Z, _accHitTest@DuiAccessible@DirectUI@@UAGJJJPAUtagVARIANT@@@Z, _accNavigate@DuiAccessible@DirectUI@@UAGJJUtagVARIANT@@PAU3@@Z, _accLocation@DuiAccessible@DirectUI@@UAGJPAJ000UtagVARIANT@@@Z, _accSelect@DuiAccessible@DirectUI@@UAGJJUtagVARIANT@@@Z, _get_accDefaultAction@DuiAccessible@DirectUI@@UAGJUtagVARIANT@@PAPA_W@Z, _get_accSelection@DuiAccessible@DirectUI@@UAGJPAUtagVARIANT@@@Z, _get_accFocus@DuiAccessible@DirectUI@@UAGJPAUtagVARIANT@@@Z, _get_accKeyboardShortcut@DuiAccessible@DirectUI@@UAGJUtagVARIANT@@PAPA_W@Z, _get_accHelpTopic@DuiAccessible@DirectUI@@UAGJPAPA_WUtagVARIANT@@PAJ@Z, _get_accHelp@DuiAccessible@DirectUI@@UAGJUtagVARIANT@@PAPA_W@Z, _get_accState@DuiAccessible@DirectUI@@UAGJUtagVARIANT@@PAU3@@Z, _get_accRole@DuiAccessible@DirectUI@@UAGJUtagVARIANT@@PAU3@@Z, _get_accDescription@DuiAccessible@DirectUI@@UAGJUtagVARIANT@@PAPA_W@Z, _get_accValue@CRichEditAccessible@@UAGJUtagVARIANT@@PAPA_W@Z, _get_accName@DuiAccessible@DirectUI@@UAGJUtagVARIANT@@PAPA_W@Z, _get_accChild@DuiAccessible@DirectUI@@UAGJUtagVARIANT@@PAPAUIDispatch@@@Z, _get_accChildCount@DuiAccessible@DirectUI@@UAGJPAJ@Z, _get_accParent@DuiAccessible@DirectUI@@UAGJPAPAUIDispatch@@@Z, _Invoke@DuiAccessible@DirectUI@@UAGJJABU_GUID@@KGPAUtagDISPPARAMS@@PAUtagVARIANT@@PAUtagEXCEPINFO@@PAI@Z, _GetIDsOfNames@DuiAccessible@DirectUI@@UAGJABU_GUID@@PAPA_WIKPAJ@Z, _GetTypeInfo@DuiAccessible@DirectUI@@UAGJIKPAPAUITypeInfo@@@Z, _GetTypeInfoCount@DuiAccessible@DirectUI@@UAGJPAI@Z, _Release@DuiAccessible@DirectUI@@UAGKXZ, _AddRef@DuiAccessible@DirectUI@@UAGKXZ, _QueryInterface@DuiAccessible@DirectUI@@UAGJABU_GUID@@PAPAX@Z, __1DuiAccessible@DirectUI@@UAE@XZ, _Initialize@Selector@DirectUI@@QAEJXZ, _Create@Selector@DirectUI@@SGJPAPAVElement@2@@Z, _SelectionChange@Selector@DirectUI@@2PAEA, _MessageCallbackHelper@CDropTargetGadgetAdaptor@@SGIPAVElement@DirectUI@@PAUIDropTarget@@PAUtagGMSG@@AAV_$CRefCountedPtr2@VCDropTargetGadgetAdaptor@@@@@Z, _GetClassInfoW@CmdButton@@UAEPAUIClassInfo@DirectUI@@XZ, _BringWindowToTop@NativeHWNDHost@DirectUI@@QAEXXZ, _pvValueListNull@Value@DirectUI@@2PAV12@A, _CreateVariant@Value@DirectUI@@SGPAV12@PAUtagVARIANT@@@Z, _RMFindModuleForResource@@YGPAUHINSTANCE__@@PB_W0K0@Z, _RMLoadBitmap@@YGPAUHBITMAP__@@PB_WK0@Z, _DataTransformProp@Element@DirectUI@@2PAUPropertyInfo@2@A, __SetValue@Element@DirectUI@@IAEJPBUPropertyInfo@2@HPAVValue@2@_N2@Z, _KillTimer@DuiElementTimerHandler@@QAEXIK@Z, _SetTimer@DuiElementTimerHandler@@QAEIIIK@Z, __1DuiElementTimerHandler@@UAE@XZ, __0DuiElementTimerHandler@@QAE@XZ, _pvUnknownNull@Value@DirectUI@@2PAV12@A, _Help@HWNDElement@DirectUI@@2PAEA, _DestroyWindow@NativeHWNDHost@DirectUI@@QAEXXZ, _CreateImageValue@CRMDUIParser@@UAEPAVValue@DirectUI@@PB_W@Z, _CreateStringValue@CRMDUIParser@@UAEPAVValue@DirectUI@@PB_WI@Z, _SetDataTransform@Element@DirectUI@@QAEJPAUIUnknown@@@Z, _Create@FillLayout@DirectUI@@SGJPAPAVLayout@2@@Z, _Initialize@HWNDElement@DirectUI@@QAEJPAUHWND__@@_NI1@Z, ForwardGadgetMessage, _WndProc@HWNDElement@DirectUI@@UAEJPAUHWND__@@IIJ@Z, _GetAccessibleImpl@HWNDElement@DirectUI@@UAEJPAPAUIAccessible@@@Z, _RemoveTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z, _RMLoadImage@@YGPAXPB_WIHHIK0@Z, _RMLoadResourceStream@@YGPAUIStream@@PB_W0_NPAKK0@Z, _GetContentSize@WLEditT@@QAE_AUtagSIZE@@XZ, _ActivateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@K@Z, _UpdateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z, _OnDestroy@HWNDElement@DirectUI@@UAEXXZ, _OnKeyFocusMoved@HWNDElement@DirectUI@@UAEXPAVElement@2@0@Z, _OnGroupChanged@HWNDElement@DirectUI@@UAEXH_N@Z, _OnPropertyChanged@HWNDElement@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z, _OnInput@HWNDElement@DirectUI@@UAEXPAUInputEvent@2@@Z, _OnEvent@HWNDElement@DirectUI@@UAEXPAUEvent@2@@Z, _Destroy@NativeHWNDHost@DirectUI@@UAEXXZ, _GetScreenCenterPoint@CDUIDialog@@SG_AUtagPOINT@@PAUHWND__@@@Z, _Class@HWNDElement@DirectUI@@2PAUIClassInfo@2@A, _SyncMaxVisibleLines@WLEditT@@QAEJXZ, _RMFindModule@@YGPAUHINSTANCE__@@KPB_W@Z, _Class@Element@DirectUI@@2PAUIClassInfo@2@A, _FindDescendent@Element@DirectUI@@QAEPAV12@G@Z, _StrToID@DirectUI@@YGGPB_W@Z, _EndDefer@Element@DirectUI@@SGXXZ, _ShowElement@@YGJPAVElement@DirectUI@@H@Z, _StartDefer@Element@DirectUI@@SGXXZ, _GetElement@NativeHWNDHost@DirectUI@@QAEPAVElement@2@XZ, __1CRMDirectStringResource@@UAE@XZ, __BCRMDirectStringResource@@QBEPB_WXZ, __1CRMSystemMetricString@@UAE@XZ, __BCRMSystemMetricString@@QAEPB_WXZ, _Length@CRMSystemMetricString@@QAEKXZ, __0CRMSystemMetricString@@QAE@ABVCRMDirectStringResource@@@Z, _IsSystemMetric@CRMDirectStringResource@@QBE_NXZ, _Length@CRMDirectStringResource@@QBEIXZ, __0CRMDirectStringResource@@QAE@IKPB_W@Z, __1CRMCompoundStringResource@@UAE@XZ, _BuildString@CRMCompoundStringResource@@UBE_NPA_WI@Z, _Length@CRMCompoundStringResource@@QBEIXZ, __0CRMCompoundStringResource@@QAE@IKPB_W@Z, _GetInstance@CConfigServerClientEvents@@SGPAV1@XZ, _g_fIsRTL@UxgUtil@@3HA, __0CDUIDialog@@QAE@XZ, _Destroy@CDUIDialog@@MAEXXZ, _OnMessage@CDUIDialog@@MAEJIIJAAJ@Z, _SetDefaultFocus@NativeHWNDHost@DirectUI@@MAEXXZ, _OnDefaultFrameColorChanged@CFramelessHost@@MAEXXZ, _OnUpdateFrame@CFramelessHost@@MAEX_N@Z, _OnLoadHiddenState@CDUIDialog@@MAE_NXZ, _OnSaveHiddenState@CDUIDialog@@MAEX_N@Z, _OnCreateRegion@CDUIDialog@@MAEPAUHRGN__@@HHHH@Z, _ExitDialog@CDUIDialog@@MAEXH@Z, _OnPostCreateDialog@CDUIDialog@@MAEXPAVElement@DirectUI@@@Z, _OnSize@CDUIDialog@@MAE_NIJAAJ@Z, _OnCreate@CDUIDialog@@MAE_NIJAAJ@Z, _OnDestroy@CDUIDialog@@MAE_NIJAAJ@Z, _OnNCDestroy@CDUIDialog@@MAE_NIJAAJ@Z, _OnActivate@CDUIDialog@@MAE_NIJAAJ@Z, _OnSysCommand@CDUIDialog@@MAE_NIJAAJ@Z, _OnClose@CDUIDialog@@MAE_NIJAAJ@Z, _OnShowWindow@CDUIDialog@@MAE_NIJAAJ@Z, _ShowDialog@CDUIDialog@@MAEJPAUHWND__@@PAUtagPOINT@@@Z, _FilterMessage@CDUIDialog@@MAEHPAUtagMSG@@@Z, __1CDUIDialog@@UAE@XZ, _GetColor@CCustomColor@@CGKW4EUIType@@@Z, __1CMsgFilter@@QAE@XZ, __ZeroRelease@Value@DirectUI@@AAEXXZ, _Count@CPerfMonitor@@QAEHH@Z, _Elapsed@CPerfMonitor@@QAENH@Z, _End@CPerfMonitor@@QAENH@Z, _Start@CPerfMonitor@@QAENH@Z, _g_LogonPerfMonitor@@3VCLogonPerfMonitor@@A, _ParentProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _DesiredSizeProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _GetValue@Element@DirectUI@@QBEPAVValue@2@PBUPropertyInfo@2@H@Z, _EnabledProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _SetValue@Element@DirectUI@@QAEJPBUPropertyInfo@2@HPAVValue@2@@Z, _PaddingProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _CreateRect@Value@DirectUI@@SGPAV12@HHHH@Z, _CreateInt@Value@DirectUI@@SGPAV12@H@Z, _CSConfigGetAttributeValue@@YGJPB_W0AAV_$CStringT@_WV_$StrTraitATL@_WV_$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z, _QueryInterface@CPerfMonitor@@UAGJABU_GUID@@PAPAX@Z, DUserMessageHook, MsnCoreUnInitProcess, MsnCoreUnInitThread, MsnCoreInitThread, MsnCoreInitProcess, GetMessageExW, _FilterMessage@CMsgFilterHolder@@SGHPAUtagMSG@@@Z, _LayoutPosProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _SelectedProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _CreateBool@Value@DirectUI@@SGPAV12@_N@Z, InvalidateGadget, GetGadgetRect, _GetRootHWND@HWNDElement@DirectUI@@SGPAUHWND__@@PAVElement@2@@Z, _RMLoadColorRef@@YGKPB_WKK0@Z, _BackgroundProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _CreateColor@Value@DirectUI@@SGPAV12@KEE@Z, _GetHWND@NativeHWNDHost@DirectUI@@QAEPAUHWND__@@XZ, _WidthProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _HeightProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _ChildrenProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _ExtentProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _KeyFocusedProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _IDProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _VisibleProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _Destroy@Element@DirectUI@@QAEJ_N@Z, _ContentProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _CreateString@Value@DirectUI@@SGPAV12@PB_WPAUHINSTANCE__@@I@Z, _ActiveProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _ClassProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _CreateAtom@Value@DirectUI@@SGPAV12@PB_W@Z, _AccessibleProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _AccRoleProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _AccNameProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _AccDescProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _WindowActiveProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _DropFocusProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _g_dwElSlot@DirectUI@@3KA, _PressedProp@Button@DirectUI@@2PAUPropertyInfo@2@A, _AggressiveUpdateProp@HWNDHost@DirectUI@@2PAUPropertyInfo@2@A, _PositionProp@Progress@DirectUI@@2PAUPropertyInfo@2@A, _Attach@CRMDUIParser@@QAEJPAVElement@DirectUI@@@Z, _Add@Element@DirectUI@@QAEJPAV12@@Z, _DestroyAll@Element@DirectUI@@QAEJXZ, _LoadAndCreateElement@CRMDUIParser@@QAEJIPB_WPAPAVElement@DirectUI@@PAV23@K0@Z, __0CRMDUIParser@@QAE@XZ, _RMLoadString@@YGIIPA_WIKPB_W@Z, _OnInitDialog@CDUIDialog@@MAE_NIJAAJ@Z, _OnCommand@CDUIDialog@@MAE_NIJAAJ@Z, _ShowWindow@NativeHWNDHost@DirectUI@@QAEXH@Z, _KillTimer@SyncTimerHandler@@QAEXIK@Z, _SetRichEditStyle@WLEditT@@QAEJH@Z, _GetRichEditStyle@WLEditT@@QBEHXZ, _Class@CExpandoH@@2PAUIClassInfo@DirectUI@@A, _Class@Constrainer@DirectUI@@2PAUIClassInfo@2@A, _Class@Progress@DirectUI@@2PAUIClassInfo@2@A, _Initialize@NativeHWNDHost@DirectUI@@QAEJPB_W0PAUHWND__@@PAUHICON__@@HHHHHHHPAUHINSTANCE__@@I@Z, _RemoveLocalValue@Element@DirectUI@@QAEJPBUPropertyInfo@2@@Z, _ForceCaretRefresh@WLEditT@@QAEJXZ, _SyncRect@WLEditT@@QAEJUtagSIZE@@@Z, GetGadgetFocus, _ShowElement@@YGJPAVElement@DirectUI@@PB_WH@Z, SetGadgetRootInfo, _Class@CmdButton@@2PAUIClassInfo@DirectUI@@A, SetElementContentFromImageResource, __1CFramelessHost@@UAE@XZ, __1SyncTimerHandler@@UAE@XZ, _AdjustElementSize@@YGJPAVElement@DirectUI@@PAUtagSIZE@@K@Z, _IsChildElement@@YGHPAVElement@DirectUI@@0@Z, _ElementFromGadget@DirectUI@@YGPAVElement@1@PAUHGADGET__@@@Z, FindGadgetFromPoint, _m_crDefaultFrameColor@CFramelessHost@@1KA, SetElementPropertyFromImageResource, _IconProp@Button@DirectUI@@2PAUPropertyInfo@2@A, _Remove@Element@DirectUI@@QAEJPAV12@@Z, _SelectElement@@YGJPAVElement@DirectUI@@PB_WH@Z, _SetDefaultFocusID@NativeHWNDHost@DirectUI@@QAEXPB_W@Z, _SetTimer@SyncTimerHandler@@QAEIIIK@Z, ___7CMsgFilter@@6B@, __0CFramelessHost@@QAE@XZ, _SetFramelessCaption@CFramelessHost@@QAE_NQB_W@Z, _SetActiveWindow@CMsgFilter@@IAEXXZ, _RMLoadStringBSTR@@YGPA_WIKPB_W@Z, _RemoveListener@Element@DirectUI@@QAEXPAUIElementListener@2@@Z, _OnMessage@CFramelessHost@@UAEJIIJAAJ@Z, RevokeDropTarget, _OnSysChange@CCustomColor@@SGXXZ, _Insert@Element@DirectUI@@QAEJPAV12@I@Z, _AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z, _Initialize@CFramelessHost@@QAEJXZ, _Host@NativeHWNDHost@DirectUI@@QAEXPAVElement@2@@Z, BuildDropTarget, _Create@HWNDContainer@@SGJPAVNativeHWNDHost@DirectUI@@PAUIDropTarget@@PAPAVElement@3@@Z, _TooltipProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _RMIsResourceAvailable@@YG_NPB_W0K0@Z, _SetDefaultFrameColor@CFramelessHost@@SGKK@Z, __0_$IElementListenerImpl@VElement@DirectUI@@@DirectUI@@QAE@XZ, _OnListenerAttach@_$IElementListenerImpl@VElement@DirectUI@@@DirectUI@@UAEXPAVElement@2@@Z, _OnListenedPropertyChanging@_$IElementListenerImpl@VElement@DirectUI@@@DirectUI@@UAE_NPAVElement@2@PAUPropertyInfo@2@HPAVValue@2@2@Z, _OnListenedPropertyChanged@_$IElementListenerImpl@VElement@DirectUI@@@DirectUI@@UAEXPAVElement@2@PAUPropertyInfo@2@HPAVValue@2@2@Z, _OnListenedInput@_$IElementListenerImpl@VElement@DirectUI@@@DirectUI@@UAEXPAVElement@2@PAUInputEvent@2@@Z, _OnListenedEvent@_$IElementListenerImpl@VElement@DirectUI@@@DirectUI@@UAEXPAVElement@2@PAUEvent@2@@Z, _OnListenedWindowMessage@_$IElementListenerImpl@VElement@DirectUI@@@DirectUI@@UAE_NPAVElement@2@PAUHWND__@@IIJPAJ@Z, __1_$ListenedElementPtr@VElement@DirectUI@@@DirectUI@@QAE@XZ, __B_$ListenedElementPtr@VElement@DirectUI@@@DirectUI@@QBEPAVElement@1@XZ, __4_$ListenedElementPtr@VElement@DirectUI@@@DirectUI@@QAEPBVElement@1@PAV21@@Z, __0_$ListenedElementPtr@VElement@DirectUI@@@DirectUI@@QAE@PAVElement@1@@Z, _UpdateFrame@CFramelessHost@@IAEXXZ, _IsDescendent@Element@DirectUI@@QAE_NPAV12@@Z, _PerformFramelessHitTest@CFramelessHost@@IAEJUtagPOINT@@PAPAVElement@DirectUI@@@Z, _RMUpdateResourceSet@@YG_NPB_WK00@Z, _RMTerminate@@YGXXZ, _RMInitialize@@YGXXZ, _Class@Checkbox@DirectUI@@2PAUIClassInfo@2@A, _CheckedProp@Checkbox@DirectUI@@2PAUPropertyInfo@2@A, _UpdateStateProp@Checkbox@DirectUI@@IAEJH@Z, _FirstStart@CPerfMonitor@@QAENH@Z, _ElementMinimizeMemoryUsage@DirectUI@@YGXXZ, _EventEnd@CPerfMonitor@@UAGXH@Z, _EventStart@CPerfMonitor@@UAGXH@Z, _Init@CCustomColor@@SGJXZ, _DirectionProp@Element@DirectUI@@2PAUPropertyInfo@2@A, __0CmdButton@@QAE@XZ, _OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z, _OnGroupChanged@Element@DirectUI@@UAEXH_N@Z, _OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z, _OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z, _OnDestroy@Element@DirectUI@@UAEXXZ, _OnEvent@CmdButton@@UAEXPAUEvent@DirectUI@@@Z, _Paint@CmdButton@@UAEXPAUHDC__@@PAUHBITMAP__@@PAUtagDIBSECTION@@PBUtagRECT@@3PAU5@4@Z, _GetContentSize@Element@DirectUI@@UAE_AUtagSIZE@@HHPAVSurface@2@@Z, _Add@Element@DirectUI@@UAEJPAPAV12@I@Z, _Insert@Element@DirectUI@@UAEJPAPAV12@II@Z, _Remove@Element@DirectUI@@UAEJPAPAV12@I@Z, _GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z, _EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z, _SetKeyFocus@Element@DirectUI@@UAEXXZ, _MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z, __SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z, __SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE_AUtagSIZE@@HHPAVSurface@2@@Z, _OnHosted@Button@DirectUI@@UAEXPAVElement@2@@Z, _OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z, _GetAccessibleImpl@Button@DirectUI@@UAEJPAPAUIAccessible@@@Z, _DefaultAction@Button@DirectUI@@UAEJXZ, _UpdateCue@Button@DirectUI@@MAEJXZ, __1CmdButton@@UAE@XZ, _g_hHeap@DirectUI@@3PAXA, _AlphaProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _Initialize@PNGGraphic@@QAEJI@Z, _OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z, _Click@Button@DirectUI@@2PAEA, _OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z, UtilDrawBlendRect, _AllocatePropertyIndex@Element@DirectUI@@SGIXZ, _AllocateClassIndex@Element@DirectUI@@SGIXZ, _GetPciMap@Element@DirectUI@@SGPAV_$BTreeLookup@PAUIClassInfo@DirectUI@@@2@XZ, _InvalidateElement@@YGHPAVElement@DirectUI@@@Z, __1CRMResource@@UAE@XZ, __0CRMResource@@QAE@PB_W0K0PAK@Z, _pvBoolTrue@Value@DirectUI@@2PAV12@A, _OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z, _Paint@Element@DirectUI@@UAEXPAUHDC__@@PAUHBITMAP__@@PAUtagDIBSECTION@@PBUtagRECT@@3PAU6@4@Z, _OnHosted@Element@DirectUI@@MAEXPAV12@@Z, _GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z, _DefaultAction@Element@DirectUI@@UAEJXZ, __1Element@DirectUI@@UAE@XZ, _OnPropertyChanged@Selector@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z, _OnInput@Selector@DirectUI@@UAEXPAUInputEvent@2@@Z, _OnKeyFocusMoved@Selector@DirectUI@@UAEXPAVElement@2@0@Z, _OnMouseFocusMoved@Selector@DirectUI@@UAEXPAVElement@2@0@Z, _GetAdjacent@Selector@DirectUI@@UAEPAVElement@2@PAV32@HPBUNavReference@2@K@Z, _Class@Selector@DirectUI@@2PAUIClassInfo@2@A, __1CRMDUIParser@@UAE@XZ, _Initialize@Element@DirectUI@@QAEJI@Z, _pvBoolFalse@Value@DirectUI@@2PAV12@A, _pvIntZero@Value@DirectUI@@2PAV12@A, _DoModal@CDUIDialog@@QAEHGPB_WPAUHWND__@@PAUtagPOINT@@0_N0@Z, _SelectionProp@Selector@DirectUI@@2PAUPropertyInfo@2@A, _CreateElementRef@Value@DirectUI@@SGPAV12@PAVElement@2@@Z, _Class@Button@DirectUI@@2PAUIClassInfo@2@A, _CmdIdProp@CmdButton@@2PAUPropertyInfo@DirectUI@@A, _FindDialogElement@CDUIDialog@@IAEPAVElement@DirectUI@@PB_W@Z, _RMLoadStringA@@YGIIPADIKPB_W@Z, _CmdIDProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _TextProp@Button@DirectUI@@2PAUPropertyInfo@2@A, _Class@TabControl@DirectUI@@2PAUIClassInfo@2@A, _Class@TabButton@DirectUI@@2PAUIClassInfo@2@A, _SetDataContext@Element@DirectUI@@QAEJPAUIUnknown@@@Z, _RMLoadInt@@YGHIHKPB_W@Z, __1NativeHWNDHost@DirectUI@@UAE@XZ, __0NativeHWNDHost@DirectUI@@QAE@XZ, _SetFocusOnChild@TabControl@DirectUI@@QAEJPAVElement@2@_N@Z, _GetTabButtons@TabControl@DirectUI@@QAEPAV_$DynamicArray@PAVElement@DirectUI@@@2@XZ, _GetTabPages@TabControl@DirectUI@@QAEPAV_$DynamicArray@PAVElement@DirectUI@@@2@XZ, _AsyncSelectionChange@TabControl@DirectUI@@2PAEA, _SetBinding@Element@DirectUI@@QAEJPAUPropertyInfo@2@PAVBinding@2@@Z, _TagProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _BorderColorProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _ForegroundProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _ColorizeProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _CreateColorize@Value@DirectUI@@SGPAV12@K@Z, _Class@TabPage@DirectUI@@2PAUIClassInfo@2@A, _AccValueProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _Initialize@Button@DirectUI@@QAEJI@Z, _pvUnset@Value@DirectUI@@2PAV12@A, _RMLoadIcon@@YGPAUHICON__@@PB_WK0@Z, _ShortcutProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _MaximumProp@Progress@DirectUI@@2PAUPropertyInfo@2@A, _MinimumProp@Progress@DirectUI@@2PAUPropertyInfo@2@A, _DoModeless@CDUIDialog@@QAEJGPB_WPAUHWND__@@PAUtagPOINT@@0_N330@Z, _FireEvent@Element@DirectUI@@QAEXPAUEvent@2@_N@Z, _IdResProp@PNGGraphic@@2PAUPropertyInfo@DirectUI@@A, _Class@PNGGraphic@@2PAUIClassInfo@DirectUI@@A, __1PNGGraphic@@UAE@XZ, _OnInput@Button@DirectUI@@UAEXPAUInputEvent@2@@Z, __0PNGGraphic@@QAE@XZ, _OnPropertyChanged@Button@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z, _OnPropertyChanged@PNGGraphic@@UAEXPAUPropertyInfo@DirectUI@@HPAVValue@3@1@Z, _PostEvent@Element@DirectUI@@QAEXPAUEvent@2@@Z, GetGadgetStyle, _KeyboardNavigate@Element@DirectUI@@2PAEA, _DUI2Win32Message@CDUI2WindowMsg@@IAEJPAUInputEvent@DirectUI@@PAV_$DynamicArray@UCWinMsg@CDUI2WindowMsg@@@3@@Z, _OnPropertyChanged@HWNDHost@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z, _OnInput@HWNDHost@DirectUI@@UAEXPAUInputEvent@2@@Z, _OnDestroy@HWNDHost@DirectUI@@UAEXXZ, _Paint@HWNDHost@DirectUI@@UAEXPAUHDC__@@PAUHBITMAP__@@PAUtagDIBSECTION@@PBUtagRECT@@3PAU6@4@Z, _MessageCallback@HWNDHost@DirectUI@@UAEIPAUtagGMSG@@@Z, _OnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z, _OnUnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z, _GetAccessibleImpl@HWNDHost@DirectUI@@UAEJPAPAUIAccessible@@@Z, _OnNotify@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z, _OnMessage@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z, _OnAdjustWindowSize@HWNDHost@DirectUI@@UAEHHHI@Z, _CreateHWND@HWNDHost@DirectUI@@MAEPAUHWND__@@PAU3@@Z, _SyncFont@HWNDHost@DirectUI@@MAEXXZ, _Class@HWNDHost@DirectUI@@2PAUIClassInfo@2@A, _Initialize@HWNDHost@DirectUI@@QAEJII@Z, _pvStringNull@Value@DirectUI@@2PAV12@A, _TransferImageToPNG@PNGGraphic@@QAEJAAVCMSGRImage@ATL@@@Z, _HideWindow@NativeHWNDHost@DirectUI@@QAEXXZ, _NotifyAccessibilityEvent@DirectUI@@YGXKPAVElement@1@@Z, _OnMessage@NativeHWNDHost@DirectUI@@UAEJIIJAAJ@Z, _SetActiveWindow@CMsgFilterHolder@@SGXPAVCMsgFilter@@@Z, _LayoutProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _CreateLayout@Value@DirectUI@@SGPAV12@PAVLayout@2@@Z, _ContentAlignProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _IsDefaultProp@Button@DirectUI@@2PAUPropertyInfo@2@A, SetElementContentFromIconResource, _Create@FlowLayout@DirectUI@@SGJHIIIPAPAVLayout@2@@Z, _OnPropertyChanged@CmdButton@@UAEXPAUPropertyInfo@DirectUI@@HPAVValue@3@1@Z, _OnInput@CmdButton@@UAEXPAUInputEvent@DirectUI@@@Z, _Init@NavReference@DirectUI@@QAEXPAVElement@2@PAUtagRECT@@@Z, _KeyWithinProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _MouseWithinProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _AccStateProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _ButtonStyleProp@CmdButton@@2PAUPropertyInfo@DirectUI@@A, _IsEqual@Value@DirectUI@@QAE_NPAV12@@Z, GetGadgetAnimation, _pvAtomZero@Value@DirectUI@@2PAV12@A, __0WLEditT@@QAE@XZ, _OnPropertyChanged@WLEditT@@UAEXPAUPropertyInfo@DirectUI@@HPAVValue@3@1@Z, _OnInput@WLEditT@@UAEXPAUInputEvent@DirectUI@@@Z, _OnKeyFocusMoved@WLEditT@@UAEXPAVElement@DirectUI@@0@Z, _OnEvent@WLEditT@@UAEXPAUEvent@DirectUI@@@Z, _Paint@WLEditT@@UAEXPAUHDC__@@PAUHBITMAP__@@PAUtagDIBSECTION@@PBUtagRECT@@3PAU5@4@Z, _GetContentSize@WLEditT@@UAE_AUtagSIZE@@HHPAVSurface@DirectUI@@@Z, _MessageCallback@WLEditT@@UAEIPAUtagGMSG@@@Z, __SelfLayoutDoLayout@WLEditT@@MAEXHH@Z, __SelfLayoutUpdateDesiredSize@WLEditT@@MAE_AUtagSIZE@@HHPAVSurface@DirectUI@@@Z, _OnHosted@WLEditT@@MAEXPAVElement@DirectUI@@@Z, _GetAccessibleImpl@WLEditT@@UAEJPAPAUIAccessible@@@Z, _Initialize@WLEditT@@UAEJI@Z, _AdjustInvalidationRect@WLEditT@@UAEXPAUtagRECT@@@Z, _OnPhysicalExtentChanged@WLEditT@@UAEXUtagSIZE@@@Z, _OnDragEnter@WLEditT@@UAEJPAUIDataObject@@@Z, _GetEditTextString@WLEditT@@UAEHAAV_$CStringT@_WV_$StrTraitATL@_WV_$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@_N1@Z, _OnVirtualExtentChanged@WLEditT@@MAEXUtagSIZE@@@Z, _SyncText@WLEditT@@MAEJPB_W@Z, _CreateTextHost@WLEditT@@MAEJXZ, _OnTimer@WLEditT@@UAEXIKK@Z, _GetTimerHwndElement@WLEditT@@UAEPAVHWNDElement@DirectUI@@XZ, _SendMessageW@WLEditT@@UAEJIIJAAJ@Z, _PostMessageW@WLEditT@@UAEJIIJAAJ@Z, _SetFocus@WLEditT@@UAEJXZ, _IsFocused@WLEditT@@UAEHXZ, _SetCursor@WLEditT@@UAEJPAUHICON__@@@Z, _GetScrollInfo@WLEditT@@UAEJHPAUtagSCROLLINFO@@@Z, _ClientToScreen@WLEditT@@UAEJPAUtagPOINT@@@Z, _ScreenToClient@WLEditT@@UAEJPAUtagPOINT@@@Z, _InvalidateRect@WLEditT@@UAEJPAUtagRECT@@H@Z, _GetClientRect@WLEditT@@UAEJPAUtagRECT@@@Z, _GetWindowRect@WLEditT@@UAEJPAUtagRECT@@@Z, _ImmGetContext@WLEditT@@UAEPAUHIMC__@@XZ, _ImmReleaseContext@WLEditT@@UAEXPAUHIMC__@@@Z, _GetDC@WLEditT@@UAEPAUHDC__@@XZ, _ReleaseDC@WLEditT@@UAEHPAUHDC__@@@Z, _OnMessage@WLEditT@@UAEJIIJAAJ@Z, _OnInitContextMenu@WLEditT@@UAEJPAUHMENU__@@@Z, __1WLEditT@@UAE@XZ, _Class@WLEditT@@2PAUIClassInfo@DirectUI@@A, _GetFirstLineHeight@WLEditT@@QBEHXZ, _GetLabel@WLEditT@@QBEGXZ, _SetYScrollable@WLEditT@@QAEJ_N@Z, _SetXScrollable@WLEditT@@QAEJ_N@Z, _Initialize@WLEditT@@QAEJIH@Z, _VerticalProp@ScrollBar@DirectUI@@2PAUPropertyInfo@2@A, _OnPropertyChanging@ScrollBar@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z, _OnPropertyChanged@ScrollBar@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z, _OnEvent@ScrollBar@DirectUI@@UAEXPAUEvent@2@@Z, __SelfLayoutDoLayout@ScrollBar@DirectUI@@UAEXHH@Z, __SelfLayoutUpdateDesiredSize@ScrollBar@DirectUI@@UAE_AUtagSIZE@@HHPAVSurface@2@@Z, _CreateButtons@ScrollBar@DirectUI@@MAEJXZ, _SetButtonsTag@ScrollBar@DirectUI@@MAEX_N@Z, _Class@ScrollBar@DirectUI@@2PAUIClassInfo@2@A, _Initialize@ScrollBar@DirectUI@@QAEJ_N@Z, _GetTopHWNDParent@DirectUI@@YGPAUHWND__@@PAU2@H@Z, _PositionProp@ScrollBar@DirectUI@@2PAUPropertyInfo@2@A, _m_fPaintingFrozen@CMsgFilterHolder@@1HA, _CursorProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _CreateCursor@Value@DirectUI@@SGPAV12@PAUHICON__@@@Z, _CapturedProp@Button@DirectUI@@2PAUPropertyInfo@2@A, _MapElementPoint@Element@DirectUI@@QAEXPAV12@PBUtagPOINT@@PAU3@@Z, _Drag@Thumb@DirectUI@@2PAEA, _MarginProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _SizeInLayoutProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _GetImmediateChild@Element@DirectUI@@QAEPAV12@PAV12@@Z, __UpdateDesiredSize@Element@DirectUI@@QAE_AUtagSIZE@@HHPAVSurface@2@@Z, __UpdateLayoutSize@Element@DirectUI@@QAEXHH@Z, __UpdateLayoutPosition@Element@DirectUI@@QAEXHH@Z, _RMLoadMenu@@YGPAUHMENU__@@PB_WK0@Z, _Context@Button@DirectUI@@2PAEA, _BorderThicknessProp@Element@DirectUI@@2PAUPropertyInfo@2@A, _ProcessForEllipsis@WLEditT@@IAEJPAUHDC__@@AAUtagSIZE@@@Z
> WS2_32.dll: WSCEnumProtocols, WSCGetProviderPath, getnameinfo, WSAIoctl, WSACloseEvent, getaddrinfo, freeaddrinfo, WSACreateEvent
> COMCTL32.dll: ImageList_Remove, ImageList_DrawEx, ImageList_ReplaceIcon, -, -, InitCommonControlsEx, ImageList_Destroy, ImageList_AddMasked, -, ImageList_Create, -, ImageList_GetIcon, ImageList_Draw, ImageList_Add
> CRYPT32.dll: CertVerifyCertificateChainPolicy, CryptVerifyMessageSignature, CertCreateCertificateChainEngine, CertGetCertificateChain, CertFreeCertificateChain, CertFreeCertificateChainEngine, CryptFormatObject, CryptHashPublicKeyInfo, CryptMsgOpenToDecode, CryptMsgUpdate, CryptMsgGetParam, CertFindAttribute, CryptMsgClose, CryptDecodeObjectEx, CertGetNameStringW, CertFreeCertificateContext
> VERSION.dll: GetFileVersionInfoSizeW, GetFileVersionInfoA, VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeA, VerQueryValueA
> WINMM.dll: waveInGetNumDevs, waveOutGetNumDevs
> IMM32.dll: ImmGetContext, ImmGetCompositionStringW, ImmSetConversionStatus, ImmGetConversionStatus, ImmAssociateContext, ImmReleaseContext
> WININET.dll: InternetSetOptionW, GetUrlCacheEntryInfoW, InternetQueryOptionW, InternetInitializeAutoProxyDll
> iphlpapi.dll: GetAdaptersInfo, GetIpAddrTable, GetIfEntry, NotifyRouteChange
> MSACM32.dll: acmStreamOpen, acmStreamClose, acmStreamUnprepareHeader, acmStreamConvert, acmStreamPrepareHeader, acmFormatSuggest, acmMetrics, acmStreamSize
> RPCRT4.dll: UuidFromStringA
> msidcrl40.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> ContactsUX.dll: _QueryStatus@CABPopupMenu@@UAGJPBU_GUID@@KPAU_tagOLECMD@@PAU_tagOLECMDTEXT@@@Z, __1CABPopupMenu@@MAE@XZ, _GetResource@CABPopupMenu@@MAEIXZ, _OnTimer@CABPopupMenu@@MAEXXZ, _GetParentGroup@CABPopupMenu@@MAEJPAPAUIGroup@@@Z, _IsReadOnlyGrouping@CABPopupMenu@@MAEJPA_N_N@Z, _ShowPopup@CABPopupMenu@@UAEJPAUtagPOINT@@PAVElement@DirectUI@@@Z, _SetDuiElement@CABPopupMenu@@UAEJPAVElement@DirectUI@@@Z, _SetReferencedEmail@CABPopupMenu@@UAEJPB_W@Z, _SetReferencedObject@CABPopupMenu@@UAEJPAUIStoreObject@@@Z, _Exec@CABPopupMenu@@UAGJPBU_GUID@@KKPAUtagVARIANT@@1@Z, __0CABPopupMenu@@IAE@XZ, _GetDataContextAs@CABPopupMenu@@IAEJABU_GUID@@PAPAX@Z, _IsCommandSupportedByExec@CABPopupMenu@@MAE_NKU_GUID@@@Z, _GetElementSealId@CListItemElement@@IAEKXZ, _OnEvent@CContactElement@@UAEXPAUEvent@DirectUI@@@Z, _ChangeInlineEditState@CListItemElement@@IAEX_N@Z, _GetData@CContactElement@@IAEJPAPAUCONTACT@@@Z, _OnInput@CContactElement@@UAEXPAUInputEvent@DirectUI@@@Z, _Class@CListItemElement@@2PAUIClassInfo@DirectUI@@A, _GetDataContextAs@CListItemElement@@IAEJABU_GUID@@PAPAX@Z, __1CContactElement@@UAE@XZ, _QueryStatus@CListItemElement@@UAGJPBU_GUID@@KPAU_tagOLECMD@@PAU_tagOLECMDTEXT@@@Z, _IsEditInlineCmd@CContactElement@@MAE_NK@Z, _EnsurePopupMenuObject@CListItemElement@@MAEJXZ, _ShouldShowContextMenu@CContactElement@@MAE_NXZ, _OnDoubleClick@CContactElement@@MAE_NXZ, _ExecuteDefaultAction@CListItemElement@@UAE_NXZ, _DefaultAction@CListItemElement@@UAEJXZ, _Insert@CABListItemArray@@QAEHPAUIStoreObject@@K@Z, _g_wzDream15@CDonationManager@@2PA_WA, _g_wzDream14@CDonationManager@@2PA_WA, _g_wzDream13@CDonationManager@@2PA_WA, _g_wzDream12@CDonationManager@@2PA_WA, _g_wzDream11@CDonationManager@@2PA_WA, _g_wzDream10@CDonationManager@@2PA_WA, _DelayedExec@CABPopupMenu@@UAEJKU_GUID@@@Z, _g_wzDream8@CDonationManager@@2PA_WA, _g_wzDream7@CDonationManager@@2PA_WA, _g_wzDream6@CDonationManager@@2PA_WA, _g_wzDream5@CDonationManager@@2PA_WA, _g_wzDream4@CDonationManager@@2PA_WA, _g_wzDream3@CDonationManager@@2PA_WA, _g_wzDream2@CDonationManager@@2PA_WA, _g_wzDream1@CDonationManager@@2PA_WA, _SetProxyUser@Contacts@@YGXPB_W@Z, _UpdatePolicy@Contacts@@YGJPB_W@Z, _GetSubCollection@Contacts@@YGJW4STOREOBJECTTYPE@@PAUIObjectFilterer@@PAPAUIObjectPoolView@@_N@Z, _DeleteItemFromSeal@Contacts@@YGJK@Z, _CreateSqmAdapter@Contacts@@YGJABW4eSQMSessionType@@PAPAUIUnknown@@@Z, _CanMobileMessage@@YG_NPBUCONTACT@@@Z, _IsContactSomeKindOfBuddy@@YG_NPBUCONTACT@@@Z, _LaunchContactPicker@Contacts@@YGJW4ContactPickerStyle@@PAUHWND__@@PAPAUIContactPickerDialog@@@Z, __0CGroupElement@@QAE@XZ, _OnPropertyChanged@CListItemElement@@UAEXPAUPropertyInfo@DirectUI@@HPAVValue@3@1@Z, __0CContactElement@@QAE@XZ, _OnDrop@CBuddyListElement@@MAE_NPAUQueryDropEvent@@@Z, _GetRootHWNDOfElement@@YGPAUHWND__@@PAVElement@DirectUI@@@Z, _OnQueryDropEffect@CBuddyListElement@@MAEXPAUQueryDropEvent@@@Z, _OnDoubleClick@CGroupElement@@MAE_NXZ, _ShouldShowContextMenu@CGroupElement@@MAE_NXZ, _IsEditInlineCmd@CGroupElement@@MAE_NK@Z, __1CGroupElement@@UAE@XZ, _OnInput@CGroupElement@@UAEXPAUInputEvent@DirectUI@@@Z, _IsReadOnlyGroup@CGroupElement@@QAE_NXZ, _GetData@CGroupElement@@IAEJPAPAUCONTACTGROUP@@@Z, _GetIGroupFromGroupName@Contacts@@YGJPB_WPAPAUIGroup@@@Z, _OnEvent@CGroupElement@@UAEXPAUEvent@DirectUI@@@Z, _IsPublicContactFilesEncryptionEnabled@Contacts@@YGJPA_N@Z, _ConvertPublicContactFiles@Contacts@@YGJ_N@Z, _findCtry@CtryCode@@SGJKPA_WPAI@Z, _LoadCountryFromRegistry@CPhoneRegUtil@@SGKPAUHWND__@@KPBD1@Z, _InitComboBox@CtryCode@@SGJPAUHWND__@@HK@Z, _g_wzDream9@CDonationManager@@2PA_WA, _CreateUIContact@CBaseGrouping@@IAEJIPAPAUIContact@@K@Z, _OnUnHosted@CListItemElement@@UAEXPAVElement@DirectUI@@@Z, _g_wzDream16@CDonationManager@@2PA_WA, _GetSigninUserName@Contacts@@YGXAAVCStr@@@Z, _ABCMDToPhoneType@@YG_AW4SoftphoneContactPhoneType@@K@Z, _SetHost@Contacts@@YGJPAUIBuddyListHost@@@Z, _IsContactWvidBuddy@@YG_NPBUCONTACT@@@Z, _ConvertCodesToMap@CtryCode@@SGXPB_WAAV_$CRBMap@KEV_$CElementTraits@K@ATL@@V_$CElementTraits@E@2@@ATL@@@Z, _GetManager@Contacts@@YGJPAPAUIManager@1@@Z, InitializeSeal, RegisterMsnContactElements, MsnContactUnInitProcess, TerminateSeal, _GetContactCount@Contacts@@YGKPAPAUIObjectPoolView@@@Z, _GetGroupCount@Contacts@@YGKPAPAUIObjectPoolView@@@Z, _GetNumPendingRequests@Contacts@@YGKXZ, _IsAbchFailure@Contacts@@YG_NJ@Z, _GetIContactFromPhoneNumber@Contacts@@YGJPB_WPAPAUIContact@@@Z, _GetIContactFromEmail@Contacts@@YGJPB_WPAPAUIContact@@@Z, _CommitContactProperty@Contacts@@YGJABVCUpdateProperties@@@Z, _Synchronize@Contacts@@YGJW4ESyncTrigger@1@@Z, _SetStorageServer@Contacts@@YGXPBD0@Z, _LaunchContactDeleteDialog@Contacts@@YGJPAUIContact@@PAUHWND__@@@Z, _LaunchContactEditDialog@Contacts@@YGJPAUIContact@@_NPAUHWND__@@PAPAUIContactDialog@@@Z, _LaunchGroupEditDialog@Contacts@@YGJPAUIGroup@@PAUHWND__@@@Z, _LaunchGroupDeleteDialog@Contacts@@YGJKPAUHWND__@@@Z, _SetUseSsl@Contacts@@YGX_N@Z, _EnsureDefaultUiGroups@Contacts@@YGJPAUIStoreTransactionCallback@@PAPAUIUnknown@@@Z, _ReadyHelperObjects@Contacts@@YGXXZ, _LaunchContactEditDialog@Contacts@@YGJPB_WW4EEditDialogFillField@1@PAUHWND__@@_N@Z, _GetMeContact@Contacts@@YGJPAPAUIContact@@@Z, _SetCountingOfSocialNetworkRequests@Contacts@@YGJH@Z, _SetMarket@Contacts@@YGJPB_W@Z, _SetDefaultTransform@Contacts@@YGJPAVElement@DirectUI@@@Z, IsSpaceSet, _IsContactMe@@YG_NPAUIContact@@@Z, _SubscribeToLiveContactProfile@Contacts@@YGJPAUIContact@@@Z, _ViewMap@Contacts@@YGJPAUIContact@@W4EAddressType@@@Z, IsContactProfileSet, IsProfileSet, _ContactHasPhone@@YG_NPAUIContact@@@Z, _QueryContactCommand@@YGJPAUIBuddyListHost@@PAUIContact@@HAA_N2@Z, _IsContactMe@@YG_NPAUCONTACT@@@Z, _GetHost@Contacts@@YGJPAPAUIBuddyListHost@@@Z, _SetPolicyFlags@Contacts@@YGXW4EPolicyFlags@1@@Z, _GetStoreInfoFromDataObject@@YGJPAUIDataObject@@ABU_GUID@@PAPAXPAPAUIStoreObject@@@Z, _GetGroupContacts@Contacts@@YGJKPAPAUIObjectPoolView@@@Z, _SetAuth@Contacts@@YGXPB_W00@Z, _IsSyncOwner@Contacts@@YG_NXZ, _ReadyAbch@Contacts@@YGXXZ, __1CContactElemBase@@UAE@XZ, _OnDestroy@CContactElemBase@@UAEXXZ, _OnEvent@CContactElemBase@@UAEXPAUEvent@DirectUI@@@Z, _UpdateList@CContactElemBase@@MAEJ_N@Z, _ShouldSelectFirstItemInWordWheel@CContactElemBase@@UAE_NXZ, _Setup@CContactElemBase@@MAEJXZ, _CreateViewFilter@CContactElemBase@@MAEJXZ, _EnsureView@CContactElemBase@@MAEJK@Z, _DestroyAndReleaseElements@CContactElemBase@@MAEJXZ, _FindElements@CContactElemBase@@MAEJXZ, _EnsureFilter@CContactElemBase@@MAEJK_N@Z, _CheckForZeroListItems@CContactElemBase@@MAEXXZ, _SetSelectionOnChildren@CContactElemBase@@MAEJPAUIUnknown@@@Z, _SetDataSourceFilter@CContactElemBase@@MAEJXZ, _OnListenedPropertyChanged@CContactElemBase@@UAEXPAVElement@DirectUI@@PAUPropertyInfo@3@HPAVValue@3@2@Z, _GetSelection@CContactElemBase@@UAEJPAPAUIUnknown@@@Z, _SetSelection@CContactElemBase@@UAEJPAUIUnknown@@@Z, _AffectParticipant@CContactElemBase@@UAEJPAUIParticipant@@W4ParticipantModificationOperation@@@Z, _AffectParticipant@CContactElemBase@@UAEJABUPARTICIPANT@@W4ParticipantModificationOperation@@@Z, _GetSelectionChangeCallback@CContactElemBase@@UAEJPAPAUIParticipantSelectionControl@Contacts@@@Z, _SetSelectionChangeCallback@CContactElemBase@@UAEJPAUIParticipantSelectionControl@Contacts@@@Z, _UpdateList@CContactElemBase@@UAEJPAUIABViewFilter@@_N@Z, _GetSelectedObject@CContactElemBase@@UAEJPAPAUIUnknown@@@Z, _GetCmdTarget@CContactElemBase@@UAEJPAPAUIOleCommandTarget@@@Z, _SetWordWheelUpdateEnabled@CContactElemBase@@UAEX_N@Z, _SetFocusOnItem@CContactElemBase@@UAEJJ@Z, _OnTimer@CContactElemBase@@UAEXIKK@Z, _GetTimerHwndElement@CContactElemBase@@UAEPAVHWNDElement@DirectUI@@XZ, _Cleanup@CContactElemBase@@IAEXXZ, _QueryStatus@CContactElemBase@@UAGJPBU_GUID@@KPAU_tagOLECMD@@PAU_tagOLECMDTEXT@@@Z, _CannotMobileMessage@@YG_NPBUCONTACT@@@Z, _Class@CWordWheelElement@@2PAUIClassInfo@DirectUI@@A, _GroupingProp@CContactElemBase@@2PAUPropertyInfo@DirectUI@@A, _GetSigninCookie@Contacts@@YGKXZ, _GetFilterFromSettings@CContactElemBase@@IAEHXZ, _GetViewFromSettings@CContactElemBase@@IAEHXZ, _OnPropertyChanged@CContactElemBase@@UAEXPAUPropertyInfo@DirectUI@@HPAVValue@3@1@Z, _Class@CContactElemBase@@2PAUIClassInfo@DirectUI@@A, _AddToList@CBaseGrouping@@MAEJKPAUIABDataSource@@AAVCABListItemArray@@@Z, __0CContactElemBase@@QAE@XZ, _Create@CABDataSource@@SGJKPAPAUIABDataSource@@W4ESORTBYCOLUMN@@@Z, _Initialize@CContactElemBase@@QAEJXZ, _AddToList@CPartitionedGrouping@@UAEJKPAUIABDataSource@@AAVCABListItemArray@@@Z, _DetermineZeroContactsState@CContactElemBase@@MAE_AW4EZeroContactsElement@@_N@Z, _IsInOtherGroup@@YG_NPBUCONTACT@@@Z, __0CFilteredGrouping@@QAE@IIP6G_NPBUCONTACT@@@Z111@Z, _IsContactNotSomeBuddy@@YG_NPBUCONTACT@@@Z, __0CWordWheelGrouping@@QAE@I@Z, _IsWordWheelInUse@CContactElemBase@@QAE_NXZ, _SetGroupViewToSettings@CContactElemBase@@IAEXK@Z, _GetGroupViewFromSettings@CContactElemBase@@IAEHXZ, _Register@CContactElemBase@@SGJXZ, _EnsureView@CWordWheelElement@@QAEJW4eWordWheelView@@@Z, _Exec@CContactElemBase@@UAGJPBU_GUID@@KKPAUtagVARIANT@@1@Z, __0CBuddyListElement@@QAE@XZ, _OnInput@CBuddyListElementBase@@UAEXPAUInputEvent@DirectUI@@@Z, _OnDestroy@CBuddyListElementBase@@UAEXXZ, _OnEvent@CBuddyListElementBase@@UAEXPAUEvent@DirectUI@@@Z, _OnHosted@CBuddyListElementBase@@UAEXPAVElement@DirectUI@@@Z, _OnUnHosted@CBuddyListElementBase@@UAEXPAVElement@DirectUI@@@Z, _Initialize@CBuddyListElementBase@@UAEJXZ, _ClearSelection@CBuddyListElementBase@@UAEXXZ, _IsWordWheelUpdateEnabled@CBuddyListElementBase@@UAE_NXZ, _IsWordWheelFilteringEnabled@CBuddyListElement@@UAE_NXZ, _IsContactBuddy@@YG_NPBUCONTACT@@@Z, _SetFocusOnItem@CBuddyListElementBase@@UAEJJ@Z, _CreateItemList@CBuddyListElementBase@@MAEJXZ, _OnVirtualListCreated@CBuddyListElementBase@@MAEJPAVCBuddyVirtualList@@@Z, _OnScrollBarsChanged@CBuddyListElementBase@@MAEXPAVElement@DirectUI@@@Z, _GetHandleInputValue@CBuddyListElementBase@@MAE_AW4EHandleInput@@XZ, _GetSelectionMode@CBuddyListElementBase@@MAE_AW4VirtualListSelectionMode@@XZ, _ExecCommit@CBuddyListElementBase@@MAEJXZ, _ExpandCollapseItem@CBuddyListElementBase@@MAEJPAUIListItem@@_N@Z, _OnPoolViewEvent@CBuddyListElementBase@@UAEXW4EEvent@IObjectPoolViewCallback@@PAUIObjectPoolView@@@Z, _OnBegin@CBuddyListElementBase@@UAEXXZ, _OnInsert@CBuddyListElementBase@@UAEXPAUIStoreObject@@@Z, _OnChange@CBuddyListElementBase@@UAEXPAUIStoreObject@@PAUIObjectChangeDescription@@@Z, _OnDelete@CBuddyListElementBase@@UAEXPAUIStoreObject@@@Z, _OnEnd@CBuddyListElementBase@@UAEXXZ, _GetDataSource@CBuddyListElementBase@@UAEJPAPAUIUnknown@@@Z, _SetDataSource@CBuddyListElementBase@@UAEJPAUIUnknown@@@Z, _GetSelection@CBuddyListElementBase@@UAEJPAPAUIUnknown@@@Z, _SetSelection@CBuddyListElementBase@@UAEJPAUIUnknown@@@Z, _AffectParticipant@CBuddyListElementBase@@UAEJPAUIParticipant@@W4ParticipantModificationOperation@@@Z, _AffectParticipant@CBuddyListElementBase@@UAEJABUPARTICIPANT@@W4ParticipantModificationOperation@@@Z, _GetSelectionChangeCallback@CBuddyListElementBase@@UAEJPAPAUIParticipantSelectionControl@Contacts@@@Z, _SetSelectionChangeCallback@CBuddyListElementBase@@UAEJPAUIParticipantSelectionControl@Contacts@@@Z, _OnTimer@CBuddyListElementBase@@UAEXIKK@Z, _GetTimerHwndElement@CBuddyListElementBase@@UAEPAVHWNDElement@DirectUI@@XZ, __1CBuddyListElement@@UAE@XZ, _OnCanDrop@CBuddyListElement@@MAEXPAUQueryDropEvent@@@Z, _Class@CBuddyListElement@@2PAUIClassInfo@DirectUI@@A, _Register@CBuddyListElement@@SGJXZ, _OnHosted@CListItemElement@@UAEXPAVElement@DirectUI@@@Z
> SETUPAPI.dll: SetupIterateCabinetW
> CRYPTNET.dll: CryptRetrieveObjectByUrlW
> Secur32.dll: FreeContextBuffer, FreeCredentialsHandle, InitSecurityInterfaceW, DeleteSecurityContext

( 0 exports )
CWSandbox info: http://research.sunbelt-software.com/... Antivirus Version Dernière mise à jour Résultat a-squared 4.0.0.93 2009.02.10 - AhnLab-V3 5.0.0.2 2009.02.10 - AntiVir 7.9.0.76 2009.02.10 - Authentium 5.1.0.4 2009.02.10 - Avast 4.8.1335.0 2009.02.10 - AVG 8.0.0.229 2009.02.10 - BitDefender 7.2 2009.02.11 - CAT-QuickHeal 10.00 2009.02.10 - ClamAV 0.94.1 2009.02.10 - Comodo 973 2009.02.10 - DrWeb 4.44.0.09170 2009.02.11 - eSafe 7.0.17.0 2009.02.09 - eTrust-Vet 31.6.6348 2009.02.10 - F-Prot 4.4.4.56 2009.02.10 - F-Secure 8.0.14470.0 2009.02.10 - Fortinet 3.117.0.0 2009.02.11 - GData 19 2009.02.11 - Ikarus T3.1.1.45.0 2009.02.10 - K7AntiVirus 7.10.626 2009.02.10 - Kaspersky 7.0.0.125 2009.02.11 - McAfee 5522 2009.02.10 - McAfee+Artemis 5522 2009.02.10 - Microsoft 1.4306 2009.02.10 - NOD32 3843 2009.02.10 - Norman 6.00.02 2009.02.09 - nProtect 2009.1.8.0 2009.02.10 - Panda 10.0.0.10 2009.02.10 - PCTools 4.4.2.0 2009.02.10 - Prevx1 V2 2009.02.11 - Rising 21.16.12.00 2009.02.10 - SecureWeb-Gateway 6.7.6 2009.02.10 - Sophos 4.38.0 2009.02.10 - Sunbelt 3.2.1851.2 2009.02.10 - Symantec 10 2009.02.11 - TheHacker 6.3.1.5.252 2009.02.11 - TrendMicro 8.700.0.1004 2009.02.10 - VBA32 3.12.8.12 2009.02.10 - ViRobot 2009.2.10.1599 2009.02.10 - VirusBuster 4.5.11.0 2009.02.10 - Information additionnelle File size: 5674352 bytes MD5...: a7efc7ea7ef6fb022a8a95813edcbe5d SHA1..: 3a61f9696cc34fd4863f07c9aa70e54621bb4c77 SHA256: 98247c844f9d9c165787f830e5c8850046565d3775833334987dad7377843005 SHA512: 5ec5bcb26e0921d1aa20cfef9384a08c91ae36a28b6ba2afd28a6b01ece40dd6
e5ad39a51a1deabc3c35a6878be06a5e21f7dce5dae14f25db91b07bc25c4ef5
ssdeep: 49152:+nRgOM5CKhm4W1nf5IWbDmGdq0HSHnBY2lWtoK/r3uoWfKrPR5Z4a+v3Xk
9SEBoz:+nRNMBO1f1bilESicQTr2KzR8apVCD
PEiD..: - TrID..: File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1708ed
timedatestamp.....: 0x45b12d6a (Fri Jan 19 20:43:22 2007)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x4b1029 0x4b1200 6.32 8d3146f757440806d5803f1d0d94b2b7
.data 0x4b3000 0x88824 0x87e00 5.05 08b16b3222aaf04e0a2d978fd1d8fa4c
.rsrc 0x53c000 0x2db10 0x2dc00 4.88 ee608aaa6b1f77f4951050802ea41f10

( 28 imports )
> MSVCR80.dll: __3@YAXPAX@Z, ___V@YAXPAX@Z, memcpy_s, _CxxThrowException, memmove_s, wcschr, rand, _wcsdup, ceil, _wtol, memmove, free, isxdigit, isalpha, isdigit, realloc, atol, _difftime64, _wcsupr_s, floor, _callnewh, _amsg_exit, __getmainargs, _cexit, _exit, _XcptFilter, _ismbblead, _acmdln, _initterm, _initterm_e, _configthreadlocale, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, _encode_pointer, __set_app_type, _terminate@@YAXXZ, _except_handler4_common, _unlock, __dllonexit, _lock, _onexit, _decode_pointer, _invoke_watson, _controlfp_s, __type_info_dtor_internal_method@type_info@@QAEXXZ, _crt_debugger_hook, tolower, wcspbrk, _wgetenv, wcstol, wcsncpy_s, strtoul, _mbsrchr, _mbsupr_s, _ismbcspace, _mbsinc, _wfullpath, _gmtime64_s, _aligned_malloc, _aligned_free, _scwprintf, wcsncmp, towupper, srand, atoi, _mbschr, _stricmp, _wcsrev, wcsftime, isspace, _purecall, malloc, __CxxFrameHandler3, memset, memchr, _wcsicmp, wcsrchr, _wcslwr_s, calloc, _recalloc, _resetstkoflw, memcpy, _mktime64, _localtime64_s, _time64, wcsstr, _beginthreadex, _vscwprintf, _strnicmp, wprintf, vswprintf_s, _mbscmp, wcsspn, strtol, _wcstoui64, wcscpy_s, _strnicoll, _strrev, strncmp, _mbspbrk, _localtime64, wcstoul, __RTDynamicCast, qsort, _mbscspn, _mbsspn, _wcsncoll, iswdigit, iswalpha, _set_purecall_handler, _wcsnicmp, exit, _vsnwprintf, qsort_s, _mbsstr, fopen, fprintf, fclose, _vsnprintf, strstr, strrchr, _wcsnicoll, _wtoi, _strlwr, vsprintf_s, _vscprintf, _mbsicmp, swprintf_s, iswspace, strchr, _ltoa, wcscspn, _mbslwr_s
> ADVAPI32.dll: CryptAcquireContextW, ConvertStringSecurityDescriptorToSecurityDescriptorW, TraceEvent, RegCloseKey, CryptGenRandom, RegEnumKeyExW, RegCreateKeyExW, RegOpenKeyExW, RegDeleteValueW, CryptDecrypt, CryptEncrypt, CryptDeriveKey, CryptDestroyKey, OpenSCManagerW, OpenServiceW, CloseServiceHandle, QueryServiceStatusEx, CryptGetHashParam, CryptHashData, RegQueryValueExW, CryptCreateHash, CryptDestroyHash, CryptReleaseContext, ImpersonateSelf, RegSetValueExW, GetTraceEnableFlags, GetTraceEnableLevel, OpenThreadToken, OpenProcessToken, InitializeSecurityDescriptor, GetLengthSid, InitializeAcl, AddAccessAllowedAce, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, FreeSid, CheckTokenMembership, MakeAbsoluteSD, SetSecurityDescriptorDacl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, IsValidSecurityDescriptor, CryptImportKey, CryptSetHashParam, RegEnumKeyA, RegEnumValueA, RegQueryInfoKeyW, RegDeleteValueA, RegQueryValueExA, RegSetValueExA, RegCreateKeyExA, RegOpenKeyExA, AccessCheck, RevertToSelf, RegDeleteKeyA, AllocateAndInitializeSid
> KERNEL32.dll: VirtualAlloc, VirtualFree, IsProcessorFeaturePresent, GetThreadLocale, GetLocaleInfoA, HeapSize, HeapDestroy, AddAtomW, SetThreadPriority, CreateToolhelp32Snapshot, Process32First, Process32Next, lstrcpynA, GetLocaleInfoW, GetACP, GetSystemDefaultLCID, FormatMessageA, GetVolumeInformationW, FileTimeToLocalFileTime, GetVersionExW, SetErrorMode, GetUserDefaultLCID, CreateMutexA, OpenEventA, GetProcessTimes, GetSystemInfo, GetWindowsDirectoryW, GetUserDefaultUILanguage, QueryDepthSList, InterlockedFlushSList, InitializeSListHead, InterlockedPushEntrySList, InterlockedPopEntrySList, GetTempFileNameW, GetCurrentThread, QueueUserWorkItem, CompareStringA, GetSystemTimeAsFileTime, SetFileTime, FindFirstFileA, MoveFileExA, GetFullPathNameW, GetTimeZoneInformation, lstrcpyW, WaitForMultipleObjects, GetOverlappedResult, CancelIo, ReadDirectoryChangesW, SetEndOfFile, RemoveDirectoryW, SystemTimeToTzSpecificLocalTime, GetFileAttributesExW, FindFirstFileExW, FindNextFileW, FreeResource, FindAtomW, InterlockedCompareExchange, SystemTimeToFileTime, FindFirstFileW, FindClose, TerminateProcess, SetFilePointer, SetProcessWorkingSetSize, SetCurrentDirectoryW, GetModuleFileNameA, GetDiskFreeSpaceExW, CompareStringW, OpenFileMappingW, MapViewOfFileEx, LoadLibraryExW, CopyFileW, CreateFileMappingW, CreateMutexW, DuplicateHandle, GetCurrentProcessId, ReleaseMutex, GetVersionExA, CreateEventA, GetCommandLineA, GetModuleHandleA, GlobalMemoryStatus, ExitProcess, CreateFileMappingA, OpenFileMappingA, MapViewOfFile, UnmapViewOfFile, ExpandEnvironmentStringsA, DeleteFileA, GetSystemDirectoryW, LoadLibraryW, ExpandEnvironmentStringsW, GetStartupInfoA, lstrcmpiA, lstrcmpA, ReadFile, RtlMoveMemory, MoveFileW, MoveFileExW, GetProcAddress, GetSystemTime, FileTimeToSystemTime, GetDateFormatW, GetTimeFormatW, GetLocalTime, FreeLibrary, GetTempPathW, GlobalFree, TlsGetValue, GetSystemDirectoryA, LoadLibraryA, GetModuleFileNameW, lstrlenA, Sleep, CreateThread, GetModuleHandleW, LocalAlloc, ResumeThread, GetExitCodeThread, TerminateThread, SetEvent, ResetEvent, CreateEventW, CreateProcessW, WaitForSingleObject, GetExitCodeProcess, CompareFileTime, SetThreadExecutionState, InterlockedDecrement, InterlockedIncrement, HeapReAlloc, HeapAlloc, GetProcessHeap, HeapFree, CreateDirectoryW, SetLastError, GetCurrentProcess, FlushInstructionCache, RaiseException, GetTickCount, GetFileAttributesW, SetFileAttributesW, DeleteFileW, GetShortPathNameW, GlobalAlloc, GlobalLock, GlobalSize, GlobalUnlock, lstrcmpW, lstrcpynW, lstrcmpiW, lstrlenW, MulDiv, GetFileSize, InterlockedExchange, WideCharToMultiByte, FlushFileBuffers, WriteFile, CreateFileW, FormatMessageW, MultiByteToWideChar, CloseHandle, GetLastError, LocalFree, GetCurrentThreadId, FindResourceExW, FindResourceW, LoadResource, LockResource, SizeofResource, DeleteCriticalSection, InitializeCriticalSection, LeaveCriticalSection, EnterCriticalSection, GetStringTypeExA, IsDBCSLeadByteEx, lstrcatA, lstrcpyA, SetCurrentDirectoryA, GetCurrentDirectoryA, GetPrivateProfileIntA, GetDriveTypeW, GetLogicalDriveStringsW, IsWow64Process, QueryPerformanceCounter, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, OpenMutexW, DebugBreak, LoadLibraryExA, VirtualQuery, VirtualProtect, GetThreadContext, SetThreadContext, SuspendThread, GetCurrentDirectoryW
> GDI32.dll: GetDIBits, SetBitmapBits, SetPixel, EnumFontFamiliesExW, CreateRectRgn, OffsetViewportOrgEx, SetDIBColorTable, SetLayout, GetRgnBox, SetStretchBltMode,

loloetseb · Answer

Télécharge Malwarebytes’ Anti-Malware 

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/ 

- Sur la page cliques sur Télécharger Malwarebyte’s Anti-Malware 
- Enregistres le sur le bureau 
- Double cliques sur le fichier téléchargé pour lancer le processus d’installation 
- Lorsqu’il te le sera demandé, met à jour Malwarebytes anti malware 
- Si le pare-feu demande l’autorisation de se connecter pour malwarebytes, acceptes 
- Une fois la mise à jour terminée, ferme Malwarebytes 
- Double-cliques sur l’icône de malwarebytes pour le relancer 
- Dans l’onglet, Recherche, probablement ouvert par défaut, 
- Sélectionne Exécuter un examen complet 
- Clique sur Rechercher 
- Le scan démarre 
- A la fin de l’analyse, un message s’affiche : L’examen s’est terminé normalement. Cliquez sur ‘Afficher les résultats’ pour afficher tous les objets trouvés. 
- Cliques sur Ok pour poursuivre. 
- Si des malwares ont été détectés, cliques sur Afficher les résultats 
- Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine. 
- Malwarebytes va ouvrir le bloc-notes et y copier le rapport d’analyse. 
- Rends toi dans l’onglet rapport/log 
- Tu cliques dessus pour l’afficher une fois affiché 
- Tu cliques sur édition en haut du bloc notes, et puis sur sélectionner tout 
- Tu recliques sur édition et puis sur copier et tu reviens sur le forum et dans ta réponse 
- Tu cliques droit dans le cadre de la réponse et coller 

Si tu as besoin d’aide regarde ce tutorial 

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

thely10 · Answer

bonsoir et au secours j'ai le meme probleme avec tradedaubler et j'en peus plus je ne peux meme plus me servir de mon pc car j'ei 10 message a la seconde parfaois.
J'ai fait comme il a ete explique plus hautr et voila ce qui en ressort.Merci de m'aider car je n'y connais rien en info.Merci merci merci


Logfile of random's system information tool 1.05 (written by random/random)
Run by thely at 2009-02-22 19:32:54
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 89 GB (75%) free of 118 GB
Total RAM: 1023 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:33:48, on 22/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\MySecurityCenter\Programs\service.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32undll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\wlcsdk.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings	hely\Local Settings\Temporary Internet Files\Content.IE5\QUUOTBQB\RSIT[1].exe
C:\Program Files	rend micro	hely.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.neuf.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww17.ads.eorezo.com/cgi-bin/advert/getads.cgi?x_format=redirect&x_dp_id=9
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = France Télécom Câble
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\pmnkLbCt.dll (file missing)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7DCA92E4-E4A6-4AAE-B9F7-D822F4B0600B} - C:\WINDOWS\system32	uvuuvWq.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [b8a42c3e] rundll32.exe "C:\WINDOWS\system32\qidnrwlu.dll",b
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [setc] C:\Program Files\MySecurityCenter\Programs\setc.exe
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Golden Riviera - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\goldenrivieraMPP\MPPoker.exe (file missing) (HKCU)
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings	hely\Menu Démarrer\Programmes\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings	hely\Menu Démarrer\Programmes\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fdivertissement%2fcelebrites%2fgalery%2fwentworth02.jpg%3f
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader5.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097743015284
O16 - DPF: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} (Image Uploader) - http://www.extrafilm.fr/ImageUploader4.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {DAF94F73-2AA6-44D8-A562-A28831820D34} (Pixum EasyUploadX Control) - http://www.pixum.de/int/EasyUpload/ImgUploader.cab
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - https://www.photostation.fr/?404;http://www.photostation.fr:80/aurigma/ImageUploader4.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://casinofrancenet.microgaming.com/casinofrancenet/FlashAX2.cab
O20 - Winlogon Notify: pmnkLbCt - pmnkLbCt.dll (file missing)
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MySecurityCenter License Service - Unknown owner - C:\Program Files\MySecurityCenter\Programs\service.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

kevin05 · Answer

Salut crée ton propre topic stp 

Merci 

++

kevin05 · Answer

Ok !

Un topic c'est là  ou t'ecris en ce moment crée le tien !

Trojan Horse - Tradedaubler.com???

27 réponses

Votre réponse

Discussions similaires

Newsletters