Problème gestionnaire des tâches / Antivirus - Page 11

Précédent
  • 1
  • 3
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  1. Utilisateur anonyme
     
    regarde dans le gestionnaire des peripherique pour le clavier

    et fais un scan en ligne :http://www.bitdefender.fr/scan_fr/scan8/ie.html

    Poste en réponse le rapport de scan qui se trouve ici C:\windows\bdoscan8\scanres.txt ou scanres.html
    0
  2. Ororo Messages postés 115 Statut Membre
     
    J'ai l'impression d'etre toujours bloqué au niveau de l'accès auxsites de scan en ligne.
    Je ne viens jamais avec de bonnes nouvelles.
    Cette infection me saoule !!
    0
  3. Utilisateur anonyme
     
    .;) et de mon coté j ai du mal a identifier le processus qui la relance ..
    0
  4. Utilisateur anonyme
     
    ON VA fouiller un peut + :

    Télécharge DiagHelp.zip sur ton bureau :

    http://www.malekal.com/download/DiagHelp.zip

    !! déconnectes toi et fermes toutes tes applications en cours !!

    Fais un clic droit sur le fichier et extraire tout .

    --> Un nouveau dossier va être créé : "DiagHelp"
    Ouvres le et double-clic sur go.cmd et pas sur autre chose !

    --> Une fenêtre va s'ouvrir, choisis l'option 1
    L'analyse va commencer, ce-ci peut durer quelques minutes, laisses faire et appuies sur une touche quand on te le demandera :
    une page IE va s'ouvrir , fermes la .
    Re-appuis sur une touche, le bloc-note s'ouvre :
    Sauvegardes ce rapport de façon à le retrouver et postes tout son contenu dans ta prochaine réponse ...

    ##########################

    Télécharge GMER à partir de ce lien : http://www.gmer.net#files - clic sur "Download EXE" et télécharge le fichier sur ton bureau.
    Voir le tutorial GMER, ça peut peut-être t'aider : https://www.malekal.com/tutorial-gmer/

    Désactive tes logiciels de protection (antivirus, antispyware etc) et ferme tous les programmes ouverts.
    Double-clic sur le fichier GMER téléchargé.
    IMPORTANT: Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.
    Clic sur l'onglet "rootkit"
    Laisse tout coché.
    Clic sur Scan
    Lorsque le scan est terminé, clic sur "Copy"

    Ouvre le bloc-note et clic sur le Menu Edition / Coller
    Le rapport doit alors apparaître.
    Enregistre le fichier sur ton bureau et copie/colle le contenu ici.

    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Ororo Messages postés 115 Statut Membre
     
    Voici le rapport DiagHelp enespérant que ça aboutisse à quelque chose

    DiagHelp version v1.4 - http://www.malekal.com
    excute le 07/06/2009 à 15:32:14,35

    System information for \\YOUR-090942473E:
    Uptime: Error reading uptime
    Kernel version: Microsoft Windows XP, Uniprocessor Free
    Product type: Professional
    Product version: 5.1
    Service pack: 2
    Kernel build number: 2600
    Registered organization:
    Registered owner: solo & kad
    Install date: 01/02/2003, 15:51:45
    Activation status: Error reading status
    IE version: 7.0000
    System root: C:\WINDOWS
    Processors: 1
    Processor speed: 2.3 GHz
    Processor type: Intel(R) Pentium(R) 4 CPU
    Physical memory: 256 MB
    Video driver: NVIDIA GeForce4 MX 440
    Volume Type Format Label Size Free Free
    A: Removable 0.0%
    C: Fixed NTFS HDD 72.57 GB 12.14 GB 16.7%
    D: CD-ROM 0.0%
    E: Removable FAT32 1.88 GB 1.67 GB 88.8%
    F: Removable FAT 1.91 GB 1.80 GB 94.5%
    R: CD-ROM 0.0%

    C:\WINDOWS\prefetch\CHCP.COM-17EDBDC9.pf -->07/06/2009 15:31:47
    C:\WINDOWS\prefetch\MSSWCHX.EXE-331A4C32.pf -->07/06/2009 15:31:03
    C:\WINDOWS\prefetch\OSK.EXE-1B87648A.pf -->07/06/2009 15:31:02
    C:\WINDOWS\prefetch\REALEVENT.EXE-168B1F2F.pf -->07/06/2009 15:30:54
    C:\WINDOWS\prefetch\CMD.EXE-034B0549.pf -->07/06/2009 15:30:36
    C:\WINDOWS\prefetch\URLMAP.EXE-2A71A1E4.pf -->07/06/2009 15:30:23
    C:\WINDOWS\prefetch\WINRAR.EXE-0AA31BB9.pf -->07/06/2009 15:30:04
    C:\WINDOWS\prefetch\VERCLSID.EXE-28F52AD2.pf -->07/06/2009 15:29:31
    C:\WINDOWS\prefetch\RUNDLL32.EXE-3D479208.pf -->07/06/2009 15:29:05
    C:\WINDOWS\prefetch\RUNDLL32.EXE-527366BD.pf -->07/06/2009 14:49:37

    C:\WINDOWS\System32\drivers\mbamswissarmy.sys -->26/05/2009 13:20:08
    C:\WINDOWS\System32\drivers\mbam.sys -->26/05/2009 13:19:56
    C:\WINDOWS\System32\drivers\usbaapl.sys -->26/03/2009 15:23:46
    C:\WINDOWS\System32\drivers\fwdrv.err -->27/02/2009 01:00:55
    C:\WINDOWS\System32\drivers\srv.sys -->11/12/2008 13:57:21
    C:\WINDOWS\System32\drivers\mrxsmb.sys -->24/10/2008 13:10:42
    C:\WINDOWS\System32\drivers\afd.sys -->14/08/2008 11:51:43

    C:\WINDOWS\System32\wpa.dbl -->07/06/2009 14:11:50
    C:\WINDOWS\System32\CF8886.exe -->07/06/2009 13:23:40
    C:\WINDOWS\System32\nvapps.xml -->06/06/2009 00:00:08
    C:\WINDOWS\System32\perfh00C.dat -->28/05/2009 18:42:08
    C:\WINDOWS\System32\perfh009.dat -->28/05/2009 18:42:08
    C:\WINDOWS\System32\perfc00C.dat -->28/05/2009 18:42:08
    C:\WINDOWS\System32\perfc009.dat -->28/05/2009 18:42:07
    C:\WINDOWS\System32\PerfStringBackup.INI -->28/05/2009 18:42:05
    C:\WINDOWS\System32\FNTCACHE.DAT -->28/05/2009 06:13:48
    C:\WINDOWS\System32\KGyGaAvL.sys -->21/05/2009 23:43:25
    C:\WINDOWS\System32\MRT.exe -->07/05/2009 00:16:30
    C:\WINDOWS\System32\kernel32.dll -->21/03/2009 16:20:10
    C:\WINDOWS\System32\pdh.dll -->06/03/2009 16:46:15
    C:\WINDOWS\System32\wininet.dll -->03/03/2009 02:13:06
    C:\WINDOWS\System32\ieencode.dll -->20/02/2009 19:10:57
    C:\WINDOWS\System32\webcheck.dll -->20/02/2009 19:10:56
    C:\WINDOWS\System32\urlmon.dll -->20/02/2009 19:10:56
    C:\WINDOWS\System32\url.dll -->20/02/2009 19:10:55
    C:\WINDOWS\System32\pngfilt.dll -->20/02/2009 19:10:55
    C:\WINDOWS\System32\occache.dll -->20/02/2009 19:10:55
    C:\WINDOWS\System32\mstime.dll -->20/02/2009 19:10:55
    C:\WINDOWS\System32\msrating.dll -->20/02/2009 19:10:55
    C:\WINDOWS\System32\mshtmled.dll -->20/02/2009 19:10:54
    C:\WINDOWS\System32\mshtml.dll -->20/02/2009 19:10:54
    C:\WINDOWS\System32\msfeedsbs.dll -->20/02/2009 19:10:52

    C:\WINDOWS\setupapi.log -->07/06/2009 14:45:39
    C:\WINDOWS\WindowsUpdate.log -->07/06/2009 14:30:28
    C:\WINDOWS\0.log -->07/06/2009 14:11:34
    C:\WINDOWS\wiaservc.log -->07/06/2009 14:11:26
    C:\WINDOWS\wiadebug.log -->07/06/2009 14:11:25
    C:\WINDOWS\bootstat.dat -->07/06/2009 14:11:09
    C:\WINDOWS\SchedLgU.Txt -->07/06/2009 14:09:44
    C:\WINDOWS\system.ini -->06/06/2009 04:09:45
    C:\WINDOWS\MEMORY.DMP -->02/06/2009 20:35:36
    C:\WINDOWS\PEV.exe -->31/05/2009 11:08:41
    C:\WINDOWS\msiosd.ini -->22/05/2009 19:28:37
    C:\WINDOWS\ActiveSurfUI.INI -->17/05/2009 13:47:57
    C:\WINDOWS\NIRCMD.exe -->20/04/2009 12:56:28
    C:\WINDOWS\QTFont.qfn -->20/07/2008 11:18:05
    C:\WINDOWS\cdplayer.ini -->18/07/2008 10:21:41

    Le volume dans le lecteur C s'appelle HDD
    Le numéro de série du volume est 50A3-C98D

    Répertoire de C:\WINDOWS

    25/05/2009 03:42 <REP> $hf_mig$
    14/04/2005 01:13 <REP> $MSI31Uninstall_KB893803$
    19/05/2005 17:51 <REP> $MSI31Uninstall_KB893803v2$
    06/09/2004 20:42 <REP> $NtServicePackUninstall$
    23/05/2009 10:12 <REP> $NtServicePackUninstallIDNMitigationAPIs$
    23/05/2009 10:10 <REP> $NtServicePackUninstallNLSDownlevelMapping$
    03/05/2004 10:03 <REP> $NtUninstallKB821557$
    17/07/2003 14:44 <REP> $NtUninstallKB821557_RTM$
    03/05/2004 10:00 <REP> $NtUninstallKB823182$
    17/10/2003 17:13 <REP> $NtUninstallKB823182_RTM$
    10/07/2003 20:20 <REP> $NtUninstallKB823559$
    03/05/2004 09:58 <REP> $NtUninstallKB823980$
    17/07/2003 14:42 <REP> $NtUninstallKB823980_RTM$
    03/05/2004 09:57 <REP> $NtUninstallKB824105$
    04/09/2003 14:41 <REP> $NtUninstallKB824105_RTM$
    03/05/2004 09:54 <REP> $NtUninstallKB824141$
    17/10/2003 17:14 <REP> $NtUninstallKB824141_RTM$
    03/05/2004 09:52 <REP> $NtUninstallKB824146$
    11/09/2003 17:03 <REP> $NtUninstallKB824146_RTM$
    17/10/2003 17:11 <REP> $NtUninstallKB825119$
    03/05/2004 09:49 <REP> $NtUninstallKB828028$
    11/02/2004 20:11 <REP> $NtUninstallKB828028_RTM$
    03/05/2004 09:47 <REP> $NtUninstallKB828035$
    17/10/2003 17:10 <REP> $NtUninstallKB828035_RTM$
    03/05/2004 09:44 <REP> $NtUninstallKB828741$
    14/04/2004 09:45 <REP> $NtUninstallKB828741_RTM$
    14/10/2004 19:43 <REP> $NtUninstallKB834707$
    03/05/2004 09:43 <REP> $NtUninstallKB835732$
    14/04/2004 09:46 <REP> $NtUninstallKB835732_RTM$
    03/05/2004 09:42 <REP> $NtUninstallKB837001$
    14/04/2004 09:44 <REP> $NtUninstallKB837001_RTM$
    09/06/2004 17:33 <REP> $NtUninstallKB839643$
    15/07/2004 18:58 <REP> $NtUninstallKB839645$
    15/07/2004 18:57 <REP> $NtUninstallKB840315$
    12/05/2004 20:23 <REP> $NtUninstallKB840374$
    15/07/2004 18:57 <REP> $NtUninstallKB841873$
    15/07/2004 18:56 <REP> $NtUninstallKB842773$
    09/02/2005 21:53 <REP> $NtUninstallKB867282$
    09/02/2005 21:53 <REP> $NtUninstallKB873333$
    15/12/2004 19:17 <REP> $NtUninstallKB873339$
    16/06/2005 01:47 <REP> $NtUninstallKB883939$
    09/02/2005 21:54 <REP> $NtUninstallKB885250$
    15/12/2004 19:16 <REP> $NtUninstallKB885835$
    15/12/2004 19:17 <REP> $NtUninstallKB885836$
    14/10/2004 19:43 <REP> $NtUninstallKB885884$
    15/12/2004 19:16 <REP> $NtUninstallKB886185$
    09/02/2005 21:54 <REP> $NtUninstallKB887472$
    23/02/2005 12:19 <REP> $NtUninstallKB887742$
    09/02/2005 21:54 <REP> $NtUninstallKB888113$
    09/02/2005 21:52 <REP> $NtUninstallKB888302$
    16/06/2005 01:44 <REP> $NtUninstallKB890046$
    09/02/2005 21:52 <REP> $NtUninstallKB890047$
    13/01/2005 11:11 <REP> $NtUninstallKB890175$
    14/04/2005 01:13 <REP> $NtUninstallKB890859$
    14/04/2005 01:14 <REP> $NtUninstallKB890923$
    09/02/2005 21:54 <REP> $NtUninstallKB891781$
    14/04/2005 01:14 <REP> $NtUninstallKB893066$
    14/04/2005 01:14 <REP> $NtUninstallKB893086$
    13/08/2005 16:06 <REP> $NtUninstallKB893756$
    13/08/2005 16:03 <REP> $NtUninstallKB894391$
    16/06/2005 01:46 <REP> $NtUninstallKB896358$
    16/06/2005 01:47 <REP> $NtUninstallKB896422$
    13/08/2005 16:05 <REP> $NtUninstallKB896423$
    10/11/2005 00:53 <REP> $NtUninstallKB896424$
    16/06/2005 01:43 <REP> $NtUninstallKB896428$
    26/10/2005 00:06 <REP> $NtUninstallKB896688$
    13/08/2005 16:05 <REP> $NtUninstallKB896727$
    16/06/2005 01:45 <REP> $NtUninstallKB898458$
    29/06/2005 17:00 <REP> $NtUninstallKB898461$
    13/08/2005 16:06 <REP> $NtUninstallKB899587$
    13/08/2005 16:04 <REP> $NtUninstallKB899588$
    13/08/2005 16:06 <REP> $NtUninstallKB899591$
    25/04/2006 22:33 <REP> $NtUninstallKB900485$
    26/10/2005 00:05 <REP> $NtUninstallKB900725$
    26/10/2005 00:07 <REP> $NtUninstallKB901017$
    13/07/2005 14:41 <REP> $NtUninstallKB901214$
    26/10/2005 00:07 <REP> $NtUninstallKB902400$
    13/07/2005 14:40 <REP> $NtUninstallKB903235$
    26/10/2005 00:05 <REP> $NtUninstallKB904706$
    26/10/2005 00:06 <REP> $NtUninstallKB905414$
    26/10/2005 00:05 <REP> $NtUninstallKB905749$
    17/12/2005 16:47 <REP> $NtUninstallKB905915$
    11/01/2006 12:49 <REP> $NtUninstallKB908519$
    21/04/2006 02:29 <REP> $NtUninstallKB908531$
    17/12/2005 16:47 <REP> $NtUninstallKB910437$
    27/06/2006 20:51 <REP> $NtUninstallKB911280$
    16/04/2006 13:50 <REP> $NtUninstallKB911562$
    15/02/2006 11:53 <REP> $NtUninstallKB911564$
    15/02/2006 11:52 <REP> $NtUninstallKB911565$
    16/04/2006 13:48 <REP> $NtUninstallKB911567$
    15/02/2006 11:53 <REP> $NtUninstallKB911927$
    16/04/2006 13:49 <REP> $NtUninstallKB912812$
    06/01/2006 13:05 <REP> $NtUninstallKB912919$
    15/02/2006 11:51 <REP> $NtUninstallKB913446$
    11/05/2006 00:56 <REP> $NtUninstallKB913580$
    12/07/2006 01:28 <REP> $NtUninstallKB914388$
    21/06/2006 18:39 <REP> $NtUninstallKB914389$
    23/05/2009 10:08 <REP> $NtUninstallKB915865$
    21/06/2006 18:40 <REP> $NtUninstallKB916281$
    12/07/2006 01:27 <REP> $NtUninstallKB916595$
    12/07/2006 01:28 <REP> $NtUninstallKB917159$
    21/06/2006 18:40 <REP> $NtUninstallKB917344$
    09/08/2006 21:16 <REP> $NtUninstallKB917422$
    21/06/2006 18:41 <REP> $NtUninstallKB917734_WMP9$
    21/06/2006 18:40 <REP> $NtUninstallKB917953$
    15/02/2007 19:09 <REP> $NtUninstallKB918118$
    21/06/2006 18:40 <REP> $NtUninstallKB918439$
    09/08/2006 21:17 <REP> $NtUninstallKB918899$
    14/09/2006 09:06 <REP> $NtUninstallKB919007$
    16/11/2006 11:40 <REP> $NtUninstallKB920213$
    09/08/2006 21:19 <REP> $NtUninstallKB920214$
    09/08/2006 21:17 <REP> $NtUninstallKB920670$
    09/08/2006 21:14 <REP> $NtUninstallKB920683$
    14/09/2006 09:06 <REP> $NtUninstallKB920685$
    14/09/2006 09:06 <REP> $NtUninstallKB920872$
    09/08/2006 21:18 <REP> $NtUninstallKB921398$
    15/08/2007 08:25 <REP> $NtUninstallKB921503$
    08/08/2006 20:49 <REP> $NtUninstallKB921883$
    14/09/2006 09:05 <REP> $NtUninstallKB922582$
    09/08/2006 21:19 <REP> $NtUninstallKB922616$
    16/11/2006 11:39 <REP> $NtUninstallKB922760$
    12/10/2006 00:36 <REP> $NtUninstallKB922819$
    12/10/2006 00:35 <REP> $NtUninstallKB923191$
    12/10/2006 00:36 <REP> $NtUninstallKB923414$
    25/05/2009 03:05 <REP> $NtUninstallKB923561$
    13/12/2006 18:17 <REP> $NtUninstallKB923689$
    13/12/2006 18:15 <REP> $NtUninstallKB923694$
    15/02/2007 19:10 <REP> $NtUninstallKB923723$
    16/11/2006 11:42 <REP> $NtUninstallKB923980$
    12/10/2006 00:36 <REP> $NtUninstallKB924191$
    16/11/2006 11:42 <REP> $NtUninstallKB924270$
    12/10/2006 00:35 <REP> $NtUninstallKB924496$
    15/02/2007 19:10 <REP> $NtUninstallKB924667$
    13/12/2006 18:17 <REP> $NtUninstallKB925398_WMP64$
    13/12/2006 18:18 <REP> $NtUninstallKB925454$
    27/09/2006 09:50 <REP> $NtUninstallKB925486$
    04/04/2007 07:38 <REP> $NtUninstallKB925902$
    13/12/2006 18:16 <REP> $NtUninstallKB926255$
    15/02/2007 19:09 <REP> $NtUninstallKB926436$
    15/02/2007 19:12 <REP> $NtUninstallKB927779$
    15/02/2007 19:12 <REP> $NtUninstallKB927802$
    24/05/2007 07:12 <REP> $NtUninstallKB927891$
    15/02/2007 19:04 <REP> $NtUninstallKB928090$
    15/02/2007 19:11 <REP> $NtUninstallKB928255$
    15/02/2007 19:02 <REP> $NtUninstallKB928843$
    13/06/2007 07:06 <REP> $NtUninstallKB929123$
    16/03/2007 00:32 <REP> $NtUninstallKB929338$
    10/01/2007 11:29 <REP> $NtUninstallKB929969$
    11/04/2007 07:04 <REP> $NtUninstallKB930178$
    10/05/2007 07:19 <REP> $NtUninstallKB930916$
    11/04/2007 07:04 <REP> $NtUninstallKB931261$
    10/05/2007 07:19 <REP> $NtUninstallKB931768$
    11/04/2007 07:05 <REP> $NtUninstallKB931784$
    15/02/2007 19:10 <REP> $NtUninstallKB931836$
    11/04/2007 07:04 <REP> $NtUninstallKB932168$
    30/08/2007 01:10 <REP> $NtUninstallKB933360$
    13/06/2007 07:06 <REP> $NtUninstallKB933566$
    10/10/2007 01:02 <REP> $NtUninstallKB933729$
    13/06/2007 07:02 <REP> $NtUninstallKB935839$
    13/06/2007 07:05 <REP> $NtUninstallKB935840$
    15/08/2007 08:27 <REP> $NtUninstallKB936021$
    11/07/2007 07:32 <REP> $NtUninstallKB936357$
    15/08/2007 08:26 <REP> $NtUninstallKB936782_WMP9$
    15/08/2007 08:22 <REP> $NtUninstallKB937143$
    15/08/2007 08:22 <REP> $NtUninstallKB938127$
    10/09/2008 08:43 <REP> $NtUninstallKB938464$
    15/08/2007 08:26 <REP> $NtUninstallKB938828$
    15/08/2007 08:25 <REP> $NtUninstallKB938829$
    10/10/2007 01:01 <REP> $NtUninstallKB939653$
    10/10/2007 00:58 <REP> $NtUninstallKB941202$
    13/12/2007 04:05 <REP> $NtUninstallKB941568$
    13/12/2007 04:07 <REP> $NtUninstallKB941569$
    09/01/2008 11:42 <REP> $NtUninstallKB941644$
    10/04/2008 01:44 <REP> $NtUninstallKB941693$
    13/12/2007 04:04 <REP> $NtUninstallKB942615$
    13/12/2007 04:08 <REP> $NtUninstallKB942763$
    13/12/2007 04:12 <REP> $NtUninstallKB942840$
    14/02/2008 01:57 <REP> $NtUninstallKB943055$
    15/11/2007 01:47 <REP> $NtUninstallKB943460$
    09/01/2008 11:38 <REP> $NtUninstallKB943485$
    10/04/2008 01:41 <REP> $NtUninstallKB944338$
    14/02/2008 01:58 <REP> $NtUninstallKB944533$
    13/12/2007 04:03 <REP> $NtUninstallKB944653$
    10/04/2008 01:40 <REP> $NtUninstallKB945553$
    14/02/2008 01:58 <REP> $NtUninstallKB946026$
    21/12/2007 12:35 <REP> $NtUninstallKB946627$
    15/08/2008 02:56 <REP> $NtUninstallKB946648$
    10/04/2008 01:45 <REP> $NtUninstallKB947864$
    10/04/2008 01:44 <REP> $NtUninstallKB948590$
    10/04/2008 01:45 <REP> $NtUninstallKB948881$
    15/05/2008 02:49 <REP> $NtUninstallKB950749$
    12/06/2008 03:04 <REP> $NtUninstallKB950759$
    12/06/2008 03:03 <REP> $NtUninstallKB950760$
    12/06/2008 03:05 <REP> $NtUninstallKB950762$
    15/08/2008 02:56 <REP> $NtUninstallKB950974$
    15/08/2008 02:54 <REP> $NtUninstallKB951066$
    15/08/2008 02:55 <REP> $NtUninstallKB951072-v2$
    12/06/2008 03:03 <REP> $NtUninstallKB951376$
    20/06/2008 18:10 <REP> $NtUninstallKB951376-v2$
    12/06/2008 03:05 <REP> $NtUninstallKB951698$
    10/07/2008 00:31 <REP> $NtUninstallKB951748$
    25/05/2009 03:32 <REP> $NtUninstallKB952004$
    12/12/2008 02:42 <REP> $NtUninstallKB952069_WM9$
    15/08/2008 02:55 <REP> $NtUninstallKB952287$
    15/08/2008 02:56 <REP> $NtUninstallKB952954$
    15/08/2008 02:53 <REP> $NtUninstallKB953838$
    15/08/2008 02:56 <REP> $NtUninstallKB953839$
    10/09/2008 08:44 <REP> $NtUninstallKB954156_WM9L$
    17/10/2008 02:11 <REP> $NtUninstallKB954211$
    12/12/2008 02:37 <REP> $NtUninstallKB954600$
    12/11/2008 08:49 <REP> $NtUninstallKB955069$
    12/12/2008 02:42 <REP> $NtUninstallKB955839$
    17/10/2008 02:09 <REP> $NtUninstallKB956390$
    17/10/2008 02:12 <REP> $NtUninstallKB956391$
    25/05/2009 03:33 <REP> $NtUninstallKB956572$
    12/12/2008 02:36 <REP> $NtUninstallKB956802$
    17/10/2008 02:12 <REP> $NtUninstallKB956803$
    17/10/2008 02:10 <REP> $NtUninstallKB956841$
    17/10/2008 02:11 <REP> $NtUninstallKB957095$
    12/11/2008 08:49 <REP> $NtUninstallKB957097$
    12/12/2008 02:41 <REP> $NtUninstallKB958215$
    25/10/2008 02:23 <REP> $NtUninstallKB958644$
    14/01/2009 20:56 <REP> $NtUninstallKB958687$
    12/03/2009 04:05 <REP> $NtUninstallKB958690$
    25/05/2009 03:43 <REP> $NtUninstallKB959426$
    12/03/2009 04:07 <REP> $NtUninstallKB960225$
    18/12/2008 03:55 <REP> $NtUninstallKB960714$
    11/02/2009 02:36 <REP> $NtUninstallKB960715$
    25/05/2009 03:08 <REP> $NtUninstallKB960803$
    25/05/2009 03:42 <REP> $NtUninstallKB961373$
    25/02/2009 04:09 <REP> $NtUninstallKB967715$
    31/03/2003 20:45 <REP> $NtUninstallQ309521$
    31/03/2003 20:45 <REP> $NtUninstallQ311889$
    31/03/2003 20:45 <REP> $NtUninstallQ311967$
    15/01/2003 08:54 <REP> $NtUninstallQ312370$
    31/03/2003 20:44 <REP> $NtUninstallQ313450$
    31/03/2003 20:45 <REP> $NtUninstallQ314147$
    31/03/2003 20:45 <REP> $NtUninstallQ314862$
    31/03/2003 20:49 <REP> $NtUninstallQ318138$
    31/03/2003 20:50 <REP> $NtUninstallQ319580$
    30/08/2003 12:58 <REP> $NtUninstallQ320552$
    31/03/2003 20:44 <REP> $NtUninstallQ323172$
    31/03/2003 20:44 <REP> $NtUninstallQ324096$
    31/03/2003 20:44 <REP> $NtUninstallQ324380$
    31/03/2003 20:44 <REP> $NtUninstallQ326830$
    03/05/2004 09:41 <REP> $NtUninstallQ328310$
    31/03/2003 20:47 <REP> $NtUninstallQ328310_RTM$
    17/10/2003 17:11 <REP> $NtUninstallQ328940$
    03/05/2004 09:39 <REP> $NtUninstallQ329048$
    31/03/2003 20:50 <REP> $NtUninstallQ329048_RTM$
    31/03/2003 20:46 <REP> $NtUninstallQ329115$
    03/05/2004 09:38 <REP> $NtUninstallQ329170$
    31/03/2003 20:53 <REP> $NtUninstallQ329170_RTM$
    03/05/2004 09:36 <REP> $NtUninstallQ329390$
    31/03/2003 20:45 <REP> $NtUninstallQ329390_RTM$
    03/05/2004 09:35 <REP> $NtUninstallQ329441$
    31/03/2003 20:43 <REP> $NtUninstallQ329441_RTM$
    03/05/2004 09:33 <REP> $NtUninstallQ329834$
    17/10/2003 17:14 <REP> $NtUninstallQ329834_RTM$
    03/05/2004 09:32 <REP> $NtUninstallQ331953$
    31/03/2003 20:55 <REP> $NtUninstallQ331953_RTM$
    03/05/2004 17:43 <REP> $NtUninstallQ810565$
    03/05/2004 09:29 <REP> $NtUninstallQ810577$
    31/03/2003 20:48 <REP> $NtUninstallQ810577_RTM$
    03/05/2004 17:46 <REP> $NtUninstallQ810833$
    03/05/2004 09:27 <REP> $NtUninstallQ811493$
    08/05/2003 13:45 <REP> $NtUninstallQ811493_RTM$
    03/05/2004 17:41 <REP> $NtUninstallQ814033$
    03/05/2004 09:22 <REP> $NtUninstallQ815021$
    30/05/2003 12:26 <REP> $NtUninstallQ815021_RTM$
    03/05/2004 09:20 <REP> $NtUninstallQ817606$
    10/07/2003 20:21 <REP> $NtUninstallQ817606_RTM$
    03/05/2004 09:17 <REP> $NtUninstallQ819696$
    24/07/2003 11:18 <REP> $NtUninstallQ819696_RTM$
    04/10/2003 12:34 <REP> $NtUninstallQ828026$
    14/04/2004 09:46 <REP> $xpsp1hfm$
    09/02/2003 15:23 30 720 CdaC13BA.EXE
    09/02/2003 15:23 112 128 CdaC14BA.DLL
    23/05/2009 10:15 <REP> ie7
    07/06/2009 12:06 <REP> inf
    07/06/2009 14:45 <REP> Installer
    30/08/2003 13:09 <REP> msdownld.tmp
    05/10/2003 21:47 <REP> PIF
    20/07/2008 11:18 54 156 QTFont.qfn
    28/08/2001 13:00 49 102 winnt.bmp
    28/08/2001 13:00 49 102 winnt256.bmp
    6 fichier(s) 295 957 octets
    281 Rép(s) 13 039 030 272 octets libres
    Le volume dans le lecteur C s'appelle HDD
    Le numéro de série du volume est 50A3-C98D

    Répertoire de C:\WINDOWS\system32

    07/06/2009 14:12 <REP> dllcache
    26/04/2003 23:31 30 112 fiz1
    30/04/2003 22:10 30 027 fiz10
    01/05/2003 18:23 30 105 fiz11
    02/05/2003 19:23 30 020 fiz12
    03/05/2003 17:19 30 107 fiz13
    04/05/2003 13:50 30 098 fiz14
    05/05/2003 19:05 30 109 fiz15
    06/05/2003 13:21 30 054 fiz16
    07/05/2003 12:44 30 062 fiz17
    09/05/2003 21:45 30 140 fiz18
    10/05/2003 14:18 30 014 fiz19
    26/04/2003 23:43 30 006 fiz2
    10/05/2003 23:38 30 068 fiz20
    27/04/2003 00:10 30 032 fiz3
    27/04/2003 00:48 30 027 fiz4
    27/04/2003 14:06 30 089 fiz5
    28/04/2003 13:05 30 073 fiz6
    28/04/2003 13:55 30 015 fiz7
    29/04/2003 13:26 30 003 fiz8
    30/04/2003 15:49 30 034 fiz9
    21/05/2009 23:43 10 022 KGyGaAvL.sys
    27/11/2003 11:08 2 152 346 kyf.dat
    13/12/2008 14:41 16 servdat.slm
    30 fichier(s) 2 768 300 octets
    1 Rép(s) 13 039 013 888 octets libres
    winlogon.exe
    Verified: Signed
    svchost.exe
    Verified: Signed
    ws2_32.dll
    Verified: Signed
    user32.dll
    Verified: Signed
    tcpip.sys
    Verified: Signed
    ndis.sys
    Verified: Signed
    null.sys
    Verified: Signed
    userinit.exe
    kernel32.dll

    ListDLLs v2.25 - DLL lister for Win9x/NT
    Copyright (C) 1997-2004 Mark Russinovich
    Sysinternals - www.sysinternals.com

    ------------------------------------------------------------------------------
    explorer.exe pid: 1640
    Command line: C:\WINDOWS\Explorer.EXE

    Base Size Version Path
    0x44080000 0xd0000 7.00.6000.16827 C:\WINDOWS\system32\WININET.dll
    0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
    0x43e00000 0x45000 7.00.6000.16825 C:\WINDOWS\system32\iertutil.dll
    0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll
    0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
    0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
    0x45180000 0x127000 7.00.6000.16825 C:\WINDOWS\system32\urlmon.dll
    0x44360000 0x5cd000 7.00.6000.16825 C:\WINDOWS\system32\ieframe.dll
    0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
    0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll
    0x442b0000 0x3c000 7.00.6000.16825 C:\WINDOWS\system32\webcheck.dll
    0x00d40000 0x6000 6.01.0000.0145 C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
    0x00d60000 0x8000 9.43.0000.0000 C:\PROGRA~1\MOUSEW~1\SYSTEM\LgMousHk.dll
    0x01e60000 0x16000 8.04.0002.1019 C:\WINDOWS\system32\LQCUI2.dll
    0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
    0x01d80000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
    0x10000000 0x76d000 6.14.0010.9371 C:\WINDOWS\system32\nvcpl.dll
    0x74bf0000 0x2c000 4.02.5406.0000 C:\WINDOWS\system32\OLEACC.dll
    0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
    0x02030000 0x44000 6.14.0010.9371 C:\WINDOWS\system32\NVRSFR.DLL
    0x02080000 0x36000 6.14.0010.9371 C:\WINDOWS\system32\nvapi.dll
    0x02860000 0x73000 6.14.0010.11060 C:\WINDOWS\system32\nvshell.dll
    0x028f0000 0x12000 1.01.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
    0x02910000 0x2b000 C:\Program Files\WinRAR\rarext.dll
    0x02df0000 0x13000 1.00.0000.0000 C:\Program Files\EPSON\Creativity Suite\Easy Photo Print\EPPShell.dll
    0x73d20000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL
    0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL
    0x02f10000 0x1b000 C:\WINDOWS\System32\tsseCryp.dll
    0x01150000 0x9000 0.01.0000.0002 C:\Apps\ActivBoard\nhkdll.dll
    0x03840000 0x7000 10.00.0000.0831 C:\Program Files\Microsoft Money\System\urlmapps.dll

    ListDLLs v2.25 - DLL lister for Win9x/NT
    Copyright (C) 1997-2004 Mark Russinovich
    Sysinternals - www.sysinternals.com

    ------------------------------------------------------------------------------
    winlogon.exe pid: 532
    Command line: winlogon.exe

    Base Size Version Path
    0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe
    0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll
    0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
    0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
    0x012f0000 0xae000 1.05.0540.0000 C:\WINDOWS\system32\WgaLogon.dll
    0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
    0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll

    Le volume dans le lecteur C s'appelle HDD
    Le numéro de série du volume est 50A3-C98D

    Répertoire de C:\WINDOWS\temp

    07/06/2009 15:28 19 968 abgtr.exe
    07/06/2009 14:14 11 264 ugqwhy.exe
    07/06/2009 14:15 19 968 vwxagf.exe
    3 fichier(s) 51 200 octets
    0 Rép(s) 13 039 009 792 octets libres

    Contenu de Downloaded Program Files
    Le volume dans le lecteur C s'appelle HDD
    Le numéro de série du volume est 50A3-C98D

    Répertoire de C:\WINDOWS\Downloaded Program Files

    07/06/2009 14:45 <REP> .
    07/06/2009 14:45 <REP> ..
    20/01/2005 14:53 171 ampx.inf
    17/05/2006 14:32 231 072 avsniff.dll
    17/05/2006 14:29 878 avsniff.inf
    17/05/2006 14:32 198 304 avsniffdlgs.dll
    17/05/2006 14:26 537 704 AXXPEE.dll
    17/05/2006 14:29 241 CabSA.inf
    12/09/2007 01:00 2 504 catalog.dat
    21/05/2003 02:06 70 656 Checkers.dll
    06/07/2001 17:41 106 496 ChkDVD.dll
    21/09/2004 15:09 36 864 coltrans.ax
    28/08/2003 23:40 <REP> CONFLICT.1
    21/09/2004 15:10 163 840 CoreExecutive.dll
    27/03/2003 23:35 65 desktop.ini
    21/09/2004 15:10 36 864 DownloadersWI.dll
    12/09/2007 01:00 6 899 ecbootil.vxd
    17/05/2006 14:26 42 112 ecmldr32.dll
    12/09/2007 01:00 284 016 ecmsvr32.dll
    08/09/2004 23:38 1 271 erma.inf
    09/06/2003 15:18 234 FileSharingCtrl.inf
    24/03/2008 19:33 1 527 056 FP_AX_CAB_INSTALLER.exe
    14/08/2003 11:14 223 832 fsmsngr-fr.dll
    13/11/2002 08:06 196 608 GSManager.dll
    03/07/2003 13:59 160 gsmanager.inf
    29/05/2009 17:12 1 569 hardwaredetection.inf
    17/08/2003 01:31 113 008 HMAtchmt.ocx
    21/09/2004 15:10 90 112 HtmlParser.dll
    21/09/2004 15:10 53 248 HTMLSourceFilter.ax
    21/09/2004 15:11 57 344 MelodySourceParser.ax
    21/05/2003 02:06 152 576 MessengerStatsClient.dll
    20/01/2000 15:25 1 162 Microsoft XML Parser for Java.osd
    21/05/2003 02:06 77 312 MineSweeper.dll
    21/09/2004 15:11 81 920 MPO.dll
    18/11/1999 13:49 992 msaudio.inf
    29/05/2003 15:00 77 408 msgrchkr.dll
    11/06/2003 16:40 32 768 MsnChat40fr-fr.dll
    16/05/2003 17:33 278 MsnChat45.inf
    16/05/2003 17:33 457 288 MSNChat45.ocx
    17/05/2006 14:28 6 850 navapi.vxd
    17/05/2006 14:28 201 896 navapi32.dll
    12/09/2007 01:00 124 272 naveng32.dll
    12/09/2007 01:00 914 800 navex32a.dll
    31/08/2002 13:36 516 NPX.INF
    31/08/2002 13:33 290 816 npx.ocx
    21/09/2004 15:12 229 376 Parsers.dll
    21/09/2004 15:12 36 864 PlayerServer.dll
    21/09/2004 15:11 94 208 PNGSource.ax
    09/10/2003 11:32 144 QTPlugin.inf
    05/03/2003 17:23 524 404 RdxIE.dll
    21/09/2004 15:12 32 768 RegType_IE.dll
    17/05/2006 14:32 161 480 rufsi.dll
    21/09/2004 15:13 25 600 scg.ax
    12/09/2007 01:00 97 744 scrauth.dat
    21/09/2004 15:13 147 456 SMILInetCtrl.dll
    21/09/2004 15:14 28 326 SMILViewer_DX6.inf
    29/05/2003 15:00 86 112 solitaireshowdown.dll
    29/05/2002 23:12 9 488 sporder.dll
    29/05/2002 23:12 9 488 sporder_.dll
    21/09/2004 15:11 57 344 StreamControl.ax
    24/03/2008 19:18 247 swflash.inf
    12/09/2007 01:00 11 875 symaveng.cat
    12/09/2007 01:00 1 061 symaveng.inf
    12/09/2007 01:00 397 385 tcdefs.dat
    12/09/2007 01:00 1 794 980 tcscan7.dat
    12/09/2007 01:00 394 740 tcscan8.dat
    12/09/2007 01:00 908 486 tcscan9.dat
    12/09/2007 01:00 453 tinf.dat
    12/09/2007 01:00 148 tinfidx.dat
    12/09/2007 01:00 1 957 tinfl.dat
    12/09/2007 01:00 67 619 tscan1.dat
    12/09/2007 01:00 3 240 tscan1hd.dat
    12/09/2007 01:00 4 778 v.grd
    12/09/2007 01:00 2 267 v.sig
    21/09/2004 15:13 110 592 VideoCompositor.ax
    12/09/2007 01:00 106 244 virscan.inf
    12/09/2007 01:00 993 455 virscan1.dat
    12/09/2007 01:00 570 702 virscan2.dat
    12/09/2007 01:00 150 140 virscan3.dat
    12/09/2007 01:00 320 253 virscan4.dat
    12/09/2007 01:00 4 496 806 virscan5.dat
    12/09/2007 01:00 391 782 virscan6.dat
    12/09/2007 01:00 12 097 338 virscan7.dat
    12/09/2007 01:00 1 807 666 virscan8.dat
    12/09/2007 01:00 4 989 561 virscan9.dat
    12/09/2007 01:00 32 virscant.dat
    26/09/2007 01:34 2 072 vscanmsx.dat
    21/09/2004 15:13 36 864 WBMPSource.ax
    27/10/2002 19:32 3 036 wmv9dmo.inf
    04/03/2005 12:11 2 371 wmvadvd.inf
    12/09/2007 01:00 224 zdone.dat
    88 fichier(s) 37 613 158 octets

    Répertoire de C:\WINDOWS\Downloaded Program Files\CONFLICT.1

    28/08/2003 23:40 <REP> .
    28/08/2003 23:40 <REP> ..
    29/05/2003 15:00 160 864 messengerstatsclient.dll
    29/05/2003 15:00 84 064 minesweeper.dll
    2 fichier(s) 244 928 octets

    Total des fichiers listés :
    90 fichier(s) 37 858 086 octets
    5 Rép(s) 13 039 005 696 octets libres

    Recherche de rootkit! (Merci S!Ri)

    Recherche d'infections connues

    Export des clefs sensibles..

    Liste des fichiers en exception sur le pare-feu XP SP2

    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\\APPS\\ActivSurf\\4448364\\Program\\backWeb-4448364.exe"="C:\\apps\\ActivSurf\\4448364\\Program\\backweb-4448364.exe:*:Enabled:ipsec"
    "C:\\Documents and Settings\\solo & kad\\Mes documents\\mircfr\\mircfr\\mirc.exe"="C:\\Documents and Settings\\solo & kad\\Mes documents\\mircfr\\mircfr\\mirc.exe:*:Enabled:mIRC"
    "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealOne Player"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Disabled:Skype"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"="C:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe:*:Enabled:ipsec"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "C:\\Program Files\\SPSSInc\\Statistics17\\statistics.com"="C:\\Program Files\\SPSSInc\\Statistics17\\statistics.com:*:Disabled:Statistics17:com"
    "C:\\Program Files\\SPSSInc\\Statistics17\\statistics.exe"="C:\\Program Files\\SPSSInc\\Statistics17\\statistics.exe:*:Disabled:Statistics17:exe"
    "C:\\Program Files\\SPSSInc\\Statistics17\\SPSSWinWrapIDE.exe"="C:\\Program Files\\SPSSInc\\Statistics17\\SPSSWinWrapIDE.exe:*:Disabled:SPSS Basic Script Editor"
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
    "C:\\WINDOWS\\System32\\rmctrl.exe"="C:\\WINDOWS\\System32\\rmctrl.exe:*:Enabled:ipsec"
    "C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe:*:Enabled:ipsec"
    "C:\\Program Files\\Java\\jre6\\bin\\jusched.exe"="C:\\Program Files\\Java\\jre6\\bin\\jusched.exe:*:Enabled:ipsec"
    "C:\\Program Files\\Logitech\\Video\\FxSvr2.exe"="C:\\Program Files\\Logitech\\Video\\FxSvr2.exe:*:Enabled:ipsec"
    "C:\\Apps\\ActivBoard\\OSD.exe"="C:\\Apps\\ActivBoard\\OSD.exe:*:Enabled:ipsec"
    "C:\\Program Files\\Logitech\\Video\\LogiTray.exe"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\system32\\netsh.exe"="C:\\WINDOWS\\system32\\netsh.exe:*:Enabled:ipsec"
    "C:\\Apps\\ActivBoard\\MMKeybd.exe"="C:\\Apps\\ActivBoard\\MMKeybd.exe:*:Enabled:ipsec"
    "C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe:*:Enabled:ipsec"
    "C:\\divtools\\unzip\\unzip.exe"="C:\\divtools\\unzip\\unzip.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIBVE.EXE"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIBVE.EXE:*:Enabled:ipsec"
    "C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe"="C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe:*:Enabled:ipsec"
    "C:\\Apps\\ActivBoard\\TrayMon.exe"="C:\\Apps\\ActivBoard\\TrayMon.exe:*:Enabled:ipsec"
    "C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\rnathchk.exe"="C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\rnathchk.exe:*:Enabled:ipsec"
    "C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe"="C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe:*:Enabled:ipsec"
    "C:\\Program Files\\Microsoft Money\\System\\urlmap.exe"="C:\\Program Files\\Microsoft Money\\System\\urlmap.exe:*:Enabled:ipsec"
    "C:\\Program Files\\Virtual CD v4 SDK\\system\\vcsplay.exe"="C:\\Program Files\\Virtual CD v4 SDK\\system\\vcsplay.exe:*:Enabled:ipsec"
    "C:\\Program Files\\iTunes\\iTunesHelper.exe"="C:\\Program Files\\iTunes\\iTunesHelper.exe:*:Enabled:ipsec"
    "C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"="C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe:*:Enabled:ipsec"
    "C:\\Program Files\\QuickTime\\QTTask.exe"="C:\\Program Files\\QuickTime\\QTTask.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\system32\\LVCOMSX.EXE"="C:\\WINDOWS\\system32\\LVComsX.exe:*:Enabled:ipsec"
    "C:\\apps\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe"="C:\\apps\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\system32\\wuauclt.exe"="C:\\WINDOWS\\system32\\wuauclt.exe:*:Enabled:ipsec"
    "C:\\Program Files\\Java\\jre6\\bin\\jucheck.exe"="C:\\Program Files\\Java\\jre6\\bin\\jucheck.exe:*:Enabled:ipsec"
    "C:\\PROGRA~1\\MOUSEW~1\\SYSTEM\\EM_EXEC.EXE"="C:\\PROGRA~1\\MOUSEW~1\\SYSTEM\\EM_EXEC.EXE:*:Enabled:ipsec"
    "C:\\WINDOWS\\system32\\drwtsn32.exe"="C:\\WINDOWS\\system32\\drwtsn32.exe:*:Enabled:ipsec"
    "C:\\ComboFix\\NirCmd.cfexe"="C:\\ComboFix\\NirCmd.cfexe:*:Enabled:ipsec"
    "C:\\Documents and Settings\\solo & kad\\Application Data\\Real\\Update\\setup\\setup.exe"="C:\\Documents and Settings\\solo & kad\\Application Data\\Real\\Update\\setup\\setup.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\system32\\CF8025.exe"="C:\\WINDOWS\\system32\\CF8025.exe:*:Enabled:ipsec"
    "C:\\Apps\\ActivBoard\\nhksrv.exe"="C:\\Apps\\ActivBoard\\nhksrv.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\gicry.exe"="C:\\WINDOWS\\TEMP\\gicry.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\imnms.exe"="C:\\WINDOWS\\TEMP\\imnms.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\winvvjufv.exe"="C:\\WINDOWS\\TEMP\\winvvjufv.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\winolsjx.exe"="C:\\WINDOWS\\TEMP\\winolsjx.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\leihn.exe"="C:\\WINDOWS\\TEMP\\leihn.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\mxyuse.exe"="C:\\WINDOWS\\TEMP\\mxyuse.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\winxxoleg.exe"="C:\\WINDOWS\\TEMP\\winxxoleg.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\dcxb.exe"="C:\\WINDOWS\\TEMP\\dcxb.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\winxouwi.exe"="C:\\WINDOWS\\TEMP\\winxouwi.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\ugqwhy.exe"="C:\\WINDOWS\\TEMP\\ugqwhy.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\winxebb.exe"="C:\\WINDOWS\\TEMP\\winxebb.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\winhgdls.exe"="C:\\WINDOWS\\TEMP\\winhgdls.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\vwxagf.exe"="C:\\WINDOWS\\TEMP\\vwxagf.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\eynbvr.exe"="C:\\WINDOWS\\TEMP\\eynbvr.exe:*:Enabled:ipsec"
    "C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
    "C:\\WINDOWS\\TEMP\\winnkcun.exe"="C:\\WINDOWS\\TEMP\\winnkcun.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\ktcuc.exe"="C:\\WINDOWS\\TEMP\\ktcuc.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\winvssrac.exe"="C:\\WINDOWS\\TEMP\\winvssrac.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\olbctq.exe"="C:\\WINDOWS\\TEMP\\olbctq.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\winogqu.exe"="C:\\WINDOWS\\TEMP\\winogqu.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\winjcabwl.exe"="C:\\WINDOWS\\TEMP\\winjcabwl.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\winirfm.exe"="C:\\WINDOWS\\TEMP\\winirfm.exe:*:Enabled:ipsec"
    "C:\\WINDOWS\\TEMP\\upqn.exe"="C:\\WINDOWS\\TEMP\\upqn.exe:*:Enabled:ipsec"

    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    Export de la clef SharedTaskScheduler

    [SharedTaskScheduler]
    "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
    "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

    exports des policies
    REGEDIT4

    [system]
    "dontdisplaylastusername"=dword:00000000
    "legalnoticecaption"=""
    "legalnoticetext"=""
    "shutdownwithoutlogon"=dword:00000001
    "undockwithoutlogon"=dword:00000001
    "DisableRegistryTools"=dword:00000000
    "EnableLUA"=dword:00000000

    Export des clefs sensibles..
    Rechercher adresses sensibles dans le fichier HOSTS...
    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-06-07 15:33:53
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\000a9414c109]
    "00124750b94d"=hex:cd,d4,c9,b6,fa,85,82,ed,00,d1,26,0c,c7,63,33,11
    "001a8a07c09e"=hex:6d,c2,ef,33,5b,5c,66,49,f6,08,f3,5b,9f,08,8e,86
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\knbwwgw]
    "DisplayName"="Manager Microsoft"
    "Type"=dword:00000020
    "Start"=dword:00000002
    "ErrorControl"=dword:00000000
    "ImagePath"=str(2):"%SystemRoot%\system32\svchost.exe -k netsvcs"
    "ObjectName"="LocalSystem"
    "Description"="Fournit des services d'acquisition d'images pour les scanneurs et les appareils photo."

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\knbwwgw\Parameters]
    "ServiceDll"=str(2):"C:\WINDOWS\system32\eslwkuq.dll"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a9414c109]
    "00124750b94d"=hex:cd,d4,c9,b6,fa,85,82,ed,00,d1,26,0c,c7,63,33,11
    "001a8a07c09e"=hex:6d,c2,ef,33,5b,5c,66,49,f6,08,f3,5b,9f,08,8e,86
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a9414c109]
    "00124750b94d"=hex:cd,d4,c9,b6,fa,85,82,ed,00,d1,26,0c,c7,63,33,11
    "001a8a07c09e"=hex:6d,c2,ef,33,5b,5c,66,49,f6,08,f3,5b,9f,08,8e,86

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "DeviceNotSelectedTimeout"="15"
    "GDIProcessHandleQuota"=dword:00002710
    "Spooler"="yes"
    "swapdisk"=""
    "TransmissionRetryTimeout"="90"
    "USERProcessHandleQuota"=dword:00002710

    scanning hidden files ...

    scan completed successfully
    hidden services: 0
    hidden files: 0

    Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

    device: opened successfully
    user: MBR read successfully
    kernel: MBR read successfully
    user & kernel MBR OK

    KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

    Process list by traversal of KiWaitListHead

    4 - System
    396 - svchost.exe
    428 - vcssecs.exe
    504 - csrss.exe
    532 - winlogon.exe
    576 - services.exe
    596 - lsass.exe
    744 - svchost.exe
    792 - svchost.exe
    856 - svchost.exe
    916 - svchost.exe
    1032 - svchost.exe
    1108 - vwxagf.exe
    1172 - spoolsv.exe
    1252 - ugqwhy.exe
    1292 - svchost.exe
    1640 - explorer.exe
    1732 - svchost.exe
    1764 - nhksrv.exe
    1800 - AppleMobileDevi
    1924 - CDAC11BA.EXE
    1988 - jqs.exe
    2020 - mdm.exe
    3184 - EM_EXEC.EXE
    3200 - MMKeybd.exe
    3208 - backWeb-4448364
    3220 - rmctrl.exe
    3240 - LogiTray.exe
    3296 - jusched.exe
    3320 - realsched.exe
    3332 - QTTask.exe
    3384 - ctfmon.exe
    3572 - rnathchk.exe
    3580 - Traymon.exe
    3604 - osd.exe
    3624 - NintendoWFCReg.
    3816 - LVCOMSX.EXE
    3980 - FxSvr2.exe
    4016 - cmd.exe

    Total number of processes = 39
    NOTE: Under WinXP, this will not show all processes.

    KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

    Driver/Module list by traversal of PsLoadedModuleList

    804D7000 - \WINDOWS\system32\ntoskrnl.exe
    806EC000 - \WINDOWS\system32\hal.dll
    F9F71000 - \WINDOWS\system32\KDCOM.DLL
    F9E81000 - \WINDOWS\system32\BOOTVID.dll
    F9A21000 - ACPI.sys
    F9F73000 - \WINDOWS\System32\DRIVERS\WMILIB.SYS
    F9A10000 - pci.sys
    F9A71000 - isapnp.sys
    FA039000 - pciide.sys
    F9CF1000 - \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
    F9F75000 - aliide.sys
    F9F77000 - cmdide.sys
    F9F79000 - toside.sys
    F9F7B000 - viaide.sys
    F9F7D000 - intelide.sys
    F9A81000 - MountMgr.sys
    F99F1000 - ftdisk.sys
    F9CF9000 - PartMgr.sys
    F9A91000 - VolSnap.sys
    F9E85000 - cpqarray.sys
    F99D9000 - \WINDOWS\System32\DRIVERS\SCSIPORT.SYS
    F99C1000 - atapi.sys
    F9E89000 - aha154x.sys
    F9D01000 - sparrow.sys
    F9E8D000 - symc810.sys
    F9AA1000 - aic78xx.sys
    F9E91000 - dac960nt.sys
    F9AB1000 - ql10wnt.sys
    F9E95000 - amsint.sys
    F9D09000 - asc.sys
    F9E99000 - asc3550.sys
    F9D11000 - mraid35x.sys
    F9D19000 - i2omp.sys
    F9E9D000 - ini910u.sys
    F9AC1000 - ql1240.sys
    F9AD1000 - aic78u2.sys
    F9D21000 - symc8xx.sys
    F9D29000 - sym_u3.sys
    F9D31000 - sym_hi.sys
    F9D39000 - ABP480N5.SYS
    F9D41000 - asc3350p.sys
    F9F7F000 - cd20xrnt.sys
    F9AE1000 - ultra.sys
    F9AF1000 - hpt3xx.sys
    F99A8000 - adpu160m.sys
    F9D49000 - dpti2o.sys
    F9B01000 - ql1080.sys
    F9B11000 - ql1280.sys
    F9B21000 - ql12160.sys
    F9D51000 - perc2.sys
    F9F81000 - perc2hib.sys
    F9D59000 - hpn.sys
    F9EA1000 - cbidf2k.sys
    F997C000 - dac2w2k.sys
    F9B31000 - disk.sys
    F9B41000 - \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
    F995C000 - fltmgr.sys
    F994A000 - sr.sys
    F9EA5000 - PxHelp20.sys
    F9933000 - KSecDD.sys
    F98A6000 - Ntfs.sys
    F9879000 - NDIS.sys
    F9D61000 - sisagp.sys
    F9B51000 - viaagp.sys
    F9866000 - sfvfs02.sys
    F9D69000 - sfhlp02.sys
    F9F83000 - sfhlp01.sys
    F9854000 - sfdrv01.sys
    F9842000 - prohlp02.sys
    F9B61000 - ohci1394.sys
    F9B71000 - \WINDOWS\System32\DRIVERS\1394BUS.SYS
    F9827000 - Mup.sys
    F9B81000 - alim1541.sys
    F9B91000 - amdagp.sys
    F9BA1000 - agp440.sys
    F9BB1000 - agpCPQ.sys
    F9BE1000 - \SystemRoot\System32\DRIVERS\nic1394.sys
    F9BF1000 - \SystemRoot\System32\DRIVERS\intelppm.sys
    F9DB1000 - \SystemRoot\System32\DRIVERS\fdc.sys
    F8F3E000 - \SystemRoot\System32\DRIVERS\serial.sys
    F9747000 - \SystemRoot\System32\DRIVERS\serenum.sys
    F8F2A000 - \SystemRoot\System32\DRIVERS\parport.sys
    F9C11000 - \SystemRoot\System32\DRIVERS\imapi.sys
    F9C21000 - \SystemRoot\System32\DRIVERS\cdrom.sys
    F9C31000 - \SystemRoot\System32\DRIVERS\redbook.sys
    F8F07000 - \SystemRoot\System32\DRIVERS\ks.sys
    F9743000 - \SystemRoot\System32\Drivers\GEARAspiWDM.sys
    F8EDA000 - \SystemRoot\System32\DRIVERS\slntamr.sys
    F9454000 - \SystemRoot\System32\DRIVERS\SlWdmSup.sys
    F8EC5000 - \SystemRoot\System32\DRIVERS\Mtlmnt5.sys
    F9DB9000 - \SystemRoot\System32\Drivers\Modem.SYS
    F8E8D000 - \SystemRoot\system32\drivers\stac97nh.sys
    F8E45000 - \SystemRoot\system32\drivers\stac97na.sys
    F8E21000 - \SystemRoot\system32\drivers\portcls.sys
    F9C51000 - \SystemRoot\system32\drivers\drmk.sys
    F9DC1000 - \SystemRoot\System32\DRIVERS\usbohci.sys
    F8DFE000 - \SystemRoot\System32\DRIVERS\USBPORT.SYS
    F9DC9000 - \SystemRoot\System32\DRIVERS\usbehci.sys
    F9C61000 - \SystemRoot\System32\DRIVERS\R8139n51.SYS
    FA125000 - \SystemRoot\System32\DRIVERS\audstub.sys
    F9CC1000 - \SystemRoot\System32\DRIVERS\rasl2tp.sys
    F944C000 - \SystemRoot\System32\DRIVERS\ndistapi.sys
    F8DE7000 - \SystemRoot\System32\DRIVERS\ndiswan.sys
    F9CD1000 - \SystemRoot\System32\DRIVERS\raspppoe.sys
    F9CE1000 - \SystemRoot\System32\DRIVERS\raspptp.sys
    F9DD1000 - \SystemRoot\System32\DRIVERS\TDI.SYS
    F8DD6000 - \SystemRoot\System32\DRIVERS\psched.sys
    F9817000 - \SystemRoot\System32\DRIVERS\msgpc.sys
    F9DD9000 - \SystemRoot\System32\DRIVERS\ptilink.sys
    F9DE1000 - \SystemRoot\System32\DRIVERS\raspti.sys
    F9807000 - \SystemRoot\System32\DRIVERS\termdd.sys
    F9DE9000 - \SystemRoot\System32\DRIVERS\kbdclass.sys
    F9DF1000 - \SystemRoot\System32\DRIVERS\mouclass.sys
    F9FD9000 - \SystemRoot\System32\DRIVERS\swenum.sys
    F8D7D000 - \SystemRoot\System32\DRIVERS\update.sys
    F9438000 - \SystemRoot\System32\DRIVERS\mssmbios.sys
    F97E7000 - \SystemRoot\System32\Drivers\NDProxy.SYS
    F9E11000 - \SystemRoot\System32\DRIVERS\flpydisk.sys
    F97A7000 - \SystemRoot\System32\DRIVERS\usbhub.sys
    F9FE1000 - \SystemRoot\System32\DRIVERS\USBD.SYS
    F9FF3000 - \SystemRoot\System32\Drivers\i2omgmt.SYS
    F9FF5000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
    FA0C1000 - \SystemRoot\System32\Drivers\Null.SYS
    F9FF7000 - \SystemRoot\System32\Drivers\Beep.SYS
    F9E79000 - \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
    F9D81000 - \SystemRoot\System32\drivers\vga.sys
    F8D41000 - \SystemRoot\System32\drivers\VIDEOPRT.SYS
    F9FF9000 - \SystemRoot\System32\Drivers\mnmdd.SYS
    F9FFB000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
    F9D89000 - \SystemRoot\System32\Drivers\Msfs.SYS
    F9D91000 - \SystemRoot\System32\Drivers\Npfs.SYS
    F9F51000 - \SystemRoot\System32\DRIVERS\rasacd.sys
    F8C96000 - \SystemRoot\System32\DRIVERS\ipsec.sys
    F8C3E000 - \SystemRoot\System32\DRIVERS\tcpip.sys
    F8BFE000 - \SystemRoot\System32\Drivers\SYMTDI.SYS
    F8BD6000 - \SystemRoot\System32\DRIVERS\netbt.sys
    F9F59000 - \SystemRoot\System32\drivers\ws2ifsl.sys
    F8BB4000 - \SystemRoot\System32\drivers\afd.sys
    F949B000 - \SystemRoot\System32\DRIVERS\netbios.sys
    F8B89000 - \SystemRoot\System32\DRIVERS\rdbss.sys
    F8FDF000 - \SystemRoot\System32\drivers\prodrv06.sys
    F8B1A000 - \SystemRoot\System32\DRIVERS\mrxsmb.sys
    F8FCF000 - \SystemRoot\System32\Drivers\Fips.SYS
    F8AF9000 - \SystemRoot\System32\DRIVERS\ipnat.sys
    F8FAF000 - \SystemRoot\System32\DRIVERS\wanarp.sys
    F8F9F000 - \SystemRoot\System32\DRIVERS\arp1394.sys
    F8F7F000 - \SystemRoot\System32\Drivers\Cdfs.SYS
    F9DF9000 - \SystemRoot\System32\DRIVERS\USBSTOR.SYS
    F9C41000 - \SystemRoot\system32\drivers\lvusbsta.sys
    F8A9D000 - \SystemRoot\system32\DRIVERS\LV561AV.SYS
    F9C71000 - \SystemRoot\system32\DRIVERS\STREAM.SYS
    F974B000 - \SystemRoot\System32\DRIVERS\hidusb.sys
    F9C81000 - \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
    F9E31000 - \SystemRoot\System32\DRIVERS\LHidFlt2.sys
    F8D79000 - \SystemRoot\System32\DRIVERS\mouhid.sys
    F9CA1000 - \SystemRoot\System32\DRIVERS\LMouFlt2.sys
    F8A85000 - \SystemRoot\System32\Drivers\dump_atapi.sys
    F9FFF000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    BF800000 - \SystemRoot\System32\win32k.sys
    F8D61000 - \SystemRoot\System32\drivers\Dxapi.sys
    F9E49000 - \SystemRoot\System32\watchdog.sys
    BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
    FA166000 - \SystemRoot\System32\drivers\dxgthk.sys
    BFF70000 - \SystemRoot\System32\framebuf.dll
    F8CB5000 - \SystemRoot\System32\DRIVERS\ndisuio.sys
    F851A000 - \SystemRoot\System32\Drivers\Fastfat.SYS
    F8465000 - \SystemRoot\system32\drivers\wdmaud.sys
    F94AB000 - \SystemRoot\system32\drivers\sysaudio.sys
    F82CB000 - \SystemRoot\System32\DRIVERS\mrxdav.sys
    F9FB5000 - \SystemRoot\System32\Drivers\ParVdm.SYS
    F8D01000 - \SystemRoot\system32\drivers\ip6fw.sys
    F8153000 - \SystemRoot\system32\drivers\tcpip6.sys
    F80D9000 - \SystemRoot\System32\DRIVERS\srv.sys
    F8825000 - \SystemRoot\System32\DRIVERS\ipfltdrv.sys
    F9F8D000 - \??\C:\WINDOWS\system32\drivers\mfhnjq.sys
    F7D78000 - \SystemRoot\System32\Drivers\HTTP.sys
    F7598000 - \SystemRoot\system32\drivers\kmixer.sys
    F8CD1000 - \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
    FA031000 - \??\C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\mbr.sys
    FA0FA000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

    Total number of drivers = 180

    Liste des programmes installes

    ABBYY FineReader 6.0 Sprint
    AC3Filter (remove only)
    Adobe Flash Player 10 ActiveX
    Adobe Photoshop 7.0
    adsl TV
    Apple Mobile Device Support
    Apple Software Update
    Archiveur WinRAR
    Assistant de connexion Windows Live
    AtomixMP3 Limited Edition v2.0
    AtomixMP3 v2.2 Trial
    Audacity 1.2.6
    AutoUpdate
    AVIcodec (remove only)
    BitComet 0.70
    Bonjour
    BSPlayer
    C.I.L. version 2.1
    CCleaner (remove only)
    Cda Product Service - shared component
    CDex extraction audio
    Codeur Windows Media Série 9
    Codeur Windows Media Série 9
    Correctif pour Windows XP (KB952287)
    Correctif Windows XP - KB834707
    Correctif Windows XP - KB867282
    Correctif Windows XP - KB873333
    Correctif Windows XP - KB873339
    Correctif Windows XP - KB885250
    Correctif Windows XP - KB885835
    Correctif Windows XP - KB885836
    Correctif Windows XP - KB885884
    Correctif Windows XP - KB886185
    Correctif Windows XP - KB887472
    Correctif Windows XP - KB887742
    Correctif Windows XP - KB888113
    Correctif Windows XP - KB888302
    Correctif Windows XP - KB890047
    Correctif Windows XP - KB890175
    Correctif Windows XP - KB890859
    Correctif Windows XP - KB890923
    Correctif Windows XP - KB891781
    Correctif Windows XP - KB893066
    Correctif Windows XP - KB893086
    dBpoweramp DirectShow Decoder
    DigitalCam Pro
    DivX
    DivX Player
    EasyCleaner
    Encyclopédie Hachette Multimédia
    EPSON Attach To Email
    EPSON Attach To Email
    EPSON Copy Utility 3
    EPSON Easy Photo Print
    EPSON File Manager
    EPSON Logiciel imprimante
    EPSON Scan
    EPSON Web-To-Page
    ESDX5000_CX4900 Guide d’utilisation
    ffdshow (remove only)
    Free - Kit de connexion
    Free iPod Video Converter 1.34
    Free RM to MP3 Converter 1.12
    Free YouTube to iPod Converter version 2.8
    Free YouTube to Mp3 Converter version 2.4
    FreeGo 2.0
    Google Earth
    Google Toolbar for Internet Explorer
    Google Toolbar for Internet Explorer
    Hemera Products
    HijackThis 2.0.2
    honestech MPEG Encoder 4.0 Demo
    Hotfix for Windows XP (KB915865)
    Huffyuv AVI lossless video codec (Remove Only)
    iTunes
    Java 2 Runtime Environment, SE v1.4.1_01
    Java 2 Runtime Environment, SE v1.4.1_05
    Java 2 Runtime Environment, SE v1.4.2_01
    Java Runtime Environment 1.1
    Java Web Start
    Java(TM) 6 Update 11
    Java(TM) 6 Update 3
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    K-Lite Codec Pack 2.10 Full
    Kerio Personall Firewall
    Language Pack for Ad-aware 6
    Le Sphinx
    LiveReg (Symantec Corporation)
    LiveUpdate 1.6 (Symantec Corporation)
    Logiciel WebCam de Labtec
    Ma-Config.com
    Macromedia Flash MX
    Macromedia Shockwave Player
    Malwarebytes' Anti-Malware
    Messenger Plus! 3
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft Data Access Components KB870669
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office PowerPoint Viewer 2007 (French)
    Microsoft Office XP Professional avec FrontPage
    Micros
    0
  7. Utilisateur anonyme
     
    ça devrait servir a quelque chose car je viens de trouver qui relance l infection

    je te prepare la manipe ;)
    0
  8. Utilisateur anonyme
     
    cette fois ci ça devrait etre bon :

    Copie le texte ci-dessous :

    killall::

    Driver::
    knbwwgw
    abp470n5

    File::
    C:\WINDOWS\system32\eslwkuq.dll
    C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
    C:\WINDOWS\system32\drivers\mfhnjq.sys
    C:\WINDOWS\temp\abgtr.exe
    C:\WINDOWS\temp\ugqwhy.exe
    C:\WINDOWS\temp\vwxagf.exe
    C:\WINDOWS\TEMP\ugqwhy.exe
    C:\WINDOWS\TEMP\vwxagf.exe

    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000000
    "FirewallOverride"=dword:00000000
    "UacDisableNotify"=dword:00000000
    "AntiVirusDisableNotify"=dword:00000000
    "UpdatesDisableNotify"=dword:00000000
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "AntiVirusOverride"=dword:00000000
    "AntiVirusDisableNotify"=dword:00000000
    "FirewallDisableNotify"=dword:00000000
    "FirewallOverride"=dword:00000000
    "UpdatesDisableNotify"=dword:00000000
    "UacDisableNotify"=dword:00000000
    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
    "DisableTaskMgr"=-
    "DisableRegistryTools"=-
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\\Apps\\ActivBoard\\nhksrv.exe"=-
    "C:\\WINDOWS\\TEMP\\gicry.exe"=-
    "C:\\WINDOWS\\TEMP\\imnms.exe"=-
    "C:\\WINDOWS\\TEMP\\winvvjufv.exe"=-
    "C:\\WINDOWS\\TEMP\\winolsjx.exe"=-
    "C:\\WINDOWS\\TEMP\\leihn.exe"=-
    "C:\\WINDOWS\\TEMP\\mxyuse.exe"=-
    "C:\\WINDOWS\\TEMP\\winxxoleg.exe"=-
    "C:\\WINDOWS\\TEMP\\dcxb.exe"=-
    "C:\\WINDOWS\\TEMP\\winxouwi.exe"=-
    "C:\\WINDOWS\\TEMP\\ugqwhy.exe"=-
    "C:\\WINDOWS\\TEMP\\winxebb.exe"=-
    "C:\\WINDOWS\\TEMP\\winhgdls.exe"=-
    "C:\\WINDOWS\\TEMP\\vwxagf.exe"=-
    "C:\\WINDOWS\\TEMP\\eynbvr.exe"=-
    "C:\\WINDOWS\\TEMP\\winnkcun.exe"=-
    "C:\\WINDOWS\\TEMP\\ktcuc.exe"=-
    "C:\\WINDOWS\\TEMP\\winvssrac.exe"=-
    "C:\\WINDOWS\\TEMP\\olbctq.exe"=-
    "C:\\WINDOWS\\TEMP\\winogqu.exe"=-
    "C:\\WINDOWS\\TEMP\\winjcabwl.exe"=-
    "C:\\WINDOWS\\TEMP\\winirfm.exe"=-
    "C:\\WINDOWS\\TEMP\\upqn.exe"=-

    Ouvre le Bloc-Notes puis colle le texte copié.
    (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
    Sauvegarde ce fichier sous le nom de CFScript.txt

    Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ceci :

    Cela va relancer Combofix,

    Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

    Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

    Ne touche à rien tant que le scan n'est pas terminé.

    Après redémarrage, poste le contenu du rapport Combofix.txt

    0
  9. Ororo Messages postés 115 Statut Membre
     
    ok je lance ça !
    0
  10. Ororo Messages postés 115 Statut Membre
     
    Désolé, ça n'a pas marché, intérrompu au bout de 2 minutes.
    Est ce du au fait d'avoir laissé le cable réseau branché ?

    J'ai cru avoir vu AUTORITE NT \ SYSTEM

    J'ai envie de balancé cette tour par la fenetre !
    0
  12. Utilisateur anonyme
     
    ---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
    http://oldtimer.geekstogo.com/OTMoveIt3.exe

    ---> Double-clique sur OTMoveIt3.exe afin de le lancer.

    ---> Copie (Ctrl+C) le texte suivant ci-dessous :

    :processes
    explorer.exe

    :services
    knbwwgw
    abp470n5

    :files
    C:\WINDOWS\system32\eslwkuq.dll
    C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
    C:\WINDOWS\system32\drivers\mfhnjq.sys
    C:\WINDOWS\temp\abgtr.exe
    C:\WINDOWS\temp\ugqwhy.exe
    C:\WINDOWS\temp\vwxagf.exe
    C:\WINDOWS\TEMP\ugqwhy.exe
    C:\WINDOWS\TEMP\vwxagf.exe

    :reg
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000000
    "FirewallOverride"=dword:00000000
    "UacDisableNotify"=dword:00000000
    "AntiVirusDisableNotify"=dword:00000000
    "UpdatesDisableNotify"=dword:00000000
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "AntiVirusOverride"=dword:00000000
    "AntiVirusDisableNotify"=dword:00000000
    "FirewallDisableNotify"=dword:00000000
    "FirewallOverride"=dword:00000000
    "UpdatesDisableNotify"=dword:00000000
    "UacDisableNotify"=dword:00000000
    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
    "DisableTaskMgr"=-
    "DisableRegistryTools"=-
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\\Apps\\ActivBoard\\nhksrv.exe"=-
    "C:\\WINDOWS\\TEMP\\gicry.exe"=-
    "C:\\WINDOWS\\TEMP\\imnms.exe"=-
    "C:\\WINDOWS\\TEMP\\winvvjufv.exe"=-
    "C:\\WINDOWS\\TEMP\\winolsjx.exe"=-
    "C:\\WINDOWS\\TEMP\\leihn.exe"=-
    "C:\\WINDOWS\\TEMP\\mxyuse.exe"=-
    "C:\\WINDOWS\\TEMP\\winxxoleg.exe"=-
    "C:\\WINDOWS\\TEMP\\dcxb.exe"=-
    "C:\\WINDOWS\\TEMP\\winxouwi.exe"=-
    "C:\\WINDOWS\\TEMP\\ugqwhy.exe"=-
    "C:\\WINDOWS\\TEMP\\winxebb.exe"=-
    "C:\\WINDOWS\\TEMP\\winhgdls.exe"=-
    "C:\\WINDOWS\\TEMP\\vwxagf.exe"=-
    "C:\\WINDOWS\\TEMP\\eynbvr.exe"=-
    "C:\\WINDOWS\\TEMP\\winnkcun.exe"=-
    "C:\\WINDOWS\\TEMP\\ktcuc.exe"=-
    "C:\\WINDOWS\\TEMP\\winvssrac.exe"=-
    "C:\\WINDOWS\\TEMP\\olbctq.exe"=-
    "C:\\WINDOWS\\TEMP\\winogqu.exe"=-
    "C:\\WINDOWS\\TEMP\\winjcabwl.exe"=-
    "C:\\WINDOWS\\TEMP\\winirfm.exe"=-
    "C:\\WINDOWS\\TEMP\\upqn.exe"=-

    :commands
    [emptytemp]
    [start explorer]
    [reboot]

    ---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

    ---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

    Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
    Accepte en cliquant sur YES.

    ---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
    Le nom du rapport correspond au moment de sa création : date_heure.log
    0
  13. Ororo Messages postés 115 Statut Membre
     
    ========== PROCESSES ==========
    Process explorer.exe killed successfully.
    ========== SERVICES/DRIVERS ==========
    Service\Driver knbwwgw not found.
    Service\Driver knbwwgw not found.
    Service\Driver knbwwgw not found.
    Service\Driver abp470n5 deleted successfully.
    ========== FILES ==========
    File/Folder C:\WINDOWS\system32\eslwkuq.dll not found.
    DllUnregisterServer procedure not found in C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll
    C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll NOT unregistered.
    C:\DOCUME~1\SOLO&K~1\LOCALS~1\Temp\IadHide3.dll moved successfully.
    File/Folder C:\WINDOWS\system32\drivers\mfhnjq.sys not found.
    File/Folder C:\WINDOWS\temp\abgtr.exe not found.
    File/Folder C:\WINDOWS\temp\ugqwhy.exe not found.
    File/Folder C:\WINDOWS\temp\vwxagf.exe not found.
    File/Folder C:\WINDOWS\TEMP\ugqwhy.exe not found.
    File/Folder C:\WINDOWS\TEMP\vwxagf.exe not found.
    ========== REGISTRY ==========
    HKEY_LOCAL_MACHINE\software\microsoft\security center\\"AntiVirusOverride"|dword:00000000 /E : value set successfully!
    HKEY_LOCAL_MACHINE\software\microsoft\security center\\"FirewallOverride"|dword:00000000 /E : value set successfully!
    HKEY_LOCAL_MACHINE\software\microsoft\security center\\"UacDisableNotify"|dword:00000000 /E : value set successfully!
    HKEY_LOCAL_MACHINE\software\microsoft\security center\\"AntiVirusDisableNotify"|dword:00000000 /E : value set successfully!
    HKEY_LOCAL_MACHINE\software\microsoft\security center\\"UpdatesDisableNotify"|dword:00000000 /E : value set successfully!
    HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"AntiVirusOverride"|dword:00000000 /E : value set successfully!
    HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"AntiVirusDisableNotify"|dword:00000000 /E : value set successfully!
    HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"FirewallDisableNotify"|dword:00000000 /E : value set successfully!
    HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"FirewallOverride"|dword:00000000 /E : value set successfully!
    HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"UpdatesDisableNotify"|dword:00000000 /E : value set successfully!
    HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\\"UacDisableNotify"|dword:00000000 /E : value set successfully!
    Registry value HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system\\DisableTaskMgr deleted successfully.
    Registry value HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system\\DisableRegistryTools deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Apps\ActivBoard\nhksrv.exe deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\gicry.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\imnms.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winvvjufv.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winolsjx.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\leihn.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\mxyuse.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winxxoleg.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\dcxb.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winxouwi.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\ugqwhy.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winxebb.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winhgdls.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\vwxagf.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\eynbvr.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winnkcun.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\ktcuc.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winvssrac.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\olbctq.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winogqu.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winjcabwl.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\winirfm.exe not found.
    Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\TEMP\upqn.exe not found.
    ========== COMMANDS ==========
    User's Temp folder emptied.
    User's Internet Explorer cache folder emptied.
    File delete failed. C:\Documents and Settings\solo & kad\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
    User's Temporary Internet Files folder emptied.
    Local Service Temp folder emptied.
    File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
    Local Service Temporary Internet Files folder emptied.
    Network Service Temp folder emptied.
    Network Service Temporary Internet Files folder emptied.
    File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_724.dat scheduled to be deleted on reboot.
    File delete failed. C:\WINDOWS\temp\pwomb.exe scheduled to be deleted on reboot.
    File delete failed. C:\WINDOWS\temp\winxxjxpe.exe scheduled to be deleted on reboot.
    Windows Temp folder emptied.
    Java cache emptied.
    FireFox cache emptied.
    Temp folders emptied.
    Explorer started successfully

    OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 06072009_184208

    Files moved on Reboot...
    File C:\WINDOWS\temp\Perflib_Perfdata_724.dat not found!
    File C:\WINDOWS\temp\pwomb.exe not found!
    File C:\WINDOWS\temp\winxxjxpe.exe not found!
    0
  15. Ororo Messages postés 115 Statut Membre
     
    ça ne passe pas. redémarrage au bout de quelques minutes.
    0
  17. Ororo Messages postés 115 Statut Membre
     
    le mode sans echec ne passe pas.
    0
  19. Ororo Messages postés 115 Statut Membre
     
    La page se charge sans vraiment aboutir à quelque chose (la jauge de chargement s'arrete à la moitié).
    Page blanche !

    Concernant mon clavier, c'est chiant d'écrire le clavier visuel.
    Ce problème est apparu suite à un scan combofix, il a peut-etre déréglé certains elements ?
    Windows dit qu'il est branché mais ne trouve pas le périphérique
    0
  20. Utilisateur anonyme
     
    t as été voir dans le gestionnaire des périphérique pour le clavier ?
    0
  21. Ororo Messages postés 115 Statut Membre
     
    oui j'étais allé voir.
    Windows a chargé le pilote de périphérique de ce matériel mais ne trouve pas le périphérique matériel
    0
Précédent
  • 1
  • 3
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12