Trojan win32 vundo.gen!BC Fermé

Question

Bonjour,

Voila depuis quelque temps mon pc portable subit quelques désagrements

Après avoir effectué un cc cleaner (avec verificaion du registre) plus un malwarebytes et un spybot windows me detecte toujours un

Trojan win32 vundo.gen!BC ainsi que 4 autres fichiers

C:\windows\sytem32\selutanu.dll
C:\windows\system32\miwovila.dll
C:\windows\system32\jutofeke.dll
C:\programdata\herutoho\herutoho.dll

Le pc va mieux que avant après avoir fait les premieres manip avec cc cleaner et les autres, néanmoins je ne suis toujours pas rassuré avec la présence de ce trojan

Le démarrage du pc reste toujours long et beaucoup de boite de dialogue s'ouvre indiquant que des emplacements dll sont manquants

Donc si une bonne ame pouvair venir à mon secours ca seraiT super cool !!

Bonne journée

Nicolas

jlpjlp · Answer

slt,

Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

shaiko · Answer

Salut jlpjlp,

merci de venir m'aider, c'est cool

Voici le rapport log

Logfile of random's system information tool 1.06 (written by random/random)
Run by LOULOU at 2009-04-08 13:23:03
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 21 GB (12%) free of 180 GB
Total RAM: 2046 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:23:25 PM, on 08/04/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\SYSTEM32	askeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32undll32.exe
C:\Windows\SYSTEM32	askeng.exe
C:\Windows\System32undll32.exe
C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\WordWeb\wweb32.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\explorer.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\LOULOU\Desktop\RSIT.exe
C:\Program Files	rend micro\LOULOU.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.repubblica.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {091dab19-a6bb-45cf-ad42-edcbcdd6d5c6} - C:\ProgramData\wimohigi\wimohigi.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {D0943516-5076-4020-A3B5-AEFAF26AB263} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [zaduyuwibe] Rundll32.exe "C:\ProgramData\fenozano\fenozano.dll",s
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Cognac] C:\Users\LOULOU\AppData\Local\Temp\~tmpa.exe
O4 - HKCU\..\Run: [zaduyuwibe] Rundll32.exe "C:\ProgramData\fenozano\fenozano.dll",s
O4 - HKCU\..\Run: [Diagnostic Manager] C:\Users\LOULOU\AppData\Local\Temp\2503048393.exe
O4 - HKCU\..\Run: [CPM21ecd6e6] Rundll32.exe "C:\ProgramData	iyunike	iyunike.dll",a
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [zaduyuwibe] Rundll32.exe "C:\Windows\system32\wisepale.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [] C:\Windows\TEMP\ydj6d.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] C:\Windows\TEMP\ydj6d.exe (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = LOULOU\AppData\Local\Temp\{69F91187-803B-416A-8B25-186FFB893E10}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix: 
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL C:\Windows\system32\vosorudi.dll C:\Windows\system32\wisepale.dll c:\PROGRA~2	iyunike	iyunike.dll,C:\Windows\system32\miwovima.dll,C:\Windows\system32\jutofeke.dll,C:\Windows\system32\selutanu.dll,C:\ProgramData\herutoho\herutoho.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Service CANALPLAY - Canal+ Active - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\stacsv.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

shaiko · Answer

tu es toujours la jlpjlp ??

jlpjlp · Answer

vire ces tachs plannifiées qui entraine les reinfections de ton ordi 

 en allant dans poste de travail puis

C:\Windows	asks\At1.job
C:\Windows	asks\At10.job
C:\Windows	asks\At11.job
C:\Windows	asks\At12.job
C:\Windows	asks\At13.job
C:\Windows	asks\At14.job
C:\Windows	asks\At15.job
C:\Windows	asks\At16.job
C:\Windows	asks\At17.job
C:\Windows	asks\At18.job
C:\Windows	asks\At19.job
C:\Windows	asks\At2.job
C:\Windows	asks\At20.job
C:\Windows	asks\At21.job
C:\Windows	asks\At22.job
C:\Windows	asks\At23.job
C:\Windows	asks\At24.job
C:\Windows	asks\At3.job
C:\Windows	asks\At4.job
C:\Windows	asks\At5.job
C:\Windows	asks\At6.job
C:\Windows	asks\At7.job
C:\Windows	asks\At8.job
C:\Windows	asks\At9.job


___________________________

colle un rapport avec malwarebyte (scan rapide)
__________________________

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

shaiko · Answer

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 1949
Windows 6.0.6001 Service Pack 1

08/04/2009 02:29:20 PM
mbam-log-2009-04-08 (14-29-20).txt

Type de recherche: Examen rapide
Eléments examinés: 63990
Temps écoulé: 3 minute(s), 27 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 7
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm21ecd6e6 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaduyuwibe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaduyuwibe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cognac (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diagnostic manager (Trojan.Downloader) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)


je redemarre comme conseillé par malwarevytes

a toute

shaiko · Answer

yo, combo fix detecte norton en activité mais je ne le trouve nulle part sur mon pc car je l'ai desinstallé il y a longtemps ...... je fais quoi ??

shaiko · Answer

tu es toujours la ?? je fais comment avec combi fix alors ? il detecte norton 360, mais je ne le trouve pourtant pas dans mon ordi et j'ai bien cherché

jlpjlp · Answer

vire les restes de norton
comme ceci

http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924




fais ensuite combofix

shaiko · Answer

désolé c'est tres long, combofix a terminé, mais ensuite au moment du redemarrage ya eu un ecran bleu flippant de windows, puis l'outil de reparation du systeme s'est mis en marche ...enfin la c'est bon il a redemarré bien, mais du coup je refais un combofix car du coup le rapport ne s'est pas affiché ..a toute

shaiko · Answer

l'écran bleu windows disait INVALID_KERNEL_HANDLE

shaiko · Answer

voici le rapport combofix ComboFix 09-04-04.01 - LOULOU 2009-04-08 17:03:13.1 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2046.1245 [GMT 2:00] Lancé depuis: c:\users\LOULOU\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((( Fichiers créés du 2009-03-08 au 2009-04-08 )))))))))))))))))))))))))))))))))))) . 2009-04-08 16:59 . 2009-04-08 17:09 308,852,947 --a------ c:\windows\MEMORY.DMP 2009-04-08 16:41 . 2009-04-08 16:41 d-------- c:\programdata\NortonInstaller 2009-04-08 13:23 . 2009-04-08 13:23 d-------- C:\rsit 2009-04-08 13:23 . 2009-04-08 13:23 d-------- c:\program files\trend micro 2009-04-08 09:11 . 2009-04-08 09:18 d-------- c:\programdata\tiyunike 2009-04-08 09:11 . 2009-04-08 13:09 d-------- c:\programdata\linanotu 2009-04-08 09:11 . 2009-04-08 16:40 d-------- c:\programdata\fubatuzo 2009-04-07 23:09 . 2008-06-20 03:14 781,344 --a------ c:\windows\System32\PresentationNative_v0300.dll 2009-04-07 23:09 . 2008-06-20 03:14 622,080 --a------ c:\windows\System32\icardagt.exe 2009-04-07 23:09 . 2008-06-20 03:14 326,160 --a------ c:\windows\System32\PresentationHost.exe 2009-04-07 23:09 . 2008-06-20 03:14 105,016 --a------ c:\windows\System32\PresentationCFFRasterizerNative_v0300.dll 2009-04-07 23:09 . 2008-06-20 03:14 97,800 --a------ c:\windows\System32\infocardapi.dll 2009-04-07 23:09 . 2008-06-20 03:14 43,544 --a------ c:\windows\System32\PresentationHostProxy.dll 2009-04-07 23:09 . 2008-06-20 03:14 37,384 --a------ c:\windows\System32\infocardcpl.cpl 2009-04-07 23:09 . 2008-06-20 03:14 11,264 --a------ c:\windows\System32\icardres.dll 2009-04-07 23:05 . 2009-04-07 23:05 0 --a------ c:\windows\RAVTC.TMP 2009-04-07 23:02 . 2008-07-27 20:03 282,112 --a------ c:\windows\System32\mscoree.dll 2009-04-07 23:02 . 2008-07-27 20:03 96,760 --a------ c:\windows\System32\dfshim.dll 2009-04-07 23:02 . 2008-07-27 20:03 41,984 --a------ c:\windows\System32\netfxperf.dll 2009-04-07 23:01 . 2008-07-27 20:03 158,720 --a------ c:\windows\System32\mscorier.dll 2009-04-07 23:01 . 2008-07-27 20:03 83,968 --a------ c:\windows\System32\mscories.dll 2009-04-07 22:58 . 2009-04-07 22:58 410,984 --a------ c:\windows\System32\deploytk.dll 2009-04-07 22:57 . 2009-04-07 22:57 0 --------- c:\windows\PAVSHRB.INI 2009-04-07 22:22 . 2009-04-07 22:22 d-------- c:\users\LOULOU\AppData\Roaming\Malwarebytes 2009-04-07 22:22 . 2009-04-07 22:22 d-------- c:\programdata\Malwarebytes 2009-04-07 22:22 . 2009-04-07 22:24 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-04-07 22:22 . 2009-04-06 15:32 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2009-04-07 22:22 . 2009-04-06 15:32 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2009-04-07 22:18 . 2009-04-07 22:18 28,320 --a------ c:\windows\System32\drivers\sifzbtej.sys 2009-04-06 16:25 . 2009-04-08 16:40 d-------- c:\programdata\toladeya 2009-04-05 17:58 . 2009-04-08 16:40 d-------- c:\programdata\goyipeme 2009-04-04 16:37 . 2009-04-08 16:40 d-------- c:\programdata\mofanedo 2009-04-03 14:02 . 2009-04-07 22:37 d-------- c:\programdata\wimohigi 2009-04-03 14:02 . 2009-04-08 13:06 d-------- c:\programdata\herutoho 2009-04-03 14:02 . 2009-04-07 22:37 d-------- c:\programdata\fenozano 2009-04-03 14:00 . 2009-04-07 22:36 d-------- c:\programdata\zulagovi 2009-04-03 14:00 . 2009-04-08 16:40 d-------- c:\programdata\yubiwojo 2009-04-03 14:00 . 2009-04-03 14:00 d-------- c:\programdata\niyihese 2009-04-03 14:00 . 2009-04-07 22:34 d-------- c:\programdata\govegomu 2009-04-03 00:14 . 2009-04-08 16:40 d-------- c:\programdata\nojibipu 2009-04-03 00:13 . 2009-04-07 00:00 d-------- c:\users\LOULOU\AppData\Roaming\skypePM 2009-04-03 00:13 . 2009-04-03 00:13 56 --ah----- c:\programdata\ezsidmv.dat 2009-04-03 00:12 . 2009-04-03 00:12 dr------- c:\program files\Skype 2009-04-03 00:12 . 2009-04-03 00:12 d-------- c:\program files\Common Files\Skype 2009-04-02 12:13 . 2009-04-02 12:13 d-------- c:\programdata\zotowuru 2009-04-02 12:13 . 2009-04-03 14:02 d-------- c:\programdata\yinuyoni 2009-04-02 12:13 . 2009-04-02 12:34 d-------- c:\programdata\retegefu 2009-04-02 12:13 . 2009-04-03 14:02 d-------- c:\programdata\hewalote 2009-04-02 12:13 . 2009-04-02 12:13 d-------- c:\programdata\delehele 2009-04-02 12:13 . 2009-04-02 12:13 d-------- c:\programdata\betakoso 2009-04-02 00:13 . 2009-04-08 16:40 d-------- c:\programdata\mevozeha 2009-04-02 00:13 . 2009-04-07 23:45 d-------- c:\programdata\feyiloto 2009-03-11 21:08 . 2009-03-11 21:08 d-------- c:\program files\GSC Game World 2009-03-11 21:06 . 2009-03-11 21:06 d-------- c:\users\LOULOU\AppData\Roaming\DAEMON Tools Pro 2009-03-11 21:06 . 2009-03-11 21:06 d-------- c:\programdata\DAEMON Tools Lite 2009-03-11 21:06 . 2009-03-11 21:06 d-------- c:\program files\DAEMON Tools Lite 2009-03-11 20:45 . 2009-03-11 21:06 d-------- c:\users\LOULOU\AppData\Roaming\DAEMON Tools Lite 2009-03-11 20:26 . 2009-03-11 20:26 d-------- c:\programdata\Roxio 2009-03-11 20:24 . 2009-03-11 20:26 d-------- c:\users\LOULOU\AppData\Roaming\Roxio 2009-03-11 19:13 . 2009-03-11 19:14 d-------- c:\users\LOULOU\AppData\Roaming\SPORE 2009-03-11 19:11 . 2009-03-11 19:11 dr-h----- c:\users\LOULOU\AppData\Roaming\SecuROM 2009-03-11 10:52 . 2008-12-16 05:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL 2009-03-11 10:52 . 2008-12-16 07:31 7,680 --a------ c:\windows\System32\spwmp.dll 2009-03-11 10:52 . 2008-12-16 07:31 4,096 --a------ c:\windows\System32\msdxm.ocx 2009-03-11 10:52 . 2008-12-16 07:31 4,096 --a------ c:\windows\System32\dxmasf.dll 2009-03-11 10:51 . 2009-02-09 05:10 2,033,152 --a------ c:\windows\System32\win32k.sys 2009-03-11 10:51 . 2008-11-27 06:43 268,288 --a------ c:\windows\System32\schannel.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-07 20:57 --------- d-----w c:\program files\Java 2009-04-07 20:48 --------- d-----w c:\programdata\Spybot - Search & Destroy 2009-04-07 20:47 --------- d-----w c:\program files\Spybot - Search & Destroy 2009-04-07 19:47 --------- d-----w c:\program files\CCleaner 2009-04-07 16:24 --------- d-----w c:\users\LOULOU\AppData\Roaming\uTorrent 2009-04-06 23:30 --------- d-----w c:\users\LOULOU\AppData\Roaming\Skype 2009-04-02 22:12 --------- d-----w c:\programdata\Skype 2009-03-31 21:59 223,934 ----a-w c:\users\LOULOU\AppData\Roaming\nvModes.dat 2009-03-23 15:42 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-21 11:52 --------- d-----w c:\program files\Metin2_France 2009-03-12 18:38 --------- d-----w c:\program files\Windows Mail 2009-03-11 19:06 --------- d-----w c:\users\LOULOU\AppData\Roaming\DAEMON Tools 2009-03-11 18:45 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2009-03-11 17:03 --------- d-----w c:\program files\Electronic Arts 2009-03-01 21:25 --------- d-----w c:\programdata\Electronic Arts 2009-02-24 13:21 --------- d-----w c:\users\LOULOU\AppData\Roaming\Atari 2009-02-24 13:17 --------- d-----w c:\users\LOULOU\AppData\Roaming\Leadertech 2009-02-24 13:06 --------- d-----w c:\program files\Atari 2009-02-23 21:28 --------- d-----w c:\program files\uTorrent 2009-02-19 01:59 --------- d-----w c:\program files\Google 2009-02-17 07:54 --------- d-----w c:\program files\DivX 2009-01-20 13:24 174 --sha-w c:\program files\desktop.ini 2008-06-01 21:35 5,682 ----a-w c:\users\LOULOU\AppData\Roaming\wklnhst.dat 2007-11-14 17:11 22,328 ----a-w c:\users\LOULOU\AppData\Roaming\PnkBstrK.sys 2008-11-16 22:35 122,880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll 2008-12-17 23:04 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-12-17 23:04 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-17 23:04 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-12-17 23:04 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-12-17 23:04 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll 2008-01-03 20:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-01-03 20:09 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-01-03 20:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint\Apoint.exe" [2007-06-10 118784] "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-06-11 317560] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-17 29744] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-07 148888] "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-06-28 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8429568] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576] c:\users\LOULOU\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-06-22 739880] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon] 2007-07-12 08:33 98304 c:\windows\System32\VESWinlogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.dvsd"= c:\program files\Common Files\Sony Shared\VideoLib\sonydv.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{EB7EE62E-514C-4ED2-96CC-E76742C6C8BA}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C6785C36-3B71-4EC6-8473-E9FD35A708F1}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{93C3FF1C-85CA-4F0A-A50F-F70534120517}"= Disabled:UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "{118CEEBF-6311-4A81-A47B-F47606B5CBD3}"= Disabled:TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "{316EA76B-B568-42EA-95F3-0109AB8EA870}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{88469EB4-4B06-4D20-B8A9-3BBA166C1D56}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{D9908554-A2C2-4B9F-804B-3517AF46D966}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{9BC30465-1180-4166-8D1F-0FCD7D1CC954}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{75D82640-B909-4A0C-BE49-42497CA673B2}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{5D5BEBCE-E214-4DE9-9EE1-4672F4D796F7}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{7A850012-1055-48BF-B522-6C74674AC924}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{D2B1522F-CCD4-40CB-9A1C-19B827A90265}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{1FB827CF-5D00-40E1-AC7C-985474FC750A}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{CCDDE7B3-5E87-4DAF-A244-DED7287CBE11}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{EC8E278D-4838-4EE3-93BA-CBC9A0BA8AE4}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "{AD8E3901-A158-4A3F-821F-C99754C2C917}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "{63F025D1-B60B-4B47-A5B0-54457738B9B3}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{EBB36171-16AE-4355-8300-3A54AD96903C}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{B4E0DFE4-F1BB-4061-A8D3-511C451FCDF3}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{5798E201-550D-4C36-93A9-53C4ABEB9803}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{EDB28EC4-15E9-4D6C-92E1-F765466E9CA7}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{5EDD7D17-E07C-4A2E-8DDA-474E11476220}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{C3FD154C-C680-41FA-9D4C-00AF5D60BFA9}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{6D36E7FF-2BCE-4E03-BF83-B6A0A33DC36E}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{638103A7-5F79-49D7-A800-106A79F5F714}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "{9DA55446-CE37-42F3-A3AB-EDC9AC58E37A}"= UDP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III "{2F1B791E-125E-4676-8BC9-C7376EF67D1C}"= TCP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III "TCP Query User{AB4DA13B-A8EE-490C-B94D-DBC893B12F39}c:\program files\azureus\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus "UDP Query User{4701FED6-0B75-4404-AD26-7F3F6C176596}c:\program files\azureus\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus "TCP Query User{FCF347F4-4850-4B6E-8378-7A9C5F8DAACE}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{403422EC-0B56-49BF-AFA9-AF5C39386842}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{7B231355-91EC-4DF4-9B01-B2E1CFDFF4E4}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule "UDP Query User{633F1F87-CA0A-49B3-8A22-26D809151477}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule "TCP Query User{6279BC70-B4A4-4A66-A19D-BCE7869E0E4E}c:\program files\team17\worms armageddon\wa.exe"= UDP:c:\program files\team17\worms armageddon\wa.exe:Worms Armageddon "UDP Query User{00F48F3C-6725-4589-B9EC-01832517A27C}c:\program files\team17\worms armageddon\wa.exe"= TCP:c:\program files\team17\worms armageddon\wa.exe:Worms Armageddon "TCP Query User{A61540CE-73E1-43CB-9DEC-BA9F868EB181}c:\program files\team17\worms 2\frontend.exe"= UDP:c:\program files\team17\worms 2\frontend.exe:Worms 2 Frontend "UDP Query User{5A5194CB-D36F-417A-83E6-EA53C2CB85B6}c:\program files\team17\worms 2\frontend.exe"= TCP:c:\program files\team17\worms 2\frontend.exe:Worms 2 Frontend "TCP Query User{7F40AA1D-A37D-4098-88EB-EFD8F2BBE1EF}c:\program files\azureus\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus "UDP Query User{F7EB5A9D-8A39-4B20-A5E0-688CAB44C1F9}c:\program files\azureus\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus "TCP Query User{A53B07B8-5311-41E0-A0EF-E42877139A20}c:\program files\quake iii arena\quake3.exe"= UDP:c:\program files\quake iii arena\quake3.exe:quake3 "UDP Query User{E25A91CF-7720-4220-A0DB-1B8A9B16139B}c:\program files\quake iii arena\quake3.exe"= TCP:c:\program files\quake iii arena\quake3.exe:quake3 "{6A7A8727-9C46-4363-B2BC-F04B393E9746}"= UDP:54178:Azureus 54178 TCP "{EA6E3AF1-15DC-4C8A-B2CB-FBABBBF4B571}"= TCP:54178:Azureus 54178 UDP "TCP Query User{A2D16300-ED91-487C-9D67-9013488E805B}c:\program files\quake iii arena\quake3.exe"= UDP:c:\program files\quake iii arena\quake3.exe:quake3 "UDP Query User{14B3F83F-7556-44E2-85DE-CF36694C972D}c:\program files\quake iii arena\quake3.exe"= TCP:c:\program files\quake iii arena\quake3.exe:quake3 "TCP Query User{19216D63-D30C-43D2-9746-D6C518AF2AF1}c:\users\loulou\downloads\team 17\wa\[pc game] worms armageddon + all weapons unblocked + cracked + xp patch by lupen[fumai]\wormsarm\wa.exe"= UDP:c:\users\loulou\downloads\team 17\wa\[pc game] worms armageddon + all weapons unblocked + cracked + xp patch by lupen[fumai]\wormsarm\wa.exe:wa.exe "UDP Query User{0961AA07-7C08-428F-9060-78801F99F16E}c:\users\loulou\downloads\team 17\wa\[pc game] worms armageddon + all weapons unblocked + cracked + xp patch by lupen[fumai]\wormsarm\wa.exe"= TCP:c:\users\loulou\downloads\team 17\wa\[pc game] worms armageddon + all weapons unblocked + cracked + xp patch by lupen[fumai]\wormsarm\wa.exe:wa.exe "TCP Query User{62357B01-BF68-4238-95A6-51339425AFBD}c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe"= UDP:c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe:start.exe "UDP Query User{CF0B450E-B97B-4F13-ACCB-284A9D947B5B}c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe"= TCP:c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe:start.exe "TCP Query User{268C976C-DD0C-4C07-9D9E-3DCBA3A89798}c:\windows\system32\dplaysvr.exe"= UDP:c:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay "UDP Query User{86F58307-0F6D-432A-9B6E-63F4BAD95F7F}c:\windows\system32\dplaysvr.exe"= TCP:c:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay "TCP Query User{E6BCEB50-C2BB-4430-8607-40DC8C60425B}c:\program files\konami\pro evolution soccer 6\pes6.exe"= UDP:c:\program files\konami\pro evolution soccer 6\pes6.exe:pes6.exe "UDP Query User{B3423FC6-4B47-4B69-A9AB-8ED5ACC1461E}c:\program files\konami\pro evolution soccer 6\pes6.exe"= TCP:c:\program files\konami\pro evolution soccer 6\pes6.exe:pes6.exe "TCP Query User{F2DE20D8-445E-49EE-8E1A-6E231E227523}c:\program files\veoh networks\veoh\veohclient.exe"= UDP:c:\program files\veoh networks\veoh\veohclient.exe:Veoh Client "UDP Query User{C6CE2BEB-45DB-485E-AB8D-E8797F673ABF}c:\program files\veoh networks\veoh\veohclient.exe"= TCP:c:\program files\veoh networks\veoh\veohclient.exe:Veoh Client "{B3DF7D74-8051-4962-9744-01FE9583D90F}"= UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "{E61208E1-7405-470E-9BBC-E0F0917C0A09}"= TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "TCP Query User{B73D7D1E-F16B-4E4D-89DE-5F53DC65ABBC}c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe"= UDP:c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe:start.exe "UDP Query User{3736A79C-E40B-47FA-A4DE-BA0D9F62FC3B}c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe"= TCP:c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe:start.exe "TCP Query User{AFBDCDAC-AF9B-49E3-B7BA-2BB93701C6A5}c:\program files\lionhead studios ltd\black & white\runblack.exe"= UDP:c:\program files\lionhead studios ltd\black & white\runblack.exe:lh "UDP Query User{0A85C32D-3C81-4A45-B95F-D29B42823984}c:\program files\lionhead studios ltd\black & white\runblack.exe"= TCP:c:\program files\lionhead studios ltd\black & white\runblack.exe:lh "{8256E9E7-A9E5-46DE-AC62-79E4D0C23F6A}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{C10322C9-CDDA-4817-B67C-DD28B639CE65}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{D746BEDF-95CD-404E-844D-7BF0D0846D3D}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{A6ED5F3F-54EC-485D-A961-D89D55A8AD9D}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{29485F5D-2DFC-4AF6-981C-A75A77A5A930}"= UDP:86:BroadCam Web Server "TCP Query User{01CE8517-2F48-4C6A-80C6-C9A2C6F14080}c:\program files\konami\pro evolution soccer 2009\pes2009.exe"= UDP:c:\program files\konami\pro evolution soccer 2009\pes2009.exe:Pro Evolution Soccer 2009 "UDP Query User{71186C0B-7559-4592-BB18-F1D5A7AF7290}c:\program files\konami\pro evolution soccer 2009\pes2009.exe"= TCP:c:\program files\konami\pro evolution soccer 2009\pes2009.exe:Pro Evolution Soccer 2009 "TCP Query User{796B2BA3-88EC-4BA9-AF28-B9C4B83C50A1}c:\program files\activision\call of duty - world at war\codwaw.exe"= UDP:c:\program files\activision\call of duty - world at war\codwaw.exe:Call of Duty(R): World at War Campaign/Coop "UDP Query User{5D1DBAD9-01F0-40FB-AEFD-5F98F99719E8}c:\program files\activision\call of duty - world at war\codwaw.exe"= TCP:c:\program files\activision\call of duty - world at war\codwaw.exe:Call of Duty(R): World at War Campaign/Coop "{2B832080-D4C4-48F2-93F5-F2F6F3201887}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{B189AA1A-FDC7-4A67-80BF-374CF7DAC4D3}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "TCP Query User{03E9CCCC-2B08-4569-A462-1F9BC21107D5}c:\users\loulou\desktop\utorrent(3).exe"= UDP:c:\users\loulou\desktop\utorrent(3).exe:utorrent(3).exe "UDP Query User{267DCBB3-0FBD-45D4-B535-5A0EC136488A}c:\users\loulou\desktop\utorrent(3).exe"= TCP:c:\users\loulou\desktop\utorrent(3).exe:utorrent(3).exe "{4985F146-DD4A-47C1-A756-53184DCAD5D8}"= UDP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe:Burnout(TM) Paradise The Ultimate Box "{93CE50F5-6604-454E-B759-8B05F33DB9EF}"= TCP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe:Burnout(TM) Paradise The Ultimate Box "{F20BECCB-339D-48F3-8503-CDC08787DD26}"= UDP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe:Burnout(TM) Paradise The Ultimate Box "{46C1667B-342F-4E29-B901-6DF0B5C6EEDC}"= TCP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe:Burnout(TM) Paradise The Ultimate Box "{FB9FA2DF-6440-4CB7-8934-29242926DA81}"= UDP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe:Burnout(TM) Paradise The Ultimate Box "{3CF15280-DC5B-4969-9AB0-2000057AD22D}"= TCP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe:Burnout(TM) Paradise The Ultimate Box "TCP Query User{95C8A65C-DEE4-4B84-BB11-3FF9E68C5581}c:\users\loulou\desktop\utorrent(3).exe"= UDP:c:\users\loulou\desktop\utorrent(3).exe:utorrent(3).exe "UDP Query User{45963564-7CA4-4DD1-8B54-A006626DDE0C}c:\users\loulou\desktop\utorrent(3).exe"= TCP:c:\users\loulou\desktop\utorrent(3).exe:utorrent(3).exe "TCP Query User{1D193859-A5F3-4231-B897-27832AB422EC}c:\program files\metin2_france\metin2.bin"= UDP:c:\program files\metin2_france\metin2.bin:metin2.bin "UDP Query User{CFA81A6E-E4CD-421F-B3E9-99936B898C23}c:\program files\metin2_france\metin2.bin"= TCP:c:\program files\metin2_france\metin2.bin:metin2.bin "{6807E4D8-EFB9-4E6C-BD3B-8AA6FBA92E51}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{EAB1B2B1-34AE-4D29-8678-41D8F0F44B8F}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{E063BF09-18B0-49F6-9CF0-7F951E3350CA}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{C057C0CD-CE79-4393-9F0C-CD2CED382692}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{975380A9-50EE-4224-AD8D-6B2B4D7B8D98}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{E862D3AF-578E-4771-AE1F-644932B31423}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{2DB3449F-5FB7-432E-9F2E-BCEBEBD75BA5}"= UDP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{B6C1FA57-A689-40E6-8705-C0D79BCF6A6A}"= UDP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{6E583829-3301-4128-847E-851E2B2DA779}"= TCP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{5FF42E84-A5F2-4E0D-B045-EE087F8AD603}"= TCP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{EEC57245-2497-497D-A186-DF4608AAD21B}"= UDP:c:\windows\System32\5wW42d14.exe:5wW42d14 "{83151526-3DF1-4D49-913E-437D125787EE}"= TCP:c:\windows\System32\5wW42d14.exe:5wW42d14 "{805B1508-F998-4396-BD33-E739D6C125A4}"= UDP:c:\windows\System32\wbem\WmiPrvSE.exe:wmiprvse "{914AE9F4-9D1F-4F89-A8F8-5E17A1AB727E}"= TCP:c:\windows\System32\wbem\WmiPrvSE.exe:wmiprvse "{5C67F97D-6A98-426E-B1B1-85316B635131}"= UDP:c:\windows\System32\wbem\WmiPrvSE.exe:wmiprvse "{4168A88D-1452-47B4-BE79-DFC5C24395C9}"= TCP:c:\windows\System32\wbem\WmiPrvSE.exe:wmiprvse "{D8682D4D-DEBC-4C2F-951F-16F499D342C0}"= c:\program files\Skype\Phone\Skype.exe:Skype "{4557A85A-2066-46C9-A0BA-FA95E2CEEE7D}"= UDP:c:\program files\Sony\VAIO Event Service\VESMgr.exe:VESMgr "{6EE2652E-5AE9-40F2-AE99-4604845C1472}"= TCP:c:\program files\Sony\VAIO Event Service\VESMgr.exe:VESMgr "{34F41E8F-390E-4950-8418-AD4623CAEDF8}"= UDP:c:\program files\Sony\VAIO Power Management\SPMgr.exe:SPMgr "{82061BCF-225E-4552-B1AA-2135D1936CEC}"= TCP:c:\program files\Sony\VAIO Power Management\SPMgr.exe:SPMgr "{2D586C79-B7EE-4711-996E-FD2FF878FBD5}"= UDP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{CE459480-564C-4F02-8A4F-9D16E42E4B8B}"= TCP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{F6D32E9E-3533-45ED-850B-C386B37F0667}"= UDP:c:\program files\Panda Security\Panda Antivirus 2008\PsCtrlS.exe:PsCtrls "{7048C1B2-FD0C-4C89-93F3-D38ADBCCD58C}"= TCP:c:\program files\Panda Security\Panda Antivirus 2008\PsCtrlS.exe:PsCtrls "{643B49A4-60C5-440C-9A5F-1262119FBDD8}"= UDP:c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe:iviRegMgr "{F7DAF92E-3101-4D98-981E-94298B60124D}"= TCP:c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe:iviRegMgr "{F1BCBA2E-7F56-4205-B1C5-D4DB675C6F18}"= UDP:c:\program files\Panda Security\Panda Antivirus 2008\AVENGINE.EXE:AVENGINE "{CFC00A38-4EE1-4FBB-A0AA-CC6E1245E986}"= TCP:c:\program files\Panda Security\Panda Antivirus 2008\AVENGINE.EXE:AVENGINE "{C485B050-BD6B-470F-9503-884A993D6265}"= UDP:c:\windows\System32\taskeng.exe:taskeng "{ECDBF387-3AB2-4279-B2E7-C2FF9999558F}"= TCP:c:\windows\System32\taskeng.exe:taskeng "{ADE092F2-A599-47CA-86AF-4A6E999B4B40}"= UDP:c:\windows\System32\winlogon.exe:winlogon "{A1B71AE8-6618-40D2-91C7-6A615A89E954}"= TCP:c:\windows\System32\winlogon.exe:winlogon "{0FA21FA3-E919-48AC-A599-BC5ABBCD5483}"= UDP:c:\program files\Common Files\Panda Software\PavShld\PavPrSrv.exe:pavprsrv "{527FD804-8D67-4D25-8653-4865F8BCFB6B}"= TCP:c:\program files\Common Files\Panda Software\PavShld\PavPrSrv.exe:pavprsrv "{75BDDC4F-8419-4935-80E4-17434A0B43D4}"= UDP:c:\windows\System32\lsass.exe:lsass "{EA632934-E1C6-4383-B41E-C8AE85E0BC61}"= TCP:c:\windows\System32\lsass.exe:lsass "{842A5BB6-C7DC-4285-8E02-739B7BE664AE}"= UDP:c:\windows\System32\spoolsv.exe:spoolsv "{9C64DFC3-EC16-4AF7-8475-7DE62DF5F8D3}"= TCP:c:\windows\System32\spoolsv.exe:spoolsv "{C563884D-4A55-4D4E-B2E2-B0205CA7F4E3}"= UDP:c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe:AppleMobileDeviceService "{946CA4DB-56FB-4D40-8B3A-0615AC147577}"= TCP:c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe:AppleMobileDeviceService "{4456CC5F-7200-4B6C-BBC4-8EAC35F937BA}"= UDP:c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe:Switcher "{4DC2FDD4-F92E-4715-81D1-86BD88148202}"= UDP:c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe:Switcher "{0ADCE7C6-06D8-4E50-9633-2C089D3F8D2F}"= TCP:c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe:Switcher "{7DB979B6-141A-417A-8B7E-566E5266F663}"= TCP:c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe:Switcher "{8898B726-42C4-4ED2-80C4-6739134F6249}"= UDP:c:\windows\System32\wininit.exe:wininit "{6F64A62E-75D3-4336-8992-86C981F49A1E}"= TCP:c:\windows\System32\wininit.exe:wininit "{596D8D2D-9BD2-46D7-8C0B-53F63DD658B3}"= UDP:c:\windows\System32\wininit.exe:wininit "{95F864A4-6100-4F82-A075-A6F4B019B698}"= TCP:c:\windows\System32\wininit.exe:wininit "{6FB8DFCB-6528-4B6D-963A-72798E1338AE}"= UDP:c:\users\LOULOU\AppData\Local\Temp\7zS699D.tmp\SymNRT.exe:Norton Removal Tool "{D4783602-B593-4D67-A2D0-5033025F24A0}"= TCP:c:\users\LOULOU\AppData\Local\Temp\7zS699D.tmp\SymNRT.exe:Norton Removal Tool [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R2 regi;regi;c:\windows\System32\drivers\regi.sys [2007-04-17 11032] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2008-05-30 1153368] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\System32\drivers\btwl2cap.sys [2007-07-20 28464] R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\System32\drivers\R5U870FLx86.sys [2007-07-21 75008] R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\System32\drivers\R5U870FUx86.sys [2007-07-21 43904] R3 ti21sony;ti21sony;c:\windows\System32\drivers\ti21sony.sys [2007-07-21 812544] S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-07-23 29744] S3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [2007-08-08 415392] S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-08-08 745472] S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-08-08 397312] S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-08-08 1089536] S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2007-08-08 292152] S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2007-08-08 79736] --- Autres Services/Pilotes en mémoire --- *Deregistered* - sptd [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3641152b-bace-11dc-ae9e-001bfb5784a2}] \shell\AutoRun\command - setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57ed34ba-8934-11dc-9142-806e6f6e6963}] \shell\AutoRun\command - F:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7dda2a3c-3d85-11dd-9f05-001bfb5784a2}] \shell\AutoRun\command - H:\LaunchU3.exe -a . - - - - ORPHELINS SUPPRIMES - - - - BHO-{091dab19-a6bb-45cf-ad42-edcbcdd6d5c6} - c:\programdata\wimohigi\wimohigi.dll HKU-Default-Run-Windows Resurections - c:\windows\TEMP\ydj6d.exe . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.repubblica.it/ mStart Page = hxxp://fr.yahoo.com uInternet Settings,ProxyOverride = *.local IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm Trusted Zone: canalplay.com Trusted Zone: canalplusactive.com Trusted Zone: canalplay.com Trusted Zone: canalplusactive.com DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab FF - ProfilePath - c:\users\LOULOU\AppData\Roaming\Mozilla\Firefox\Profiles\nnqj9sev.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll ---- PARAMETRES FIREFOX ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.allow_platform_file_picker", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.hideGoButton", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.enabled", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.remoteLookups", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.updateURL", "http://sb.google.com/safebrowsing/update?client={moz:client}&appver={moz:version}&"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.lookupURL", "http://sb.google.com/safebrowsing/lookup?sourceid=firefox-antiphish&features=TrustRank&client={moz:client}&appver={moz:version}&"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.reportURL", "http://sb.google.com/safebrowsing/report?"); . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-08 17:10:30 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'Explorer.exe'(2628) c:\windows\system32\btmmhook.dll . ------------------------ Autres processus actifs ------------------------ . c:\windows\System32\audiodg.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe c:\windows\System32\PnkBstrA.exe c:\windows\System32\stacsv.exe c:\program files\Sony\VAIO Event Service\VESMgr.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe c:\windows\System32\drivers\XAudio.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe c:\program files\Sony\VAIO Update 4\VAIOUpdt.exe c:\program files\Sony\VAIO Event Service\VESMgrSub.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe c:\windows\System32\conime.exe c:\windows\System32\WerFault.exe c:\program files\Sony\VAIO Power Management\SPMgr.exe c:\windows\System32\rundll32.exe c:\windows\System32\rundll32.exe c:\windows\ehome\ehmsas.exe c:\program files\Apoint\ApMsgFwd.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\program files\iPod\bin\iPodService.exe c:\program files\WordWeb\wweb32.exe c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe c:\program files\Apoint\ApntEx.exe c:\windows\System32\wbem\WMIADAP.exe c:\windows\System32\dllhost.exe . ************************************************************************** . Heure de fin: 2009-04-08 17:17:23 - La machine a redémarré [LOULOU] ComboFix-quarantined-files.txt 2009-04-08 15:17:19 Avant-CF: 21,595,267,072 octets libres Après-CF: 21,362,335,744 octets libres 399 --- E O F --- 2009-04-07 21:20:27

shaiko · Answer

je dois filer à mon taff, peut on reprendre la desinfection dans la soirée ou dans journée de demain ?

merci !

Nicolas

shaiko · Answer

ps si ca peut t'interresser voici le rapport suite à l'écran bleu

Signature du problème :
  Nom d’événement de problème:	BlueScreen
  Version du système:	6.0.6001.2.1.0.768.3
  Identificateur de paramètres régionaux:	8201

Informations supplémentaires sur le problème :
  BCCode:	93
  BCP1:	0000033C
  BCP2:	00000000
  BCP3:	00000000
  BCP4:	00000000
  OS Version:	6_0_6001
  Service Pack:	1_0
  Product:	768_1

Fichiers aidant à décrire le problème :
  C:\Windows\Minidump\Mini040809-02.dmp
  C:\Users\LOULOU\AppData\Local\Temp\WER-54631-0.sysdata.xml
  C:\Users\LOULOU\AppData\Local\Temp\WERBB43.tmp.version.txt

Lire notre déclaration de confidentialité :
  https://privacy.microsoft.com/fr-fr/microsoft-error-reporting-privacy-statement

jlpjlp · Answer

Pour fusionner:

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

_________________

Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :





File::
c:\programdata	iyunike
c:\programdata\linanotu
c:\programdata\fubatuzo
c:\programdata	oladeya
c:\programdata\goyipeme
c:\programdata\mofanedo
c:\programdata\wimohigi
c:\programdata\herutoho
c:\programdata\fenozano
c:\programdata\zulagovi
c:\programdata\yubiwojo
c:\programdata
iyihese
c:\programdata\govegomu
c:\programdata
ojibipu
c:\programdata\yinuyoni
c:\programdataetegefu
c:\programdata\hewalote
c:\programdata\delehele
c:\programdata\betakoso
c:\programdata\mevozeha
c:\programdata\feyiloto 



Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt


_________________________________

colle un scan en ligne avec un des suivants:

bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html


Panda en ligne :
http://pandasoftware.fr

shaiko · Answer

ComboFix 09-04-04.01 - LOULOU 2009-04-08 21:30:54.2 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2046.1305 [GMT 2:00] Lancé depuis: c:\users\LOULOU\Desktop\ComboFix.exe Commutateurs utilisés :: c:\users\LOULOU\Desktop\CFscript.txt * Un nouveau point de restauration a été créé FILE :: c:\programdata\betakoso c:\programdata\delehele c:\programdata\fenozano c:\programdata\feyiloto c:\programdata\fubatuzo c:\programdata\govegomu c:\programdata\goyipeme c:\programdata\herutoho c:\programdata\hewalote c:\programdata\linanotu c:\programdata\mevozeha c:\programdata\mofanedo c:\programdata\niyihese c:\programdata\nojibipu c:\programdata\retegefu c:\programdata\tiyunike c:\programdata\toladeya c:\programdata\wimohigi c:\programdata\yinuyoni c:\programdata\yubiwojo c:\programdata\zulagovi . ((((((((((((((((((((((((((((( Fichiers créés du 2009-03-08 au 2009-04-08 )))))))))))))))))))))))))))))))))))) . 2009-04-08 16:59 . 2009-04-08 17:09 308,852,947 --a------ c:\windows\MEMORY.DMP 2009-04-08 16:41 . 2009-04-08 16:41 d-------- c:\programdata\NortonInstaller 2009-04-08 13:23 . 2009-04-08 13:23 d-------- C:\rsit 2009-04-08 13:23 . 2009-04-08 13:23 d-------- c:\program files\trend micro 2009-04-08 09:11 . 2009-04-08 09:18 d-------- c:\programdata\tiyunike 2009-04-08 09:11 . 2009-04-08 13:09 d-------- c:\programdata\linanotu 2009-04-08 09:11 . 2009-04-08 16:40 d-------- c:\programdata\fubatuzo 2009-04-07 23:09 . 2008-06-20 03:14 781,344 --a------ c:\windows\System32\PresentationNative_v0300.dll 2009-04-07 23:09 . 2008-06-20 03:14 622,080 --a------ c:\windows\System32\icardagt.exe 2009-04-07 23:09 . 2008-06-20 03:14 326,160 --a------ c:\windows\System32\PresentationHost.exe 2009-04-07 23:09 . 2008-06-20 03:14 105,016 --a------ c:\windows\System32\PresentationCFFRasterizerNative_v0300.dll 2009-04-07 23:09 . 2008-06-20 03:14 97,800 --a------ c:\windows\System32\infocardapi.dll 2009-04-07 23:09 . 2008-06-20 03:14 43,544 --a------ c:\windows\System32\PresentationHostProxy.dll 2009-04-07 23:09 . 2008-06-20 03:14 37,384 --a------ c:\windows\System32\infocardcpl.cpl 2009-04-07 23:09 . 2008-06-20 03:14 11,264 --a------ c:\windows\System32\icardres.dll 2009-04-07 23:05 . 2009-04-07 23:05 0 --a------ c:\windows\RAVTC.TMP 2009-04-07 23:02 . 2008-07-27 20:03 282,112 --a------ c:\windows\System32\mscoree.dll 2009-04-07 23:02 . 2008-07-27 20:03 96,760 --a------ c:\windows\System32\dfshim.dll 2009-04-07 23:02 . 2008-07-27 20:03 41,984 --a------ c:\windows\System32\netfxperf.dll 2009-04-07 23:01 . 2008-07-27 20:03 158,720 --a------ c:\windows\System32\mscorier.dll 2009-04-07 23:01 . 2008-07-27 20:03 83,968 --a------ c:\windows\System32\mscories.dll 2009-04-07 22:58 . 2009-04-07 22:58 410,984 --a------ c:\windows\System32\deploytk.dll 2009-04-07 22:57 . 2009-04-07 22:57 0 --------- c:\windows\PAVSHRB.INI 2009-04-07 22:22 . 2009-04-07 22:22 d-------- c:\users\LOULOU\AppData\Roaming\Malwarebytes 2009-04-07 22:22 . 2009-04-07 22:22 d-------- c:\programdata\Malwarebytes 2009-04-07 22:22 . 2009-04-07 22:24 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-04-07 22:22 . 2009-04-06 15:32 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2009-04-07 22:22 . 2009-04-06 15:32 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2009-04-07 22:18 . 2009-04-07 22:18 28,320 --a------ c:\windows\System32\drivers\sifzbtej.sys 2009-04-06 16:25 . 2009-04-08 16:40 d-------- c:\programdata\toladeya 2009-04-05 17:58 . 2009-04-08 16:40 d-------- c:\programdata\goyipeme 2009-04-04 16:37 . 2009-04-08 16:40 d-------- c:\programdata\mofanedo 2009-04-03 14:02 . 2009-04-07 22:37 d-------- c:\programdata\wimohigi 2009-04-03 14:02 . 2009-04-08 13:06 d-------- c:\programdata\herutoho 2009-04-03 14:02 . 2009-04-07 22:37 d-------- c:\programdata\fenozano 2009-04-03 14:00 . 2009-04-07 22:36 d-------- c:\programdata\zulagovi 2009-04-03 14:00 . 2009-04-08 16:40 d-------- c:\programdata\yubiwojo 2009-04-03 14:00 . 2009-04-03 14:00 d-------- c:\programdata\niyihese 2009-04-03 14:00 . 2009-04-07 22:34 d-------- c:\programdata\govegomu 2009-04-03 00:14 . 2009-04-08 16:40 d-------- c:\programdata\nojibipu 2009-04-03 00:13 . 2009-04-07 00:00 d-------- c:\users\LOULOU\AppData\Roaming\skypePM 2009-04-03 00:13 . 2009-04-03 00:13 56 --ah----- c:\programdata\ezsidmv.dat 2009-04-03 00:12 . 2009-04-03 00:12 dr------- c:\program files\Skype 2009-04-03 00:12 . 2009-04-03 00:12 d-------- c:\program files\Common Files\Skype 2009-04-02 12:13 . 2009-04-02 12:13 d-------- c:\programdata\zotowuru 2009-04-02 12:13 . 2009-04-03 14:02 d-------- c:\programdata\yinuyoni 2009-04-02 12:13 . 2009-04-02 12:34 d-------- c:\programdata\retegefu 2009-04-02 12:13 . 2009-04-03 14:02 d-------- c:\programdata\hewalote 2009-04-02 12:13 . 2009-04-02 12:13 d-------- c:\programdata\delehele 2009-04-02 12:13 . 2009-04-02 12:13 d-------- c:\programdata\betakoso 2009-04-02 00:13 . 2009-04-08 16:40 d-------- c:\programdata\mevozeha 2009-04-02 00:13 . 2009-04-07 23:45 d-------- c:\programdata\feyiloto 2009-03-11 21:08 . 2009-03-11 21:08 d-------- c:\program files\GSC Game World 2009-03-11 21:06 . 2009-03-11 21:06 d-------- c:\users\LOULOU\AppData\Roaming\DAEMON Tools Pro 2009-03-11 21:06 . 2009-03-11 21:06 d-------- c:\programdata\DAEMON Tools Lite 2009-03-11 21:06 . 2009-03-11 21:06 d-------- c:\program files\DAEMON Tools Lite 2009-03-11 20:45 . 2009-03-11 21:06 d-------- c:\users\LOULOU\AppData\Roaming\DAEMON Tools Lite 2009-03-11 20:26 . 2009-03-11 20:26 d-------- c:\programdata\Roxio 2009-03-11 20:24 . 2009-03-11 20:26 d-------- c:\users\LOULOU\AppData\Roaming\Roxio 2009-03-11 19:13 . 2009-03-11 19:14 d-------- c:\users\LOULOU\AppData\Roaming\SPORE 2009-03-11 19:11 . 2009-03-11 19:11 dr-h----- c:\users\LOULOU\AppData\Roaming\SecuROM 2009-03-11 10:52 . 2008-12-16 05:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL 2009-03-11 10:52 . 2008-12-16 07:31 7,680 --a------ c:\windows\System32\spwmp.dll 2009-03-11 10:52 . 2008-12-16 07:31 4,096 --a------ c:\windows\System32\msdxm.ocx 2009-03-11 10:52 . 2008-12-16 07:31 4,096 --a------ c:\windows\System32\dxmasf.dll 2009-03-11 10:51 . 2009-02-09 05:10 2,033,152 --a------ c:\windows\System32\win32k.sys 2009-03-11 10:51 . 2008-11-27 06:43 268,288 --a------ c:\windows\System32\schannel.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-07 20:57 --------- d-----w c:\program files\Java 2009-04-07 20:48 --------- d-----w c:\programdata\Spybot - Search & Destroy 2009-04-07 20:47 --------- d-----w c:\program files\Spybot - Search & Destroy 2009-04-07 19:47 --------- d-----w c:\program files\CCleaner 2009-04-07 16:24 --------- d-----w c:\users\LOULOU\AppData\Roaming\uTorrent 2009-04-06 23:30 --------- d-----w c:\users\LOULOU\AppData\Roaming\Skype 2009-04-04 18:09 49,152 --sha-w c:\windows\System32\hikenuse.dll 2009-04-02 22:12 --------- d-----w c:\programdata\Skype 2009-03-31 21:59 223,934 ----a-w c:\users\LOULOU\AppData\Roaming\nvModes.dat 2009-03-23 15:42 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-21 11:52 --------- d-----w c:\program files\Metin2_France 2009-03-12 18:38 --------- d-----w c:\program files\Windows Mail 2009-03-11 19:06 --------- d-----w c:\users\LOULOU\AppData\Roaming\DAEMON Tools 2009-03-11 18:45 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2009-03-11 17:03 --------- d-----w c:\program files\Electronic Arts 2009-03-01 21:25 --------- d-----w c:\programdata\Electronic Arts 2009-02-24 13:21 --------- d-----w c:\users\LOULOU\AppData\Roaming\Atari 2009-02-24 13:17 --------- d-----w c:\users\LOULOU\AppData\Roaming\Leadertech 2009-02-24 13:06 --------- d-----w c:\program files\Atari 2009-02-23 21:28 --------- d-----w c:\program files\uTorrent 2009-02-19 01:59 --------- d-----w c:\program files\Google 2009-02-17 07:54 --------- d-----w c:\program files\DivX 2009-01-20 13:24 174 --sha-w c:\program files\desktop.ini 2009-01-20 12:43 82,432 ----a-w c:\windows\System32\axaltocm.dll 2009-01-20 12:43 101,888 ----a-w c:\windows\System32\ifxcardm.dll 2009-01-19 18:19 77,824 ----a-w c:\windows\System32\5wW42d14.exe 2009-01-15 06:11 827,392 ----a-w c:\windows\System32\wininet.dll 2008-06-01 21:35 5,682 ----a-w c:\users\LOULOU\AppData\Roaming\wklnhst.dat 2007-11-14 17:11 22,328 ----a-w c:\users\LOULOU\AppData\Roaming\PnkBstrK.sys 2008-11-16 22:35 122,880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll 2008-12-17 23:04 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-12-17 23:04 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-17 23:04 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-12-17 23:04 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-12-17 23:04 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll 2008-01-03 20:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-01-03 20:09 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-01-03 20:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((( SnapShot@2009-04-08_17.15.42.29 ))))))))))))))))))))))))))))))))))))))))) . + 2009-04-08 19:13:49 12,288 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Conversion.v3.5.resources.dll + 2009-04-08 19:13:49 69,632 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Engine.resources.dll + 2009-04-08 19:13:49 163,840 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Tasks.v3.5.resources.dll + 2009-04-08 19:13:49 11,776 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5.resources\3.5.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Utilities.v3.5.resources.dll + 2009-04-08 19:13:49 8,192 ----a-w c:\windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations.resources\3.5.0.0_fr_31bf3856ad364e35\System.ComponentModel.DataAnnotations.Resources.dll + 2009-04-08 19:13:50 61,440 ----a-w c:\windows\assembly\GAC_MSIL\System.Core.resources\3.5.0.0_fr_b77a5c561934e089\System.Core.Resources.dll + 2009-04-08 19:13:50 5,120 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.DataSetExtensions.resources\3.5.0.0_fr_b77a5c561934e089\System.Data.DataSetExtensions.Resources.dll + 2009-04-08 19:13:50 15,872 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.Entity.Design.resources\3.5.0.0_fr_b77a5c561934e089\System.Data.Entity.Design.Resources.dll + 2009-04-08 19:13:50 409,600 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.Entity.resources\3.5.0.0_fr_b77a5c561934e089\System.Data.Entity.Resources.dll + 2009-04-08 19:13:48 57,344 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.Linq.resources\3.5.0.0_fr_b77a5c561934e089\System.Data.Linq.Resources.dll + 2009-04-08 19:13:48 36,864 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.Services.Client.resources\3.5.0.0_fr_b77a5c561934e089\System.Data.Services.Client.resources.dll + 2009-04-08 19:13:48 7,680 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.Services.Design.resources\3.5.0.0_fr_b77a5c561934e089\System.Data.Services.Design.resources.dll + 2009-04-08 19:13:48 69,632 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.Services.resources\3.5.0.0_fr_b77a5c561934e089\System.Data.Services.resources.dll + 2009-04-08 19:13:48 36,864 ----a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement.resources\3.5.0.0_fr_b77a5c561934e089\System.DirectoryServices.AccountManagement.resources.dll + 2009-04-08 19:13:51 11,264 ----a-w c:\windows\assembly\GAC_MSIL\System.Management.Instrumentation.resources\3.5.0.0_fr_b77a5c561934e089\System.Management.Instrumentation.Resources.dll + 2009-04-08 19:13:52 28,672 ----a-w c:\windows\assembly\GAC_MSIL\System.Net.resources\3.5.0.0_fr_b03f5f7f11d50a3a\System.Net.Resources.dll + 2009-04-08 19:13:47 73,728 ----a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.Web.resources\3.5.0.0_fr_31bf3856ad364e35\System.ServiceModel.Web.resources.dll + 2009-04-08 19:13:51 3,584 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.Abstractions.resources\3.5.0.0_fr_31bf3856ad364e35\System.Web.Abstractions.Resources.dll + 2009-04-08 19:13:51 4,096 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.DynamicData.Design.resources\3.5.0.0_fr_31bf3856ad364e35\System.Web.DynamicData.Design.Resources.dll + 2009-04-08 19:13:51 16,384 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.DynamicData.resources\3.5.0.0_fr_31bf3856ad364e35\System.Web.DynamicData.Resources.dll + 2009-04-08 19:13:51 11,264 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.Entity.Design.resources\3.5.0.0_fr_b77a5c561934e089\System.Web.Entity.Design.Resources.dll + 2009-04-08 19:13:51 24,576 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.Entity.resources\3.5.0.0_fr_b77a5c561934e089\System.Web.Entity.Resources.dll + 2009-04-08 19:13:51 49,152 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.Extensions.Design.resources\3.5.0.0_fr_31bf3856ad364e35\System.Web.Extensions.Design.Resources.dll + 2009-04-08 19:13:51 634,880 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.Extensions.resources\3.5.0.0_fr_31bf3856ad364e35\System.Web.Extensions.Resources.dll + 2009-04-08 19:13:51 7,680 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.Routing.resources\3.5.0.0_fr_31bf3856ad364e35\System.Web.Routing.Resources.dll + 2009-04-08 19:13:52 3,584 ----a-w c:\windows\assembly\GAC_MSIL\System.Windows.Presentation.resources\3.5.0.0_fr_b77a5c561934e089\System.Windows.Presentation.resources.dll + 2009-04-08 19:13:48 102,400 ----a-w c:\windows\assembly\GAC_MSIL\System.WorkflowServices.resources\3.5.0.0_fr_31bf3856ad364e35\System.WorkflowServices.resources.dll + 2009-04-08 19:13:52 8,192 ----a-w c:\windows\assembly\GAC_MSIL\System.Xml.Linq.resources\3.5.0.0_fr_b77a5c561934e089\System.Xml.Linq.Resources.dll + 2008-07-31 02:18:06 198,144 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\1036\cscompui.dll + 2008-07-31 02:18:06 275,448 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\1036\vbc7ui.dll + 2008-07-31 02:18:06 17,944 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\fr\DataSvcUtil.resources.dll + 2008-07-31 02:18:06 22,032 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\fr\EdmGen.Resources.dll + 2008-07-31 02:18:06 163,840 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\fr\Microsoft.Build.Tasks.v3.5.resources.dll + 2008-07-31 02:18:06 4,096 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\fr\Microsoft.Data.Entity.Build.Tasks.Resources.dll + 2008-07-31 02:18:06 46,096 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\fr\MSBuild.resources.exe + 2008-07-31 02:15:58 27,910 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\baseline.dat + 2008-07-30 23:06:02 97,280 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\DeleteTemp.exe + 2008-07-30 23:06:02 276,984 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\dlmgr.dll + 2008-07-30 23:06:02 1,064,448 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\gencomp.dll + 2008-07-30 23:06:02 177,152 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\HtmlLite.dll + 2008-07-31 02:18:06 183,296 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\RebootStub.exe + 2008-07-30 23:06:02 269,304 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe + 2008-07-30 23:08:42 133,120 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setupres.dll + 2008-07-30 23:06:02 1,364,992 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\SITSetup.dll + 2008-07-30 23:06:02 1,054,208 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\vs_setup.dll + 2008-07-30 23:06:02 632,320 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\vs70uimgr.dll + 2008-07-30 23:06:02 413,184 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\vsbasereqs.dll + 2008-07-30 23:06:02 689,152 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\vsscenario.dll + 2008-07-30 23:08:42 112,120 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\WapRes.dll + 2008-07-30 23:06:02 984,056 ----a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\WapUI.dll - 2009-04-08 15:10:00 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-04-08 19:08:40 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-04-08 15:10:00 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-04-08 19:08:40 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2009-04-08 15:10:23 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat + 2009-04-08 19:10:29 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat + 2009-04-08 19:10:29 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2009-04-08 15:11:14 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat + 2009-04-08 19:10:24 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat + 2009-04-08 19:10:24 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2009-04-08 15:08:33 104,940 ----a-w c:\windows\System32\perfc009.dat + 2009-04-08 19:13:22 104,940 ----a-w c:\windows\System32\perfc009.dat - 2009-04-08 15:08:33 128,004 ----a-w c:\windows\System32\perfc00C.dat + 2009-04-08 19:13:22 128,004 ----a-w c:\windows\System32\perfc00C.dat - 2009-04-08 15:08:33 595,506 ----a-w c:\windows\System32\perfh009.dat + 2009-04-08 19:13:22 595,506 ----a-w c:\windows\System32\perfh009.dat - 2009-04-08 15:08:33 678,956 ----a-w c:\windows\System32\perfh00C.dat + 2009-04-08 19:13:22 678,956 ----a-w c:\windows\System32\perfh00C.dat - 2009-04-08 15:11:50 12,298 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1611504857-4089916995-1680512414-1000_UserData.bin + 2009-04-08 19:10:22 12,346 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1611504857-4089916995-1680512414-1000_UserData.bin - 2009-04-08 15:11:50 91,904 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2009-04-08 19:10:22 91,966 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2009-04-08 14:45:48 62,130 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-04-08 19:10:21 62,138 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin . -- Instantané actualisé -- . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint\Apoint.exe" [2007-06-10 118784] "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-06-11 317560] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-17 29744] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-07 148888] "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-06-28 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8429568] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576] c:\users\LOULOU\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-06-22 739880] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon] 2007-07-12 08:33 98304 c:\windows\System32\VESWinlogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.dvsd"= c:\program files\Common Files\Sony Shared\VideoLib\sonydv.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{EB7EE62E-514C-4ED2-96CC-E76742C6C8BA}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C6785C36-3B71-4EC6-8473-E9FD35A708F1}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{93C3FF1C-85CA-4F0A-A50F-F70534120517}"= Disabled:UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "{118CEEBF-6311-4A81-A47B-F47606B5CBD3}"= Disabled:TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "{316EA76B-B568-42EA-95F3-0109AB8EA870}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{88469EB4-4B06-4D20-B8A9-3BBA166C1D56}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{D9908554-A2C2-4B9F-804B-3517AF46D966}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{9BC30465-1180-4166-8D1F-0FCD7D1CC954}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{75D82640-B909-4A0C-BE49-42497CA673B2}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{5D5BEBCE-E214-4DE9-9EE1-4672F4D796F7}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{7A850012-1055-48BF-B522-6C74674AC924}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{D2B1522F-CCD4-40CB-9A1C-19B827A90265}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{1FB827CF-5D00-40E1-AC7C-985474FC750A}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{CCDDE7B3-5E87-4DAF-A244-DED7287CBE11}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{EC8E278D-4838-4EE3-93BA-CBC9A0BA8AE4}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "{AD8E3901-A158-4A3F-821F-C99754C2C917}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "{63F025D1-B60B-4B47-A5B0-54457738B9B3}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{EBB36171-16AE-4355-8300-3A54AD96903C}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{B4E0DFE4-F1BB-4061-A8D3-511C451FCDF3}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{5798E201-550D-4C36-93A9-53C4ABEB9803}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{EDB28EC4-15E9-4D6C-92E1-F765466E9CA7}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{5EDD7D17-E07C-4A2E-8DDA-474E11476220}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{C3FD154C-C680-41FA-9D4C-00AF5D60BFA9}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{6D36E7FF-2BCE-4E03-BF83-B6A0A33DC36E}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{638103A7-5F79-49D7-A800-106A79F5F714}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "{9DA55446-CE37-42F3-A3AB-EDC9AC58E37A}"= UDP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III "{2F1B791E-125E-4676-8BC9-C7376EF67D1C}"= TCP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III "TCP Query User{AB4DA13B-A8EE-490C-B94D-DBC893B12F39}c:\program files\azureus\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus "UDP Query User{4701FED6-0B75-4404-AD26-7F3F6C176596}c:\program files\azureus\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus "TCP Query User{FCF347F4-4850-4B6E-8378-7A9C5F8DAACE}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{403422EC-0B56-49BF-AFA9-AF5C39386842}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{7B231355-91EC-4DF4-9B01-B2E1CFDFF4E4}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule "UDP Query User{633F1F87-CA0A-49B3-8A22-26D809151477}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule "TCP Query User{6279BC70-B4A4-4A66-A19D-BCE7869E0E4E}c:\program files\team17\worms armageddon\wa.exe"= UDP:c:\program files\team17\worms armageddon\wa.exe:Worms Armageddon "UDP Query User{00F48F3C-6725-4589-B9EC-01832517A27C}c:\program files\team17\worms armageddon\wa.exe"= TCP:c:\program files\team17\worms armageddon\wa.exe:Worms Armageddon "TCP Query User{A61540CE-73E1-43CB-9DEC-BA9F868EB181}c:\program files\team17\worms 2\frontend.exe"= UDP:c:\program files\team17\worms 2\frontend.exe:Worms 2 Frontend "UDP Query User{5A5194CB-D36F-417A-83E6-EA53C2CB85B6}c:\program files\team17\worms 2\frontend.exe"= TCP:c:\program files\team17\worms 2\frontend.exe:Worms 2 Frontend "TCP Query User{7F40AA1D-A37D-4098-88EB-EFD8F2BBE1EF}c:\program files\azureus\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus "UDP Query User{F7EB5A9D-8A39-4B20-A5E0-688CAB44C1F9}c:\program files\azureus\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus "TCP Query User{A53B07B8-5311-41E0-A0EF-E42877139A20}c:\program files\quake iii arena\quake3.exe"= UDP:c:\program files\quake iii arena\quake3.exe:quake3 "UDP Query User{E25A91CF-7720-4220-A0DB-1B8A9B16139B}c:\program files\quake iii arena\quake3.exe"= TCP:c:\program files\quake iii arena\quake3.exe:quake3 "{6A7A8727-9C46-4363-B2BC-F04B393E9746}"= UDP:54178:Azureus 54178 TCP "{EA6E3AF1-15DC-4C8A-B2CB-FBABBBF4B571}"= TCP:54178:Azureus 54178 UDP "TCP Query User{A2D16300-ED91-487C-9D67-9013488E805B}c:\program files\quake iii arena\quake3.exe"= UDP:c:\program files\quake iii arena\quake3.exe:quake3 "UDP Query User{14B3F83F-7556-44E2-85DE-CF36694C972D}c:\program files\quake iii arena\quake3.exe"= TCP:c:\program files\quake iii arena\quake3.exe:quake3 "TCP Query User{19216D63-D30C-43D2-9746-D6C518AF2AF1}c:\users\loulou\downloads\team 17\wa\[pc game] worms armageddon + all weapons unblocked + cracked + xp patch by lupen[fumai]\wormsarm\wa.exe"= UDP:c:\users\loulou\downloads\team 17\wa\[pc game] worms armageddon + all weapons unblocked + cracked + xp patch by lupen[fumai]\wormsarm\wa.exe:wa.exe "UDP Query User{0961AA07-7C08-428F-9060-78801F99F16E}c:\users\loulou\downloads\team 17\wa\[pc game] worms armageddon + all weapons unblocked + cracked + xp patch by lupen[fumai]\wormsarm\wa.exe"= TCP:c:\users\loulou\downloads\team 17\wa\[pc game] worms armageddon + all weapons unblocked + cracked + xp patch by lupen[fumai]\wormsarm\wa.exe:wa.exe "TCP Query User{62357B01-BF68-4238-95A6-51339425AFBD}c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe"= UDP:c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe:start.exe "UDP Query User{CF0B450E-B97B-4F13-ACCB-284A9D947B5B}c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe"= TCP:c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe:start.exe "TCP Query User{268C976C-DD0C-4C07-9D9E-3DCBA3A89798}c:\windows\system32\dplaysvr.exe"= UDP:c:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay "UDP Query User{86F58307-0F6D-432A-9B6E-63F4BAD95F7F}c:\windows\system32\dplaysvr.exe"= TCP:c:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay "TCP Query User{E6BCEB50-C2BB-4430-8607-40DC8C60425B}c:\program files\konami\pro evolution soccer 6\pes6.exe"= UDP:c:\program files\konami\pro evolution soccer 6\pes6.exe:pes6.exe "UDP Query User{B3423FC6-4B47-4B69-A9AB-8ED5ACC1461E}c:\program files\konami\pro evolution soccer 6\pes6.exe"= TCP:c:\program files\konami\pro evolution soccer 6\pes6.exe:pes6.exe "TCP Query User{F2DE20D8-445E-49EE-8E1A-6E231E227523}c:\program files\veoh networks\veoh\veohclient.exe"= UDP:c:\program files\veoh networks\veoh\veohclient.exe:Veoh Client "UDP Query User{C6CE2BEB-45DB-485E-AB8D-E8797F673ABF}c:\program files\veoh networks\veoh\veohclient.exe"= TCP:c:\program files\veoh networks\veoh\veohclient.exe:Veoh Client "{B3DF7D74-8051-4962-9744-01FE9583D90F}"= UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "{E61208E1-7405-470E-9BBC-E0F0917C0A09}"= TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "TCP Query User{B73D7D1E-F16B-4E4D-89DE-5F53DC65ABBC}c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe"= UDP:c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe:start.exe "UDP Query User{3736A79C-E40B-47FA-A4DE-BA0D9F62FC3B}c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe"= TCP:c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe:start.exe "TCP Query User{AFBDCDAC-AF9B-49E3-B7BA-2BB93701C6A5}c:\program files\lionhead studios ltd\black & white\runblack.exe"= UDP:c:\program files\lionhead studios ltd\black & white\runblack.exe:lh "UDP Query User{0A85C32D-3C81-4A45-B95F-D29B42823984}c:\program files\lionhead studios ltd\black & white\runblack.exe"= TCP:c:\program files\lionhead studios ltd\black & white\runblack.exe:lh "{8256E9E7-A9E5-46DE-AC62-79E4D0C23F6A}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{C10322C9-CDDA-4817-B67C-DD28B639CE65}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{D746BEDF-95CD-404E-844D-7BF0D0846D3D}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{A6ED5F3F-54EC-485D-A961-D89D55A8AD9D}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{29485F5D-2DFC-4AF6-981C-A75A77A5A930}"= UDP:86:BroadCam Web Server "TCP Query User{01CE8517-2F48-4C6A-80C6-C9A2C6F14080}c:\program files\konami\pro evolution soccer 2009\pes2009.exe"= UDP:c:\program files\konami\pro evolution soccer 2009\pes2009.exe:Pro Evolution Soccer 2009 "UDP Query User{71186C0B-7559-4592-BB18-F1D5A7AF7290}c:\program files\konami\pro evolution soccer 2009\pes2009.exe"= TCP:c:\program files\konami\pro evolution soccer 2009\pes2009.exe:Pro Evolution Soccer 2009 "TCP Query User{796B2BA3-88EC-4BA9-AF28-B9C4B83C50A1}c:\program files\activision\call of duty - world at war\codwaw.exe"= UDP:c:\program files\activision\call of duty - world at war\codwaw.exe:Call of Duty(R): World at War Campaign/Coop "UDP Query User{5D1DBAD9-01F0-40FB-AEFD-5F98F99719E8}c:\program files\activision\call of duty - world at war\codwaw.exe"= TCP:c:\program files\activision\call of duty - world at war\codwaw.exe:Call of Duty(R): World at War Campaign/Coop "{2B832080-D4C4-48F2-93F5-F2F6F3201887}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{B189AA1A-FDC7-4A67-80BF-374CF7DAC4D3}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "TCP Query User{03E9CCCC-2B08-4569-A462-1F9BC21107D5}c:\users\loulou\desktop\utorrent(3).exe"= UDP:c:\users\loulou\desktop\utorrent(3).exe:utorrent(3).exe "UDP Query User{267DCBB3-0FBD-45D4-B535-5A0EC136488A}c:\users\loulou\desktop\utorrent(3).exe"= TCP:c:\users\loulou\desktop\utorrent(3).exe:utorrent(3).exe "{4985F146-DD4A-47C1-A756-53184DCAD5D8}"= UDP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe:Burnout(TM) Paradise The Ultimate Box "{93CE50F5-6604-454E-B759-8B05F33DB9EF}"= TCP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe:Burnout(TM) Paradise The Ultimate Box "{F20BECCB-339D-48F3-8503-CDC08787DD26}"= UDP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe:Burnout(TM) Paradise The Ultimate Box "{46C1667B-342F-4E29-B901-6DF0B5C6EEDC}"= TCP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe:Burnout(TM) Paradise The Ultimate Box "{FB9FA2DF-6440-4CB7-8934-29242926DA81}"= UDP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe:Burnout(TM) Paradise The Ultimate Box "{3CF15280-DC5B-4969-9AB0-2000057AD22D}"= TCP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe:Burnout(TM) Paradise The Ultimate Box "TCP Query User{95C8A65C-DEE4-4B84-BB11-3FF9E68C5581}c:\users\loulou\desktop\utorrent(3).exe"= UDP:c:\users\loulou\desktop\utorrent(3).exe:utorrent(3).exe "UDP Query User{45963564-7CA4-4DD1-8B54-A006626DDE0C}c:\users\loulou\desktop\utorrent(3).exe"= TCP:c:\users\loulou\desktop\utorrent(3).exe:utorrent(3).exe "TCP Query User{1D193859-A5F3-4231-B897-27832AB422EC}c:\program files\metin2_france\metin2.bin"= UDP:c:\program files\metin2_france\metin2.bin:metin2.bin "UDP Query User{CFA81A6E-E4CD-421F-B3E9-99936B898C23}c:\program files\metin2_france\metin2.bin"= TCP:c:\program files\metin2_france\metin2.bin:metin2.bin "{6807E4D8-EFB9-4E6C-BD3B-8AA6FBA92E51}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{EAB1B2B1-34AE-4D29-8678-41D8F0F44B8F}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{E063BF09-18B0-49F6-9CF0-7F951E3350CA}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{C057C0CD-CE79-4393-9F0C-CD2CED382692}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{975380A9-50EE-4224-AD8D-6B2B4D7B8D98}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{E862D3AF-578E-4771-AE1F-644932B31423}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{2DB3449F-5FB7-432E-9F2E-BCEBEBD75BA5}"= UDP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{B6C1FA57-A689-40E6-8705-C0D79BCF6A6A}"= UDP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{6E583829-3301-4128-847E-851E2B2DA779}"= TCP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{5FF42E84-A5F2-4E0D-B045-EE087F8AD603}"= TCP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{EEC57245-2497-497D-A186-DF4608AAD21B}"= UDP:c:\windows\System32\5wW42d14.exe:5wW42d14 "{83151526-3DF1-4D49-913E-437D125787EE}"= TCP:c:\windows\System32\5wW42d14.exe:5wW42d14 "{805B1508-F998-4396-BD33-E739D6C125A4}"= UDP:c:\windows\System32\wbem\WmiPrvSE.exe:wmiprvse "{914AE9F4-9D1F-4F89-A8F8-5E17A1AB727E}"= TCP:c:\windows\System32\wbem\WmiPrvSE.exe:wmiprvse "{5C67F97D-6A98-426E-B1B1-85316B635131}"= UDP:c:\windows\System32\wbem\WmiPrvSE.exe:wmiprvse "{4168A88D-1452-47B4-BE79-DFC5C24395C9}"= TCP:c:\windows\System32\wbem\WmiPrvSE.exe:wmiprvse "{D8682D4D-DEBC-4C2F-951F-16F499D342C0}"= c:\program files\Skype\Phone\Skype.exe:Skype "{4557A85A-2066-46C9-A0BA-FA95E2CEEE7D}"= UDP:c:\program files\Sony\VAIO Event Service\VESMgr.exe:VESMgr "{6EE2652E-5AE9-40F2-AE99-4604845C1472}"= TCP:c:\program files\Sony\VAIO Event Service\VESMgr.exe:VESMgr "{34F41E8F-390E-4950-8418-AD4623CAEDF8}"= UDP:c:\program files\Sony\VAIO Power Management\SPMgr.exe:SPMgr "{82061BCF-225E-4552-B1AA-2135D1936CEC}"= TCP:c:\program files\Sony\VAIO Power Management\SPMgr.exe:SPMgr "{2D586C79-B7EE-4711-996E-FD2FF878FBD5}"= UDP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{CE459480-564C-4F02-8A4F-9D16E42E4B8B}"= TCP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{F6D32E9E-3533-45ED-850B-C386B37F0667}"= UDP:c:\program files\Panda Security\Panda Antivirus 2008\PsCtrlS.exe:PsCtrls "{7048C1B2-FD0C-4C89-93F3-D38ADBCCD58C}"= TCP:c:\program files\Panda Security\Panda Antivirus 2008\PsCtrlS.exe:PsCtrls "{643B49A4-60C5-440C-9A5F-1262119FBDD8}"= UDP:c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe:iviRegMgr "{F7DAF92E-3101-4D98-981E-94298B60124D}"= TCP:c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe:iviRegMgr "{F1BCBA2E-7F56-4205-B1C5-D4DB675C6F18}"= UDP:c:\program files\Panda Security\Panda Antivirus 2008\AVENGINE.EXE:AVENGINE "{CFC00A38-4EE1-4FBB-A0AA-CC6E1245E986}"= TCP:c:\program files\Panda Security\Panda Antivirus 2008\AVENGINE.EXE:AVENGINE "{C485B050-BD6B-470F-9503-884A993D6265}"= UDP:c:\windows\System32\taskeng.exe:taskeng "{ECDBF387-3AB2-4279-B2E7-C2FF9999558F}"= TCP:c:\windows\System32\taskeng.exe:taskeng "{ADE092F2-A599-47CA-86AF-4A6E999B4B40}"= UDP:c:\windows\System32\winlogon.exe:winlogon "{A1B71AE8-6618-40D2-91C7-6A615A89E954}"= TCP:c:\windows\System32\winlogon.exe:winlogon "{0FA21FA3-E919-48AC-A599-BC5ABBCD5483}"= UDP:c:\program files\Common Files\Panda Software\PavShld\PavPrSrv.exe:pavprsrv "{527FD804-8D67-4D25-8653-4865F8BCFB6B}"= TCP:c:\program files\Common Files\Panda Software\PavShld\PavPrSrv.exe:pavprsrv "{75BDDC4F-8419-4935-80E4-17434A0B43D4}"= UDP:c:\windows\System32\lsass.exe:lsass "{EA632934-E1C6-4383-B41E-C8AE85E0BC61}"= TCP:c:\windows\System32\lsass.exe:lsass "{842A5BB6-C7DC-4285-8E02-739B7BE664AE}"= UDP:c:\windows\System32\spoolsv.exe:spoolsv "{9C64DFC3-EC16-4AF7-8475-7DE62DF5F8D3}"= TCP:c:\windows\System32\spoolsv.exe:spoolsv "{C563884D-4A55-4D4E-B2E2-B0205CA7F4E3}"= UDP:c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe:AppleMobileDeviceService "{946CA4DB-56FB-4D40-8B3A-0615AC147577}"= TCP:c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe:AppleMobileDeviceService "{4456CC5F-7200-4B6C-BBC4-8EAC35F937BA}"= UDP:c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe:Switcher "{4DC2FDD4-F92E-4715-81D1-86BD88148202}"= UDP:c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe:Switcher "{0ADCE7C6-06D8-4E50-9633-2C089D3F8D2F}"= TCP:c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe:Switcher "{7DB979B6-141A-417A-8B7E-566E5266F663}"= TCP:c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe:Switcher "{8898B726-42C4-4ED2-80C4-6739134F6249}"= UDP:c:\windows\System32\wininit.exe:wininit "{6F64A62E-75D3-4336-8992-86C981F49A1E}"= TCP:c:\windows\System32\wininit.exe:wininit "{596D8D2D-9BD2-46D7-8C0B-53F63DD658B3}"= UDP:c:\windows\System32\wininit.exe:wininit "{95F864A4-6100-4F82-A075-A6F4B019B698}"= TCP:c:\windows\System32\wininit.exe:wininit "{6FB8DFCB-6528-4B6D-963A-72798E1338AE}"= UDP:c:\users\LOULOU\AppData\Local\Temp\7zS699D.tmp\SymNRT.exe:Norton Removal Tool "{D4783602-B593-4D67-A2D0-5033025F24A0}"= TCP:c:\users\LOULOU\AppData\Local\Temp\7zS699D.tmp\SymNRT.exe:Norton Removal Tool R2 regi;regi;c:\windows\System32\drivers\regi.sys [2007-04-17 11032] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2008-05-30 1153368] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\System32\drivers\btwl2cap.sys [2007-07-20 28464] R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\System32\drivers\R5U870FLx86.sys [2007-07-21 75008] R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\System32\drivers\R5U870FUx86.sys [2007-07-21 43904] R3 ti21sony;ti21sony;c:\windows\System32\drivers\ti21sony.sys [2007-07-21 812544] S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-07-23 29744] S3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [2007-08-08 415392] S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-08-08 745472] S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-08-08 397312] S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-08-08 1089536] S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2007-08-08 292152] S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2007-08-08 79736] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3641152b-bace-11dc-ae9e-001bfb5784a2}] \shell\AutoRun\command - setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57ed34ba-8934-11dc-9142-806e6f6e6963}] \shell\AutoRun\command - F:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7dda2a3c-3d85-11dd-9f05-001bfb5784a2}] \shell\AutoRun\command - H:\LaunchU3.exe -a . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.repubblica.it/ mStart Page = hxxp://fr.yahoo.com uInternet Settings,ProxyOverride = *.local IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm Trusted Zone: canalplay.com Trusted Zone: canalplusactive.com Trusted Zone: canalplay.com Trusted Zone: canalplusactive.com DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab FF - ProfilePath - c:\users\LOULOU\AppData\Roaming\Mozilla\Firefox\Profiles\nnqj9sev.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll ---- PARAMETRES FIREFOX ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.allow_platform_file_picker", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.hideGoButton", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.enabled", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.remoteLookups", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.updateURL", "http://sb.google.com/safebrowsing/update?client={moz:client}&appver={moz:version}&"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.lookupURL", "http://sb.google.com/safebrowsing/lookup?sourceid=firefox-antiphish&features=TrustRank&client={moz:client}&appver={moz:version}&"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.reportURL", "http://sb.google.com/safebrowsing/report?"); . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-08 21:33:58 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... c:\users\LOULOU\AppData\Local\Temp\catchme.dll 53248 bytes executable Scan terminé avec succès Fichiers cachés: 1 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'Explorer.exe'(1672) c:\windows\system32\btmmhook.dll . Heure de fin: 2009-04-08 21:36:52 ComboFix-quarantined-files.txt 2009-04-08 19:36:48 ComboFix2.txt 2009-04-08 15:17:24 Avant-CF: 24,823,250,944 octets libres Après-CF: 24,784,130,048 octets libres 469 --- E O F --- 2009-04-08 19:14:05 je n'ai pas eu le tape 1 ou 2 sur combofix par contre

jlpjlp · Answer

Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :




Collect::
c:\programdata	iyunike 
c:\programdata\linanotu
c:\programdata\fubatuzo
c:\windows\System32\drivers\sifzbtej.sys
c:\programdata	oladeya
c:\programdata\goyipeme
c:\programdata\mofanedo
c:\programdata\wimohigi
c:\programdata\herutoho
c:\programdata\fenozano
c:\programdata\yubiwojo
c:\programdata
iyihese
c:\programdata\govegomu
c:\programdata
ojibipu
c:\programdata\ezsidmv.dat
c:\programdata\zotowuru
c:\programdata\yinuyoni
c:\programdataetegefu
c:\programdata\hewalote
c:\programdata\delehele
c:\programdata\betakoso
c:\programdata\mevozeha
c:\programdata\feyiloto 
C:\Users\All Users\ezsidmv.dat 
Driver ::
sifzbtej








Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt


_____________________



colle un scan en ligne avec un des suivants:


Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

Panda en ligne : 
http://pandasoftware.fr

shaiko · Answer

Rapport COMBO FIX ComboFix 09-04-04.01 - LOULOU 2009-04-09 15:08:01.3 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2046.1285 [GMT 2:00] Lancé depuis: c:\users\LOULOU\Desktop\ComboFix.exe Commutateurs utilisés :: c:\users\LOULOU\Desktop\CFscript.txt * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\programdata\ezsidmv.dat c:\windows\System32\drivers\sifzbtej.sys . ((((((((((((((((((((((((((((( Fichiers créés du 2009-03-09 au 2009-04-09 )))))))))))))))))))))))))))))))))))) . 2009-04-08 16:59 . 2009-04-08 17:09 308,852,947 --a------ c:\windows\MEMORY.DMP 2009-04-08 16:41 . 2009-04-08 16:41 d-------- c:\programdata\NortonInstaller 2009-04-08 13:23 . 2009-04-08 13:23 d-------- C:\rsit 2009-04-08 13:23 . 2009-04-08 13:23 d-------- c:\program files\trend micro 2009-04-08 09:11 . 2009-04-08 09:18 d-------- c:\programdata\tiyunike 2009-04-08 09:11 . 2009-04-08 13:09 d-------- c:\programdata\linanotu 2009-04-08 09:11 . 2009-04-08 16:40 d-------- c:\programdata\fubatuzo 2009-04-07 23:09 . 2008-06-20 03:14 781,344 --a------ c:\windows\System32\PresentationNative_v0300.dll 2009-04-07 23:09 . 2008-06-20 03:14 622,080 --a------ c:\windows\System32\icardagt.exe 2009-04-07 23:09 . 2008-06-20 03:14 326,160 --a------ c:\windows\System32\PresentationHost.exe 2009-04-07 23:09 . 2008-06-20 03:14 105,016 --a------ c:\windows\System32\PresentationCFFRasterizerNative_v0300.dll 2009-04-07 23:09 . 2008-06-20 03:14 97,800 --a------ c:\windows\System32\infocardapi.dll 2009-04-07 23:09 . 2008-06-20 03:14 43,544 --a------ c:\windows\System32\PresentationHostProxy.dll 2009-04-07 23:09 . 2008-06-20 03:14 37,384 --a------ c:\windows\System32\infocardcpl.cpl 2009-04-07 23:09 . 2008-06-20 03:14 11,264 --a------ c:\windows\System32\icardres.dll 2009-04-07 23:05 . 2009-04-07 23:05 0 --a------ c:\windows\RAVTC.TMP 2009-04-07 23:02 . 2008-07-27 20:03 282,112 --a------ c:\windows\System32\mscoree.dll 2009-04-07 23:02 . 2008-07-27 20:03 96,760 --a------ c:\windows\System32\dfshim.dll 2009-04-07 23:02 . 2008-07-27 20:03 41,984 --a------ c:\windows\System32\netfxperf.dll 2009-04-07 23:01 . 2008-07-27 20:03 158,720 --a------ c:\windows\System32\mscorier.dll 2009-04-07 23:01 . 2008-07-27 20:03 83,968 --a------ c:\windows\System32\mscories.dll 2009-04-07 22:58 . 2009-04-07 22:58 410,984 --a------ c:\windows\System32\deploytk.dll 2009-04-07 22:57 . 2009-04-07 22:57 0 --------- c:\windows\PAVSHRB.INI 2009-04-07 22:22 . 2009-04-07 22:22 d-------- c:\users\LOULOU\AppData\Roaming\Malwarebytes 2009-04-07 22:22 . 2009-04-07 22:22 d-------- c:\programdata\Malwarebytes 2009-04-07 22:22 . 2009-04-07 22:24 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-04-07 22:22 . 2009-04-06 15:32 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2009-04-07 22:22 . 2009-04-06 15:32 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2009-04-06 16:25 . 2009-04-08 16:40 d-------- c:\programdata\toladeya 2009-04-05 17:58 . 2009-04-08 16:40 d-------- c:\programdata\goyipeme 2009-04-04 16:37 . 2009-04-08 16:40 d-------- c:\programdata\mofanedo 2009-04-03 14:02 . 2009-04-07 22:37 d-------- c:\programdata\wimohigi 2009-04-03 14:02 . 2009-04-08 13:06 d-------- c:\programdata\herutoho 2009-04-03 14:02 . 2009-04-07 22:37 d-------- c:\programdata\fenozano 2009-04-03 14:00 . 2009-04-07 22:36 d-------- c:\programdata\zulagovi 2009-04-03 14:00 . 2009-04-08 16:40 d-------- c:\programdata\yubiwojo 2009-04-03 14:00 . 2009-04-03 14:00 d-------- c:\programdata\niyihese 2009-04-03 14:00 . 2009-04-07 22:34 d-------- c:\programdata\govegomu 2009-04-03 00:14 . 2009-04-08 16:40 d-------- c:\programdata\nojibipu 2009-04-03 00:13 . 2009-04-07 00:00 d-------- c:\users\LOULOU\AppData\Roaming\skypePM 2009-04-03 00:12 . 2009-04-03 00:12 dr------- c:\program files\Skype 2009-04-03 00:12 . 2009-04-03 00:12 d-------- c:\program files\Common Files\Skype 2009-04-02 12:13 . 2009-04-02 12:13 d-------- c:\programdata\zotowuru 2009-04-02 12:13 . 2009-04-03 14:02 d-------- c:\programdata\yinuyoni 2009-04-02 12:13 . 2009-04-02 12:34 d-------- c:\programdata\retegefu 2009-04-02 12:13 . 2009-04-03 14:02 d-------- c:\programdata\hewalote 2009-04-02 12:13 . 2009-04-02 12:13 d-------- c:\programdata\delehele 2009-04-02 12:13 . 2009-04-02 12:13 d-------- c:\programdata\betakoso 2009-04-02 00:13 . 2009-04-08 16:40 d-------- c:\programdata\mevozeha 2009-04-02 00:13 . 2009-04-07 23:45 d-------- c:\programdata\feyiloto 2009-03-11 21:08 . 2009-03-11 21:08 d-------- c:\program files\GSC Game World 2009-03-11 21:06 . 2009-03-11 21:06 d-------- c:\users\LOULOU\AppData\Roaming\DAEMON Tools Pro 2009-03-11 21:06 . 2009-03-11 21:06 d-------- c:\programdata\DAEMON Tools Lite 2009-03-11 21:06 . 2009-03-11 21:06 d-------- c:\program files\DAEMON Tools Lite 2009-03-11 20:45 . 2009-03-11 21:06 d-------- c:\users\LOULOU\AppData\Roaming\DAEMON Tools Lite 2009-03-11 20:26 . 2009-03-11 20:26 d-------- c:\programdata\Roxio 2009-03-11 20:24 . 2009-03-11 20:26 d-------- c:\users\LOULOU\AppData\Roaming\Roxio 2009-03-11 19:13 . 2009-03-11 19:14 d-------- c:\users\LOULOU\AppData\Roaming\SPORE 2009-03-11 19:11 . 2009-03-11 19:11 dr-h----- c:\users\LOULOU\AppData\Roaming\SecuROM 2009-03-11 10:52 . 2008-12-16 05:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL 2009-03-11 10:52 . 2008-12-16 07:31 7,680 --a------ c:\windows\System32\spwmp.dll 2009-03-11 10:52 . 2008-12-16 07:31 4,096 --a------ c:\windows\System32\msdxm.ocx 2009-03-11 10:52 . 2008-12-16 07:31 4,096 --a------ c:\windows\System32\dxmasf.dll 2009-03-11 10:51 . 2009-02-09 05:10 2,033,152 --a------ c:\windows\System32\win32k.sys 2009-03-11 10:51 . 2008-11-27 06:43 268,288 --a------ c:\windows\System32\schannel.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-09 04:35 223,910 ----a-w c:\users\LOULOU\AppData\Roaming\nvModes.dat 2009-04-07 20:57 --------- d-----w c:\program files\Java 2009-04-07 20:48 --------- d-----w c:\programdata\Spybot - Search & Destroy 2009-04-07 20:47 --------- d-----w c:\program files\Spybot - Search & Destroy 2009-04-07 19:47 --------- d-----w c:\program files\CCleaner 2009-04-07 16:24 --------- d-----w c:\users\LOULOU\AppData\Roaming\uTorrent 2009-04-06 23:30 --------- d-----w c:\users\LOULOU\AppData\Roaming\Skype 2009-04-04 18:09 49,152 --sha-w c:\windows\System32\hikenuse.dll 2009-04-02 22:12 --------- d-----w c:\programdata\Skype 2009-03-23 15:42 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-21 11:52 --------- d-----w c:\program files\Metin2_France 2009-03-12 18:38 --------- d-----w c:\program files\Windows Mail 2009-03-11 19:06 --------- d-----w c:\users\LOULOU\AppData\Roaming\DAEMON Tools 2009-03-11 18:45 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2009-03-11 17:03 --------- d-----w c:\program files\Electronic Arts 2009-03-01 21:25 --------- d-----w c:\programdata\Electronic Arts 2009-02-24 13:21 --------- d-----w c:\users\LOULOU\AppData\Roaming\Atari 2009-02-24 13:17 --------- d-----w c:\users\LOULOU\AppData\Roaming\Leadertech 2009-02-24 13:06 --------- d-----w c:\program files\Atari 2009-02-23 21:28 --------- d-----w c:\program files\uTorrent 2009-02-19 01:59 --------- d-----w c:\program files\Google 2009-02-17 07:54 --------- d-----w c:\program files\DivX 2009-01-20 13:24 174 --sha-w c:\program files\desktop.ini 2009-01-20 12:43 82,432 ----a-w c:\windows\System32\axaltocm.dll 2009-01-20 12:43 101,888 ----a-w c:\windows\System32\ifxcardm.dll 2009-01-19 18:19 77,824 ----a-w c:\windows\System32\5wW42d14.exe 2009-01-15 06:11 827,392 ----a-w c:\windows\System32\wininet.dll 2008-06-01 21:35 5,682 ----a-w c:\users\LOULOU\AppData\Roaming\wklnhst.dat 2007-11-14 17:11 22,328 ----a-w c:\users\LOULOU\AppData\Roaming\PnkBstrK.sys 2008-11-16 22:35 122,880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll 2008-12-17 23:04 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-12-17 23:04 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-17 23:04 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-12-17 23:04 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-12-17 23:04 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll 2008-01-03 20:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-01-03 20:09 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-01-03 20:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((( SnapShot_2009-04-08_21.34.45.07 ))))))))))))))))))))))))))))))))))))))))) . - 2009-04-08 19:08:40 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-04-09 12:59:26 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-04-08 19:08:40 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-04-09 12:59:26 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2009-04-08 19:10:29 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat + 2009-04-09 13:01:15 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat + 2009-04-09 13:01:15 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2009-04-08 19:10:24 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat + 2009-04-09 13:01:10 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat + 2009-04-09 13:01:10 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2009-04-08 15:08:06 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-04-09 13:09:38 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-04-08 15:08:06 49,152 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-04-09 13:09:38 49,152 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-04-08 15:08:06 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-04-09 13:09:38 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-04-08 19:13:22 104,940 ----a-w c:\windows\System32\perfc009.dat + 2009-04-09 13:07:16 104,940 ----a-w c:\windows\System32\perfc009.dat - 2009-04-08 19:13:22 128,004 ----a-w c:\windows\System32\perfc00C.dat + 2009-04-09 13:07:16 128,004 ----a-w c:\windows\System32\perfc00C.dat - 2009-04-08 19:13:22 595,506 ----a-w c:\windows\System32\perfh009.dat + 2009-04-09 13:07:16 595,506 ----a-w c:\windows\System32\perfh009.dat - 2009-04-08 19:13:22 678,956 ----a-w c:\windows\System32\perfh00C.dat + 2009-04-09 13:07:16 678,956 ----a-w c:\windows\System32\perfh00C.dat - 2009-04-08 19:10:22 12,346 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1611504857-4089916995-1680512414-1000_UserData.bin + 2009-04-09 13:01:05 12,346 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1611504857-4089916995-1680512414-1000_UserData.bin - 2009-04-08 19:10:22 91,966 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2009-04-09 13:01:05 92,114 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2009-04-08 19:10:21 62,138 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-04-09 13:01:04 62,146 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin . -- Instantané actualisé -- . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint\Apoint.exe" [2007-06-10 118784] "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-06-11 317560] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-17 29744] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-07 148888] "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-06-28 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8429568] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576] c:\users\LOULOU\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-06-22 739880] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon] 2007-07-12 08:33 98304 c:\windows\System32\VESWinlogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.dvsd"= c:\program files\Common Files\Sony Shared\VideoLib\sonydv.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{EB7EE62E-514C-4ED2-96CC-E76742C6C8BA}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C6785C36-3B71-4EC6-8473-E9FD35A708F1}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{93C3FF1C-85CA-4F0A-A50F-F70534120517}"= Disabled:UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "{118CEEBF-6311-4A81-A47B-F47606B5CBD3}"= Disabled:TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "{316EA76B-B568-42EA-95F3-0109AB8EA870}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{88469EB4-4B06-4D20-B8A9-3BBA166C1D56}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{D9908554-A2C2-4B9F-804B-3517AF46D966}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{9BC30465-1180-4166-8D1F-0FCD7D1CC954}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{75D82640-B909-4A0C-BE49-42497CA673B2}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{5D5BEBCE-E214-4DE9-9EE1-4672F4D796F7}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{7A850012-1055-48BF-B522-6C74674AC924}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{D2B1522F-CCD4-40CB-9A1C-19B827A90265}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{1FB827CF-5D00-40E1-AC7C-985474FC750A}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{CCDDE7B3-5E87-4DAF-A244-DED7287CBE11}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{EC8E278D-4838-4EE3-93BA-CBC9A0BA8AE4}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "{AD8E3901-A158-4A3F-821F-C99754C2C917}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "{63F025D1-B60B-4B47-A5B0-54457738B9B3}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{EBB36171-16AE-4355-8300-3A54AD96903C}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{B4E0DFE4-F1BB-4061-A8D3-511C451FCDF3}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{5798E201-550D-4C36-93A9-53C4ABEB9803}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{EDB28EC4-15E9-4D6C-92E1-F765466E9CA7}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{5EDD7D17-E07C-4A2E-8DDA-474E11476220}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{C3FD154C-C680-41FA-9D4C-00AF5D60BFA9}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{6D36E7FF-2BCE-4E03-BF83-B6A0A33DC36E}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{638103A7-5F79-49D7-A800-106A79F5F714}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "{9DA55446-CE37-42F3-A3AB-EDC9AC58E37A}"= UDP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III "{2F1B791E-125E-4676-8BC9-C7376EF67D1C}"= TCP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III "TCP Query User{AB4DA13B-A8EE-490C-B94D-DBC893B12F39}c:\program files\azureus\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus "UDP Query User{4701FED6-0B75-4404-AD26-7F3F6C176596}c:\program files\azureus\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus "TCP Query User{FCF347F4-4850-4B6E-8378-7A9C5F8DAACE}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{403422EC-0B56-49BF-AFA9-AF5C39386842}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{7B231355-91EC-4DF4-9B01-B2E1CFDFF4E4}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule "UDP Query User{633F1F87-CA0A-49B3-8A22-26D809151477}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule "TCP Query User{6279BC70-B4A4-4A66-A19D-BCE7869E0E4E}c:\program files\team17\worms armageddon\wa.exe"= UDP:c:\program files\team17\worms armageddon\wa.exe:Worms Armageddon "UDP Query User{00F48F3C-6725-4589-B9EC-01832517A27C}c:\program files\team17\worms armageddon\wa.exe"= TCP:c:\program files\team17\worms armageddon\wa.exe:Worms Armageddon "TCP Query User{A61540CE-73E1-43CB-9DEC-BA9F868EB181}c:\program files\team17\worms 2\frontend.exe"= UDP:c:\program files\team17\worms 2\frontend.exe:Worms 2 Frontend "UDP Query User{5A5194CB-D36F-417A-83E6-EA53C2CB85B6}c:\program files\team17\worms 2\frontend.exe"= TCP:c:\program files\team17\worms 2\frontend.exe:Worms 2 Frontend "TCP Query User{7F40AA1D-A37D-4098-88EB-EFD8F2BBE1EF}c:\program files\azureus\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus "UDP Query User{F7EB5A9D-8A39-4B20-A5E0-688CAB44C1F9}c:\program files\azureus\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus "TCP Query User{A53B07B8-5311-41E0-A0EF-E42877139A20}c:\program files\quake iii arena\quake3.exe"= UDP:c:\program files\quake iii arena\quake3.exe:quake3 "UDP Query User{E25A91CF-7720-4220-A0DB-1B8A9B16139B}c:\program files\quake iii arena\quake3.exe"= TCP:c:\program files\quake iii arena\quake3.exe:quake3 "{6A7A8727-9C46-4363-B2BC-F04B393E9746}"= UDP:54178:Azureus 54178 TCP "{EA6E3AF1-15DC-4C8A-B2CB-FBABBBF4B571}"= TCP:54178:Azureus 54178 UDP "TCP Query User{A2D16300-ED91-487C-9D67-9013488E805B}c:\program files\quake iii arena\quake3.exe"= UDP:c:\program files\quake iii arena\quake3.exe:quake3 "UDP Query User{14B3F83F-7556-44E2-85DE-CF36694C972D}c:\program files\quake iii arena\quake3.exe"= TCP:c:\program files\quake iii arena\quake3.exe:quake3 "TCP Query User{19216D63-D30C-43D2-9746-D6C518AF2AF1}c:\users\loulou\downloads\team 17\wa\[pc game] worms armageddon + all weapons unblocked + cracked + xp patch by lupen[fumai]\wormsarm\wa.exe"= UDP:c:\users\loulou\downloads\team 17\wa\[pc game] worms armageddon + all weapons unblocked + cracked + xp patch by lupen[fumai]\wormsarm\wa.exe:wa.exe "UDP Query User{0961AA07-7C08-428F-9060-78801F99F16E}c:\users\loulou\downloads\team 17\wa\[pc game] worms armageddon + all weapons unblocked + cracked + xp patch by lupen[fumai]\wormsarm\wa.exe"= TCP:c:\users\loulou\downloads\team 17\wa\[pc game] worms armageddon + all weapons unblocked + cracked + xp patch by lupen[fumai]\wormsarm\wa.exe:wa.exe "TCP Query User{62357B01-BF68-4238-95A6-51339425AFBD}c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe"= UDP:c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe:start.exe "UDP Query User{CF0B450E-B97B-4F13-ACCB-284A9D947B5B}c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe"= TCP:c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe:start.exe "TCP Query User{268C976C-DD0C-4C07-9D9E-3DCBA3A89798}c:\windows\system32\dplaysvr.exe"= UDP:c:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay "UDP Query User{86F58307-0F6D-432A-9B6E-63F4BAD95F7F}c:\windows\system32\dplaysvr.exe"= TCP:c:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay "TCP Query User{E6BCEB50-C2BB-4430-8607-40DC8C60425B}c:\program files\konami\pro evolution soccer 6\pes6.exe"= UDP:c:\program files\konami\pro evolution soccer 6\pes6.exe:pes6.exe "UDP Query User{B3423FC6-4B47-4B69-A9AB-8ED5ACC1461E}c:\program files\konami\pro evolution soccer 6\pes6.exe"= TCP:c:\program files\konami\pro evolution soccer 6\pes6.exe:pes6.exe "TCP Query User{F2DE20D8-445E-49EE-8E1A-6E231E227523}c:\program files\veoh networks\veoh\veohclient.exe"= UDP:c:\program files\veoh networks\veoh\veohclient.exe:Veoh Client "UDP Query User{C6CE2BEB-45DB-485E-AB8D-E8797F673ABF}c:\program files\veoh networks\veoh\veohclient.exe"= TCP:c:\program files\veoh networks\veoh\veohclient.exe:Veoh Client "{B3DF7D74-8051-4962-9744-01FE9583D90F}"= UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "{E61208E1-7405-470E-9BBC-E0F0917C0A09}"= TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "TCP Query User{B73D7D1E-F16B-4E4D-89DE-5F53DC65ABBC}c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe"= UDP:c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe:start.exe "UDP Query User{3736A79C-E40B-47FA-A4DE-BA0D9F62FC3B}c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe"= TCP:c:\users\loulou\downloads\team 17\worms 2\worms2\start.exe:start.exe "TCP Query User{AFBDCDAC-AF9B-49E3-B7BA-2BB93701C6A5}c:\program files\lionhead studios ltd\black & white\runblack.exe"= UDP:c:\program files\lionhead studios ltd\black & white\runblack.exe:lh "UDP Query User{0A85C32D-3C81-4A45-B95F-D29B42823984}c:\program files\lionhead studios ltd\black & white\runblack.exe"= TCP:c:\program files\lionhead studios ltd\black & white\runblack.exe:lh "{8256E9E7-A9E5-46DE-AC62-79E4D0C23F6A}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{C10322C9-CDDA-4817-B67C-DD28B639CE65}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{D746BEDF-95CD-404E-844D-7BF0D0846D3D}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{A6ED5F3F-54EC-485D-A961-D89D55A8AD9D}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{29485F5D-2DFC-4AF6-981C-A75A77A5A930}"= UDP:86:BroadCam Web Server "TCP Query User{01CE8517-2F48-4C6A-80C6-C9A2C6F14080}c:\program files\konami\pro evolution soccer 2009\pes2009.exe"= UDP:c:\program files\konami\pro evolution soccer 2009\pes2009.exe:Pro Evolution Soccer 2009 "UDP Query User{71186C0B-7559-4592-BB18-F1D5A7AF7290}c:\program files\konami\pro evolution soccer 2009\pes2009.exe"= TCP:c:\program files\konami\pro evolution soccer 2009\pes2009.exe:Pro Evolution Soccer 2009 "TCP Query User{796B2BA3-88EC-4BA9-AF28-B9C4B83C50A1}c:\program files\activision\call of duty - world at war\codwaw.exe"= UDP:c:\program files\activision\call of duty - world at war\codwaw.exe:Call of Duty(R): World at War Campaign/Coop "UDP Query User{5D1DBAD9-01F0-40FB-AEFD-5F98F99719E8}c:\program files\activision\call of duty - world at war\codwaw.exe"= TCP:c:\program files\activision\call of duty - world at war\codwaw.exe:Call of Duty(R): World at War Campaign/Coop "{2B832080-D4C4-48F2-93F5-F2F6F3201887}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{B189AA1A-FDC7-4A67-80BF-374CF7DAC4D3}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "TCP Query User{03E9CCCC-2B08-4569-A462-1F9BC21107D5}c:\users\loulou\desktop\utorrent(3).exe"= UDP:c:\users\loulou\desktop\utorrent(3).exe:utorrent(3).exe "UDP Query User{267DCBB3-0FBD-45D4-B535-5A0EC136488A}c:\users\loulou\desktop\utorrent(3).exe"= TCP:c:\users\loulou\desktop\utorrent(3).exe:utorrent(3).exe "{4985F146-DD4A-47C1-A756-53184DCAD5D8}"= UDP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe:Burnout(TM) Paradise The Ultimate Box "{93CE50F5-6604-454E-B759-8B05F33DB9EF}"= TCP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutLauncher.exe:Burnout(TM) Paradise The Ultimate Box "{F20BECCB-339D-48F3-8503-CDC08787DD26}"= UDP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe:Burnout(TM) Paradise The Ultimate Box "{46C1667B-342F-4E29-B901-6DF0B5C6EEDC}"= TCP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutConfigTool.exe:Burnout(TM) Paradise The Ultimate Box "{FB9FA2DF-6440-4CB7-8934-29242926DA81}"= UDP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe:Burnout(TM) Paradise The Ultimate Box "{3CF15280-DC5B-4969-9AB0-2000057AD22D}"= TCP:c:\program files\Electronic Arts\Burnout(TM) Paradise The Ultimate Box\BurnoutParadise.exe:Burnout(TM) Paradise The Ultimate Box "TCP Query User{95C8A65C-DEE4-4B84-BB11-3FF9E68C5581}c:\users\loulou\desktop\utorrent(3).exe"= UDP:c:\users\loulou\desktop\utorrent(3).exe:utorrent(3).exe "UDP Query User{45963564-7CA4-4DD1-8B54-A006626DDE0C}c:\users\loulou\desktop\utorrent(3).exe"= TCP:c:\users\loulou\desktop\utorrent(3).exe:utorrent(3).exe "TCP Query User{1D193859-A5F3-4231-B897-27832AB422EC}c:\program files\metin2_france\metin2.bin"= UDP:c:\program files\metin2_france\metin2.bin:metin2.bin "UDP Query User{CFA81A6E-E4CD-421F-B3E9-99936B898C23}c:\program files\metin2_france\metin2.bin"= TCP:c:\program files\metin2_france\metin2.bin:metin2.bin "{6807E4D8-EFB9-4E6C-BD3B-8AA6FBA92E51}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{EAB1B2B1-34AE-4D29-8678-41D8F0F44B8F}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{E063BF09-18B0-49F6-9CF0-7F951E3350CA}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{C057C0CD-CE79-4393-9F0C-CD2CED382692}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{975380A9-50EE-4224-AD8D-6B2B4D7B8D98}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{E862D3AF-578E-4771-AE1F-644932B31423}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{2DB3449F-5FB7-432E-9F2E-BCEBEBD75BA5}"= UDP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{B6C1FA57-A689-40E6-8705-C0D79BCF6A6A}"= UDP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{6E583829-3301-4128-847E-851E2B2DA779}"= TCP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{5FF42E84-A5F2-4E0D-B045-EE087F8AD603}"= TCP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{EEC57245-2497-497D-A186-DF4608AAD21B}"= UDP:c:\windows\System32\5wW42d14.exe:5wW42d14 "{83151526-3DF1-4D49-913E-437D125787EE}"= TCP:c:\windows\System32\5wW42d14.exe:5wW42d14 "{805B1508-F998-4396-BD33-E739D6C125A4}"= UDP:c:\windows\System32\wbem\WmiPrvSE.exe:wmiprvse "{914AE9F4-9D1F-4F89-A8F8-5E17A1AB727E}"= TCP:c:\windows\System32\wbem\WmiPrvSE.exe:wmiprvse "{5C67F97D-6A98-426E-B1B1-85316B635131}"= UDP:c:\windows\System32\wbem\WmiPrvSE.exe:wmiprvse "{4168A88D-1452-47B4-BE79-DFC5C24395C9}"= TCP:c:\windows\System32\wbem\WmiPrvSE.exe:wmiprvse "{D8682D4D-DEBC-4C2F-951F-16F499D342C0}"= c:\program files\Skype\Phone\Skype.exe:Skype "{4557A85A-2066-46C9-A0BA-FA95E2CEEE7D}"= UDP:c:\program files\Sony\VAIO Event Service\VESMgr.exe:VESMgr "{6EE2652E-5AE9-40F2-AE99-4604845C1472}"= TCP:c:\program files\Sony\VAIO Event Service\VESMgr.exe:VESMgr "{34F41E8F-390E-4950-8418-AD4623CAEDF8}"= UDP:c:\program files\Sony\VAIO Power Management\SPMgr.exe:SPMgr "{82061BCF-225E-4552-B1AA-2135D1936CEC}"= TCP:c:\program files\Sony\VAIO Power Management\SPMgr.exe:SPMgr "{2D586C79-B7EE-4711-996E-FD2FF878FBD5}"= UDP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{CE459480-564C-4F02-8A4F-9D16E42E4B8B}"= TCP:c:\windows\servicing\TrustedInstaller.exe:TrustedInstaller "{F6D32E9E-3533-45ED-850B-C386B37F0667}"= UDP:c:\program files\Panda Security\Panda Antivirus 2008\PsCtrlS.exe:PsCtrls "{7048C1B2-FD0C-4C89-93F3-D38ADBCCD58C}"= TCP:c:\program files\Panda Security\Panda Antivirus 2008\PsCtrlS.exe:PsCtrls "{643B49A4-60C5-440C-9A5F-1262119FBDD8}"= UDP:c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe:iviRegMgr "{F7DAF92E-3101-4D98-981E-94298B60124D}"= TCP:c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe:iviRegMgr "{F1BCBA2E-7F56-4205-B1C5-D4DB675C6F18}"= UDP:c:\program files\Panda Security\Panda Antivirus 2008\AVENGINE.EXE:AVENGINE "{CFC00A38-4EE1-4FBB-A0AA-CC6E1245E986}"= TCP:c:\program files\Panda Security\Panda Antivirus 2008\AVENGINE.EXE:AVENGINE "{C485B050-BD6B-470F-9503-884A993D6265}"= UDP:c:\windows\System32\taskeng.exe:taskeng "{ECDBF387-3AB2-4279-B2E7-C2FF9999558F}"= TCP:c:\windows\System32\taskeng.exe:taskeng "{ADE092F2-A599-47CA-86AF-4A6E999B4B40}"= UDP:c:\windows\System32\winlogon.exe:winlogon "{A1B71AE8-6618-40D2-91C7-6A615A89E954}"= TCP:c:\windows\System32\winlogon.exe:winlogon "{0FA21FA3-E919-48AC-A599-BC5ABBCD5483}"= UDP:c:\program files\Common Files\Panda Software\PavShld\PavPrSrv.exe:pavprsrv "{527FD804-8D67-4D25-8653-4865F8BCFB6B}"= TCP:c:\program files\Common Files\Panda Software\PavShld\PavPrSrv.exe:pavprsrv "{75BDDC4F-8419-4935-80E4-17434A0B43D4}"= UDP:c:\windows\System32\lsass.exe:lsass "{EA632934-E1C6-4383-B41E-C8AE85E0BC61}"= TCP:c:\windows\System32\lsass.exe:lsass "{842A5BB6-C7DC-4285-8E02-739B7BE664AE}"= UDP:c:\windows\System32\spoolsv.exe:spoolsv "{9C64DFC3-EC16-4AF7-8475-7DE62DF5F8D3}"= TCP:c:\windows\System32\spoolsv.exe:spoolsv "{C563884D-4A55-4D4E-B2E2-B0205CA7F4E3}"= UDP:c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe:AppleMobileDeviceService "{946CA4DB-56FB-4D40-8B3A-0615AC147577}"= TCP:c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe:AppleMobileDeviceService "{4456CC5F-7200-4B6C-BBC4-8EAC35F937BA}"= UDP:c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe:Switcher "{4DC2FDD4-F92E-4715-81D1-86BD88148202}"= UDP:c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe:Switcher "{0ADCE7C6-06D8-4E50-9633-2C089D3F8D2F}"= TCP:c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe:Switcher "{7DB979B6-141A-417A-8B7E-566E5266F663}"= TCP:c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe:Switcher "{8898B726-42C4-4ED2-80C4-6739134F6249}"= UDP:c:\windows\System32\wininit.exe:wininit "{6F64A62E-75D3-4336-8992-86C981F49A1E}"= TCP:c:\windows\System32\wininit.exe:wininit "{596D8D2D-9BD2-46D7-8C0B-53F63DD658B3}"= UDP:c:\windows\System32\wininit.exe:wininit "{95F864A4-6100-4F82-A075-A6F4B019B698}"= TCP:c:\windows\System32\wininit.exe:wininit "{6FB8DFCB-6528-4B6D-963A-72798E1338AE}"= UDP:c:\users\LOULOU\AppData\Local\Temp\7zS699D.tmp\SymNRT.exe:Norton Removal Tool "{D4783602-B593-4D67-A2D0-5033025F24A0}"= TCP:c:\users\LOULOU\AppData\Local\Temp\7zS699D.tmp\SymNRT.exe:Norton Removal Tool R2 regi;regi;c:\windows\System32\drivers\regi.sys [2007-04-17 11032] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2008-05-30 1153368] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\System32\drivers\btwl2cap.sys [2007-07-20 28464] R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\System32\drivers\R5U870FLx86.sys [2007-07-21 75008] R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\System32\drivers\R5U870FUx86.sys [2007-07-21 43904] R3 ti21sony;ti21sony;c:\windows\System32\drivers\ti21sony.sys [2007-07-21 812544] S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-07-23 29744] S3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [2007-08-08 415392] S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-08-08 745472] S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-08-08 397312] S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-08-08 1089536] S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2007-08-08 292152] S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2007-08-08 79736] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3641152b-bace-11dc-ae9e-001bfb5784a2}] \shell\AutoRun\command - setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57ed34ba-8934-11dc-9142-806e6f6e6963}] \shell\AutoRun\command - F:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7dda2a3c-3d85-11dd-9f05-001bfb5784a2}] \shell\AutoRun\command - H:\LaunchU3.exe -a . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.repubblica.it/ mStart Page = hxxp://fr.yahoo.com uInternet Settings,ProxyOverride = *.local IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm Trusted Zone: canalplay.com Trusted Zone: canalplusactive.com Trusted Zone: canalplay.com Trusted Zone: canalplusactive.com DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab FF - ProfilePath - c:\users\LOULOU\AppData\Roaming\Mozilla\Firefox\Profiles\nnqj9sev.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll ---- PARAMETRES FIREFOX ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.allow_platform_file_picker", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.hideGoButton", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.enabled", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.remoteLookups", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.updateURL", "http://sb.google.com/safebrowsing/update?client={moz:client}&appver={moz:version}&"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.lookupURL", "http://sb.google.com/safebrowsing/lookup?sourceid=firefox-antiphish&features=TrustRank&client={moz:client}&appver={moz:version}&"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.reportURL", "http://sb.google.com/safebrowsing/report?"); . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-09 15:11:07 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... c:\windows\TEMP\TMP0000005F5C33EC953FE4474E 524288 bytes executable Scan terminé avec succès Fichiers cachés: 1 ************************************************************************** . Heure de fin: 2009-04-09 15:13:20 ComboFix-quarantined-files.txt 2009-04-09 13:13:18 ComboFix2.txt 2009-04-08 19:36:53 ComboFix3.txt 2009-04-08 15:17:24 Avant-CF: 22,891,753,472 octets libres Après-CF: 22,873,739,264 octets libres 403 --- E O F --- 2009-04-08 19:14:05 RAPPORT HIJACKJIS Logfile of random's system information tool 1.06 (written by random/random) Run by LOULOU at 2009-04-09 15:16:46 Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1 System drive C: has 21 GB (12%) free of 180 GB Total RAM: 2046 MB (52% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 03:17:03 PM, on 09/04/2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\Apoint\Apoint.exe C:\Windows\system32\taskeng.exe C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe C:\Program Files\Sony\ISB Utility\ISBMgr.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\WordWeb\wweb32.exe C:\Program Files\Apoint\ApMsgFwd.exe C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe C:\Program Files\Apoint\Apntex.exe C:\Windows\system32\conime.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Windows\Explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\LOULOU\Desktop\RSIT.exe C:\Program Files\trend micro\LOULOU.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.repubblica.it/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: (no name) - {D0943516-5076-4020-A3B5-AEFAF26AB263} - (no file) O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = LOULOU\AppData\Local\Temp\{69F91187-803B-416A-8B25-186FFB893E10}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe O4 - Global Startup: BTTray.lnk = ? O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O13 - Gopher Prefix: O15 - Trusted Zone: *.canalplay.com O15 - Trusted Zone: *.canalplusactive.com O15 - Trusted Zone: *.canalplay.com (HKLM) O15 - Trusted Zone: *.canalplusactive.com (HKLM) O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: Service CANALPLAY - Canal+ Active - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\stacsv.exe O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

shaiko · Answer

ps: mon internet explorer ne marche pas completement ce qui emepche les antivirus en ligne de pouvoir fonctionner par ex dans IE je ne peux pas voir le logo des icones presents sur les pages web .... j'ai meme installé la derniere version (la 8) mais le probleme persiste .... du coup je navigue sous firefox

jlpjlp · Answer

tu as mal fais le glissé de combofix. Il faudra le refaire . Sinon j'attends le scan en ligne. À plus

jlpjlp · Answer

Tu as mal fais le glissé de combofix. Il faudra le refaire . 
et
alors fais un scan en ligne chez panda avec firefox:


http://pandasoftware.fr

ou

http://www.nam.fr/info-securite/ScanVirus.htm

ou ici
	
https://www.trendmicro.com/fr_fr/business.html

shaiko · Answer

salut jlp jlp

shaiko · Answer

salut jlpjlp,

je viens de refaire la manip, mais je n'ai toujours pas vu le tapez 1 ou taepez 2. je ne sais pas ce qui se passe c'est la premiere fois que ca me fait ca alors que j'ai deja fait ce genre d'operation

ven plus quand je veux coller le nouveau rapport le forum me l'empeche en disanr que j'ai deja posté le message,,,enfin c'esr bizarre

bon je vais te faire le scan en ligne

a toute

shaiko · Answer

salut jlpjlp,

voici le rapport en ligne avec panda

;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-04-11 13:01:27
PROTECTIONS: 2
MALWARE: 7
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Spybot - Search and Destroy                  1.0.0.6                       No        No
Windows Defender                             1.1.1505.0                    No        Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Users\LOULOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\loulou@ad.yieldmanager[1].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Users\LOULOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\loulou@serving-sys[1].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Users\LOULOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\loulou@bs.serving-sys[2].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Users\LOULOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\loulou@smartadserver[1].txt
00538316  Trj/Downloader.VHA                 Virus/Trojan        No        1         Yes            No           C:\Windows\System32\5wW42d14.exe
03074964  Trj/CI.A                           Virus/Trojan        No        0         Yes            No           C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1V5LTGXJ\atgdriijjk[1].htm
03429845  Bck/Hupigon.AZG                    Virus/Trojan        No        1         Yes            No           C:\Program Files\Image-Line\Toxic Biohazard\Toxic Biohazard.dll
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ^&#65533;m&#65533;8&#65533;	39
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ^&#65533;m&#65533;8&#65533;	39
;===================================================================================================================================================================================
;===================================================================================================================================================================================

shaiko · Answer

au fait windows defender vient de m'enlever un trojan la... il m'a conseillé de supprimer, j'ai accepté et a dit que l'operation etait reussie, donc il y a un fichier dangereux en moins ... je t'informe au cas ou ca pourrait t'interresser

le fichier enlevé est

C:\Windows\system32\hikenuse.dll

jlpjlp · Answer

télécharge OTMoveIt 
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved. 
(attention bien mettre :files)

:files
C:\Windows\System32\5wW42d14.exe
C:\Windows\System32\config\systemprofile\AppData\Local\Micro­soft\Windows\Temporary Internet Files\Content.IE5\1V5LTGXJ\atgdriijjk[1].htm
C:\Program Files\Image-Line\Toxic Biohazard\Toxic Biohazard.dll 
c:\programdata	iyunike
c:\programdata\linanotu
c:\programdata\fubatuzo
c:\windows\System32\drivers\sifzbtej.sys
c:\programdata	oladeya
c:\programdata\goyipeme
c:\programdata\mofanedo
c:\programdata\wimohigi
c:\programdata\herutoho
c:\programdata\fenozano
c:\programdata\yubiwojo
c:\programdata
iyihese
c:\programdata\govegomu
c:\programdata
ojibipu
c:\programdata\ezsidmv.dat
c:\programdata\zotowuru
c:\programdata\yinuyoni
c:\programdataetegefu
c:\programdata\hewalote
c:\programdata\delehele
c:\programdata\betakoso
c:\programdata\mevozeha
c:\programdata\feyiloto
C:\Users\All Users\ezsidmv.dat 
:commands
[purity]
[emptytemp]
[start explorer]



clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 


_______________________

remets un rapport combofix

a plus

shaiko · Answer

yo,

tout a bien fonctionné, voici le rapport de OTmoveIT

========== FILES ==========
File/Folder C:\Windows\System32\5wW42d14.exe not found.
File/Folder C:\Windows\System32\config\systemprofile\AppData\Local\Micro­­soft\Windows\Temporary Internet Files\Content.IE5\1V5LTGXJ\atgdriijjk[1].htm not found.
File/Folder C:\Program Files\Image-Line\Toxic Biohazard\Toxic Biohazard.dll not found.
c:\programdata	iyunike moved successfully.
c:\programdata\linanotu moved successfully.
c:\programdata\fubatuzo moved successfully.
File/Folder c:\windows\System32\drivers\sifzbtej.sys not found.
c:\programdata	oladeya moved successfully.
c:\programdata\goyipeme moved successfully.
c:\programdata\mofanedo moved successfully.
c:\programdata\wimohigi moved successfully.
c:\programdata\herutoho moved successfully.
c:\programdata\fenozano moved successfully.
c:\programdata\yubiwojo moved successfully.
c:\programdata
iyihese moved successfully.
c:\programdata\govegomu moved successfully.
c:\programdata
ojibipu moved successfully.
File/Folder c:\programdata\ezsidmv.dat not found.
c:\programdata\zotowuru moved successfully.
c:\programdata\yinuyoni moved successfully.
c:\programdataetegefu moved successfully.
c:\programdata\hewalote moved successfully.
c:\programdata\delehele moved successfully.
c:\programdata\betakoso moved successfully.
c:\programdata\mevozeha moved successfully.
c:\programdata\feyiloto moved successfully.
File/Folder C:\Users\All Users\ezsidmv.dat not found.
========== COMMANDS ==========
File delete failed. C:\Users\LOULOU\AppData\Local\Temp\etilqs_XSuVyFAYAQ2VdPAwPKVe scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
Windows Temp folder emptied.
File delete failed. C:\Users\LOULOU\AppData\Local\Mozilla\Firefox\Profiles
nqj9sev.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Users\LOULOU\AppData\Local\Mozilla\Firefox\Profiles
nqj9sev.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Users\LOULOU\AppData\Local\Mozilla\Firefox\Profiles
nqj9sev.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Users\LOULOU\AppData\Local\Mozilla\Firefox\Profiles
nqj9sev.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Users\LOULOU\AppData\Local\Mozilla\Firefox\Profiles
nqj9sev.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Users\LOULOU\AppData\Local\Mozilla\Firefox\Profiles
nqj9sev.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.10.0 log created on 04112009_191420

shaiko · Answer

Voici ComboFix ComboFix 09-04-04.01 - LOULOU 2009-04-11 19:20:51.5 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2046.1301 [GMT 2:00] Lancé depuis: c:\users\LOULOU\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((( Fichiers créés du 2009-03-11 au 2009-04-11 )))))))))))))))))))))))))))))))))))) . 2009-04-11 19:14 . 2009-04-11 19:14 d-------- C:\_OTMoveIt 2009-04-11 00:06 . 2008-06-19 16:24 28,544 --a------ c:\windows\System32\drivers\pavboot.sys 2009-04-10 20:58 . 2009-04-10 21:27 d-------- c:\users\LOULOU\.housecall6.6 2009-04-09 15:40 . 2009-04-09 15:40 d--h----- c:\windows\msdownld.tmp 2009-04-09 15:21 . 2009-04-09 15:21 d-------- c:\windows\System32\Kaspersky Lab 2009-04-08 16:59 . 2009-04-08 17:09 308,852,947 --a------ c:\windows\MEMORY.DMP 2009-04-08 16:41 . 2009-04-08 16:41 d-------- c:\programdata\NortonInstaller 2009-04-08 13:23 . 2009-04-08 13:23 d-------- C: sit 2009-04-08 13:23 . 2009-04-09 15:16 d-------- c:\program files rend micro 2009-04-07 23:09 . 2008-06-20 03:14 781,344 --a------ c:\windows\System32\PresentationNative_v0300.dll 2009-04-07 23:09 . 2008-06-20 03:14 622,080 --a------ c:\windows\System32\icardagt.exe 2009-04-07 23:09 . 2008-06-20 03:14 326,160 --a------ c:\windows\System32\PresentationHost.exe 2009-04-07 23:09 . 2008-06-20 03:14 105,016 --a------ c:\windows\System32\PresentationCFFRasterizerNative_v0300.dll 2009-04-07 23:09 . 2008-06-20 03:14 97,800 --a------ c:\windows\System32\infocardapi.dll 2009-04-07 23:09 . 2008-06-20 03:14 43,544 --a------ c:\windows\System32\PresentationHostProxy.dll 2009-04-07 23:09 . 2008-06-20 03:14 37,384 --a------ c:\windows\System32\infocardcpl.cpl 2009-04-07 23:09 . 2008-06-20 03:14 11,264 --a------ c:\windows\System32\icardres.dll 2009-04-07 23:05 . 2009-04-07 23:05 0 --a------ c:\windows\RAVTC.TMP 2009-04-07 23:02 . 2008-07-27 20:03 282,112 --a------ c:\windows\System32\mscoree.dll 2009-04-07 23:02 . 2008-07-27 20:03 96,760 --a------ c:\windows\System32\dfshim.dll 2009-04-07 23:02 . 2008-07-27 20:03 41,984 --a------ c:\windows\System32 etfxperf.dll 2009-04-07 23:01 . 2008-07-27 20:03 158,720 --a------ c:\windows\System32\mscorier.dll 2009-04-07 23:01 . 2008-07-27 20:03 83,968 --a------ c:\windows\System32\mscories.dll 2009-04-07 22:58 . 2009-04-07 22:58 410,984 --a------ c:\windows\System32\deploytk.dll 2009-04-07 22:57 . 2009-04-07 22:57 0 --------- c:\windows\PAVSHRB.INI 2009-04-07 22:22 . 2009-04-07 22:22 d-------- c:\users\LOULOU\AppData\Roaming\Malwarebytes 2009-04-07 22:22 . 2009-04-07 22:22 d-------- c:\programdata\Malwarebytes 2009-04-07 22:22 . 2009-04-07 22:24 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-04-07 22:22 . 2009-04-06 15:32 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2009-04-07 22:22 . 2009-04-06 15:32 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2009-04-03 14:00 . 2009-04-07 22:36 d-------- c:\programdata\zulagovi 2009-04-03 00:13 . 2009-04-07 00:00 d-------- c:\users\LOULOU\AppData\Roaming\skypePM 2009-04-03 00:12 . 2009-04-03 00:12 dr------- c:\program files\Skype 2009-04-03 00:12 . 2009-04-03 00:12 d-------- c:\program files\Common Files\Skype 2009-03-11 21:08 . 2009-03-11 21:08 d-------- c:\program files\GSC Game World 2009-03-11 21:06 . 2009-03-11 21:06 d-------- c:\users\LOULOU\AppData\Roaming\DAEMON Tools Pro 2009-03-11 21:06 . 2009-03-11 21:06 d-------- c:\programdata\DAEMON Tools Lite 2009-03-11 21:06 . 2009-03-11 21:06 d-------- c:\program files\DAEMON Tools Lite 2009-03-11 20:45 . 2009-03-11 21:06 d-------- c:\users\LOULOU\AppData\Roaming\DAEMON Tools Lite 2009-03-11 20:26 . 2009-03-11 20:26 d-------- c:\programdata\Roxio 2009-03-11 20:24 . 2009-03-11 20:26 d-------- c:\users\LOULOU\AppData\Roaming\Roxio 2009-03-11 19:13 . 2009-03-11 19:14 d-------- c:\users\LOULOU\AppData\Roaming\SPORE 2009-03-11 19:11 . 2009-03-11 19:11 dr-h----- c:\users\LOULOU\AppData\Roaming\SecuROM 2009-03-11 10:52 . 2008-12-16 05:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL 2009-03-11 10:52 . 2008-12-16 07:31 7,680 --a------ c:\windows\System32\spwmp.dll 2009-03-11 10:52 . 2008-12-16 07:31 4,096 --a------ c:\windows\System32\msdxm.ocx 2009-03-11 10:52 . 2008-12-16 07:31 4,096 --a------ c:\windows\System32\dxmasf.dll 2009-03-11 10:51 . 2009-02-09 05:10 2,033,152 --a------ c:\windows\System32\win32k.sys 2009-03-11 10:51 . 2008-11-27 06:43 268,288 --a------ c:\windows\System32\schannel.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-11 15:56 223,910 ----a-w c:\users\LOULOU\AppData\Roaming vModes.dat 2009-04-10 22:06 --------- d-----w c:\program files\Panda Security 2009-04-10 15:35 --------- d-----w c:\users\LOULOU\AppData\Roaming\uTorrent 2009-04-07 20:57 --------- d-----w c:\program files\Java 2009-04-07 20:48 --------- d-----w c:\programdata\Spybot - Search & Destroy 2009-04-07 20:47 --------- d-----w c:\program files\Spybot - Search & Destroy 2009-04-07 19:47 --------- d-----w c:\program files\CCleaner 2009-04-06 23:30 --------- d-----w c:\users\LOULOU\AppData\Roaming\Skype 2009-04-02 22:12 --------- d-----w c:\programdata\Skype 2009-03-23 15:42 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-21 11:52 --------- d-----w c:\program files\Metin2_France 2009-03-12 18:38 --------- d-----w c:\program files\Windows Mail 2009-03-11 19:06 --------- d-----w c:\users\LOULOU\AppData\Roaming\DAEMON Tools 2009-03-11 18:45 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2009-03-11 17:03 --------- d-----w c:\program files\Electronic Arts 2009-03-08 11:34 914,944 ----a-w c:\windows\System32\wininet.dll 2009-03-08 11:34 43,008 ----a-w c:\windows\System32\licmgr10.dll 2009-03-08 11:33 420,352 ----a-w c:\windows\System32\vbscript.dll 2009-03-08 11:33 18,944 ----a-w c:\windows\System32\corpol.dll 2009-03-08 11:33 132,608 ----a-w c:\windows\System32\ieUnatt.exe 2009-03-08 11:33 109,568 ----a-w c:\windows\System32\PDMSetup.exe 2009-03-08 11:33 109,056 ----a-w c:\windows\System32\iesysprep.dll 2009-03-08 11:33 107,520 ----a-w c:\windows\System32\RegisterIEPKEYs.exe 2009-03-08 11:33 107,008 ----a-w c:\windows\System32\SetIEInstalledDate.exe 2009-03-08 11:33 103,936 ----a-w c:\windows\System32\SetDepNx.exe 2009-03-08 11:32 72,704 ----a-w c:\windows\System32\admparse.dll 2009-03-08 11:32 71,680 ----a-w c:\windows\System32\iesetup.dll 2009-03-08 11:32 66,560 ----a-w c:\windows\System32\wextract.exe 2009-03-08 11:32 169,472 ----a-w c:\windows\System32\iexpress.exe 2009-03-08 11:31 48,128 ----a-w c:\windows\System32\mshtmler.dll 2009-03-08 11:31 45,568 ----a-w c:\windows\System32\mshta.exe 2009-03-08 11:31 34,816 ----a-w c:\windows\System32\imgutil.dll 2009-03-08 11:22 156,160 ----a-w c:\windows\System32\msls31.dll 2009-03-01 21:25 --------- d-----w c:\programdata\Electronic Arts 2009-02-24 13:21 --------- d-----w c:\users\LOULOU\AppData\Roaming\Atari 2009-02-24 13:17 --------- d-----w c:\users\LOULOU\AppData\Roaming\Leadertech 2009-02-24 13:06 --------- d-----w c:\program files\Atari 2009-02-23 21:28 --------- d-----w c:\program files\uTorrent 2009-02-19 01:59 --------- d-----w c:\program files\Google 2009-02-17 07:54 --------- d-----w c:\program files\DivX 2009-01-20 13:24 174 --sha-w c:\program files\desktop.ini 2009-01-20 12:43 82,432 ----a-w c:\windows\System32\axaltocm.dll 2009-01-20 12:43 101,888 ----a-w c:\windows\System32\ifxcardm.dll 2008-06-01 21:35 5,682 ----a-w c:\users\LOULOU\AppData\Roaming\wklnhst.dat 2007-11-14 17:11 22,328 ----a-w c:\users\LOULOU\AppData\Roaming\PnkBstrK.sys 2008-11-16 22:35 122,880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll 2008-01-03 20:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-01-03 20:09 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-01-03 20:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((( SnapShot_2009-04-10_20.36.34.11 ))))))))))))))))))))))))))))))))))))))))) . - 2009-04-10 18:25:40 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-04-11 17:16:39 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-04-10 18:25:40 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-04-11 17:16:39 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2009-04-10 18:27:24 262,144 --sha-w c:\windows\ServiceProfiles\LocalService tuser.dat + 2009-04-11 17:18:19 262,144 --sha-w c:\windows\ServiceProfiles\LocalService tuser.dat + 2009-04-11 17:18:19 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService tuser.dat.LOG1 - 2009-04-10 18:27:29 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService tuser.dat + 2009-04-11 17:18:24 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService tuser.dat + 2009-04-11 17:18:24 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService tuser.dat.LOG1 + 2009-04-11 03:37:05 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{04298876-264A-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:08:29 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{05A4E276-2646-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:37:32 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{05CE1576-2607-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:08:54 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{06275DA6-2603-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:06:10 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{064D33B6-260B-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:34:49 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{06AF5416-260F-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 02:39:55 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{07F1B576-2642-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:19:32 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{09340A36-2626-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:11:21 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0A056776-263E-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:42:47 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0C81D5F6-263A-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:14:12 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0E25A756-2636-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:45:36 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0F9C3E96-2632-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:17:00 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{10C1E716-262E-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:48:23 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{111D3AB6-262A-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:29:41 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{121BCF96-261F-11DE-A754-001BFB5784A2}.dat + 2009-04-11 11:01:32 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1983E6C4-2688-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:58:41 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1FCF9AF6-2623-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:08:45 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2578FE36-261C-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:45:15 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{27FCB786-264B-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:16:40 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{29A3AD96-2647-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:45:42 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2A2568A6-2608-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:17:05 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2A320FA6-2604-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:14:21 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2A8258E6-260C-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 02:48:05 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2BE23856-2643-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:19:31 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2E101976-263F-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:50:56 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{305CEC76-263B-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:22:22 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{324CE9D6-2637-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:27:52 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3358E646-2627-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:53:46 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{33C5E276-2633-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:25:11 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3518C516-262F-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:56:35 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{365D5F76-262B-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:37:58 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3A9F76F6-2620-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:06:59 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{487BB9B6-2624-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:17:01 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4D4C7FD6-261D-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:24:50 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4DFCECF6-2648-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:25:15 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4EE03566-2605-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:53:53 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4EE827D6-2609-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:22:32 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4F657156-260D-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 02:56:15 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4FC6D456-2644-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:27:40 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{51EFF2B6-2640-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:59:06 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5424F7F6-263C-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:30:32 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5671CAF6-2638-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:01:57 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{57D09476-2634-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:33:21 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5944CA56-2630-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:04:45 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5A870356-262C-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:36:07 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5A8CA576-2628-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:46:13 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{61FBF3D6-2621-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:33:00 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{71F23296-2649-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:33:26 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{738C1136-2606-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 03:04:24 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{73B03316-2645-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:04:48 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{73B1AED6-2602-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:02:05 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{73D24526-260A-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 23:15:22 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7427C266-2625-11DE-A754-001BFB5784A2}.dat + 2009-04-10 20:30:44 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{74A21B76-260E-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 02:35:50 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{75F11F36-2641-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:07:16 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{78131976-263D-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:25:22 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{78801496-261E-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:38:42 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7A8D2696-2639-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:10:07 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7C03BDD6-2635-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:41:31 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7D8AFEB6-2631-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:12:55 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7E810BB6-262D-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:44:18 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7EE5E4D6-2629-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:54:32 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8B4EB2D6-2622-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:41:10 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{961713B6-264A-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:12:34 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{97A7DA16-2646-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:41:37 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{97F62916-2607-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:12:59 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{985AB416-2603-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:10:15 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{98651AB6-260B-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:38:55 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{990C8176-260F-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 02:44:00 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{99F24BB6-2642-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:15:26 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9BF7B576-263E-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:46:52 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9E78E6B6-263A-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:23:44 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9F327266-2626-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:18:17 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A03BA9F6-2636-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:49:41 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A1BE2816-2632-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:21:06 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A30523D6-262E-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:52:30 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A463ED56-262A-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:33:49 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A65ED3F6-261F-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:02:51 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B438B556-2623-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:12:52 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B9618E56-261C-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:20:45 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BBFC56B6-2647-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:21:10 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BC815A56-2604-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:49:48 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BCAC8C36-2608-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:18:26 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BCE02286-260C-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 02:52:10 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BDCD6236-2643-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:23:36 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BFFDA4B6-263F-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:55:01 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C239CE16-263B-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:26:27 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C45E29B6-2637-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:57:51 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C5C41756-2633-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:29:16 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C72A04F6-262F-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:32:01 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C7F879F6-2627-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:00:40 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C888CE76-262B-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:42:06 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{CE409DD6-2620-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:11:13 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{DFB151F6-2624-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:28:55 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{DFFB21D6-2648-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:57:59 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E12D6066-2609-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:29:21 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E17059A6-2605-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:26:38 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E1983356-260D-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:00:43 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E1A2D056-2601-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 03:00:20 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E1B92256-2644-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:31:45 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E3F2EA56-2640-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:21:14 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E41E1E56-261D-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:03:11 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E60DC076-263C-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:34:37 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E8987736-2638-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:06:02 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EA07EA56-2634-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:37:26 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EB703956-2630-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:08:50 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EC8C5C56-262C-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:40:12 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{ECC199F6-2628-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:50:21 4,096 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F5CF1796-2621-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:37:05 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{04298875-264A-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:08:29 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{05A4E275-2646-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:37:32 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{05CE1575-2607-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:08:54 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{06275DA5-2603-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:06:10 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{064D33B5-260B-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:34:49 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{06AF5415-260F-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 02:39:55 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{07F1B575-2642-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:19:32 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{09340A35-2626-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:11:21 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0A056775-263E-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:42:47 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0C81D5F5-263A-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:14:12 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0E25A755-2636-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:45:36 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0F9C3E95-2632-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:17:00 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{10C1E715-262E-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:48:23 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{111D3AB5-262A-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:29:41 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{121BCF95-261F-11DE-A754-001BFB5784A2}.dat + 2009-04-11 11:01:32 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1983E6C3-2688-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:58:41 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1FCF9AF5-2623-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:08:45 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2578FE35-261C-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:45:15 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{27FCB785-264B-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:16:40 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{29A3AD95-2647-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:45:42 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2A2568A5-2608-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:17:05 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2A320FA5-2604-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:14:21 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2A8258E5-260C-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 02:48:05 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2BE23855-2643-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:19:31 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2E101975-263F-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:50:56 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{305CEC75-263B-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:22:22 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{324CE9D5-2637-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:27:52 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3358E645-2627-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:53:46 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{33C5E275-2633-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:25:11 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3518C515-262F-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:56:35 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{365D5F75-262B-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:37:58 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3A9F76F5-2620-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:06:59 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{487BB9B5-2624-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:17:01 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4D4C7FD5-261D-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:24:50 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4DFCECF5-2648-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:25:15 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4EE03565-2605-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:53:53 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4EE827D5-2609-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:22:32 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4F657155-260D-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 02:56:15 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4FC6D455-2644-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:27:40 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{51EFF2B5-2640-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:59:06 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5424F7F5-263C-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:30:32 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5671CAF5-2638-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:01:57 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{57D09475-2634-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:33:21 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5944CA55-2630-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:04:45 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5A870355-262C-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:36:07 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5A8CA575-2628-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:46:13 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{61FBF3D5-2621-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:33:00 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{71F23295-2649-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:33:26 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{738C1135-2606-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 03:04:24 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{73B03315-2645-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:04:48 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{73B1AED5-2602-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:02:05 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{73D24525-260A-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 23:15:22 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7427C265-2625-11DE-A754-001BFB5784A2}.dat + 2009-04-10 20:30:44 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{74A21B75-260E-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 02:35:50 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{75F11F35-2641-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:07:16 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{78131975-263D-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:25:22 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{78801495-261E-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:38:42 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7A8D2695-2639-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:10:07 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7C03BDD5-2635-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:41:31 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7D8AFEB5-2631-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:12:55 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7E810BB5-262D-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:44:18 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7EE5E4D5-2629-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:54:32 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8B4EB2D5-2622-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:41:10 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{961713B5-264A-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:12:34 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{97A7DA15-2646-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:41:37 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{97F62915-2607-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:12:59 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{985AB415-2603-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:10:15 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{98651AB5-260B-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:38:55 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{990C8175-260F-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 02:44:00 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{99F24BB5-2642-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:15:26 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9BF7B575-263E-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:46:52 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9E78E6B5-263A-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:23:44 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9F327265-2626-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:18:17 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A03BA9F5-2636-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:49:41 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A1BE2815-2632-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:21:06 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A30523D5-262E-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:52:30 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A463ED55-262A-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:33:49 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A65ED3F5-261F-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:02:51 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B438B555-2623-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:12:52 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B9618E55-261C-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:20:45 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BBFC56B5-2647-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:21:10 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BC815A55-2604-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:49:48 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BCAC8C35-2608-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:18:26 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BCE02285-260C-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 02:52:10 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BDCD6235-2643-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:23:36 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BFFDA4B5-263F-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:55:01 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C239CE15-263B-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:26:27 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C45E29B5-2637-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:57:51 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C5C41755-2633-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:29:16 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C72A04F5-262F-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:32:01 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C7F879F5-2627-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:00:40 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C888CE75-262B-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:42:06 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CE409DD5-2620-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:11:13 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DFB151F5-2624-11DE-A754-001BFB5784A2}.dat + 2009-04-11 03:28:55 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DFFB21D5-2648-11DE-A754-001BFB5784A2}.dat + 2009-04-10 19:57:59 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E12D6065-2609-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:29:21 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E17059A5-2605-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 20:26:38 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E1983355-260D-11DE-9E48-001BFB5784A2}.dat + 2009-04-10 19:00:43 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E1A2D055-2601-11DE-9E48-001BFB5784A2}.dat + 2009-04-11 03:00:20 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E1B92255-2644-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:31:45 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E3F2EA55-2640-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:21:14 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E41E1E55-261D-11DE-A754-001BFB5784A2}.dat + 2009-04-11 02:03:11 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E60DC075-263C-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:34:37 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E8987735-2638-11DE-A754-001BFB5784A2}.dat + 2009-04-11 01:06:02 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EA07EA55-2634-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:37:26 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EB703955-2630-11DE-A754-001BFB5784A2}.dat + 2009-04-11 00:08:50 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EC8C5C55-262C-11DE-A754-001BFB5784A2}.dat + 2009-04-10 23:40:12 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{ECC199F5-2628-11DE-A754-001BFB5784A2}.dat + 2009-04-10 22:50:21 3,584 ----a-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F5CF1795-2621-11DE-A754-001BFB5784A2}.dat - 2009-04-10 17:49:28 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-04-11 11:01:32 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-04-10 17:49:28 49,152 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-04-11 11:01:32 49,152 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-04-10 17:49:28 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-04-11 11:01:32 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-04-10 17:49:28 245,760 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2009-04-11 11:01:32 245,760 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat - 2009-04-10 18:33:33 104,940 ----a-w c:\windows\System32\perfc009.dat + 2009-04-11 11:04:30 104,940 ----a-w c:\windows\System32\perfc009.dat - 2009-04-10 18:33:33 128,004 ----a-w c:\windows\System32\perfc00C.dat + 2009-04-11 11:04:30 128,004 ----a-w c:\windows\System32\perfc00C.dat - 2009-04-10 18:33:33 595,506 ----a-w c:\windows\System32\perfh009.dat + 2009-04-11 11:04:30 595,506 ----a-w c:\windows\System32\perfh009.dat - 2009-04-10 18:33:33 678,956 ----a-w c:\windows\System32\perfh00C.dat + 2009-04-11 11:04:30 678,956 ----a-w c:\windows\System32\perfh00C.dat - 2009-04-10 18:27:33 12,354 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1611504857-4089916995-1680512414-1000_UserData.bin + 2009-04-11 17:18:27 12,502 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1611504857-4089916995-1680512414-1000_UserData.bin - 2009-04-10 18:27:33 92,354 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2009-04-11 17:18:27 92,608 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2009-04-10 18:27:31 62,162 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-04-11 17:18:26 62,336 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin - 2009-03-22 23:35:45 251,028 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2009-04-11 17:11:52 257,392 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin . -- Instantané actualisé -- . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint\Apoint.exe" [2007-06-10 118784] "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-06-11 317560] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-17 29744] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-07 148888] "NvSvc"="c:\windows\system32 vsvc.dll" [2007-06-28 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8429568] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576] c:\users\LOULOU\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-06-22 739880] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\VESWinlogon] 2007-07-12 08:33 98304 c:\windows\System32\VESWinlogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.dvsd"= c:\program files\Common Files\Sony Shared\VideoLib\sonydv.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{EB7EE62E-514C-4ED2-96CC-E76742C6C8BA}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C6785C36-3B71-4EC6-8473-E9FD35A708F1}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{93C3FF1C-85CA-4F0A-A50F-F70534120517}"= Disabled:UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "{118CEEBF-6311-4A81-A47B-F47606B5CBD3}"= Disabled:TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media "{316EA76B-B568-42EA-95F3-0109AB8EA870}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{88469EB4-4B06-4D20-B8A9-3BBA166C1D56}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete "{D9908554-A2C2-4B9F-804B-3517AF46D966}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{9BC30465-1180-4166-8D1F-0FCD7D1CC954}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords "{75D82640-B909-4A0C-BE49-42497CA673B2}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{5D5BEBCE-E214-4DE9-9EE1-4672F4D796F7}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword "{7A850012-1055-48BF-B522-6C74674AC924}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{D2B1522F-CCD4-40CB-9A1C-19B827A90265}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{1FB827CF-5D00-40E1-AC7C-985474FC750A}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{CCDDE7B3-5E87-4DAF-A244-DED7287CBE11}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{EC8E278D-4838-4EE3-93BA-CBC9A0BA8AE4}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "{AD8E3901-A158-4A3F-821F-C99754C2C917}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "{63F025D1-B60B-4B47-A5B0-54457738B9B3}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{EBB36171-16AE-4355-8300-3A54AD96903C}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{B4E0DFE4-F1BB-4061-A8D3-511C451FCDF3}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{5798E201-550D-4C36-93A9-53C4ABEB9803}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{EDB28EC4-15E9-4D6C-92E1-F765466E9CA7}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{5EDD7D17-E07C-4A2E-8DDA-474E11476220}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{C3FD154C-C680-41FA-9D4C-00AF5D60BFA9}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{6D36E7FF-2BCE-4E03-BF83-B6A0A33DC36E}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{638103A7-5F79-49D7-A800-106A79F5F714}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "{9DA55446-CE37-42F3-A3AB-EDC9AC58E37A}"= UDP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III "{2F1B791E-125E-4676-8BC9-C7376EF67D1C}"= TCP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III "TCP Query User{AB4DA13B-A8EE-490C-B94D-DBC893B12F39}c:\program files\azureus\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus "UDP Query User{4701FED6-0B75-4404-AD26-7F3F6C176596}c:\program files\azureus\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus "TCP Query User{FCF347F4-4850-4B6E-8378-7A9C5F8DAACE}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{403422EC-0B56-49BF-AFA9-AF5C39386842}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{7B231355-91EC-4DF4-9B01-B2E1CFDFF4E4}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule "UDP Query User{633F1F87-CA0A-49B3-8A22-26D809151477}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule "TCP Query User{6279BC70-B4A4-4A66-A19D-BCE7869E0E4E}c:\program files\team17\worms armageddon\wa.exe"= UDP:c:\program files eam17\worms armageddon\wa.exe:Worms Armageddon "UDP Query User{00F48F3C-6725-4589-B9EC-01832517A27C}c:\program files\team17\worms armageddon\wa.exe"= TCP:c:\program files eam17\worms armageddon\wa.exe:Worms Armageddon "TCP Query User{A61540CE-73E1-43CB-9DEC-BA9F868EB181}c:\program files\team17\worms 2\fronte

jlpjlp · Answer

comment va ton pc?????



Télécharge ToolsCleaner sur ton bureau. 
-->  http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

shaiko · Answer

salut jlpjlp,

le pc va beaucoup mieux, rien ne semble désormais indiquer la présence d'un virus, plus de pop-up ni de boites de dialogues intempestives, internet et mozilla fonctionnent correctement ...un grand nettoyage de printemps en somme !

je te fais le tools cleaner !

jlpjlp · Answer

ok fais tool cleanr pour virer ce qui a été utilisé

et bonne suite

jlpjlp · Answer

oui

shaiko · Answer

salut jlpjlp

voici le tools cleaner

[ Rapport ToolsCleaner version 2.3.5 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\Combofix: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Rsit: trouvé !
C:\Program Files	rend micro\HijackThis.exe: trouvé !
C:\Program Files	rend micro\hijackthis.log: trouvé !
C:\Users\LOULOU\Desktop\ComboFix.exe: trouvé !
C:\Users\LOULOU\Desktop\Trucs Antivirus\Rsit.exe: trouvé !
C:\Users\LOULOU\Downloads\OTMoveIt3.exe: trouvé !

---------------------------------
--> Suppression: 

C:\Program Files	rend micro\HijackThis.exe: ERREUR DE SUPPRESSION !!
C:\Users\LOULOU\Desktop\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Combofix.txt: ERREUR DE SUPPRESSION !!
C:\Program Files	rend micro\hijackthis.log: ERREUR DE SUPPRESSION !!
C:\Users\LOULOU\Desktop\Trucs Antivirus\Rsit.exe: supprimé !
C:\Users\LOULOU\Downloads\OTMoveIt3.exe: supprimé !
C:\Combofix: supprimé !
C:\Qoobox: ERREUR DE SUPPRESSION !!
C:\_OtMoveIt: supprimé !
C:\Rsit: supprimé !


je t'ai copié ce qu'il y avait ds la fenetre du logiciel car le rapport ne voulait pas se créer: ce la dit impossible de creer le fichier txt: accès refusé

Trojan win32 vundo.gen!BC

32 réponses

Discussions similaires