Problème gestionnaire des tâches / Antivirus
Fermé
Ororo
Messages postés
115
Date d'inscription
dimanche 24 mai 2009
Statut
Membre
Dernière intervention
13 juin 2009
-
24 mai 2009 à 03:13
gen-hackman - 15 juin 2009 à 14:38
gen-hackman - 15 juin 2009 à 14:38
A voir également:
- Problème gestionnaire des tâches / Antivirus
- Gestionnaire des taches - Guide
- Gestionnaire des taches windows 11 - Guide
- Windows 11 barre des taches a gauche - Guide
- Comment remettre la barre des tâches à la normale ? - Guide
- Gestionnaire de périphérique - Guide
233 réponses
Utilisateur anonyme
7 juin 2009 à 15:00
7 juin 2009 à 15:00
regarde dans le gestionnaire des peripherique pour le clavier
et fais un scan en ligne :http://www.bitdefender.fr/scan_fr/scan8/ie.html
Poste en réponse le rapport de scan qui se trouve ici C:\windows\bdoscan8\scanres.txt ou scanres.html
et fais un scan en ligne :http://www.bitdefender.fr/scan_fr/scan8/ie.html
Poste en réponse le rapport de scan qui se trouve ici C:\windows\bdoscan8\scanres.txt ou scanres.html
Ororo
Messages postés
115
Date d'inscription
dimanche 24 mai 2009
Statut
Membre
Dernière intervention
13 juin 2009
7 juin 2009 à 15:12
7 juin 2009 à 15:12
J'ai l'impression d'etre toujours bloqué au niveau de l'accès auxsites de scan en ligne.
Je ne viens jamais avec de bonnes nouvelles.
Cette infection me saoule !!
Je ne viens jamais avec de bonnes nouvelles.
Cette infection me saoule !!
Utilisateur anonyme
7 juin 2009 à 15:13
7 juin 2009 à 15:13
.;) et de mon coté j ai du mal a identifier le processus qui la relance ..
Utilisateur anonyme
7 juin 2009 à 15:19
7 juin 2009 à 15:19
ON VA fouiller un peut + :
Télécharge DiagHelp.zip sur ton bureau :
http://www.malekal.com/download/DiagHelp.zip
!! déconnectes toi et fermes toutes tes applications en cours !!
Fais un clic droit sur le fichier et extraire tout .
--> Un nouveau dossier va être créé : "DiagHelp"
Ouvres le et double-clic sur go.cmd et pas sur autre chose !
--> Une fenêtre va s'ouvrir, choisis l'option 1
L'analyse va commencer, ce-ci peut durer quelques minutes, laisses faire et appuies sur une touche quand on te le demandera :
une page IE va s'ouvrir , fermes la .
Re-appuis sur une touche, le bloc-note s'ouvre :
Sauvegardes ce rapport de façon à le retrouver et postes tout son contenu dans ta prochaine réponse ...
##########################
Télécharge GMER à partir de ce lien : http://www.gmer.net#files - clic sur "Download EXE" et télécharge le fichier sur ton bureau.
Voir le tutorial GMER, ça peut peut-être t'aider : https://www.malekal.com/tutorial-gmer/
Désactive tes logiciels de protection (antivirus, antispyware etc) et ferme tous les programmes ouverts.
Double-clic sur le fichier GMER téléchargé.
IMPORTANT: Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.
Clic sur l'onglet "rootkit"
Laisse tout coché.
Clic sur Scan
Lorsque le scan est terminé, clic sur "Copy"
Ouvre le bloc-note et clic sur le Menu Edition / Coller
Le rapport doit alors apparaître.
Enregistre le fichier sur ton bureau et copie/colle le contenu ici.
Télécharge DiagHelp.zip sur ton bureau :
http://www.malekal.com/download/DiagHelp.zip
!! déconnectes toi et fermes toutes tes applications en cours !!
Fais un clic droit sur le fichier et extraire tout .
--> Un nouveau dossier va être créé : "DiagHelp"
Ouvres le et double-clic sur go.cmd et pas sur autre chose !
--> Une fenêtre va s'ouvrir, choisis l'option 1
L'analyse va commencer, ce-ci peut durer quelques minutes, laisses faire et appuies sur une touche quand on te le demandera :
une page IE va s'ouvrir , fermes la .
Re-appuis sur une touche, le bloc-note s'ouvre :
Sauvegardes ce rapport de façon à le retrouver et postes tout son contenu dans ta prochaine réponse ...
##########################
Télécharge GMER à partir de ce lien : http://www.gmer.net#files - clic sur "Download EXE" et télécharge le fichier sur ton bureau.
Voir le tutorial GMER, ça peut peut-être t'aider : https://www.malekal.com/tutorial-gmer/
Désactive tes logiciels de protection (antivirus, antispyware etc) et ferme tous les programmes ouverts.
Double-clic sur le fichier GMER téléchargé.
IMPORTANT: Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.
Clic sur l'onglet "rootkit"
Laisse tout coché.
Clic sur Scan
Lorsque le scan est terminé, clic sur "Copy"
Ouvre le bloc-note et clic sur le Menu Edition / Coller
Le rapport doit alors apparaître.
Enregistre le fichier sur ton bureau et copie/colle le contenu ici.
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Ororo
Messages postés
115
Date d'inscription
dimanche 24 mai 2009
Statut
Membre
Dernière intervention
13 juin 2009
7 juin 2009 à 17:39
7 juin 2009 à 17:39
Voici le rapport DiagHelp enespérant que ça aboutisse à quelque chose
DiagHelp version v1.4 - http://www.malekal.com
excute le 07/06/2009 à 15:32:14,35
System information for \\YOUR-090942473E:
Uptime: Error reading uptime
Kernel version: Microsoft Windows XP, Uniprocessor Free
Product type: Professional
Product version: 5.1
Service pack: 2
Kernel build number: 2600
Registered organization:
Registered owner: solo & kad
Install date: 01/02/2003, 15:51:45
Activation status: Error reading status
IE version: 7.0000
System root: C:\WINDOWS
Processors: 1
Processor speed: 2.3 GHz
Processor type: Intel(R) Pentium(R) 4 CPU
Physical memory: 256 MB
Video driver: NVIDIA GeForce4 MX 440
Volume Type Format Label Size Free Free
A: Removable 0.0%
C: Fixed NTFS HDD 72.57 GB 12.14 GB 16.7%
D: CD-ROM 0.0%
E: Removable FAT32 1.88 GB 1.67 GB 88.8%
F: Removable FAT 1.91 GB 1.80 GB 94.5%
R: CD-ROM 0.0%
C:\WINDOWS\prefetch\CHCP.COM-17EDBDC9.pf -->07/06/2009 15:31:47
C:\WINDOWS\prefetch\MSSWCHX.EXE-331A4C32.pf -->07/06/2009 15:31:03
C:\WINDOWS\prefetch\OSK.EXE-1B87648A.pf -->07/06/2009 15:31:02
C:\WINDOWS\prefetch\REALEVENT.EXE-168B1F2F.pf -->07/06/2009 15:30:54
C:\WINDOWS\prefetch\CMD.EXE-034B0549.pf -->07/06/2009 15:30:36
C:\WINDOWS\prefetch\URLMAP.EXE-2A71A1E4.pf -->07/06/2009 15:30:23
C:\WINDOWS\prefetch\WINRAR.EXE-0AA31BB9.pf -->07/06/2009 15:30:04
C:\WINDOWS\prefetch\VERCLSID.EXE-28F52AD2.pf -->07/06/2009 15:29:31
C:\WINDOWS\prefetch\RUNDLL32.EXE-3D479208.pf -->07/06/2009 15:29:05
C:\WINDOWS\prefetch\RUNDLL32.EXE-527366BD.pf -->07/06/2009 14:49:37
C:\WINDOWS\System32\drivers\mbamswissarmy.sys -->26/05/2009 13:20:08
C:\WINDOWS\System32\drivers\mbam.sys -->26/05/2009 13:19:56
C:\WINDOWS\System32\drivers\usbaapl.sys -->26/03/2009 15:23:46
C:\WINDOWS\System32\drivers\fwdrv.err -->27/02/2009 01:00:55
C:\WINDOWS\System32\drivers\srv.sys -->11/12/2008 13:57:21
C:\WINDOWS\System32\drivers\mrxsmb.sys -->24/10/2008 13:10:42
C:\WINDOWS\System32\drivers\afd.sys -->14/08/2008 11:51:43
C:\WINDOWS\System32\wpa.dbl -->07/06/2009 14:11:50
C:\WINDOWS\System32\CF8886.exe -->07/06/2009 13:23:40
C:\WINDOWS\System32\nvapps.xml -->06/06/2009 00:00:08
C:\WINDOWS\System32\perfh00C.dat -->28/05/2009 18:42:08
C:\WINDOWS\System32\perfh009.dat -->28/05/2009 18:42:08
C:\WINDOWS\System32\perfc00C.dat -->28/05/2009 18:42:08
C:\WINDOWS\System32\perfc009.dat -->28/05/2009 18:42:07
C:\WINDOWS\System32\PerfStringBackup.INI -->28/05/2009 18:42:05
C:\WINDOWS\System32\FNTCACHE.DAT -->28/05/2009 06:13:48
C:\WINDOWS\System32\KGyGaAvL.sys -->21/05/2009 23:43:25
C:\WINDOWS\System32\MRT.exe -->07/05/2009 00:16:30
C:\WINDOWS\System32\kernel32.dll -->21/03/2009 16:20:10
C:\WINDOWS\System32\pdh.dll -->06/03/2009 16:46:15
C:\WINDOWS\System32\wininet.dll -->03/03/2009 02:13:06
C:\WINDOWS\System32\ieencode.dll -->20/02/2009 19:10:57
C:\WINDOWS\System32\webcheck.dll -->20/02/2009 19:10:56
C:\WINDOWS\System32\urlmon.dll -->20/02/2009 19:10:56
C:\WINDOWS\System32\url.dll -->20/02/2009 19:10:55
C:\WINDOWS\System32\pngfilt.dll -->20/02/2009 19:10:55
C:\WINDOWS\System32\occache.dll -->20/02/2009 19:10:55
C:\WINDOWS\System32\mstime.dll -->20/02/2009 19:10:55
C:\WINDOWS\System32\msrating.dll -->20/02/2009 19:10:55
C:\WINDOWS\System32\mshtmled.dll -->20/02/2009 19:10:54
C:\WINDOWS\System32\mshtml.dll -->20/02/2009 19:10:54
C:\WINDOWS\System32\msfeedsbs.dll -->20/02/2009 19:10:52
C:\WINDOWS\setupapi.log -->07/06/2009 14:45:39
C:\WINDOWS\WindowsUpdate.log -->07/06/2009 14:30:28
C:\WINDOWS\0.log -->07/06/2009 14:11:34
C:\WINDOWS\wiaservc.log -->07/06/2009 14:11:26
C:\WINDOWS\wiadebug.log -->07/06/2009 14:11:25
C:\WINDOWS\bootstat.dat -->07/06/2009 14:11:09
C:\WINDOWS\SchedLgU.Txt -->07/06/2009 14:09:44
C:\WINDOWS\system.ini -->06/06/2009 04:09:45
C:\WINDOWS\MEMORY.DMP -->02/06/2009 20:35:36
C:\WINDOWS\PEV.exe -->31/05/2009 11:08:41
C:\WINDOWS\msiosd.ini -->22/05/2009 19:28:37
C:\WINDOWS\ActiveSurfUI.INI -->17/05/2009 13:47:57
C:\WINDOWS\NIRCMD.exe -->20/04/2009 12:56:28
C:\WINDOWS\QTFont.qfn -->20/07/2008 11:18:05
C:\WINDOWS\cdplayer.ini -->18/07/2008 10:21:41
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 50A3-C98D
Répertoire de C:\WINDOWS
25/05/2009 03:42 <REP> $hf_mig$
14/04/2005 01:13 <REP> $MSI31Uninstall_KB893803$
19/05/2005 17:51 <REP> $MSI31Uninstall_KB893803v2$
06/09/2004 20:42 <REP> $NtServicePackUninstall$
23/05/2009 10:12 <REP> $NtServicePackUninstallIDNMitigationAPIs$
23/05/2009 10:10 <REP> $NtServicePackUninstallNLSDownlevelMapping$
03/05/2004 10:03 <REP> $NtUninstallKB821557$
17/07/2003 14:44 <REP> $NtUninstallKB821557_RTM$
03/05/2004 10:00 <REP> $NtUninstallKB823182$
17/10/2003 17:13 <REP> $NtUninstallKB823182_RTM$
10/07/2003 20:20 <REP> $NtUninstallKB823559$
03/05/2004 09:58 <REP> $NtUninstallKB823980$
17/07/2003 14:42 <REP> $NtUninstallKB823980_RTM$
03/05/2004 09:57 <REP> $NtUninstallKB824105$
04/09/2003 14:41 <REP> $NtUninstallKB824105_RTM$
03/05/2004 09:54 <REP> $NtUninstallKB824141$
17/10/2003 17:14 <REP> $NtUninstallKB824141_RTM$
03/05/2004 09:52 <REP> $NtUninstallKB824146$
11/09/2003 17:03 <REP> $NtUninstallKB824146_RTM$
17/10/2003 17:11 <REP> $NtUninstallKB825119$
03/05/2004 09:49 <REP> $NtUninstallKB828028$
11/02/2004 20:11 <REP> $NtUninstallKB828028_RTM$
03/05/2004 09:47 <REP> $NtUninstallKB828035$
17/10/2003 17:10 <REP> $NtUninstallKB828035_RTM$
03/05/2004 09:44 <REP> $NtUninstallKB828741$
14/04/2004 09:45 <REP> $NtUninstallKB828741_RTM$
14/10/2004 19:43 <REP> $NtUninstallKB834707$
03/05/2004 09:43 <REP> $NtUninstallKB835732$
14/04/2004 09:46 <REP> $NtUninstallKB835732_RTM$
03/05/2004 09:42 <REP> $NtUninstallKB837001$
14/04/2004 09:44 <REP> $NtUninstallKB837001_RTM$
09/06/2004 17:33 <REP> $NtUninstallKB839643$
15/07/2004 18:58 <REP> $NtUninstallKB839645$
15/07/2004 18:57 <REP> $NtUninstallKB840315$
12/05/2004 20:23 <REP> $NtUninstallKB840374$
15/07/2004 18:57 <REP> $NtUninstallKB841873$
15/07/2004 18:56 <REP> $NtUninstallKB842773$
09/02/2005 21:53 <REP> $NtUninstallKB867282$
09/02/2005 21:53 <REP> $NtUninstallKB873333$
15/12/2004 19:17 <REP> $NtUninstallKB873339$
16/06/2005 01:47 <REP> $NtUninstallKB883939$
09/02/2005 21:54 <REP> $NtUninstallKB885250$
15/12/2004 19:16 <REP> $NtUninstallKB885835$
15/12/2004 19:17 <REP> $NtUninstallKB885836$
14/10/2004 19:43 <REP> $NtUninstallKB885884$
15/12/2004 19:16 <REP> $NtUninstallKB886185$
09/02/2005 21:54 <REP> $NtUninstallKB887472$
23/02/2005 12:19 <REP> $NtUninstallKB887742$
09/02/2005 21:54 <REP> $NtUninstallKB888113$
09/02/2005 21:52 <REP> $NtUninstallKB888302$
16/06/2005 01:44 <REP> $NtUninstallKB890046$
09/02/2005 21:52 <REP> $NtUninstallKB890047$
13/01/2005 11:11 <REP> $NtUninstallKB890175$
14/04/2005 01:13 <REP> $NtUninstallKB890859$
14/04/2005 01:14 <REP> $NtUninstallKB890923$
09/02/2005 21:54 <REP> $NtUninstallKB891781$
14/04/2005 01:14 <REP> $NtUninstallKB893066$
14/04/2005 01:14 <REP> $NtUninstallKB893086$
13/08/2005 16:06 <REP> $NtUninstallKB893756$
13/08/2005 16:03 <REP> $NtUninstallKB894391$
16/06/2005 01:46 <REP> $NtUninstallKB896358$
16/06/2005 01:47 <REP> $NtUninstallKB896422$
13/08/2005 16:05 <REP> $NtUninstallKB896423$
10/11/2005 00:53 <REP> $NtUninstallKB896424$
16/06/2005 01:43 <REP> $NtUninstallKB896428$
26/10/2005 00:06 <REP> $NtUninstallKB896688$
13/08/2005 16:05 <REP> $NtUninstallKB896727$
16/06/2005 01:45 <REP> $NtUninstallKB898458$
29/06/2005 17:00 <REP> $NtUninstallKB898461$
13/08/2005 16:06 <REP> $NtUninstallKB899587$
13/08/2005 16:04 <REP> $NtUninstallKB899588$
13/08/2005 16:06 <REP> $NtUninstallKB899591$
25/04/2006 22:33 <REP> $NtUninstallKB900485$
26/10/2005 00:05 <REP> $NtUninstallKB900725$
26/10/2005 00:07 <REP> $NtUninstallKB901017$
13/07/2005 14:41 <REP> $NtUninstallKB901214$
26/10/2005 00:07 <REP> $NtUninstallKB902400$
13/07/2005 14:40 <REP> $NtUninstallKB903235$
26/10/2005 00:05 <REP> $NtUninstallKB904706$
26/10/2005 00:06 <REP> $NtUninstallKB905414$
26/10/2005 00:05 <REP> $NtUninstallKB905749$
17/12/2005 16:47 <REP> $NtUninstallKB905915$
11/01/2006 12:49 <REP> $NtUninstallKB908519$
21/04/2006 02:29 <REP> $NtUninstallKB908531$
17/12/2005 16:47 <REP> $NtUninstallKB910437$
27/06/2006 20:51 <REP> $NtUninstallKB911280$
16/04/2006 13:50 <REP> $NtUninstallKB911562$
15/02/2006 11:53 <REP> $NtUninstallKB911564$
15/02/2006 11:52 <REP> $NtUninstallKB911565$
16/04/2006 13:48 <REP> $NtUninstallKB911567$
15/02/2006 11:53 <REP> $NtUninstallKB911927$
16/04/2006 13:49 <REP> $NtUninstallKB912812$
06/01/2006 13:05 <REP> $NtUninstallKB912919$
15/02/2006 11:51 <REP> $NtUninstallKB913446$
11/05/2006 00:56 <REP> $NtUninstallKB913580$
12/07/2006 01:28 <REP> $NtUninstallKB914388$
21/06/2006 18:39 <REP> $NtUninstallKB914389$
23/05/2009 10:08 <REP> $NtUninstallKB915865$
21/06/2006 18:40 <REP> $NtUninstallKB916281$
12/07/2006 01:27 <REP> $NtUninstallKB916595$
12/07/2006 01:28 <REP> $NtUninstallKB917159$
21/06/2006 18:40 <REP> $NtUninstallKB917344$
09/08/2006 21:16 <REP> $NtUninstallKB917422$
21/06/2006 18:41 <REP> $NtUninstallKB917734_WMP9$
21/06/2006 18:40 <REP> $NtUninstallKB917953$
15/02/2007 19:09 <REP> $NtUninstallKB918118$
21/06/2006 18:40 <REP> $NtUninstallKB918439$
09/08/2006 21:17 <REP> $NtUninstallKB918899$
14/09/2006 09:06 <REP> $NtUninstallKB919007$
16/11/2006 11:40 <REP> $NtUninstallKB920213$
09/08/2006 21:19 <REP> $NtUninstallKB920214$
09/08/2006 21:17 <REP> $NtUninstallKB920670$
09/08/2006 21:14 <REP> $NtUninstallKB920683$
14/09/2006 09:06 <REP> $NtUninstallKB920685$
14/09/2006 09:06 <REP> $NtUninstallKB920872$
09/08/2006 21:18 <REP> $NtUninstallKB921398$
15/08/2007 08:25 <REP> $NtUninstallKB921503$
08/08/2006 20:49 <REP> $NtUninstallKB921883$
14/09/2006 09:05 <REP> $NtUninstallKB922582$
09/08/2006 21:19 <REP> $NtUninstallKB922616$
16/11/2006 11:39 <REP> $NtUninstallKB922760$
12/10/2006 00:36 <REP> $NtUninstallKB922819$
12/10/2006 00:35 <REP> $NtUninstallKB923191$
12/10/2006 00:36 <REP> $NtUninstallKB923414$
25/05/2009 03:05 <REP> $NtUninstallKB923561$
13/12/2006 18:17 <REP> $NtUninstallKB923689$
13/12/2006 18:15 <REP> $NtUninstallKB923694$
15/02/2007 19:10 <REP> $NtUninstallKB923723$
16/11/2006 11:42 <REP> $NtUninstallKB923980$
12/10/2006 00:36 <REP> $NtUninstallKB924191$
16/11/2006 11:42 <REP> $NtUninstallKB924270$
12/10/2006 00:35 <REP> $NtUninstallKB924496$
15/02/2007 19:10 <REP> $NtUninstallKB924667$
13/12/2006 18:17 <REP> $NtUninstallKB925398_WMP64$
13/12/2006 18:18 <REP> $NtUninstallKB925454$
27/09/2006 09:50 <REP> $NtUninstallKB925486$
04/04/2007 07:38 <REP> $NtUninstallKB925902$
13/12/2006 18:16 <REP> $NtUninstallKB926255$
15/02/2007 19:09 <REP> $NtUninstallKB926436$
15/02/2007 19:12 <REP> $NtUninstallKB927779$
15/02/2007 19:12 <REP> $NtUninstallKB927802$
24/05/2007 07:12 <REP> $NtUninstallKB927891$
15/02/2007 19:04 <REP> $NtUninstallKB928090$
15/02/2007 19:11 <REP> $NtUninstallKB928255$
15/02/2007 19:02 <REP> $NtUninstallKB928843$
13/06/2007 07:06 <REP> $NtUninstallKB929123$
16/03/2007 00:32 <REP> $NtUninstallKB929338$
10/01/2007 11:29 <REP> $NtUninstallKB929969$
11/04/2007 07:04 <REP> $NtUninstallKB930178$
10/05/2007 07:19 <REP> $NtUninstallKB930916$
11/04/2007 07:04 <REP> $NtUninstallKB931261$
10/05/2007 07:19 <REP> $NtUninstallKB931768$
11/04/2007 07:05 <REP> $NtUninstallKB931784$
15/02/2007 19:10 <REP> $NtUninstallKB931836$
11/04/2007 07:04 <REP> $NtUninstallKB932168$
30/08/2007 01:10 <REP> $NtUninstallKB933360$
13/06/2007 07:06 <REP> $NtUninstallKB933566$
10/10/2007 01:02 <REP> $NtUninstallKB933729$
13/06/2007 07:02 <REP> $NtUninstallKB935839$
13/06/2007 07:05 <REP> $NtUninstallKB935840$
15/08/2007 08:27 <REP> $NtUninstallKB936021$
11/07/2007 07:32 <REP> $NtUninstallKB936357$
15/08/2007 08:26 <REP> $NtUninstallKB936782_WMP9$
15/08/2007 08:22 <REP> $NtUninstallKB937143$
15/08/2007 08:22 <REP> $NtUninstallKB938127$
10/09/2008 08:43 <REP> $NtUninstallKB938464$
15/08/2007 08:26 <REP> $NtUninstallKB938828$
15/08/2007 08:25 <REP> $NtUninstallKB938829$
10/10/2007 01:01 <REP> $NtUninstallKB939653$
10/10/2007 00:58 <REP> $NtUninstallKB941202$
13/12/2007 04:05 <REP> $NtUninstallKB941568$
13/12/2007 04:07 <REP> $NtUninstallKB941569$
09/01/2008 11:42 <REP> $NtUninstallKB941644$
10/04/2008 01:44 <REP> $NtUninstallKB941693$
13/12/2007 04:04 <REP> $NtUninstallKB942615$
13/12/2007 04:08 <REP> $NtUninstallKB942763$
13/12/2007 04:12 <REP> $NtUninstallKB942840$
14/02/2008 01:57 <REP> $NtUninstallKB943055$
15/11/2007 01:47 <REP> $NtUninstallKB943460$
09/01/2008 11:38 <REP> $NtUninstallKB943485$
10/04/2008 01:41 <REP> $NtUninstallKB944338$
14/02/2008 01:58 <REP> $NtUninstallKB944533$
13/12/2007 04:03 <REP> $NtUninstallKB944653$
10/04/2008 01:40 <REP> $NtUninstallKB945553$
14/02/2008 01:58 <REP> $NtUninstallKB946026$
21/12/2007 12:35 <REP> $NtUninstallKB946627$
15/08/2008 02:56 <REP> $NtUninstallKB946648$
10/04/2008 01:45 <REP> $NtUninstallKB947864$
10/04/2008 01:44 <REP> $NtUninstallKB948590$
10/04/2008 01:45 <REP> $NtUninstallKB948881$
15/05/2008 02:49 <REP> $NtUninstallKB950749$
12/06/2008 03:04 <REP> $NtUninstallKB950759$
12/06/2008 03:03 <REP> $NtUninstallKB950760$
12/06/2008 03:05 <REP> $NtUninstallKB950762$
15/08/2008 02:56 <REP> $NtUninstallKB950974$
15/08/2008 02:54 <REP> $NtUninstallKB951066$
15/08/2008 02:55 <REP> $NtUninstallKB951072-v2$
12/06/2008 03:03 <REP> $NtUninstallKB951376$
20/06/2008 18:10 <REP> $NtUninstallKB951376-v2$
12/06/2008 03:05 <REP> $NtUninstallKB951698$
10/07/2008 00:31 <REP> $NtUninstallKB951748$
25/05/2009 03:32 <REP> $NtUninstallKB952004$
12/12/2008 02:42 <REP> $NtUninstallKB952069_WM9$
15/08/2008 02:55 <REP> $NtUninstallKB952287$
15/08/2008 02:56 <REP> $NtUninstallKB952954$
15/08/2008 02:53 <REP> $NtUninstallKB953838$
15/08/2008 02:56 <REP> $NtUninstallKB953839$
10/09/2008 08:44 <REP> $NtUninstallKB954156_WM9L$
17/10/2008 02:11 <REP> $NtUninstallKB954211$
12/12/2008 02:37 <REP> $NtUninstallKB954600$
12/11/2008 08:49 <REP> $NtUninstallKB955069$
12/12/2008 02:42 <REP> $NtUninstallKB955839$
17/10/2008 02:09 <REP> $NtUninstallKB956390$
17/10/2008 02:12 <REP> $NtUninstallKB956391$
25/05/2009 03:33 <REP> $NtUninstallKB956572$
12/12/2008 02:36 <REP> $NtUninstallKB956802$
17/10/2008 02:12 <REP> $NtUninstallKB956803$
17/10/2008 02:10 <REP> $NtUninstallKB956841$
17/10/2008 02:11 <REP> $NtUninstallKB957095$
12/11/2008 08:49 <REP> $NtUninstallKB957097$
12/12/2008 02:41 <REP> $NtUninstallKB958215$
25/10/2008 02:23 <REP> $NtUninstallKB958644$
14/01/2009 20:56 <REP> $NtUninstallKB958687$
12/03/2009 04:05 <REP> $NtUninstallKB958690$
25/05/2009 03:43 <REP> $NtUninstallKB959426$
12/03/2009 04:07 <REP> $NtUninstallKB960225$
18/12/2008 03:55 <REP> $NtUninstallKB960714$
11/02/2009 02:36 <REP> $NtUninstallKB960715$
25/05/2009 03:08 <REP> $NtUninstallKB960803$
25/05/2009 03:42 <REP> $NtUninstallKB961373$
25/02/2009 04:09 <REP> $NtUninstallKB967715$
31/03/2003 20:45 <REP> $NtUninstallQ309521$
31/03/2003 20:45 <REP> $NtUninstallQ311889$
31/03/2003 20:45 <REP> $NtUninstallQ311967$
15/01/2003 08:54 <REP> $NtUninstallQ312370$
31/03/2003 20:44 <REP> $NtUninstallQ313450$
31/03/2003 20:45 <REP> $NtUninstallQ314147$
31/03/2003 20:45 <REP> $NtUninstallQ314862$
31/03/2003 20:49 <REP> $NtUninstallQ318138$
31/03/2003 20:50 <REP> $NtUninstallQ319580$
30/08/2003 12:58 <REP> $NtUninstallQ320552$
31/03/2003 20:44 <REP> $NtUninstallQ323172$
31/03/2003 20:44 <REP> $NtUninstallQ324096$
31/03/2003 20:44 <REP> $NtUninstallQ324380$
31/03/2003 20:44 <REP> $NtUninstallQ326830$
03/05/2004 09:41 <REP> $NtUninstallQ328310$
31/03/2003 20:47 <REP> $NtUninstallQ328310_RTM$
17/10/2003 17:11 <REP> $NtUninstallQ328940$
03/05/2004 09:39 <REP> $NtUninstallQ329048$
31/03/2003 20:50 <REP> $NtUninstallQ329048_RTM$
31/03/2003 20:46 <REP> $NtUninstallQ329115$
03/05/2004 09:38 <REP> $NtUninstallQ329170$
31/03/2003 20:53 <REP> $NtUninstallQ329170_RTM$
03/05/2004 09:36 <REP> $NtUninstallQ329390$
31/03/2003 20:45 <REP> $NtUninstallQ329390_RTM$
03/05/2004 09:35 <REP> $NtUninstallQ329441$
31/03/2003 20:43 <REP> $NtUninstallQ329441_RTM$
03/05/2004 09:33 <REP> $NtUninstallQ329834$
17/10/2003 17:14 <REP> $NtUninstallQ329834_RTM$
03/05/2004 09:32 <REP> $NtUninstallQ331953$
31/03/2003 20:55 <REP> $NtUninstallQ331953_RTM$
03/05/2004 17:43 <REP> $NtUninstallQ810565$
03/05/2004 09:29 <REP> $NtUninstallQ810577$
31/03/2003 20:48 <REP> $NtUninstallQ810577_RTM$
03/05/2004 17:46 <REP> $NtUninstallQ810833$
03/05/2004 09:27 <REP> $NtUninstallQ811493$
08/05/2003 13:45 <REP> $NtUninstallQ811493_RTM$
03/05/2004 17:41 <REP> $NtUninstallQ814033$
03/05/2004 09:22 <REP> $NtUninstallQ815021$
30/05/2003 12:26 <REP> $NtUninstallQ815021_RTM$
03/05/2004 09:20 <REP> $NtUninstallQ817606$
10/07/2003 20:21 <REP> $NtUninstallQ817606_RTM$
03/05/2004 09:17 <REP> $NtUninstallQ819696$
24/07/2003 11:18 <REP> $NtUninstallQ819696_RTM$
04/10/2003 12:34 <REP> $NtUninstallQ828026$
14/04/2004 09:46 <REP> $xpsp1hfm$
09/02/2003 15:23 30 720 CdaC13BA.EXE
09/02/2003 15:23 112 128 CdaC14BA.DLL
23/05/2009 10:15 <REP> ie7
07/06/2009 12:06 <REP> inf
07/06/2009 14:45 <REP> Installer
30/08/2003 13:09 <REP> msdownld.tmp
05/10/2003 21:47 <REP> PIF
20/07/2008 11:18 54 156 QTFont.qfn
28/08/2001 13:00 49 102 winnt.bmp
28/08/2001 13:00 49 102 winnt256.bmp
6 fichier(s) 295 957 octets
281 Rép(s) 13 039 030 272 octets libres
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 50A3-C98D
Répertoire de C:\WINDOWS\system32
07/06/2009 14:12 <REP> dllcache
26/04/2003 23:31 30 112 fiz1
30/04/2003 22:10 30 027 fiz10
01/05/2003 18:23 30 105 fiz11
02/05/2003 19:23 30 020 fiz12
03/05/2003 17:19 30 107 fiz13
04/05/2003 13:50 30 098 fiz14
05/05/2003 19:05 30 109 fiz15
06/05/2003 13:21 30 054 fiz16
07/05/2003 12:44 30 062 fiz17
09/05/2003 21:45 30 140 fiz18
10/05/2003 14:18 30 014 fiz19
26/04/2003 23:43 30 006 fiz2
10/05/2003 23:38 30 068 fiz20
27/04/2003 00:10 30 032 fiz3
27/04/2003 00:48 30 027 fiz4
27/04/2003 14:06 30 089 fiz5
28/04/2003 13:05 30 073 fiz6
28/04/2003 13:55 30 015 fiz7
29/04/2003 13:26 30 003 fiz8
30/04/2003 15:49 30 034 fiz9
21/05/2009 23:43 10 022 KGyGaAvL.sys
27/11/2003 11:08 2 152 346 kyf.dat
13/12/2008 14:41 16 servdat.slm
30 fichier(s) 2 768 300 octets
1 Rép(s) 13 039 013 888 octets libres
winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed
userinit.exe
kernel32.dll
ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com
------------------------------------------------------------------------------
explorer.exe pid: 1640
Command line: C:\WINDOWS\Explorer.EXE
Base Size Version Path
0x44080000 0xd0000 7.00.6000.16827 C:\WINDOWS\system32\WININET.dll
0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x43e00000 0x45000 7.00.6000.16825 C:\WINDOWS\system32\iertutil.dll
0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll
0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
0x45180000 0x127000 7.00.6000.16825 C:\WINDOWS\system32\urlmon.dll
0x44360000 0x5cd000 7.00.6000.16825 C:\WINDOWS\system32\ieframe.dll
0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll
0x442b0000 0x3c000 7.00.6000.16825 C:\WINDOWS\system32\webcheck.dll
0x00d40000 0x6000 6.01.0000.0145 C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
0x00d60000 0x8000 9.43.0000.0000 C:\PROGRA~1\MOUSEW~1\SYSTEM\LgMousHk.dll
0x01e60000 0x16000 8.04.0002.1019 C:\WINDOWS\system32\LQCUI2.dll
0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
0x01d80000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x10000000 0x76d000 6.14.0010.9371 C:\WINDOWS\system32\nvcpl.dll
0x74bf0000 0x2c000 4.02.5406.0000 C:\WINDOWS\system32\OLEACC.dll
0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x02030000 0x44000 6.14.0010.9371 C:\WINDOWS\system32\NVRSFR.DLL
0x02080000 0x36000 6.14.0010.9371 C:\WINDOWS\system32\nvapi.dll
0x02860000 0x73000 6.14.0010.11060 C:\WINDOWS\system32\nvshell.dll
0x028f0000 0x12000 1.01.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
0x02910000 0x2b000 C:\Program Files\WinRAR\rarext.dll
0x02df0000 0x13000 1.00.0000.0000 C:\Program Files\EPSON\Creativity Suite\Easy Photo Print\EPPShell.dll
0x73d20000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL
0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL
0x02f10000 0x1b000 C:\WINDOWS\System32\tsseCryp.dll
0x01150000 0x9000 0.01.0000.0002 C:\Apps\ActivBoard\nhkdll.dll
0x03840000 0x7000 10.00.0000.0831 C:\Program Files\Microsoft Money\System\urlmapps.dll
ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com
------------------------------------------------------------------------------
winlogon.exe pid: 532
Command line: winlogon.exe
Base Size Version Path
0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe
0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll
0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x012f0000 0xae000 1.05.0540.0000 C:\WINDOWS\system32\WgaLogon.dll
0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 50A3-C98D
Répertoire de C:\WINDOWS\temp
07/06/2009 15:28 19 968 abgtr.exe
07/06/2009 14:14 11 264 ugqwhy.exe
07/06/2009 14:15 19 968 vwxagf.exe
3 fichier(s) 51 200 octets
0 Rép(s) 13 039 009 792 octets libres
Contenu de Downloaded Program Files
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 50A3-C98D
Répertoire de C:\WINDOWS\Downloaded Program Files
07/06/2009 14:45 <REP> .
07/06/2009 14:45 <REP> ..
20/01/2005 14:53 171 ampx.inf
17/05/2006 14:32 231 072 avsniff.dll
17/05/2006 14:29 878 avsniff.inf
17/05/2006 14:32 198 304 avsniffdlgs.dll
17/05/2006 14:26 537 704 AXXPEE.dll
17/05/2006 14:29 241 CabSA.inf
12/09/2007 01:00 2 504 catalog.dat
21/05/2003 02:06 70 656 Checkers.dll
06/07/2001 17:41 106 496 ChkDVD.dll
21/09/2004 15:09 36 864 coltrans.ax
28/08/2003 23:40 <REP> CONFLICT.1
21/09/2004 15:10 163 840 CoreExecutive.dll
27/03/2003 23:35 65 desktop.ini
21/09/2004 15:10 36 864 DownloadersWI.dll
12/09/2007 01:00 6 899 ecbootil.vxd
17/05/2006 14:26 42 112 ecmldr32.dll
12/09/2007 01:00 284 016 ecmsvr32.dll
08/09/2004 23:38 1 271 erma.inf
09/06/2003 15:18 234 FileSharingCtrl.inf
24/03/2008 19:33 1 527 056 FP_AX_CAB_INSTALLER.exe
14/08/2003 11:14 223 832 fsmsngr-fr.dll
13/11/2002 08:06 196 608 GSManager.dll
03/07/2003 13:59 160 gsmanager.inf
29/05/2009 17:12 1 569 hardwaredetection.inf
17/08/2003 01:31 113 008 HMAtchmt.ocx
21/09/2004 15:10 90 112 HtmlParser.dll
21/09/2004 15:10 53 248 HTMLSourceFilter.ax
21/09/2004 15:11 57 344 MelodySourceParser.ax
21/05/2003 02:06 152 576 MessengerStatsClient.dll
20/01/2000 15:25 1 162 Microsoft XML Parser for Java.osd
21/05/2003 02:06 77 312 MineSweeper.dll
21/09/2004 15:11 81 920 MPO.dll
18/11/1999 13:49 992 msaudio.inf
29/05/2003 15:00 77 408 msgrchkr.dll
11/06/2003 16:40 32 768 MsnChat40fr-fr.dll
16/05/2003 17:33 278 MsnChat45.inf
16/05/2003 17:33 457 288 MSNChat45.ocx
17/05/2006 14:28 6 850 navapi.vxd
17/05/2006 14:28 201 896 navapi32.dll
12/09/2007 01:00 124 272 naveng32.dll
12/09/2007 01:00 914 800 navex32a.dll
31/08/2002 13:36 516 NPX.INF
31/08/2002 13:33 290 816 npx.ocx
21/09/2004 15:12 229 376 Parsers.dll
21/09/2004 15:12 36 864 PlayerServer.dll
21/09/2004 15:11 94 208 PNGSource.ax
09/10/2003 11:32 144 QTPlugin.inf
05/03/2003 17:23 524 404 RdxIE.dll
21/09/2004 15:12 32 768 RegType_IE.dll
17/05/2006 14:32 161 480 rufsi.dll
21/09/2004 15:13 25 600 scg.ax
12/09/2007 01:00 97 744 scrauth.dat
21/09/2004 15:13 147 456 SMILInetCtrl.dll
21/09/2004 15:14 28 326 SMILViewer_DX6.inf
29/05/2003 15:00 86 112 solitaireshowdown.dll
29/05/2002 23:12 9 488 sporder.dll
29/05/2002 23:12 9 488 sporder_.dll
21/09/2004 15:11 57 344 StreamControl.ax
24/03/2008 19:18 247 swflash.inf
12/09/2007 01:00 11 875 symaveng.cat
12/09/2007 01:00 1 061 symaveng.inf
12/09/2007 01:00 397 385 tcdefs.dat
12/09/2007 01:00 1 794 980 tcscan7.dat
12/09/2007 01:00 394 740 tcscan8.dat
12/09/2007 01:00 908 486 tcscan9.dat
12/09/2007 01:00 453 tinf.dat
12/09/2007 01:00 148 tinfidx.dat
12/09/2007 01:00 1 957 tinfl.dat
12/09/2007 01:00 67 619 tscan1.dat
12/09/2007 01:00 3 240 tscan1hd.dat
12/09/2007 01:00 4 778 v.grd
12/09/2007 01:00 2 267 v.sig
21/09/2004 15:13 110 592 VideoCompositor.ax
12/09/2007 01:00 106 244 virscan.inf
12/09/2007 01:00 993 455 virscan1.dat
12/09/2007 01:00 570 702 virscan2.dat
12/09/2007 01:00 150 140 virscan3.dat
12/09/2007 01:00 320 253 virscan4.dat
12/09/2007 01:00 4 496 806 virscan5.dat
12/09/2007 01:00 391 782 virscan6.dat
12/09/2007 01:00 12 097 338 virscan7.dat
12/09/2007 01:00 1 807 666 virscan8.dat
12/09/2007 01:00 4 989 561 virscan9.dat
12/09/2007 01:00 32 virscant.dat
26/09/2007 01:34 2 072 vscanmsx.dat
21/09/2004 15:13 36 864 WBMPSource.ax
27/10/2002 19:32 3 036 wmv9dmo.inf
04/03/2005 12:11 2 371 wmvadvd.inf
12/09/2007 01:00 224 zdone.dat
88 fichier(s) 37 613 158 octets
Répertoire de C:\WINDOWS\Downloaded Program Files\CONFLICT.1
28/08/2003 23:40 <REP> .
28/08/2003 23:40 <REP> ..
29/05/2003 15:00 160 864 messengerstatsclient.dll
29/05/2003 15:00 84 064 minesweeper.dll
2 fichier(s) 244 928 octets
Total des fichiers listés :
90 fichier(s) 37 858 086 octets
5 Rép(s) 13 039 005 696 octets libres
Recherche de rootkit! (Merci S!Ri)
Recherche d'infections connues
Export des clefs sensibles..
Liste des fichiers en exception sur le pare-feu XP SP2
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\APPS\\ActivSurf\\4448364\\Program\\backWeb-4448364.exe"="C:\\apps\\ActivSurf\\4448364\\Program\\backweb-4448364.exe:*:Enabled:ipsec"
"C:\\Documents and Settings\\solo & kad\\Mes documents\\mircfr\\mircfr\\mirc.exe"="C:\\Documents and Settings\\solo & kad\\Mes documents\\mircfr\\mircfr\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealOne Player"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Disabled:Skype"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"="C:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe:*:Enabled:ipsec"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\SPSSInc\\Statistics17\\statistics.com"="C:\\Program Files\\SPSSInc\\Statistics17\\statistics.com:*:Disabled:Statistics17:com"
"C:\\Program Files\\SPSSInc\\Statistics17\\statistics.exe"="C:\\Program Files\\SPSSInc\\Statistics17\\statistics.exe:*:Disabled:Statistics17:exe"
"C:\\Program Files\\SPSSInc\\Statistics17\\SPSSWinWrapIDE.exe"="C:\\Program Files\\SPSSInc\\Statistics17\\SPSSWinWrapIDE.exe:*:Disabled:SPSS Basic Script Editor"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\WINDOWS\\System32\\rmctrl.exe"="C:\\WINDOWS\\System32\\rmctrl.exe:*:Enabled:ipsec"
"C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe:*:Enabled:ipsec"
"C:\\Program Files\\Java\\jre6\\bin\\jusched.exe"="C:\\Program Files\\Java\\jre6\\bin\\jusched.exe:*:Enabled:ipsec"
"C:\\Program Files\\Logitech\\Video\\FxSvr2.exe"="C:\\Program Files\\Logitech\\Video\\FxSvr2.exe:*:Enabled:ipsec"
"C:\\Apps\\ActivBoard\\OSD.exe"="C:\\Apps\\ActivBoard\\OSD.exe:*:Enabled:ipsec"
"C:\\Program Files\\Logitech\\Video\\LogiTray.exe"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\netsh.exe"="C:\\WINDOWS\\system32\\netsh.exe:*:Enabled:ipsec"
"C:\\Apps\\ActivBoard\\MMKeybd.exe"="C:\\Apps\\ActivBoard\\MMKeybd.exe:*:Enabled:ipsec"
"C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe:*:Enabled:ipsec"
"C:\\divtools\\unzip\\unzip.exe"="C:\\divtools\\unzip\\unzip.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIBVE.EXE"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIBVE.EXE:*:Enabled:ipsec"
"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe"="C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe:*:Enabled:ipsec"
"C:\\Apps\\ActivBoard\\TrayMon.exe"="C:\\Apps\\ActivBoard\\TrayMon.exe:*:Enabled:ipsec"
"C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\rnathchk.exe"="C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\rnathchk.exe:*:Enabled:ipsec"
"C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe"="C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe:*:Enabled:ipsec"
"C:\\Program Files\\Microsoft Money\\System\\urlmap.exe"="C:\\Program Files\\Microsoft Money\\System\\urlmap.exe:*:Enabled:ipsec"
"C:\\Program Files\\Virtual CD v4 SDK\\system\\vcsplay.exe"="C:\\Program Files\\Virtual CD v4 SDK\\system\\vcsplay.exe:*:Enabled:ipsec"
"C:\\Program Files\\iTunes\\iTunesHelper.exe"="C:\\Program Files\\iTunes\\iTunesHelper.exe:*:Enabled:ipsec"
"C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"="C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe:*:Enabled:ipsec"
"C:\\Program Files\\QuickTime\\QTTask.exe"="C:\\Program Files\\QuickTime\\QTTask.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\LVCOMSX.EXE"="C:\\WINDOWS\\system32\\LVComsX.exe:*:Enabled:ipsec"
"C:\\apps\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe"="C:\\apps\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\wuauclt.exe"="C:\\WINDOWS\\system32\\wuauclt.exe:*:Enabled:ipsec"
"C:\\Program Files\\Java\\jre6\\bin\\jucheck.exe"="C:\\Program Files\\Java\\jre6\\bin\\jucheck.exe:*:Enabled:ipsec"
"C:\\PROGRA~1\\MOUSEW~1\\SYSTEM\\EM_EXEC.EXE"="C:\\PROGRA~1\\MOUSEW~1\\SYSTEM\\EM_EXEC.EXE:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\drwtsn32.exe"="C:\\WINDOWS\\system32\\drwtsn32.exe:*:Enabled:ipsec"
"C:\\ComboFix\\NirCmd.cfexe"="C:\\ComboFix\\NirCmd.cfexe:*:Enabled:ipsec"
"C:\\Documents and Settings\\solo & kad\\Application Data\\Real\\Update\\setup\\setup.exe"="C:\\Documents and Settings\\solo & kad\\Application Data\\Real\\Update\\setup\\setup.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\CF8025.exe"="C:\\WINDOWS\\system32\\CF8025.exe:*:Enabled:ipsec"
"C:\\Apps\\ActivBoard\\nhksrv.exe"="C:\\Apps\\ActivBoard\\nhksrv.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\gicry.exe"="C:\\WINDOWS\\TEMP\\gicry.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\imnms.exe"="C:\\WINDOWS\\TEMP\\imnms.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winvvjufv.exe"="C:\\WINDOWS\\TEMP\\winvvjufv.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winolsjx.exe"="C:\\WINDOWS\\TEMP\\winolsjx.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\leihn.exe"="C:\\WINDOWS\\TEMP\\leihn.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\mxyuse.exe"="C:\\WINDOWS\\TEMP\\mxyuse.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winxxoleg.exe"="C:\\WINDOWS\\TEMP\\winxxoleg.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\dcxb.exe"="C:\\WINDOWS\\TEMP\\dcxb.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winxouwi.exe"="C:\\WINDOWS\\TEMP\\winxouwi.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\ugqwhy.exe"="C:\\WINDOWS\\TEMP\\ugqwhy.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winxebb.exe"="C:\\WINDOWS\\TEMP\\winxebb.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winhgdls.exe"="C:\\WINDOWS\\TEMP\\winhgdls.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\vwxagf.exe"="C:\\WINDOWS\\TEMP\\vwxagf.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\eynbvr.exe"="C:\\WINDOWS\\TEMP\\eynbvr.exe:*:Enabled:ipsec"
"C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\\WINDOWS\\TEMP\\winnkcun.exe"="C:\\WINDOWS\\TEMP\\winnkcun.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\ktcuc.exe"="C:\\WINDOWS\\TEMP\\ktcuc.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winvssrac.exe"="C:\\WINDOWS\\TEMP\\winvssrac.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\olbctq.exe"="C:\\WINDOWS\\TEMP\\olbctq.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winogqu.exe"="C:\\WINDOWS\\TEMP\\winogqu.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winjcabwl.exe"="C:\\WINDOWS\\TEMP\\winjcabwl.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winirfm.exe"="C:\\WINDOWS\\TEMP\\winirfm.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\upqn.exe"="C:\\WINDOWS\\TEMP\\upqn.exe:*:Enabled:ipsec"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
Export de la clef SharedTaskScheduler
[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
exports des policies
REGEDIT4
[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"DisableRegistryTools"=dword:00000000
"EnableLUA"=dword:00000000
Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-07 15:33:53
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\000a9414c109]
"00124750b94d"=hex:cd,d4,c9,b6,fa,85,82,ed,00,d1,26,0c,c7,63,33,11
"001a8a07c09e"=hex:6d,c2,ef,33,5b,5c,66,49,f6,08,f3,5b,9f,08,8e,86
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\knbwwgw]
"DisplayName"="Manager Microsoft"
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000000
"ImagePath"=str(2):"%SystemRoot%\system32\svchost.exe -k netsvcs"
"ObjectName"="LocalSystem"
"Description"="Fournit des services d'acquisition d'images pour les scanneurs et les appareils photo."
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\knbwwgw\Parameters]
"ServiceDll"=str(2):"C:\WINDOWS\system32\eslwkuq.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a9414c109]
"00124750b94d"=hex:cd,d4,c9,b6,fa,85,82,ed,00,d1,26,0c,c7,63,33,11
"001a8a07c09e"=hex:6d,c2,ef,33,5b,5c,66,49,f6,08,f3,5b,9f,08,8e,86
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a9414c109]
"00124750b94d"=hex:cd,d4,c9,b6,fa,85,82,ed,00,d1,26,0c,c7,63,33,11
"001a8a07c09e"=hex:6d,c2,ef,33,5b,5c,66,49,f6,08,f3,5b,9f,08,8e,86
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
scanning hidden files ...
scan completed successfully
hidden services: 0
hidden files: 0
Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)
Process list by traversal of KiWaitListHead
4 - System
396 - svchost.exe
428 - vcssecs.exe
504 - csrss.exe
532 - winlogon.exe
576 - services.exe
596 - lsass.exe
744 - svchost.exe
792 - svchost.exe
856 - svchost.exe
916 - svchost.exe
1032 - svchost.exe
1108 - vwxagf.exe
1172 - spoolsv.exe
1252 - ugqwhy.exe
1292 - svchost.exe
1640 - explorer.exe
1732 - svchost.exe
1764 - nhksrv.exe
1800 - AppleMobileDevi
1924 - CDAC11BA.EXE
1988 - jqs.exe
2020 - mdm.exe
3184 - EM_EXEC.EXE
3200 - MMKeybd.exe
3208 - backWeb-4448364
3220 - rmctrl.exe
3240 - LogiTray.exe
3296 - jusched.exe
3320 - realsched.exe
3332 - QTTask.exe
3384 - ctfmon.exe
3572 - rnathchk.exe
3580 - Traymon.exe
3604 - osd.exe
3624 - NintendoWFCReg.
3816 - LVCOMSX.EXE
3980 - FxSvr2.exe
4016 - cmd.exe
Total number of processes = 39
NOTE: Under WinXP, this will not show all processes.
KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)
Driver/Module list by traversal of PsLoadedModuleList
804D7000 - \WINDOWS\system32\ntoskrnl.exe
806EC000 - \WINDOWS\system32\hal.dll
F9F71000 - \WINDOWS\system32\KDCOM.DLL
F9E81000 - \WINDOWS\system32\BOOTVID.dll
F9A21000 - ACPI.sys
F9F73000 - \WINDOWS\System32\DRIVERS\WMILIB.SYS
F9A10000 - pci.sys
F9A71000 - isapnp.sys
FA039000 - pciide.sys
F9CF1000 - \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
F9F75000 - aliide.sys
F9F77000 - cmdide.sys
F9F79000 - toside.sys
F9F7B000 - viaide.sys
F9F7D000 - intelide.sys
F9A81000 - MountMgr.sys
F99F1000 - ftdisk.sys
F9CF9000 - PartMgr.sys
F9A91000 - VolSnap.sys
F9E85000 - cpqarray.sys
F99D9000 - \WINDOWS\System32\DRIVERS\SCSIPORT.SYS
F99C1000 - atapi.sys
F9E89000 - aha154x.sys
F9D01000 - sparrow.sys
F9E8D000 - symc810.sys
F9AA1000 - aic78xx.sys
F9E91000 - dac960nt.sys
F9AB1000 - ql10wnt.sys
F9E95000 - amsint.sys
F9D09000 - asc.sys
F9E99000 - asc3550.sys
F9D11000 - mraid35x.sys
F9D19000 - i2omp.sys
F9E9D000 - ini910u.sys
F9AC1000 - ql1240.sys
F9AD1000 - aic78u2.sys
F9D21000 - symc8xx.sys
F9D29000 - sym_u3.sys
F9D31000 - sym_hi.sys
F9D39000 - ABP480N5.SYS
F9D41000 - asc3350p.sys
F9F7F000 - cd20xrnt.sys
F9AE1000 - ultra.sys
F9AF1000 - hpt3xx.sys
F99A8000 - adpu160m.sys
F9D49000 - dpti2o.sys
F9B01000 - ql1080.sys
F9B11000 - ql1280.sys
F9B21000 - ql12160.sys
F9D51000 - perc2.sys
F9F81000 - perc2hib.sys
F9D59000 - hpn.sys
F9EA1000 - cbidf2k.sys
F997C000 - dac2w2k.sys
F9B31000 - disk.sys
F9B41000 - \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
F995C000 - fltmgr.sys
F994A000 - sr.sys
F9EA5000 - PxHelp20.sys
F9933000 - KSecDD.sys
F98A6000 - Ntfs.sys
F9879000 - NDIS.sys
F9D61000 - sisagp.sys
F9B51000 - viaagp.sys
F9866000 - sfvfs02.sys
F9D69000 - sfhlp02.sys
F9F83000 - sfhlp01.sys
F9854000 - sfdrv01.sys
F9842000 - prohlp02.sys
F9B61000 - ohci1394.sys
F9B71000 - \WINDOWS\System32\DRIVERS\1394BUS.SYS
F9827000 - Mup.sys
F9B81000 - alim1541.sys
F9B91000 - amdagp.sys
F9BA1000 - agp440.sys
F9BB1000 - agpCPQ.sys
F9BE1000 - \SystemRoot\System32\DRIVERS\nic1394.sys
F9BF1000 - \SystemRoot\System32\DRIVERS\intelppm.sys
F9DB1000 - \SystemRoot\System32\DRIVERS\fdc.sys
F8F3E000 - \SystemRoot\System32\DRIVERS\serial.sys
F9747000 - \SystemRoot\System32\DRIVERS\serenum.sys
F8F2A000 - \SystemRoot\System32\DRIVERS\parport.sys
F9C11000 - \SystemRoot\System32\DRIVERS\imapi.sys
F9C21000 - \SystemRoot\System32\DRIVERS\cdrom.sys
F9C31000 - \SystemRoot\System32\DRIVERS\redbook.sys
F8F07000 - \SystemRoot\System32\DRIVERS\ks.sys
F9743000 - \SystemRoot\System32\Drivers\GEARAspiWDM.sys
F8EDA000 - \SystemRoot\System32\DRIVERS\slntamr.sys
F9454000 - \SystemRoot\System32\DRIVERS\SlWdmSup.sys
F8EC5000 - \SystemRoot\System32\DRIVERS\Mtlmnt5.sys
F9DB9000 - \SystemRoot\System32\Drivers\Modem.SYS
F8E8D000 - \SystemRoot\system32\drivers\stac97nh.sys
F8E45000 - \SystemRoot\system32\drivers\stac97na.sys
F8E21000 - \SystemRoot\system32\drivers\portcls.sys
F9C51000 - \SystemRoot\system32\drivers\drmk.sys
F9DC1000 - \SystemRoot\System32\DRIVERS\usbohci.sys
F8DFE000 - \SystemRoot\System32\DRIVERS\USBPORT.SYS
F9DC9000 - \SystemRoot\System32\DRIVERS\usbehci.sys
F9C61000 - \SystemRoot\System32\DRIVERS\R8139n51.SYS
FA125000 - \SystemRoot\System32\DRIVERS\audstub.sys
F9CC1000 - \SystemRoot\System32\DRIVERS\rasl2tp.sys
F944C000 - \SystemRoot\System32\DRIVERS\ndistapi.sys
F8DE7000 - \SystemRoot\System32\DRIVERS\ndiswan.sys
F9CD1000 - \SystemRoot\System32\DRIVERS\raspppoe.sys
F9CE1000 - \SystemRoot\System32\DRIVERS\raspptp.sys
F9DD1000 - \SystemRoot\System32\DRIVERS\TDI.SYS
F8DD6000 - \SystemRoot\System32\DRIVERS\psched.sys
F9817000 - \SystemRoot\System32\DRIVERS\msgpc.sys
F9DD9000 - \SystemRoot\System32\DRIVERS\ptilink.sys
F9DE1000 - \SystemRoot\System32\DRIVERS\raspti.sys
F9807000 - \SystemRoot\System32\DRIVERS\termdd.sys
F9DE9000 - \SystemRoot\System32\DRIVERS\kbdclass.sys
F9DF1000 - \SystemRoot\System32\DRIVERS\mouclass.sys
F9FD9000 - \SystemRoot\System32\DRIVERS\swenum.sys
F8D7D000 - \SystemRoot\System32\DRIVERS\update.sys
F9438000 - \SystemRoot\System32\DRIVERS\mssmbios.sys
F97E7000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F9E11000 - \SystemRoot\System32\DRIVERS\flpydisk.sys
F97A7000 - \SystemRoot\System32\DRIVERS\usbhub.sys
F9FE1000 - \SystemRoot\System32\DRIVERS\USBD.SYS
F9FF3000 - \SystemRoot\System32\Drivers\i2omgmt.SYS
F9FF5000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
FA0C1000 - \SystemRoot\System32\Drivers\Null.SYS
F9FF7000 - \SystemRoot\System32\Drivers\Beep.SYS
F9E79000 - \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
F9D81000 - \SystemRoot\System32\drivers\vga.sys
F8D41000 - \SystemRoot\System32\drivers\VIDEOPRT.SYS
F9FF9000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F9FFB000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F9D89000 - \SystemRoot\System32\Drivers\Msfs.SYS
F9D91000 - \SystemRoot\System32\Drivers\Npfs.SYS
F9F51000 - \SystemRoot\System32\DRIVERS\rasacd.sys
F8C96000 - \SystemRoot\System32\DRIVERS\ipsec.sys
F8C3E000 - \SystemRoot\System32\DRIVERS\tcpip.sys
F8BFE000 - \SystemRoot\System32\Drivers\SYMTDI.SYS
F8BD6000 - \SystemRoot\System32\DRIVERS\netbt.sys
F9F59000 - \SystemRoot\System32\drivers\ws2ifsl.sys
F8BB4000 - \SystemRoot\System32\drivers\afd.sys
F949B000 - \SystemRoot\System32\DRIVERS\netbios.sys
F8B89000 - \SystemRoot\System32\DRIVERS\rdbss.sys
F8FDF000 - \SystemRoot\System32\drivers\prodrv06.sys
F8B1A000 - \SystemRoot\System32\DRIVERS\mrxsmb.sys
F8FCF000 - \SystemRoot\System32\Drivers\Fips.SYS
F8AF9000 - \SystemRoot\System32\DRIVERS\ipnat.sys
F8FAF000 - \SystemRoot\System32\DRIVERS\wanarp.sys
F8F9F000 - \SystemRoot\System32\DRIVERS\arp1394.sys
F8F7F000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F9DF9000 - \SystemRoot\System32\DRIVERS\USBSTOR.SYS
F9C41000 - \SystemRoot\system32\drivers\lvusbsta.sys
F8A9D000 - \SystemRoot\system32\DRIVERS\LV561AV.SYS
F9C71000 - \SystemRoot\system32\DRIVERS\STREAM.SYS
F974B000 - \SystemRoot\System32\DRIVERS\hidusb.sys
F9C81000 - \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
F9E31000 - \SystemRoot\System32\DRIVERS\LHidFlt2.sys
F8D79000 - \SystemRoot\System32\DRIVERS\mouhid.sys
F9CA1000 - \SystemRoot\System32\DRIVERS\LMouFlt2.sys
F8A85000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F9FFF000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F8D61000 - \SystemRoot\System32\drivers\Dxapi.sys
F9E49000 - \SystemRoot\System32\watchdog.sys
BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
FA166000 - \SystemRoot\System32\drivers\dxgthk.sys
BFF70000 - \SystemRoot\System32\framebuf.dll
F8CB5000 - \SystemRoot\System32\DRIVERS\ndisuio.sys
F851A000 - \SystemRoot\System32\Drivers\Fastfat.SYS
F8465000 - \SystemRoot\system32\drivers\wdmaud.sys
F94AB000 - \SystemRoot\system32\drivers\sysaudio.sys
F82CB000 - \SystemRoot\System32\DRIVERS\mrxdav.sys
F9FB5000 - \SystemRoot\System32\Drivers\ParVdm.SYS
F8D01000 - \SystemRoot\system32\drivers\ip6fw.sys
F8153000 - \SystemRoot\system32\drivers\tcpip6.sys
F80D9000 - \SystemRoot\System32\DRIVERS\srv.sys
F8825000 - \SystemRoot\System32\DRIVERS\ipfltdrv.sys
F9F8D000 - \??\C:\WINDOWS\system32\drivers\mfhnjq.sys
F7D78000 - \SystemRoot\System32\Drivers\HTTP.sys
F7598000 - \SystemRoot\system32\drivers\kmixer.sys
F8CD1000 - \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
FA031000 - \??\C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\mbr.sys
FA0FA000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys
Total number of drivers = 180
Liste des programmes installes
ABBYY FineReader 6.0 Sprint
AC3Filter (remove only)
Adobe Flash Player 10 ActiveX
Adobe Photoshop 7.0
adsl TV
Apple Mobile Device Support
Apple Software Update
Archiveur WinRAR
Assistant de connexion Windows Live
AtomixMP3 Limited Edition v2.0
AtomixMP3 v2.2 Trial
Audacity 1.2.6
AutoUpdate
AVIcodec (remove only)
BitComet 0.70
Bonjour
BSPlayer
C.I.L. version 2.1
CCleaner (remove only)
Cda Product Service - shared component
CDex extraction audio
Codeur Windows Media Série 9
Codeur Windows Media Série 9
Correctif pour Windows XP (KB952287)
Correctif Windows XP - KB834707
Correctif Windows XP - KB867282
Correctif Windows XP - KB873333
Correctif Windows XP - KB873339
Correctif Windows XP - KB885250
Correctif Windows XP - KB885835
Correctif Windows XP - KB885836
Correctif Windows XP - KB885884
Correctif Windows XP - KB886185
Correctif Windows XP - KB887472
Correctif Windows XP - KB887742
Correctif Windows XP - KB888113
Correctif Windows XP - KB888302
Correctif Windows XP - KB890047
Correctif Windows XP - KB890175
Correctif Windows XP - KB890859
Correctif Windows XP - KB890923
Correctif Windows XP - KB891781
Correctif Windows XP - KB893066
Correctif Windows XP - KB893086
dBpoweramp DirectShow Decoder
DigitalCam Pro
DivX
DivX Player
EasyCleaner
Encyclopédie Hachette Multimédia
EPSON Attach To Email
EPSON Attach To Email
EPSON Copy Utility 3
EPSON Easy Photo Print
EPSON File Manager
EPSON Logiciel imprimante
EPSON Scan
EPSON Web-To-Page
ESDX5000_CX4900 Guide d’utilisation
ffdshow (remove only)
Free - Kit de connexion
Free iPod Video Converter 1.34
Free RM to MP3 Converter 1.12
Free YouTube to iPod Converter version 2.8
Free YouTube to Mp3 Converter version 2.4
FreeGo 2.0
Google Earth
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Hemera Products
HijackThis 2.0.2
honestech MPEG Encoder 4.0 Demo
Hotfix for Windows XP (KB915865)
Huffyuv AVI lossless video codec (Remove Only)
iTunes
Java 2 Runtime Environment, SE v1.4.1_01
Java 2 Runtime Environment, SE v1.4.1_05
Java 2 Runtime Environment, SE v1.4.2_01
Java Runtime Environment 1.1
Java Web Start
Java(TM) 6 Update 11
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
K-Lite Codec Pack 2.10 Full
Kerio Personall Firewall
Language Pack for Ad-aware 6
Le Sphinx
LiveReg (Symantec Corporation)
LiveUpdate 1.6 (Symantec Corporation)
Logiciel WebCam de Labtec
Ma-Config.com
Macromedia Flash MX
Macromedia Shockwave Player
Malwarebytes' Anti-Malware
Messenger Plus! 3
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office PowerPoint Viewer 2007 (French)
Microsoft Office XP Professional avec FrontPage
Micros
DiagHelp version v1.4 - http://www.malekal.com
excute le 07/06/2009 à 15:32:14,35
System information for \\YOUR-090942473E:
Uptime: Error reading uptime
Kernel version: Microsoft Windows XP, Uniprocessor Free
Product type: Professional
Product version: 5.1
Service pack: 2
Kernel build number: 2600
Registered organization:
Registered owner: solo & kad
Install date: 01/02/2003, 15:51:45
Activation status: Error reading status
IE version: 7.0000
System root: C:\WINDOWS
Processors: 1
Processor speed: 2.3 GHz
Processor type: Intel(R) Pentium(R) 4 CPU
Physical memory: 256 MB
Video driver: NVIDIA GeForce4 MX 440
Volume Type Format Label Size Free Free
A: Removable 0.0%
C: Fixed NTFS HDD 72.57 GB 12.14 GB 16.7%
D: CD-ROM 0.0%
E: Removable FAT32 1.88 GB 1.67 GB 88.8%
F: Removable FAT 1.91 GB 1.80 GB 94.5%
R: CD-ROM 0.0%
C:\WINDOWS\prefetch\CHCP.COM-17EDBDC9.pf -->07/06/2009 15:31:47
C:\WINDOWS\prefetch\MSSWCHX.EXE-331A4C32.pf -->07/06/2009 15:31:03
C:\WINDOWS\prefetch\OSK.EXE-1B87648A.pf -->07/06/2009 15:31:02
C:\WINDOWS\prefetch\REALEVENT.EXE-168B1F2F.pf -->07/06/2009 15:30:54
C:\WINDOWS\prefetch\CMD.EXE-034B0549.pf -->07/06/2009 15:30:36
C:\WINDOWS\prefetch\URLMAP.EXE-2A71A1E4.pf -->07/06/2009 15:30:23
C:\WINDOWS\prefetch\WINRAR.EXE-0AA31BB9.pf -->07/06/2009 15:30:04
C:\WINDOWS\prefetch\VERCLSID.EXE-28F52AD2.pf -->07/06/2009 15:29:31
C:\WINDOWS\prefetch\RUNDLL32.EXE-3D479208.pf -->07/06/2009 15:29:05
C:\WINDOWS\prefetch\RUNDLL32.EXE-527366BD.pf -->07/06/2009 14:49:37
C:\WINDOWS\System32\drivers\mbamswissarmy.sys -->26/05/2009 13:20:08
C:\WINDOWS\System32\drivers\mbam.sys -->26/05/2009 13:19:56
C:\WINDOWS\System32\drivers\usbaapl.sys -->26/03/2009 15:23:46
C:\WINDOWS\System32\drivers\fwdrv.err -->27/02/2009 01:00:55
C:\WINDOWS\System32\drivers\srv.sys -->11/12/2008 13:57:21
C:\WINDOWS\System32\drivers\mrxsmb.sys -->24/10/2008 13:10:42
C:\WINDOWS\System32\drivers\afd.sys -->14/08/2008 11:51:43
C:\WINDOWS\System32\wpa.dbl -->07/06/2009 14:11:50
C:\WINDOWS\System32\CF8886.exe -->07/06/2009 13:23:40
C:\WINDOWS\System32\nvapps.xml -->06/06/2009 00:00:08
C:\WINDOWS\System32\perfh00C.dat -->28/05/2009 18:42:08
C:\WINDOWS\System32\perfh009.dat -->28/05/2009 18:42:08
C:\WINDOWS\System32\perfc00C.dat -->28/05/2009 18:42:08
C:\WINDOWS\System32\perfc009.dat -->28/05/2009 18:42:07
C:\WINDOWS\System32\PerfStringBackup.INI -->28/05/2009 18:42:05
C:\WINDOWS\System32\FNTCACHE.DAT -->28/05/2009 06:13:48
C:\WINDOWS\System32\KGyGaAvL.sys -->21/05/2009 23:43:25
C:\WINDOWS\System32\MRT.exe -->07/05/2009 00:16:30
C:\WINDOWS\System32\kernel32.dll -->21/03/2009 16:20:10
C:\WINDOWS\System32\pdh.dll -->06/03/2009 16:46:15
C:\WINDOWS\System32\wininet.dll -->03/03/2009 02:13:06
C:\WINDOWS\System32\ieencode.dll -->20/02/2009 19:10:57
C:\WINDOWS\System32\webcheck.dll -->20/02/2009 19:10:56
C:\WINDOWS\System32\urlmon.dll -->20/02/2009 19:10:56
C:\WINDOWS\System32\url.dll -->20/02/2009 19:10:55
C:\WINDOWS\System32\pngfilt.dll -->20/02/2009 19:10:55
C:\WINDOWS\System32\occache.dll -->20/02/2009 19:10:55
C:\WINDOWS\System32\mstime.dll -->20/02/2009 19:10:55
C:\WINDOWS\System32\msrating.dll -->20/02/2009 19:10:55
C:\WINDOWS\System32\mshtmled.dll -->20/02/2009 19:10:54
C:\WINDOWS\System32\mshtml.dll -->20/02/2009 19:10:54
C:\WINDOWS\System32\msfeedsbs.dll -->20/02/2009 19:10:52
C:\WINDOWS\setupapi.log -->07/06/2009 14:45:39
C:\WINDOWS\WindowsUpdate.log -->07/06/2009 14:30:28
C:\WINDOWS\0.log -->07/06/2009 14:11:34
C:\WINDOWS\wiaservc.log -->07/06/2009 14:11:26
C:\WINDOWS\wiadebug.log -->07/06/2009 14:11:25
C:\WINDOWS\bootstat.dat -->07/06/2009 14:11:09
C:\WINDOWS\SchedLgU.Txt -->07/06/2009 14:09:44
C:\WINDOWS\system.ini -->06/06/2009 04:09:45
C:\WINDOWS\MEMORY.DMP -->02/06/2009 20:35:36
C:\WINDOWS\PEV.exe -->31/05/2009 11:08:41
C:\WINDOWS\msiosd.ini -->22/05/2009 19:28:37
C:\WINDOWS\ActiveSurfUI.INI -->17/05/2009 13:47:57
C:\WINDOWS\NIRCMD.exe -->20/04/2009 12:56:28
C:\WINDOWS\QTFont.qfn -->20/07/2008 11:18:05
C:\WINDOWS\cdplayer.ini -->18/07/2008 10:21:41
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 50A3-C98D
Répertoire de C:\WINDOWS
25/05/2009 03:42 <REP> $hf_mig$
14/04/2005 01:13 <REP> $MSI31Uninstall_KB893803$
19/05/2005 17:51 <REP> $MSI31Uninstall_KB893803v2$
06/09/2004 20:42 <REP> $NtServicePackUninstall$
23/05/2009 10:12 <REP> $NtServicePackUninstallIDNMitigationAPIs$
23/05/2009 10:10 <REP> $NtServicePackUninstallNLSDownlevelMapping$
03/05/2004 10:03 <REP> $NtUninstallKB821557$
17/07/2003 14:44 <REP> $NtUninstallKB821557_RTM$
03/05/2004 10:00 <REP> $NtUninstallKB823182$
17/10/2003 17:13 <REP> $NtUninstallKB823182_RTM$
10/07/2003 20:20 <REP> $NtUninstallKB823559$
03/05/2004 09:58 <REP> $NtUninstallKB823980$
17/07/2003 14:42 <REP> $NtUninstallKB823980_RTM$
03/05/2004 09:57 <REP> $NtUninstallKB824105$
04/09/2003 14:41 <REP> $NtUninstallKB824105_RTM$
03/05/2004 09:54 <REP> $NtUninstallKB824141$
17/10/2003 17:14 <REP> $NtUninstallKB824141_RTM$
03/05/2004 09:52 <REP> $NtUninstallKB824146$
11/09/2003 17:03 <REP> $NtUninstallKB824146_RTM$
17/10/2003 17:11 <REP> $NtUninstallKB825119$
03/05/2004 09:49 <REP> $NtUninstallKB828028$
11/02/2004 20:11 <REP> $NtUninstallKB828028_RTM$
03/05/2004 09:47 <REP> $NtUninstallKB828035$
17/10/2003 17:10 <REP> $NtUninstallKB828035_RTM$
03/05/2004 09:44 <REP> $NtUninstallKB828741$
14/04/2004 09:45 <REP> $NtUninstallKB828741_RTM$
14/10/2004 19:43 <REP> $NtUninstallKB834707$
03/05/2004 09:43 <REP> $NtUninstallKB835732$
14/04/2004 09:46 <REP> $NtUninstallKB835732_RTM$
03/05/2004 09:42 <REP> $NtUninstallKB837001$
14/04/2004 09:44 <REP> $NtUninstallKB837001_RTM$
09/06/2004 17:33 <REP> $NtUninstallKB839643$
15/07/2004 18:58 <REP> $NtUninstallKB839645$
15/07/2004 18:57 <REP> $NtUninstallKB840315$
12/05/2004 20:23 <REP> $NtUninstallKB840374$
15/07/2004 18:57 <REP> $NtUninstallKB841873$
15/07/2004 18:56 <REP> $NtUninstallKB842773$
09/02/2005 21:53 <REP> $NtUninstallKB867282$
09/02/2005 21:53 <REP> $NtUninstallKB873333$
15/12/2004 19:17 <REP> $NtUninstallKB873339$
16/06/2005 01:47 <REP> $NtUninstallKB883939$
09/02/2005 21:54 <REP> $NtUninstallKB885250$
15/12/2004 19:16 <REP> $NtUninstallKB885835$
15/12/2004 19:17 <REP> $NtUninstallKB885836$
14/10/2004 19:43 <REP> $NtUninstallKB885884$
15/12/2004 19:16 <REP> $NtUninstallKB886185$
09/02/2005 21:54 <REP> $NtUninstallKB887472$
23/02/2005 12:19 <REP> $NtUninstallKB887742$
09/02/2005 21:54 <REP> $NtUninstallKB888113$
09/02/2005 21:52 <REP> $NtUninstallKB888302$
16/06/2005 01:44 <REP> $NtUninstallKB890046$
09/02/2005 21:52 <REP> $NtUninstallKB890047$
13/01/2005 11:11 <REP> $NtUninstallKB890175$
14/04/2005 01:13 <REP> $NtUninstallKB890859$
14/04/2005 01:14 <REP> $NtUninstallKB890923$
09/02/2005 21:54 <REP> $NtUninstallKB891781$
14/04/2005 01:14 <REP> $NtUninstallKB893066$
14/04/2005 01:14 <REP> $NtUninstallKB893086$
13/08/2005 16:06 <REP> $NtUninstallKB893756$
13/08/2005 16:03 <REP> $NtUninstallKB894391$
16/06/2005 01:46 <REP> $NtUninstallKB896358$
16/06/2005 01:47 <REP> $NtUninstallKB896422$
13/08/2005 16:05 <REP> $NtUninstallKB896423$
10/11/2005 00:53 <REP> $NtUninstallKB896424$
16/06/2005 01:43 <REP> $NtUninstallKB896428$
26/10/2005 00:06 <REP> $NtUninstallKB896688$
13/08/2005 16:05 <REP> $NtUninstallKB896727$
16/06/2005 01:45 <REP> $NtUninstallKB898458$
29/06/2005 17:00 <REP> $NtUninstallKB898461$
13/08/2005 16:06 <REP> $NtUninstallKB899587$
13/08/2005 16:04 <REP> $NtUninstallKB899588$
13/08/2005 16:06 <REP> $NtUninstallKB899591$
25/04/2006 22:33 <REP> $NtUninstallKB900485$
26/10/2005 00:05 <REP> $NtUninstallKB900725$
26/10/2005 00:07 <REP> $NtUninstallKB901017$
13/07/2005 14:41 <REP> $NtUninstallKB901214$
26/10/2005 00:07 <REP> $NtUninstallKB902400$
13/07/2005 14:40 <REP> $NtUninstallKB903235$
26/10/2005 00:05 <REP> $NtUninstallKB904706$
26/10/2005 00:06 <REP> $NtUninstallKB905414$
26/10/2005 00:05 <REP> $NtUninstallKB905749$
17/12/2005 16:47 <REP> $NtUninstallKB905915$
11/01/2006 12:49 <REP> $NtUninstallKB908519$
21/04/2006 02:29 <REP> $NtUninstallKB908531$
17/12/2005 16:47 <REP> $NtUninstallKB910437$
27/06/2006 20:51 <REP> $NtUninstallKB911280$
16/04/2006 13:50 <REP> $NtUninstallKB911562$
15/02/2006 11:53 <REP> $NtUninstallKB911564$
15/02/2006 11:52 <REP> $NtUninstallKB911565$
16/04/2006 13:48 <REP> $NtUninstallKB911567$
15/02/2006 11:53 <REP> $NtUninstallKB911927$
16/04/2006 13:49 <REP> $NtUninstallKB912812$
06/01/2006 13:05 <REP> $NtUninstallKB912919$
15/02/2006 11:51 <REP> $NtUninstallKB913446$
11/05/2006 00:56 <REP> $NtUninstallKB913580$
12/07/2006 01:28 <REP> $NtUninstallKB914388$
21/06/2006 18:39 <REP> $NtUninstallKB914389$
23/05/2009 10:08 <REP> $NtUninstallKB915865$
21/06/2006 18:40 <REP> $NtUninstallKB916281$
12/07/2006 01:27 <REP> $NtUninstallKB916595$
12/07/2006 01:28 <REP> $NtUninstallKB917159$
21/06/2006 18:40 <REP> $NtUninstallKB917344$
09/08/2006 21:16 <REP> $NtUninstallKB917422$
21/06/2006 18:41 <REP> $NtUninstallKB917734_WMP9$
21/06/2006 18:40 <REP> $NtUninstallKB917953$
15/02/2007 19:09 <REP> $NtUninstallKB918118$
21/06/2006 18:40 <REP> $NtUninstallKB918439$
09/08/2006 21:17 <REP> $NtUninstallKB918899$
14/09/2006 09:06 <REP> $NtUninstallKB919007$
16/11/2006 11:40 <REP> $NtUninstallKB920213$
09/08/2006 21:19 <REP> $NtUninstallKB920214$
09/08/2006 21:17 <REP> $NtUninstallKB920670$
09/08/2006 21:14 <REP> $NtUninstallKB920683$
14/09/2006 09:06 <REP> $NtUninstallKB920685$
14/09/2006 09:06 <REP> $NtUninstallKB920872$
09/08/2006 21:18 <REP> $NtUninstallKB921398$
15/08/2007 08:25 <REP> $NtUninstallKB921503$
08/08/2006 20:49 <REP> $NtUninstallKB921883$
14/09/2006 09:05 <REP> $NtUninstallKB922582$
09/08/2006 21:19 <REP> $NtUninstallKB922616$
16/11/2006 11:39 <REP> $NtUninstallKB922760$
12/10/2006 00:36 <REP> $NtUninstallKB922819$
12/10/2006 00:35 <REP> $NtUninstallKB923191$
12/10/2006 00:36 <REP> $NtUninstallKB923414$
25/05/2009 03:05 <REP> $NtUninstallKB923561$
13/12/2006 18:17 <REP> $NtUninstallKB923689$
13/12/2006 18:15 <REP> $NtUninstallKB923694$
15/02/2007 19:10 <REP> $NtUninstallKB923723$
16/11/2006 11:42 <REP> $NtUninstallKB923980$
12/10/2006 00:36 <REP> $NtUninstallKB924191$
16/11/2006 11:42 <REP> $NtUninstallKB924270$
12/10/2006 00:35 <REP> $NtUninstallKB924496$
15/02/2007 19:10 <REP> $NtUninstallKB924667$
13/12/2006 18:17 <REP> $NtUninstallKB925398_WMP64$
13/12/2006 18:18 <REP> $NtUninstallKB925454$
27/09/2006 09:50 <REP> $NtUninstallKB925486$
04/04/2007 07:38 <REP> $NtUninstallKB925902$
13/12/2006 18:16 <REP> $NtUninstallKB926255$
15/02/2007 19:09 <REP> $NtUninstallKB926436$
15/02/2007 19:12 <REP> $NtUninstallKB927779$
15/02/2007 19:12 <REP> $NtUninstallKB927802$
24/05/2007 07:12 <REP> $NtUninstallKB927891$
15/02/2007 19:04 <REP> $NtUninstallKB928090$
15/02/2007 19:11 <REP> $NtUninstallKB928255$
15/02/2007 19:02 <REP> $NtUninstallKB928843$
13/06/2007 07:06 <REP> $NtUninstallKB929123$
16/03/2007 00:32 <REP> $NtUninstallKB929338$
10/01/2007 11:29 <REP> $NtUninstallKB929969$
11/04/2007 07:04 <REP> $NtUninstallKB930178$
10/05/2007 07:19 <REP> $NtUninstallKB930916$
11/04/2007 07:04 <REP> $NtUninstallKB931261$
10/05/2007 07:19 <REP> $NtUninstallKB931768$
11/04/2007 07:05 <REP> $NtUninstallKB931784$
15/02/2007 19:10 <REP> $NtUninstallKB931836$
11/04/2007 07:04 <REP> $NtUninstallKB932168$
30/08/2007 01:10 <REP> $NtUninstallKB933360$
13/06/2007 07:06 <REP> $NtUninstallKB933566$
10/10/2007 01:02 <REP> $NtUninstallKB933729$
13/06/2007 07:02 <REP> $NtUninstallKB935839$
13/06/2007 07:05 <REP> $NtUninstallKB935840$
15/08/2007 08:27 <REP> $NtUninstallKB936021$
11/07/2007 07:32 <REP> $NtUninstallKB936357$
15/08/2007 08:26 <REP> $NtUninstallKB936782_WMP9$
15/08/2007 08:22 <REP> $NtUninstallKB937143$
15/08/2007 08:22 <REP> $NtUninstallKB938127$
10/09/2008 08:43 <REP> $NtUninstallKB938464$
15/08/2007 08:26 <REP> $NtUninstallKB938828$
15/08/2007 08:25 <REP> $NtUninstallKB938829$
10/10/2007 01:01 <REP> $NtUninstallKB939653$
10/10/2007 00:58 <REP> $NtUninstallKB941202$
13/12/2007 04:05 <REP> $NtUninstallKB941568$
13/12/2007 04:07 <REP> $NtUninstallKB941569$
09/01/2008 11:42 <REP> $NtUninstallKB941644$
10/04/2008 01:44 <REP> $NtUninstallKB941693$
13/12/2007 04:04 <REP> $NtUninstallKB942615$
13/12/2007 04:08 <REP> $NtUninstallKB942763$
13/12/2007 04:12 <REP> $NtUninstallKB942840$
14/02/2008 01:57 <REP> $NtUninstallKB943055$
15/11/2007 01:47 <REP> $NtUninstallKB943460$
09/01/2008 11:38 <REP> $NtUninstallKB943485$
10/04/2008 01:41 <REP> $NtUninstallKB944338$
14/02/2008 01:58 <REP> $NtUninstallKB944533$
13/12/2007 04:03 <REP> $NtUninstallKB944653$
10/04/2008 01:40 <REP> $NtUninstallKB945553$
14/02/2008 01:58 <REP> $NtUninstallKB946026$
21/12/2007 12:35 <REP> $NtUninstallKB946627$
15/08/2008 02:56 <REP> $NtUninstallKB946648$
10/04/2008 01:45 <REP> $NtUninstallKB947864$
10/04/2008 01:44 <REP> $NtUninstallKB948590$
10/04/2008 01:45 <REP> $NtUninstallKB948881$
15/05/2008 02:49 <REP> $NtUninstallKB950749$
12/06/2008 03:04 <REP> $NtUninstallKB950759$
12/06/2008 03:03 <REP> $NtUninstallKB950760$
12/06/2008 03:05 <REP> $NtUninstallKB950762$
15/08/2008 02:56 <REP> $NtUninstallKB950974$
15/08/2008 02:54 <REP> $NtUninstallKB951066$
15/08/2008 02:55 <REP> $NtUninstallKB951072-v2$
12/06/2008 03:03 <REP> $NtUninstallKB951376$
20/06/2008 18:10 <REP> $NtUninstallKB951376-v2$
12/06/2008 03:05 <REP> $NtUninstallKB951698$
10/07/2008 00:31 <REP> $NtUninstallKB951748$
25/05/2009 03:32 <REP> $NtUninstallKB952004$
12/12/2008 02:42 <REP> $NtUninstallKB952069_WM9$
15/08/2008 02:55 <REP> $NtUninstallKB952287$
15/08/2008 02:56 <REP> $NtUninstallKB952954$
15/08/2008 02:53 <REP> $NtUninstallKB953838$
15/08/2008 02:56 <REP> $NtUninstallKB953839$
10/09/2008 08:44 <REP> $NtUninstallKB954156_WM9L$
17/10/2008 02:11 <REP> $NtUninstallKB954211$
12/12/2008 02:37 <REP> $NtUninstallKB954600$
12/11/2008 08:49 <REP> $NtUninstallKB955069$
12/12/2008 02:42 <REP> $NtUninstallKB955839$
17/10/2008 02:09 <REP> $NtUninstallKB956390$
17/10/2008 02:12 <REP> $NtUninstallKB956391$
25/05/2009 03:33 <REP> $NtUninstallKB956572$
12/12/2008 02:36 <REP> $NtUninstallKB956802$
17/10/2008 02:12 <REP> $NtUninstallKB956803$
17/10/2008 02:10 <REP> $NtUninstallKB956841$
17/10/2008 02:11 <REP> $NtUninstallKB957095$
12/11/2008 08:49 <REP> $NtUninstallKB957097$
12/12/2008 02:41 <REP> $NtUninstallKB958215$
25/10/2008 02:23 <REP> $NtUninstallKB958644$
14/01/2009 20:56 <REP> $NtUninstallKB958687$
12/03/2009 04:05 <REP> $NtUninstallKB958690$
25/05/2009 03:43 <REP> $NtUninstallKB959426$
12/03/2009 04:07 <REP> $NtUninstallKB960225$
18/12/2008 03:55 <REP> $NtUninstallKB960714$
11/02/2009 02:36 <REP> $NtUninstallKB960715$
25/05/2009 03:08 <REP> $NtUninstallKB960803$
25/05/2009 03:42 <REP> $NtUninstallKB961373$
25/02/2009 04:09 <REP> $NtUninstallKB967715$
31/03/2003 20:45 <REP> $NtUninstallQ309521$
31/03/2003 20:45 <REP> $NtUninstallQ311889$
31/03/2003 20:45 <REP> $NtUninstallQ311967$
15/01/2003 08:54 <REP> $NtUninstallQ312370$
31/03/2003 20:44 <REP> $NtUninstallQ313450$
31/03/2003 20:45 <REP> $NtUninstallQ314147$
31/03/2003 20:45 <REP> $NtUninstallQ314862$
31/03/2003 20:49 <REP> $NtUninstallQ318138$
31/03/2003 20:50 <REP> $NtUninstallQ319580$
30/08/2003 12:58 <REP> $NtUninstallQ320552$
31/03/2003 20:44 <REP> $NtUninstallQ323172$
31/03/2003 20:44 <REP> $NtUninstallQ324096$
31/03/2003 20:44 <REP> $NtUninstallQ324380$
31/03/2003 20:44 <REP> $NtUninstallQ326830$
03/05/2004 09:41 <REP> $NtUninstallQ328310$
31/03/2003 20:47 <REP> $NtUninstallQ328310_RTM$
17/10/2003 17:11 <REP> $NtUninstallQ328940$
03/05/2004 09:39 <REP> $NtUninstallQ329048$
31/03/2003 20:50 <REP> $NtUninstallQ329048_RTM$
31/03/2003 20:46 <REP> $NtUninstallQ329115$
03/05/2004 09:38 <REP> $NtUninstallQ329170$
31/03/2003 20:53 <REP> $NtUninstallQ329170_RTM$
03/05/2004 09:36 <REP> $NtUninstallQ329390$
31/03/2003 20:45 <REP> $NtUninstallQ329390_RTM$
03/05/2004 09:35 <REP> $NtUninstallQ329441$
31/03/2003 20:43 <REP> $NtUninstallQ329441_RTM$
03/05/2004 09:33 <REP> $NtUninstallQ329834$
17/10/2003 17:14 <REP> $NtUninstallQ329834_RTM$
03/05/2004 09:32 <REP> $NtUninstallQ331953$
31/03/2003 20:55 <REP> $NtUninstallQ331953_RTM$
03/05/2004 17:43 <REP> $NtUninstallQ810565$
03/05/2004 09:29 <REP> $NtUninstallQ810577$
31/03/2003 20:48 <REP> $NtUninstallQ810577_RTM$
03/05/2004 17:46 <REP> $NtUninstallQ810833$
03/05/2004 09:27 <REP> $NtUninstallQ811493$
08/05/2003 13:45 <REP> $NtUninstallQ811493_RTM$
03/05/2004 17:41 <REP> $NtUninstallQ814033$
03/05/2004 09:22 <REP> $NtUninstallQ815021$
30/05/2003 12:26 <REP> $NtUninstallQ815021_RTM$
03/05/2004 09:20 <REP> $NtUninstallQ817606$
10/07/2003 20:21 <REP> $NtUninstallQ817606_RTM$
03/05/2004 09:17 <REP> $NtUninstallQ819696$
24/07/2003 11:18 <REP> $NtUninstallQ819696_RTM$
04/10/2003 12:34 <REP> $NtUninstallQ828026$
14/04/2004 09:46 <REP> $xpsp1hfm$
09/02/2003 15:23 30 720 CdaC13BA.EXE
09/02/2003 15:23 112 128 CdaC14BA.DLL
23/05/2009 10:15 <REP> ie7
07/06/2009 12:06 <REP> inf
07/06/2009 14:45 <REP> Installer
30/08/2003 13:09 <REP> msdownld.tmp
05/10/2003 21:47 <REP> PIF
20/07/2008 11:18 54 156 QTFont.qfn
28/08/2001 13:00 49 102 winnt.bmp
28/08/2001 13:00 49 102 winnt256.bmp
6 fichier(s) 295 957 octets
281 Rép(s) 13 039 030 272 octets libres
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 50A3-C98D
Répertoire de C:\WINDOWS\system32
07/06/2009 14:12 <REP> dllcache
26/04/2003 23:31 30 112 fiz1
30/04/2003 22:10 30 027 fiz10
01/05/2003 18:23 30 105 fiz11
02/05/2003 19:23 30 020 fiz12
03/05/2003 17:19 30 107 fiz13
04/05/2003 13:50 30 098 fiz14
05/05/2003 19:05 30 109 fiz15
06/05/2003 13:21 30 054 fiz16
07/05/2003 12:44 30 062 fiz17
09/05/2003 21:45 30 140 fiz18
10/05/2003 14:18 30 014 fiz19
26/04/2003 23:43 30 006 fiz2
10/05/2003 23:38 30 068 fiz20
27/04/2003 00:10 30 032 fiz3
27/04/2003 00:48 30 027 fiz4
27/04/2003 14:06 30 089 fiz5
28/04/2003 13:05 30 073 fiz6
28/04/2003 13:55 30 015 fiz7
29/04/2003 13:26 30 003 fiz8
30/04/2003 15:49 30 034 fiz9
21/05/2009 23:43 10 022 KGyGaAvL.sys
27/11/2003 11:08 2 152 346 kyf.dat
13/12/2008 14:41 16 servdat.slm
30 fichier(s) 2 768 300 octets
1 Rép(s) 13 039 013 888 octets libres
winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed
userinit.exe
kernel32.dll
ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com
------------------------------------------------------------------------------
explorer.exe pid: 1640
Command line: C:\WINDOWS\Explorer.EXE
Base Size Version Path
0x44080000 0xd0000 7.00.6000.16827 C:\WINDOWS\system32\WININET.dll
0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x43e00000 0x45000 7.00.6000.16825 C:\WINDOWS\system32\iertutil.dll
0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll
0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
0x45180000 0x127000 7.00.6000.16825 C:\WINDOWS\system32\urlmon.dll
0x44360000 0x5cd000 7.00.6000.16825 C:\WINDOWS\system32\ieframe.dll
0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll
0x442b0000 0x3c000 7.00.6000.16825 C:\WINDOWS\system32\webcheck.dll
0x00d40000 0x6000 6.01.0000.0145 C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
0x00d60000 0x8000 9.43.0000.0000 C:\PROGRA~1\MOUSEW~1\SYSTEM\LgMousHk.dll
0x01e60000 0x16000 8.04.0002.1019 C:\WINDOWS\system32\LQCUI2.dll
0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
0x01d80000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x10000000 0x76d000 6.14.0010.9371 C:\WINDOWS\system32\nvcpl.dll
0x74bf0000 0x2c000 4.02.5406.0000 C:\WINDOWS\system32\OLEACC.dll
0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x02030000 0x44000 6.14.0010.9371 C:\WINDOWS\system32\NVRSFR.DLL
0x02080000 0x36000 6.14.0010.9371 C:\WINDOWS\system32\nvapi.dll
0x02860000 0x73000 6.14.0010.11060 C:\WINDOWS\system32\nvshell.dll
0x028f0000 0x12000 1.01.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
0x02910000 0x2b000 C:\Program Files\WinRAR\rarext.dll
0x02df0000 0x13000 1.00.0000.0000 C:\Program Files\EPSON\Creativity Suite\Easy Photo Print\EPPShell.dll
0x73d20000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL
0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL
0x02f10000 0x1b000 C:\WINDOWS\System32\tsseCryp.dll
0x01150000 0x9000 0.01.0000.0002 C:\Apps\ActivBoard\nhkdll.dll
0x03840000 0x7000 10.00.0000.0831 C:\Program Files\Microsoft Money\System\urlmapps.dll
ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com
------------------------------------------------------------------------------
winlogon.exe pid: 532
Command line: winlogon.exe
Base Size Version Path
0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe
0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll
0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x012f0000 0xae000 1.05.0540.0000 C:\WINDOWS\system32\WgaLogon.dll
0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 50A3-C98D
Répertoire de C:\WINDOWS\temp
07/06/2009 15:28 19 968 abgtr.exe
07/06/2009 14:14 11 264 ugqwhy.exe
07/06/2009 14:15 19 968 vwxagf.exe
3 fichier(s) 51 200 octets
0 Rép(s) 13 039 009 792 octets libres
Contenu de Downloaded Program Files
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 50A3-C98D
Répertoire de C:\WINDOWS\Downloaded Program Files
07/06/2009 14:45 <REP> .
07/06/2009 14:45 <REP> ..
20/01/2005 14:53 171 ampx.inf
17/05/2006 14:32 231 072 avsniff.dll
17/05/2006 14:29 878 avsniff.inf
17/05/2006 14:32 198 304 avsniffdlgs.dll
17/05/2006 14:26 537 704 AXXPEE.dll
17/05/2006 14:29 241 CabSA.inf
12/09/2007 01:00 2 504 catalog.dat
21/05/2003 02:06 70 656 Checkers.dll
06/07/2001 17:41 106 496 ChkDVD.dll
21/09/2004 15:09 36 864 coltrans.ax
28/08/2003 23:40 <REP> CONFLICT.1
21/09/2004 15:10 163 840 CoreExecutive.dll
27/03/2003 23:35 65 desktop.ini
21/09/2004 15:10 36 864 DownloadersWI.dll
12/09/2007 01:00 6 899 ecbootil.vxd
17/05/2006 14:26 42 112 ecmldr32.dll
12/09/2007 01:00 284 016 ecmsvr32.dll
08/09/2004 23:38 1 271 erma.inf
09/06/2003 15:18 234 FileSharingCtrl.inf
24/03/2008 19:33 1 527 056 FP_AX_CAB_INSTALLER.exe
14/08/2003 11:14 223 832 fsmsngr-fr.dll
13/11/2002 08:06 196 608 GSManager.dll
03/07/2003 13:59 160 gsmanager.inf
29/05/2009 17:12 1 569 hardwaredetection.inf
17/08/2003 01:31 113 008 HMAtchmt.ocx
21/09/2004 15:10 90 112 HtmlParser.dll
21/09/2004 15:10 53 248 HTMLSourceFilter.ax
21/09/2004 15:11 57 344 MelodySourceParser.ax
21/05/2003 02:06 152 576 MessengerStatsClient.dll
20/01/2000 15:25 1 162 Microsoft XML Parser for Java.osd
21/05/2003 02:06 77 312 MineSweeper.dll
21/09/2004 15:11 81 920 MPO.dll
18/11/1999 13:49 992 msaudio.inf
29/05/2003 15:00 77 408 msgrchkr.dll
11/06/2003 16:40 32 768 MsnChat40fr-fr.dll
16/05/2003 17:33 278 MsnChat45.inf
16/05/2003 17:33 457 288 MSNChat45.ocx
17/05/2006 14:28 6 850 navapi.vxd
17/05/2006 14:28 201 896 navapi32.dll
12/09/2007 01:00 124 272 naveng32.dll
12/09/2007 01:00 914 800 navex32a.dll
31/08/2002 13:36 516 NPX.INF
31/08/2002 13:33 290 816 npx.ocx
21/09/2004 15:12 229 376 Parsers.dll
21/09/2004 15:12 36 864 PlayerServer.dll
21/09/2004 15:11 94 208 PNGSource.ax
09/10/2003 11:32 144 QTPlugin.inf
05/03/2003 17:23 524 404 RdxIE.dll
21/09/2004 15:12 32 768 RegType_IE.dll
17/05/2006 14:32 161 480 rufsi.dll
21/09/2004 15:13 25 600 scg.ax
12/09/2007 01:00 97 744 scrauth.dat
21/09/2004 15:13 147 456 SMILInetCtrl.dll
21/09/2004 15:14 28 326 SMILViewer_DX6.inf
29/05/2003 15:00 86 112 solitaireshowdown.dll
29/05/2002 23:12 9 488 sporder.dll
29/05/2002 23:12 9 488 sporder_.dll
21/09/2004 15:11 57 344 StreamControl.ax
24/03/2008 19:18 247 swflash.inf
12/09/2007 01:00 11 875 symaveng.cat
12/09/2007 01:00 1 061 symaveng.inf
12/09/2007 01:00 397 385 tcdefs.dat
12/09/2007 01:00 1 794 980 tcscan7.dat
12/09/2007 01:00 394 740 tcscan8.dat
12/09/2007 01:00 908 486 tcscan9.dat
12/09/2007 01:00 453 tinf.dat
12/09/2007 01:00 148 tinfidx.dat
12/09/2007 01:00 1 957 tinfl.dat
12/09/2007 01:00 67 619 tscan1.dat
12/09/2007 01:00 3 240 tscan1hd.dat
12/09/2007 01:00 4 778 v.grd
12/09/2007 01:00 2 267 v.sig
21/09/2004 15:13 110 592 VideoCompositor.ax
12/09/2007 01:00 106 244 virscan.inf
12/09/2007 01:00 993 455 virscan1.dat
12/09/2007 01:00 570 702 virscan2.dat
12/09/2007 01:00 150 140 virscan3.dat
12/09/2007 01:00 320 253 virscan4.dat
12/09/2007 01:00 4 496 806 virscan5.dat
12/09/2007 01:00 391 782 virscan6.dat
12/09/2007 01:00 12 097 338 virscan7.dat
12/09/2007 01:00 1 807 666 virscan8.dat
12/09/2007 01:00 4 989 561 virscan9.dat
12/09/2007 01:00 32 virscant.dat
26/09/2007 01:34 2 072 vscanmsx.dat
21/09/2004 15:13 36 864 WBMPSource.ax
27/10/2002 19:32 3 036 wmv9dmo.inf
04/03/2005 12:11 2 371 wmvadvd.inf
12/09/2007 01:00 224 zdone.dat
88 fichier(s) 37 613 158 octets
Répertoire de C:\WINDOWS\Downloaded Program Files\CONFLICT.1
28/08/2003 23:40 <REP> .
28/08/2003 23:40 <REP> ..
29/05/2003 15:00 160 864 messengerstatsclient.dll
29/05/2003 15:00 84 064 minesweeper.dll
2 fichier(s) 244 928 octets
Total des fichiers listés :
90 fichier(s) 37 858 086 octets
5 Rép(s) 13 039 005 696 octets libres
Recherche de rootkit! (Merci S!Ri)
Recherche d'infections connues
Export des clefs sensibles..
Liste des fichiers en exception sur le pare-feu XP SP2
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\APPS\\ActivSurf\\4448364\\Program\\backWeb-4448364.exe"="C:\\apps\\ActivSurf\\4448364\\Program\\backweb-4448364.exe:*:Enabled:ipsec"
"C:\\Documents and Settings\\solo & kad\\Mes documents\\mircfr\\mircfr\\mirc.exe"="C:\\Documents and Settings\\solo & kad\\Mes documents\\mircfr\\mircfr\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealOne Player"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Disabled:Skype"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"="C:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe:*:Enabled:ipsec"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\SPSSInc\\Statistics17\\statistics.com"="C:\\Program Files\\SPSSInc\\Statistics17\\statistics.com:*:Disabled:Statistics17:com"
"C:\\Program Files\\SPSSInc\\Statistics17\\statistics.exe"="C:\\Program Files\\SPSSInc\\Statistics17\\statistics.exe:*:Disabled:Statistics17:exe"
"C:\\Program Files\\SPSSInc\\Statistics17\\SPSSWinWrapIDE.exe"="C:\\Program Files\\SPSSInc\\Statistics17\\SPSSWinWrapIDE.exe:*:Disabled:SPSS Basic Script Editor"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\WINDOWS\\System32\\rmctrl.exe"="C:\\WINDOWS\\System32\\rmctrl.exe:*:Enabled:ipsec"
"C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe:*:Enabled:ipsec"
"C:\\Program Files\\Java\\jre6\\bin\\jusched.exe"="C:\\Program Files\\Java\\jre6\\bin\\jusched.exe:*:Enabled:ipsec"
"C:\\Program Files\\Logitech\\Video\\FxSvr2.exe"="C:\\Program Files\\Logitech\\Video\\FxSvr2.exe:*:Enabled:ipsec"
"C:\\Apps\\ActivBoard\\OSD.exe"="C:\\Apps\\ActivBoard\\OSD.exe:*:Enabled:ipsec"
"C:\\Program Files\\Logitech\\Video\\LogiTray.exe"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\netsh.exe"="C:\\WINDOWS\\system32\\netsh.exe:*:Enabled:ipsec"
"C:\\Apps\\ActivBoard\\MMKeybd.exe"="C:\\Apps\\ActivBoard\\MMKeybd.exe:*:Enabled:ipsec"
"C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe:*:Enabled:ipsec"
"C:\\divtools\\unzip\\unzip.exe"="C:\\divtools\\unzip\\unzip.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIBVE.EXE"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIBVE.EXE:*:Enabled:ipsec"
"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe"="C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe:*:Enabled:ipsec"
"C:\\Apps\\ActivBoard\\TrayMon.exe"="C:\\Apps\\ActivBoard\\TrayMon.exe:*:Enabled:ipsec"
"C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\rnathchk.exe"="C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\rnathchk.exe:*:Enabled:ipsec"
"C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe"="C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe:*:Enabled:ipsec"
"C:\\Program Files\\Microsoft Money\\System\\urlmap.exe"="C:\\Program Files\\Microsoft Money\\System\\urlmap.exe:*:Enabled:ipsec"
"C:\\Program Files\\Virtual CD v4 SDK\\system\\vcsplay.exe"="C:\\Program Files\\Virtual CD v4 SDK\\system\\vcsplay.exe:*:Enabled:ipsec"
"C:\\Program Files\\iTunes\\iTunesHelper.exe"="C:\\Program Files\\iTunes\\iTunesHelper.exe:*:Enabled:ipsec"
"C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"="C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe:*:Enabled:ipsec"
"C:\\Program Files\\QuickTime\\QTTask.exe"="C:\\Program Files\\QuickTime\\QTTask.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\LVCOMSX.EXE"="C:\\WINDOWS\\system32\\LVComsX.exe:*:Enabled:ipsec"
"C:\\apps\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe"="C:\\apps\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\wuauclt.exe"="C:\\WINDOWS\\system32\\wuauclt.exe:*:Enabled:ipsec"
"C:\\Program Files\\Java\\jre6\\bin\\jucheck.exe"="C:\\Program Files\\Java\\jre6\\bin\\jucheck.exe:*:Enabled:ipsec"
"C:\\PROGRA~1\\MOUSEW~1\\SYSTEM\\EM_EXEC.EXE"="C:\\PROGRA~1\\MOUSEW~1\\SYSTEM\\EM_EXEC.EXE:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\drwtsn32.exe"="C:\\WINDOWS\\system32\\drwtsn32.exe:*:Enabled:ipsec"
"C:\\ComboFix\\NirCmd.cfexe"="C:\\ComboFix\\NirCmd.cfexe:*:Enabled:ipsec"
"C:\\Documents and Settings\\solo & kad\\Application Data\\Real\\Update\\setup\\setup.exe"="C:\\Documents and Settings\\solo & kad\\Application Data\\Real\\Update\\setup\\setup.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\CF8025.exe"="C:\\WINDOWS\\system32\\CF8025.exe:*:Enabled:ipsec"
"C:\\Apps\\ActivBoard\\nhksrv.exe"="C:\\Apps\\ActivBoard\\nhksrv.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\gicry.exe"="C:\\WINDOWS\\TEMP\\gicry.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\imnms.exe"="C:\\WINDOWS\\TEMP\\imnms.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winvvjufv.exe"="C:\\WINDOWS\\TEMP\\winvvjufv.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winolsjx.exe"="C:\\WINDOWS\\TEMP\\winolsjx.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\leihn.exe"="C:\\WINDOWS\\TEMP\\leihn.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\mxyuse.exe"="C:\\WINDOWS\\TEMP\\mxyuse.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winxxoleg.exe"="C:\\WINDOWS\\TEMP\\winxxoleg.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\dcxb.exe"="C:\\WINDOWS\\TEMP\\dcxb.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winxouwi.exe"="C:\\WINDOWS\\TEMP\\winxouwi.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\ugqwhy.exe"="C:\\WINDOWS\\TEMP\\ugqwhy.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winxebb.exe"="C:\\WINDOWS\\TEMP\\winxebb.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winhgdls.exe"="C:\\WINDOWS\\TEMP\\winhgdls.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\vwxagf.exe"="C:\\WINDOWS\\TEMP\\vwxagf.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\eynbvr.exe"="C:\\WINDOWS\\TEMP\\eynbvr.exe:*:Enabled:ipsec"
"C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\\WINDOWS\\TEMP\\winnkcun.exe"="C:\\WINDOWS\\TEMP\\winnkcun.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\ktcuc.exe"="C:\\WINDOWS\\TEMP\\ktcuc.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winvssrac.exe"="C:\\WINDOWS\\TEMP\\winvssrac.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\olbctq.exe"="C:\\WINDOWS\\TEMP\\olbctq.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winogqu.exe"="C:\\WINDOWS\\TEMP\\winogqu.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winjcabwl.exe"="C:\\WINDOWS\\TEMP\\winjcabwl.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\winirfm.exe"="C:\\WINDOWS\\TEMP\\winirfm.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\TEMP\\upqn.exe"="C:\\WINDOWS\\TEMP\\upqn.exe:*:Enabled:ipsec"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
Export de la clef SharedTaskScheduler
[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
exports des policies
REGEDIT4
[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"DisableRegistryTools"=dword:00000000
"EnableLUA"=dword:00000000
Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-07 15:33:53
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\000a9414c109]
"00124750b94d"=hex:cd,d4,c9,b6,fa,85,82,ed,00,d1,26,0c,c7,63,33,11
"001a8a07c09e"=hex:6d,c2,ef,33,5b,5c,66,49,f6,08,f3,5b,9f,08,8e,86
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\knbwwgw]
"DisplayName"="Manager Microsoft"
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000000
"ImagePath"=str(2):"%SystemRoot%\system32\svchost.exe -k netsvcs"
"ObjectName"="LocalSystem"
"Description"="Fournit des services d'acquisition d'images pour les scanneurs et les appareils photo."
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\knbwwgw\Parameters]
"ServiceDll"=str(2):"C:\WINDOWS\system32\eslwkuq.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a9414c109]
"00124750b94d"=hex:cd,d4,c9,b6,fa,85,82,ed,00,d1,26,0c,c7,63,33,11
"001a8a07c09e"=hex:6d,c2,ef,33,5b,5c,66,49,f6,08,f3,5b,9f,08,8e,86
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a9414c109]
"00124750b94d"=hex:cd,d4,c9,b6,fa,85,82,ed,00,d1,26,0c,c7,63,33,11
"001a8a07c09e"=hex:6d,c2,ef,33,5b,5c,66,49,f6,08,f3,5b,9f,08,8e,86
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
scanning hidden files ...
scan completed successfully
hidden services: 0
hidden files: 0
Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)
Process list by traversal of KiWaitListHead
4 - System
396 - svchost.exe
428 - vcssecs.exe
504 - csrss.exe
532 - winlogon.exe
576 - services.exe
596 - lsass.exe
744 - svchost.exe
792 - svchost.exe
856 - svchost.exe
916 - svchost.exe
1032 - svchost.exe
1108 - vwxagf.exe
1172 - spoolsv.exe
1252 - ugqwhy.exe
1292 - svchost.exe
1640 - explorer.exe
1732 - svchost.exe
1764 - nhksrv.exe
1800 - AppleMobileDevi
1924 - CDAC11BA.EXE
1988 - jqs.exe
2020 - mdm.exe
3184 - EM_EXEC.EXE
3200 - MMKeybd.exe
3208 - backWeb-4448364
3220 - rmctrl.exe
3240 - LogiTray.exe
3296 - jusched.exe
3320 - realsched.exe
3332 - QTTask.exe
3384 - ctfmon.exe
3572 - rnathchk.exe
3580 - Traymon.exe
3604 - osd.exe
3624 - NintendoWFCReg.
3816 - LVCOMSX.EXE
3980 - FxSvr2.exe
4016 - cmd.exe
Total number of processes = 39
NOTE: Under WinXP, this will not show all processes.
KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)
Driver/Module list by traversal of PsLoadedModuleList
804D7000 - \WINDOWS\system32\ntoskrnl.exe
806EC000 - \WINDOWS\system32\hal.dll
F9F71000 - \WINDOWS\system32\KDCOM.DLL
F9E81000 - \WINDOWS\system32\BOOTVID.dll
F9A21000 - ACPI.sys
F9F73000 - \WINDOWS\System32\DRIVERS\WMILIB.SYS
F9A10000 - pci.sys
F9A71000 - isapnp.sys
FA039000 - pciide.sys
F9CF1000 - \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
F9F75000 - aliide.sys
F9F77000 - cmdide.sys
F9F79000 - toside.sys
F9F7B000 - viaide.sys
F9F7D000 - intelide.sys
F9A81000 - MountMgr.sys
F99F1000 - ftdisk.sys
F9CF9000 - PartMgr.sys
F9A91000 - VolSnap.sys
F9E85000 - cpqarray.sys
F99D9000 - \WINDOWS\System32\DRIVERS\SCSIPORT.SYS
F99C1000 - atapi.sys
F9E89000 - aha154x.sys
F9D01000 - sparrow.sys
F9E8D000 - symc810.sys
F9AA1000 - aic78xx.sys
F9E91000 - dac960nt.sys
F9AB1000 - ql10wnt.sys
F9E95000 - amsint.sys
F9D09000 - asc.sys
F9E99000 - asc3550.sys
F9D11000 - mraid35x.sys
F9D19000 - i2omp.sys
F9E9D000 - ini910u.sys
F9AC1000 - ql1240.sys
F9AD1000 - aic78u2.sys
F9D21000 - symc8xx.sys
F9D29000 - sym_u3.sys
F9D31000 - sym_hi.sys
F9D39000 - ABP480N5.SYS
F9D41000 - asc3350p.sys
F9F7F000 - cd20xrnt.sys
F9AE1000 - ultra.sys
F9AF1000 - hpt3xx.sys
F99A8000 - adpu160m.sys
F9D49000 - dpti2o.sys
F9B01000 - ql1080.sys
F9B11000 - ql1280.sys
F9B21000 - ql12160.sys
F9D51000 - perc2.sys
F9F81000 - perc2hib.sys
F9D59000 - hpn.sys
F9EA1000 - cbidf2k.sys
F997C000 - dac2w2k.sys
F9B31000 - disk.sys
F9B41000 - \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
F995C000 - fltmgr.sys
F994A000 - sr.sys
F9EA5000 - PxHelp20.sys
F9933000 - KSecDD.sys
F98A6000 - Ntfs.sys
F9879000 - NDIS.sys
F9D61000 - sisagp.sys
F9B51000 - viaagp.sys
F9866000 - sfvfs02.sys
F9D69000 - sfhlp02.sys
F9F83000 - sfhlp01.sys
F9854000 - sfdrv01.sys
F9842000 - prohlp02.sys
F9B61000 - ohci1394.sys
F9B71000 - \WINDOWS\System32\DRIVERS\1394BUS.SYS
F9827000 - Mup.sys
F9B81000 - alim1541.sys
F9B91000 - amdagp.sys
F9BA1000 - agp440.sys
F9BB1000 - agpCPQ.sys
F9BE1000 - \SystemRoot\System32\DRIVERS\nic1394.sys
F9BF1000 - \SystemRoot\System32\DRIVERS\intelppm.sys
F9DB1000 - \SystemRoot\System32\DRIVERS\fdc.sys
F8F3E000 - \SystemRoot\System32\DRIVERS\serial.sys
F9747000 - \SystemRoot\System32\DRIVERS\serenum.sys
F8F2A000 - \SystemRoot\System32\DRIVERS\parport.sys
F9C11000 - \SystemRoot\System32\DRIVERS\imapi.sys
F9C21000 - \SystemRoot\System32\DRIVERS\cdrom.sys
F9C31000 - \SystemRoot\System32\DRIVERS\redbook.sys
F8F07000 - \SystemRoot\System32\DRIVERS\ks.sys
F9743000 - \SystemRoot\System32\Drivers\GEARAspiWDM.sys
F8EDA000 - \SystemRoot\System32\DRIVERS\slntamr.sys
F9454000 - \SystemRoot\System32\DRIVERS\SlWdmSup.sys
F8EC5000 - \SystemRoot\System32\DRIVERS\Mtlmnt5.sys
F9DB9000 - \SystemRoot\System32\Drivers\Modem.SYS
F8E8D000 - \SystemRoot\system32\drivers\stac97nh.sys
F8E45000 - \SystemRoot\system32\drivers\stac97na.sys
F8E21000 - \SystemRoot\system32\drivers\portcls.sys
F9C51000 - \SystemRoot\system32\drivers\drmk.sys
F9DC1000 - \SystemRoot\System32\DRIVERS\usbohci.sys
F8DFE000 - \SystemRoot\System32\DRIVERS\USBPORT.SYS
F9DC9000 - \SystemRoot\System32\DRIVERS\usbehci.sys
F9C61000 - \SystemRoot\System32\DRIVERS\R8139n51.SYS
FA125000 - \SystemRoot\System32\DRIVERS\audstub.sys
F9CC1000 - \SystemRoot\System32\DRIVERS\rasl2tp.sys
F944C000 - \SystemRoot\System32\DRIVERS\ndistapi.sys
F8DE7000 - \SystemRoot\System32\DRIVERS\ndiswan.sys
F9CD1000 - \SystemRoot\System32\DRIVERS\raspppoe.sys
F9CE1000 - \SystemRoot\System32\DRIVERS\raspptp.sys
F9DD1000 - \SystemRoot\System32\DRIVERS\TDI.SYS
F8DD6000 - \SystemRoot\System32\DRIVERS\psched.sys
F9817000 - \SystemRoot\System32\DRIVERS\msgpc.sys
F9DD9000 - \SystemRoot\System32\DRIVERS\ptilink.sys
F9DE1000 - \SystemRoot\System32\DRIVERS\raspti.sys
F9807000 - \SystemRoot\System32\DRIVERS\termdd.sys
F9DE9000 - \SystemRoot\System32\DRIVERS\kbdclass.sys
F9DF1000 - \SystemRoot\System32\DRIVERS\mouclass.sys
F9FD9000 - \SystemRoot\System32\DRIVERS\swenum.sys
F8D7D000 - \SystemRoot\System32\DRIVERS\update.sys
F9438000 - \SystemRoot\System32\DRIVERS\mssmbios.sys
F97E7000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F9E11000 - \SystemRoot\System32\DRIVERS\flpydisk.sys
F97A7000 - \SystemRoot\System32\DRIVERS\usbhub.sys
F9FE1000 - \SystemRoot\System32\DRIVERS\USBD.SYS
F9FF3000 - \SystemRoot\System32\Drivers\i2omgmt.SYS
F9FF5000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
FA0C1000 - \SystemRoot\System32\Drivers\Null.SYS
F9FF7000 - \SystemRoot\System32\Drivers\Beep.SYS
F9E79000 - \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
F9D81000 - \SystemRoot\System32\drivers\vga.sys
F8D41000 - \SystemRoot\System32\drivers\VIDEOPRT.SYS
F9FF9000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F9FFB000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F9D89000 - \SystemRoot\System32\Drivers\Msfs.SYS
F9D91000 - \SystemRoot\System32\Drivers\Npfs.SYS
F9F51000 - \SystemRoot\System32\DRIVERS\rasacd.sys
F8C96000 - \SystemRoot\System32\DRIVERS\ipsec.sys
F8C3E000 - \SystemRoot\System32\DRIVERS\tcpip.sys
F8BFE000 - \SystemRoot\System32\Drivers\SYMTDI.SYS
F8BD6000 - \SystemRoot\System32\DRIVERS\netbt.sys
F9F59000 - \SystemRoot\System32\drivers\ws2ifsl.sys
F8BB4000 - \SystemRoot\System32\drivers\afd.sys
F949B000 - \SystemRoot\System32\DRIVERS\netbios.sys
F8B89000 - \SystemRoot\System32\DRIVERS\rdbss.sys
F8FDF000 - \SystemRoot\System32\drivers\prodrv06.sys
F8B1A000 - \SystemRoot\System32\DRIVERS\mrxsmb.sys
F8FCF000 - \SystemRoot\System32\Drivers\Fips.SYS
F8AF9000 - \SystemRoot\System32\DRIVERS\ipnat.sys
F8FAF000 - \SystemRoot\System32\DRIVERS\wanarp.sys
F8F9F000 - \SystemRoot\System32\DRIVERS\arp1394.sys
F8F7F000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F9DF9000 - \SystemRoot\System32\DRIVERS\USBSTOR.SYS
F9C41000 - \SystemRoot\system32\drivers\lvusbsta.sys
F8A9D000 - \SystemRoot\system32\DRIVERS\LV561AV.SYS
F9C71000 - \SystemRoot\system32\DRIVERS\STREAM.SYS
F974B000 - \SystemRoot\System32\DRIVERS\hidusb.sys
F9C81000 - \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
F9E31000 - \SystemRoot\System32\DRIVERS\LHidFlt2.sys
F8D79000 - \SystemRoot\System32\DRIVERS\mouhid.sys
F9CA1000 - \SystemRoot\System32\DRIVERS\LMouFlt2.sys
F8A85000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F9FFF000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F8D61000 - \SystemRoot\System32\drivers\Dxapi.sys
F9E49000 - \SystemRoot\System32\watchdog.sys
BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
FA166000 - \SystemRoot\System32\drivers\dxgthk.sys
BFF70000 - \SystemRoot\System32\framebuf.dll
F8CB5000 - \SystemRoot\System32\DRIVERS\ndisuio.sys
F851A000 - \SystemRoot\System32\Drivers\Fastfat.SYS
F8465000 - \SystemRoot\system32\drivers\wdmaud.sys
F94AB000 - \SystemRoot\system32\drivers\sysaudio.sys
F82CB000 - \SystemRoot\System32\DRIVERS\mrxdav.sys
F9FB5000 - \SystemRoot\System32\Drivers\ParVdm.SYS
F8D01000 - \SystemRoot\system32\drivers\ip6fw.sys
F8153000 - \SystemRoot\system32\drivers\tcpip6.sys
F80D9000 - \SystemRoot\System32\DRIVERS\srv.sys
F8825000 - \SystemRoot\System32\DRIVERS\ipfltdrv.sys
F9F8D000 - \??\C:\WINDOWS\system32\drivers\mfhnjq.sys
F7D78000 - \SystemRoot\System32\Drivers\HTTP.sys
F7598000 - \SystemRoot\system32\drivers\kmixer.sys
F8CD1000 - \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
FA031000 - \??\C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\mbr.sys
FA0FA000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys
Total number of drivers = 180
Liste des programmes installes
ABBYY FineReader 6.0 Sprint
AC3Filter (remove only)
Adobe Flash Player 10 ActiveX
Adobe Photoshop 7.0
adsl TV
Apple Mobile Device Support
Apple Software Update
Archiveur WinRAR
Assistant de connexion Windows Live
AtomixMP3 Limited Edition v2.0
AtomixMP3 v2.2 Trial
Audacity 1.2.6
AutoUpdate
AVIcodec (remove only)
BitComet 0.70
Bonjour
BSPlayer
C.I.L. version 2.1
CCleaner (remove only)
Cda Product Service - shared component
CDex extraction audio
Codeur Windows Media Série 9
Codeur Windows Media Série 9
Correctif pour Windows XP (KB952287)
Correctif Windows XP - KB834707
Correctif Windows XP - KB867282
Correctif Windows XP - KB873333
Correctif Windows XP - KB873339
Correctif Windows XP - KB885250
Correctif Windows XP - KB885835
Correctif Windows XP - KB885836
Correctif Windows XP - KB885884
Correctif Windows XP - KB886185
Correctif Windows XP - KB887472
Correctif Windows XP - KB887742
Correctif Windows XP - KB888113
Correctif Windows XP - KB888302
Correctif Windows XP - KB890047
Correctif Windows XP - KB890175
Correctif Windows XP - KB890859
Correctif Windows XP - KB890923
Correctif Windows XP - KB891781
Correctif Windows XP - KB893066
Correctif Windows XP - KB893086
dBpoweramp DirectShow Decoder
DigitalCam Pro
DivX
DivX Player
EasyCleaner
Encyclopédie Hachette Multimédia
EPSON Attach To Email
EPSON Attach To Email
EPSON Copy Utility 3
EPSON Easy Photo Print
EPSON File Manager
EPSON Logiciel imprimante
EPSON Scan
EPSON Web-To-Page
ESDX5000_CX4900 Guide d’utilisation
ffdshow (remove only)
Free - Kit de connexion
Free iPod Video Converter 1.34
Free RM to MP3 Converter 1.12
Free YouTube to iPod Converter version 2.8
Free YouTube to Mp3 Converter version 2.4
FreeGo 2.0
Google Earth
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Hemera Products
HijackThis 2.0.2
honestech MPEG Encoder 4.0 Demo
Hotfix for Windows XP (KB915865)
Huffyuv AVI lossless video codec (Remove Only)
iTunes
Java 2 Runtime Environment, SE v1.4.1_01
Java 2 Runtime Environment, SE v1.4.1_05
Java 2 Runtime Environment, SE v1.4.2_01
Java Runtime Environment 1.1
Java Web Start
Java(TM) 6 Update 11
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
K-Lite Codec Pack 2.10 Full
Kerio Personall Firewall
Language Pack for Ad-aware 6
Le Sphinx
LiveReg (Symantec Corporation)
LiveUpdate 1.6 (Symantec Corporation)
Logiciel WebCam de Labtec
Ma-Config.com
Macromedia Flash MX
Macromedia Shockwave Player
Malwarebytes' Anti-Malware
Messenger Plus! 3
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office PowerPoint Viewer 2007 (French)
Microsoft Office XP Professional avec FrontPage
Micros
Utilisateur anonyme
7 juin 2009 à 17:49
7 juin 2009 à 17:49
ça devrait servir a quelque chose car je viens de trouver qui relance l infection
je te prepare la manipe ;)
je te prepare la manipe ;)
Utilisateur anonyme
7 juin 2009 à 17:59
7 juin 2009 à 17:59
cette fois ci ça devrait etre bon :
Copie le texte ci-dessous :
killall::
Driver::
knbwwgw
abp470n5
File::
C:\WINDOWS\system32\eslwkuq.dll
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
C:\WINDOWS\system32\drivers\mfhnjq.sys
C:\WINDOWS\temp\abgtr.exe
C:\WINDOWS\temp\ugqwhy.exe
C:\WINDOWS\temp\vwxagf.exe
C:\WINDOWS\TEMP\ugqwhy.exe
C:\WINDOWS\TEMP\vwxagf.exe
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000
"UacDisableNotify"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"FirewallOverride"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"UacDisableNotify"=dword:00000000
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=-
"DisableRegistryTools"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Apps\\ActivBoard\\nhksrv.exe"=-
"C:\\WINDOWS\\TEMP\\gicry.exe"=-
"C:\\WINDOWS\\TEMP\\imnms.exe"=-
"C:\\WINDOWS\\TEMP\\winvvjufv.exe"=-
"C:\\WINDOWS\\TEMP\\winolsjx.exe"=-
"C:\\WINDOWS\\TEMP\\leihn.exe"=-
"C:\\WINDOWS\\TEMP\\mxyuse.exe"=-
"C:\\WINDOWS\\TEMP\\winxxoleg.exe"=-
"C:\\WINDOWS\\TEMP\\dcxb.exe"=-
"C:\\WINDOWS\\TEMP\\winxouwi.exe"=-
"C:\\WINDOWS\\TEMP\\ugqwhy.exe"=-
"C:\\WINDOWS\\TEMP\\winxebb.exe"=-
"C:\\WINDOWS\\TEMP\\winhgdls.exe"=-
"C:\\WINDOWS\\TEMP\\vwxagf.exe"=-
"C:\\WINDOWS\\TEMP\\eynbvr.exe"=-
"C:\\WINDOWS\\TEMP\\winnkcun.exe"=-
"C:\\WINDOWS\\TEMP\\ktcuc.exe"=-
"C:\\WINDOWS\\TEMP\\winvssrac.exe"=-
"C:\\WINDOWS\\TEMP\\olbctq.exe"=-
"C:\\WINDOWS\\TEMP\\winogqu.exe"=-
"C:\\WINDOWS\\TEMP\\winjcabwl.exe"=-
"C:\\WINDOWS\\TEMP\\winirfm.exe"=-
"C:\\WINDOWS\\TEMP\\upqn.exe"=-
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ceci :
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt
Copie le texte ci-dessous :
killall::
Driver::
knbwwgw
abp470n5
File::
C:\WINDOWS\system32\eslwkuq.dll
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
C:\WINDOWS\system32\drivers\mfhnjq.sys
C:\WINDOWS\temp\abgtr.exe
C:\WINDOWS\temp\ugqwhy.exe
C:\WINDOWS\temp\vwxagf.exe
C:\WINDOWS\TEMP\ugqwhy.exe
C:\WINDOWS\TEMP\vwxagf.exe
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000
"UacDisableNotify"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"FirewallOverride"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"UacDisableNotify"=dword:00000000
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=-
"DisableRegistryTools"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Apps\\ActivBoard\\nhksrv.exe"=-
"C:\\WINDOWS\\TEMP\\gicry.exe"=-
"C:\\WINDOWS\\TEMP\\imnms.exe"=-
"C:\\WINDOWS\\TEMP\\winvvjufv.exe"=-
"C:\\WINDOWS\\TEMP\\winolsjx.exe"=-
"C:\\WINDOWS\\TEMP\\leihn.exe"=-
"C:\\WINDOWS\\TEMP\\mxyuse.exe"=-
"C:\\WINDOWS\\TEMP\\winxxoleg.exe"=-
"C:\\WINDOWS\\TEMP\\dcxb.exe"=-
"C:\\WINDOWS\\TEMP\\winxouwi.exe"=-
"C:\\WINDOWS\\TEMP\\ugqwhy.exe"=-
"C:\\WINDOWS\\TEMP\\winxebb.exe"=-
"C:\\WINDOWS\\TEMP\\winhgdls.exe"=-
"C:\\WINDOWS\\TEMP\\vwxagf.exe"=-
"C:\\WINDOWS\\TEMP\\eynbvr.exe"=-
"C:\\WINDOWS\\TEMP\\winnkcun.exe"=-
"C:\\WINDOWS\\TEMP\\ktcuc.exe"=-
"C:\\WINDOWS\\TEMP\\winvssrac.exe"=-
"C:\\WINDOWS\\TEMP\\olbctq.exe"=-
"C:\\WINDOWS\\TEMP\\winogqu.exe"=-
"C:\\WINDOWS\\TEMP\\winjcabwl.exe"=-
"C:\\WINDOWS\\TEMP\\winirfm.exe"=-
"C:\\WINDOWS\\TEMP\\upqn.exe"=-
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ceci :
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt
Ororo
Messages postés
115
Date d'inscription
dimanche 24 mai 2009
Statut
Membre
Dernière intervention
13 juin 2009
7 juin 2009 à 18:13
7 juin 2009 à 18:13
ok je lance ça !
Ororo
Messages postés
115
Date d'inscription
dimanche 24 mai 2009
Statut
Membre
Dernière intervention
13 juin 2009
7 juin 2009 à 18:31
7 juin 2009 à 18:31
Désolé, ça n'a pas marché, intérrompu au bout de 2 minutes.
Est ce du au fait d'avoir laissé le cable réseau branché ?
J'ai cru avoir vu AUTORITE NT \ SYSTEM
J'ai envie de balancé cette tour par la fenetre !
Est ce du au fait d'avoir laissé le cable réseau branché ?
J'ai cru avoir vu AUTORITE NT \ SYSTEM
J'ai envie de balancé cette tour par la fenetre !
Utilisateur anonyme
7 juin 2009 à 18:34
7 juin 2009 à 18:34
---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe
---> Double-clique sur OTMoveIt3.exe afin de le lancer.
---> Copie (Ctrl+C) le texte suivant ci-dessous :
:processes
explorer.exe
:services
knbwwgw
abp470n5
:files
C:\WINDOWS\system32\eslwkuq.dll
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
C:\WINDOWS\system32\drivers\mfhnjq.sys
C:\WINDOWS\temp\abgtr.exe
C:\WINDOWS\temp\ugqwhy.exe
C:\WINDOWS\temp\vwxagf.exe
C:\WINDOWS\TEMP\ugqwhy.exe
C:\WINDOWS\TEMP\vwxagf.exe
:reg
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000
"UacDisableNotify"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"FirewallOverride"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"UacDisableNotify"=dword:00000000
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=-
"DisableRegistryTools"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Apps\\ActivBoard\\nhksrv.exe"=-
"C:\\WINDOWS\\TEMP\\gicry.exe"=-
"C:\\WINDOWS\\TEMP\\imnms.exe"=-
"C:\\WINDOWS\\TEMP\\winvvjufv.exe"=-
"C:\\WINDOWS\\TEMP\\winolsjx.exe"=-
"C:\\WINDOWS\\TEMP\\leihn.exe"=-
"C:\\WINDOWS\\TEMP\\mxyuse.exe"=-
"C:\\WINDOWS\\TEMP\\winxxoleg.exe"=-
"C:\\WINDOWS\\TEMP\\dcxb.exe"=-
"C:\\WINDOWS\\TEMP\\winxouwi.exe"=-
"C:\\WINDOWS\\TEMP\\ugqwhy.exe"=-
"C:\\WINDOWS\\TEMP\\winxebb.exe"=-
"C:\\WINDOWS\\TEMP\\winhgdls.exe"=-
"C:\\WINDOWS\\TEMP\\vwxagf.exe"=-
"C:\\WINDOWS\\TEMP\\eynbvr.exe"=-
"C:\\WINDOWS\\TEMP\\winnkcun.exe"=-
"C:\\WINDOWS\\TEMP\\ktcuc.exe"=-
"C:\\WINDOWS\\TEMP\\winvssrac.exe"=-
"C:\\WINDOWS\\TEMP\\olbctq.exe"=-
"C:\\WINDOWS\\TEMP\\winogqu.exe"=-
"C:\\WINDOWS\\TEMP\\winjcabwl.exe"=-
"C:\\WINDOWS\\TEMP\\winirfm.exe"=-
"C:\\WINDOWS\\TEMP\\upqn.exe"=-
:commands
[emptytemp]
[start explorer]
[reboot]
---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.
---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log
http://oldtimer.geekstogo.com/OTMoveIt3.exe
---> Double-clique sur OTMoveIt3.exe afin de le lancer.
---> Copie (Ctrl+C) le texte suivant ci-dessous :
:processes
explorer.exe
:services
knbwwgw
abp470n5
:files
C:\WINDOWS\system32\eslwkuq.dll
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
C:\WINDOWS\system32\drivers\mfhnjq.sys
C:\WINDOWS\temp\abgtr.exe
C:\WINDOWS\temp\ugqwhy.exe
C:\WINDOWS\temp\vwxagf.exe
C:\WINDOWS\TEMP\ugqwhy.exe
C:\WINDOWS\TEMP\vwxagf.exe
:reg
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000
"UacDisableNotify"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"FirewallOverride"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"UacDisableNotify"=dword:00000000
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=-
"DisableRegistryTools"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Apps\\ActivBoard\\nhksrv.exe"=-
"C:\\WINDOWS\\TEMP\\gicry.exe"=-
"C:\\WINDOWS\\TEMP\\imnms.exe"=-
"C:\\WINDOWS\\TEMP\\winvvjufv.exe"=-
"C:\\WINDOWS\\TEMP\\winolsjx.exe"=-
"C:\\WINDOWS\\TEMP\\leihn.exe"=-
"C:\\WINDOWS\\TEMP\\mxyuse.exe"=-
"C:\\WINDOWS\\TEMP\\winxxoleg.exe"=-
"C:\\WINDOWS\\TEMP\\dcxb.exe"=-
"C:\\WINDOWS\\TEMP\\winxouwi.exe"=-
"C:\\WINDOWS\\TEMP\\ugqwhy.exe"=-
"C:\\WINDOWS\\TEMP\\winxebb.exe"=-
"C:\\WINDOWS\\TEMP\\winhgdls.exe"=-
"C:\\WINDOWS\\TEMP\\vwxagf.exe"=-
"C:\\WINDOWS\\TEMP\\eynbvr.exe"=-
"C:\\WINDOWS\\TEMP\\winnkcun.exe"=-
"C:\\WINDOWS\\TEMP\\ktcuc.exe"=-
"C:\\WINDOWS\\TEMP\\winvssrac.exe"=-
"C:\\WINDOWS\\TEMP\\olbctq.exe"=-
"C:\\WINDOWS\\TEMP\\winogqu.exe"=-
"C:\\WINDOWS\\TEMP\\winjcabwl.exe"=-
"C:\\WINDOWS\\TEMP\\winirfm.exe"=-
"C:\\WINDOWS\\TEMP\\upqn.exe"=-
:commands
[emptytemp]
[start explorer]
[reboot]
---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.
---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log
Ororo
Messages postés
115
Date d'inscription
dimanche 24 mai 2009
Statut
Membre
Dernière intervention
13 juin 2009
7 juin 2009 à 18:53
7 juin 2009 à 18:53
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Service\Driver knbwwgw not found.
Service\Driver knbwwgw not found.
Service\Driver knbwwgw not found.
Service\Driver abp470n5 deleted successfully.
========== FILES ==========
File/Folder C:\WINDOWS\system32\eslwkuq.dll not found.
DllUnregisterServer procedure not found in C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll NOT unregistered.
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll moved successfully.
File/Folder C:\WINDOWS\system32\drivers\mfhnjq.sys not found.
File/Folder C:\WINDOWS\temp\abgtr.exe not found.
File/Folder C:\WINDOWS\temp\ugqwhy.exe not found.
File/Folder C:\WINDOWS\temp\vwxagf.exe not found.
File/Folder C:\WINDOWS\TEMP\ugqwhy.exe not found.
File/Folder C:\WINDOWS\TEMP\vwxagf.exe not found.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\software\microsoft\security center\\"AntiVirusOverride"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\\"FirewallOverride"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\\"UacDisableNotify"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\\"AntiVirusDisableNotify"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\\"UpdatesDisableNotify"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"AntiVirusOverride"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"AntiVirusDisableNotify"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"FirewallDisableNotify"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"FirewallOverride"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"UpdatesDisableNotify"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"UacDisableNotify"|dword:00000000 /E : value set successfully!
Registry value HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system\\DisableTaskMgr deleted successfully.
Registry value HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system\\DisableRegistryTools deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Apps\ActivBoard\nhksrv.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\gicry.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\imnms.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winvvjufv.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winolsjx.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\leihn.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\mxyuse.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winxxoleg.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\dcxb.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winxouwi.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\ugqwhy.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winxebb.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winhgdls.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\vwxagf.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\eynbvr.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winnkcun.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\ktcuc.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winvssrac.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\olbctq.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winogqu.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winjcabwl.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winirfm.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\upqn.exe not found.
========== COMMANDS ==========
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\solo & kad\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_724.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\pwomb.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\winxxjxpe.exe scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 06072009_184208
Files moved on Reboot...
File C:\WINDOWS\temp\Perflib_Perfdata_724.dat not found!
File C:\WINDOWS\temp\pwomb.exe not found!
File C:\WINDOWS\temp\winxxjxpe.exe not found!
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Service\Driver knbwwgw not found.
Service\Driver knbwwgw not found.
Service\Driver knbwwgw not found.
Service\Driver abp470n5 deleted successfully.
========== FILES ==========
File/Folder C:\WINDOWS\system32\eslwkuq.dll not found.
DllUnregisterServer procedure not found in C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll NOT unregistered.
C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll moved successfully.
File/Folder C:\WINDOWS\system32\drivers\mfhnjq.sys not found.
File/Folder C:\WINDOWS\temp\abgtr.exe not found.
File/Folder C:\WINDOWS\temp\ugqwhy.exe not found.
File/Folder C:\WINDOWS\temp\vwxagf.exe not found.
File/Folder C:\WINDOWS\TEMP\ugqwhy.exe not found.
File/Folder C:\WINDOWS\TEMP\vwxagf.exe not found.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\software\microsoft\security center\\"AntiVirusOverride"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\\"FirewallOverride"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\\"UacDisableNotify"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\\"AntiVirusDisableNotify"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\\"UpdatesDisableNotify"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"AntiVirusOverride"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"AntiVirusDisableNotify"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"FirewallDisableNotify"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"FirewallOverride"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"UpdatesDisableNotify"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"UacDisableNotify"|dword:00000000 /E : value set successfully!
Registry value HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system\\DisableTaskMgr deleted successfully.
Registry value HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system\\DisableRegistryTools deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Apps\ActivBoard\nhksrv.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\gicry.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\imnms.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winvvjufv.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winolsjx.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\leihn.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\mxyuse.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winxxoleg.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\dcxb.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winxouwi.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\ugqwhy.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winxebb.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winhgdls.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\vwxagf.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\eynbvr.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winnkcun.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\ktcuc.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winvssrac.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\olbctq.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winogqu.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winjcabwl.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winirfm.exe not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\upqn.exe not found.
========== COMMANDS ==========
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\solo & kad\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_724.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\pwomb.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\winxxjxpe.exe scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 06072009_184208
Files moved on Reboot...
File C:\WINDOWS\temp\Perflib_Perfdata_724.dat not found!
File C:\WINDOWS\temp\pwomb.exe not found!
File C:\WINDOWS\temp\winxxjxpe.exe not found!
Utilisateur anonyme
7 juin 2009 à 19:00
7 juin 2009 à 19:00
ok ,
tu veux bien réessayer ça :
http://www.commentcamarche.net/forum/affich 12584229 probleme gestionnaire des taches antivirus?page=11#208
tu veux bien réessayer ça :
http://www.commentcamarche.net/forum/affich 12584229 probleme gestionnaire des taches antivirus?page=11#208
Ororo
Messages postés
115
Date d'inscription
dimanche 24 mai 2009
Statut
Membre
Dernière intervention
13 juin 2009
7 juin 2009 à 19:16
7 juin 2009 à 19:16
ça ne passe pas. redémarrage au bout de quelques minutes.
Ororo
Messages postés
115
Date d'inscription
dimanche 24 mai 2009
Statut
Membre
Dernière intervention
13 juin 2009
7 juin 2009 à 19:22
7 juin 2009 à 19:22
le mode sans echec ne passe pas.
Utilisateur anonyme
7 juin 2009 à 19:31
7 juin 2009 à 19:31
regarde si t as ici : et dis moi : https://www.bitdefender.com/toolbox/
Ororo
Messages postés
115
Date d'inscription
dimanche 24 mai 2009
Statut
Membre
Dernière intervention
13 juin 2009
7 juin 2009 à 19:53
7 juin 2009 à 19:53
La page se charge sans vraiment aboutir à quelque chose (la jauge de chargement s'arrete à la moitié).
Page blanche !
Concernant mon clavier, c'est chiant d'écrire le clavier visuel.
Ce problème est apparu suite à un scan combofix, il a peut-etre déréglé certains elements ?
Windows dit qu'il est branché mais ne trouve pas le périphérique
Page blanche !
Concernant mon clavier, c'est chiant d'écrire le clavier visuel.
Ce problème est apparu suite à un scan combofix, il a peut-etre déréglé certains elements ?
Windows dit qu'il est branché mais ne trouve pas le périphérique
Utilisateur anonyme
7 juin 2009 à 19:56
7 juin 2009 à 19:56
t as été voir dans le gestionnaire des périphérique pour le clavier ?
Ororo
Messages postés
115
Date d'inscription
dimanche 24 mai 2009
Statut
Membre
Dernière intervention
13 juin 2009
7 juin 2009 à 20:08
7 juin 2009 à 20:08
oui j'étais allé voir.
Windows a chargé le pilote de périphérique de ce matériel mais ne trouve pas le périphérique matériel
Windows a chargé le pilote de périphérique de ce matériel mais ne trouve pas le périphérique matériel
