Restauration du systeme impossible
muffinz
Messages postés
4
Statut
Membre
-
muffinz -
muffinz -
Bonjour,
Je suis sur XP Pro. Le titre de mon msg est (je crois) assez explicite. En outre, je ne parviens pas à ouvrir ni chrome, ni IE, ni Mozilla.
Voici le rapport hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:56:02, on 03/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\sessmgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\v-cedlam\Local Settings\Temporary Internet Files\Content.IE5\YZSHIUPX\HiJackThis[1].exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 195.144.24.27:80
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: StumbleUpon Launcher - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar4.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar4.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fssui.exe" -autorun
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [COMMUNICATOR] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" /silentRetrials /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ocwsiws] "c:\documents and settings\v-cedlam\local settings\application data\ocwsiws.exe" ocwsiws
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SU 3.14; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.2; WWTClient2)" -"https://www.miniclip.com/games/championship-rally/en/"
O4 - HKCU\..\Policies\Explorer\Run: [1] Wscript //B //NOLOGO \\europe.corp.microsoft.com\netlogon\corpsec\av\RunAVCheck.vbs
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Microsoft Firewall Client Management.lnk = ?
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - https://www.miniclip.com/games/ricochet-lost-worlds/fr/ReflexiveWebGameLoader.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/30.49/uploader2.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - https://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - https://tiragesphoto.fnac.com/
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = europe.corp.microsoft.com
O17 - HKLM\Software\..\Telephony: DomainName = europe.corp.microsoft.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = europe.corp.microsoft.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = europe.corp.microsoft.com
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: Domain = europe.corp.microsoft.com
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI1933~1\Office12\GR99D3~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: StumbleUponUpdateService - stumbleupon.com - C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe
Je suis sur XP Pro. Le titre de mon msg est (je crois) assez explicite. En outre, je ne parviens pas à ouvrir ni chrome, ni IE, ni Mozilla.
Voici le rapport hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:56:02, on 03/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\sessmgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\v-cedlam\Local Settings\Temporary Internet Files\Content.IE5\YZSHIUPX\HiJackThis[1].exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 195.144.24.27:80
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: StumbleUpon Launcher - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar4.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar4.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fssui.exe" -autorun
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [COMMUNICATOR] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" /silentRetrials /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ocwsiws] "c:\documents and settings\v-cedlam\local settings\application data\ocwsiws.exe" ocwsiws
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SU 3.14; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.2; WWTClient2)" -"https://www.miniclip.com/games/championship-rally/en/"
O4 - HKCU\..\Policies\Explorer\Run: [1] Wscript //B //NOLOGO \\europe.corp.microsoft.com\netlogon\corpsec\av\RunAVCheck.vbs
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Microsoft Firewall Client Management.lnk = ?
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - https://www.miniclip.com/games/ricochet-lost-worlds/fr/ReflexiveWebGameLoader.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/30.49/uploader2.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - https://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - https://tiragesphoto.fnac.com/
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = europe.corp.microsoft.com
O17 - HKLM\Software\..\Telephony: DomainName = europe.corp.microsoft.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = europe.corp.microsoft.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = europe.corp.microsoft.com
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: Domain = europe.corp.microsoft.com
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI1933~1\Office12\GR99D3~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: StumbleUponUpdateService - stumbleupon.com - C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe
A voir également:
- Restauration du systeme impossible
- Restauration systeme windows 10 - Guide
- Vérificateur des fichiers système - Guide
- Restauration usine pc - Guide
- Vous avez besoin d'une autorisation de la part de système pour modifier ce dossier - Guide
- Restauration des données - Guide
25 réponses
Bonjour,
Tu étais en mode sans échec quand tu as utilisé hijackthis... Tu n'as plus accès au mode normal ?
Je vois deux infections sur ce rapport :
1) Il y a une barre d'outil néfaste sur ton ordinateur (AskBar)...
Pour éviter ce genre d'infection, il faut tout lire attentivement lorsque tu installes un programme gratuit, et décocher tous les programmes additionnels qui sont proposés, en particulier les barres d'outils !
Télécharge Toolbar-S&D (Team IDN) sur ton Bureau :
• Lance l'installation du programme en exécutant le fichier téléchargé.
• Double-clique maintenant sur le raccourci de Toolbar-S&D.
• Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
• Choisis directement l'option 2 (Suppression). Patiente jusqu'à la fin de la recherche.
• Poste le rapport généré. (C:\TB.txt)
2) Il y a sur ton ordinateur une infection Navipromo, qui affiche des publicités intempestives, et qui s'est installée via des programmes "gratuits", dont ceux-ci :
• Funky Emoticons
• Games Attack
• go-astro
• GoRecord
• HotTVPlayer / HotTVPlayer & Paris Hilton
• Live-Player
• MailSkinner
• Messenger Skinner
• Instant Access
• InternetGameBox
• Officiale Emule (Version d'Emule modifiée)
• Original-solitaire
• SuperSexPlayer
• Speed Downloading
• Sudoplanet
• Webmediaplayer
Pour désinfecter, merci de suivre exactement cette procédure :
• Télécharge Navilog1 (créé par IL-MAFIOSO)
• Enregistrer la cible (du lien) sous... et enregistre-le sur ton Bureau.
• Ensuite double clique sur navilog1.exe pour lancer l'installation.
• Une fois l'installation terminée, lance Navilog depuis le raccourci présent sur le Bureau
• Au menu principal, Fais le choix 1
• Laisse toi guider et patiente jusqu'au message : "Analyse Termine le..."
• Appuie sur une touche, le bloc note va s'ouvrir : copie/colle l'intégralité du rapport ici.
Tu étais en mode sans échec quand tu as utilisé hijackthis... Tu n'as plus accès au mode normal ?
Je vois deux infections sur ce rapport :
1) Il y a une barre d'outil néfaste sur ton ordinateur (AskBar)...
Pour éviter ce genre d'infection, il faut tout lire attentivement lorsque tu installes un programme gratuit, et décocher tous les programmes additionnels qui sont proposés, en particulier les barres d'outils !
Télécharge Toolbar-S&D (Team IDN) sur ton Bureau :
• Lance l'installation du programme en exécutant le fichier téléchargé.
• Double-clique maintenant sur le raccourci de Toolbar-S&D.
• Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
• Choisis directement l'option 2 (Suppression). Patiente jusqu'à la fin de la recherche.
• Poste le rapport généré. (C:\TB.txt)
2) Il y a sur ton ordinateur une infection Navipromo, qui affiche des publicités intempestives, et qui s'est installée via des programmes "gratuits", dont ceux-ci :
• Funky Emoticons
• Games Attack
• go-astro
• GoRecord
• HotTVPlayer / HotTVPlayer & Paris Hilton
• Live-Player
• MailSkinner
• Messenger Skinner
• Instant Access
• InternetGameBox
• Officiale Emule (Version d'Emule modifiée)
• Original-solitaire
• SuperSexPlayer
• Speed Downloading
• Sudoplanet
• Webmediaplayer
Pour désinfecter, merci de suivre exactement cette procédure :
• Télécharge Navilog1 (créé par IL-MAFIOSO)
• Enregistrer la cible (du lien) sous... et enregistre-le sur ton Bureau.
• Ensuite double clique sur navilog1.exe pour lancer l'installation.
• Une fois l'installation terminée, lance Navilog depuis le raccourci présent sur le Bureau
• Au menu principal, Fais le choix 1
• Laisse toi guider et patiente jusqu'au message : "Analyse Termine le..."
• Appuie sur une touche, le bloc note va s'ouvrir : copie/colle l'intégralité du rapport ici.
merci pour ta réponse. Je suis en mode sans echec car je n'arrive à ouvrir/executer ni IE, ni chrome, ni mozilla
voici le rapport toolbar:
-----------\\ ToolBar S&D 1.2.8 XP/Vista
Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) M processor 1.73GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A06
USER : v-cedlam ( Not Administrator ! )
BOOT : Fail-safe with network boot
C:\ (Local Disk) - NTFS - Total:37 Go (Free:12 Go)
D:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 04/06/2009|10:57 )
-----------\\ SUPPRESSION
Supprime! - [Service] ASKService
Supprime! - C:\Program Files\AskBarDis\bar
Supprime! - C:\Program Files\AskBarDis\unins000.dat
Supprime! - C:\Program Files\AskBarDis\unins000.exe
Supprime! - C:\Program Files\AskBarDis
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ Extensions
(v-cedlam) - {AE93811A-5C9A-4d34-8462-F7B864FC4696} => stumbleupon
(v-cedlam) - {AE93811A-5C9A-4d34-8462-F7B864FC4696} => stumbleupon
(v-cedlam) - {B17C1C5A-04B1-11DB-9804-B622A1EF5492} => passwordexporter
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
"Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/"
--------------------\\ Recherche d'autres infections
C:\DOCUME~1\v-cedlam\LOCALS~1\APPLIC~1\ocwsiws.dat
C:\DOCUME~1\v-cedlam\LOCALS~1\APPLIC~1\ocwsiws.exe
C:\DOCUME~1\v-cedlam\LOCALS~1\APPLIC~1\ocwsiws_navps.dat
C:\DOCUME~1\v-cedlam\LOCALS~1\APPLIC~1\ymsws.dat
C:\DOCUME~1\v-cedlam\LOCALS~1\APPLIC~1\ymsws_nav.dat
C:\DOCUME~1\v-cedlam\LOCALS~1\APPLIC~1\ymsws_navps.dat
[b]==> EGDACCESS <==/b
--------------------\\ ROOTKIT !!
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_TDSSSERV]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_TDSSSERV]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_TDSSSERV]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv]
--------------------\\ Cracks & Keygens ..
C:\DOCUME~1\v-cedlam\Application Data\bang\rsrc\bounties\frontier_town\most_wanted\extreme\crackshot_maude
C:\DOCUME~1\v-cedlam\Application Data\bang\rsrc\bounties\frontier_town\most_wanted\extreme\crackshot_maude\bounty.properties
C:\DOCUME~1\v-cedlam\Application Data\bang\rsrc\bounties\frontier_town\most_wanted\extreme\crackshot_maude\crackshot_maude.png
C:\DOCUME~1\v-cedlam\Application Data\bang\rsrc\bounties\frontier_town\most_wanted\extreme\crackshot_maude\gully.game
C:\DOCUME~1\v-cedlam\Application Data\bang\rsrc\bounties\frontier_town\most_wanted\extreme\crackshot_maude\high_shooter.game
C:\DOCUME~1\v-cedlam\Application Data\bang\rsrc\bounties\frontier_town\most_wanted\extreme\crackshot_maude\keep_em.game
1 - "C:\ToolBar SD\TB_1.txt" - 04/06/2009|11:01 - Option : [2]
-----------\\ Fin du rapport a 11:01:14,04
l'installation navilog a échoué. Aucune racourci ne se crée sur mon bureau, malgré la démarche suivie
• Télécharge Navilog1 (créé par IL-MAFIOSO)
• Enregistrer la cible (du lien) sous... et enregistre-le sur ton Bureau.
• Ensuite double clique sur navilog1.exe pour lancer l'installation.
• Une fois l'installation terminée, lance Navilog depuis le raccourci présent sur le Bureau
J'ai essayé en mode normal et en mode sans echec, sans résultat.
D'autre part G un zonealarmbarsetup.exe sur mon bureau que j'ai executé pensant que c'était bien Zonealarm alors qu'il est édité par ask.
Que faire maintenant? Merci.
voici le rapport toolbar:
-----------\\ ToolBar S&D 1.2.8 XP/Vista
Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) M processor 1.73GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A06
USER : v-cedlam ( Not Administrator ! )
BOOT : Fail-safe with network boot
C:\ (Local Disk) - NTFS - Total:37 Go (Free:12 Go)
D:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 04/06/2009|10:57 )
-----------\\ SUPPRESSION
Supprime! - [Service] ASKService
Supprime! - C:\Program Files\AskBarDis\bar
Supprime! - C:\Program Files\AskBarDis\unins000.dat
Supprime! - C:\Program Files\AskBarDis\unins000.exe
Supprime! - C:\Program Files\AskBarDis
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ Extensions
(v-cedlam) - {AE93811A-5C9A-4d34-8462-F7B864FC4696} => stumbleupon
(v-cedlam) - {AE93811A-5C9A-4d34-8462-F7B864FC4696} => stumbleupon
(v-cedlam) - {B17C1C5A-04B1-11DB-9804-B622A1EF5492} => passwordexporter
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
"Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/"
--------------------\\ Recherche d'autres infections
C:\DOCUME~1\v-cedlam\LOCALS~1\APPLIC~1\ocwsiws.dat
C:\DOCUME~1\v-cedlam\LOCALS~1\APPLIC~1\ocwsiws.exe
C:\DOCUME~1\v-cedlam\LOCALS~1\APPLIC~1\ocwsiws_navps.dat
C:\DOCUME~1\v-cedlam\LOCALS~1\APPLIC~1\ymsws.dat
C:\DOCUME~1\v-cedlam\LOCALS~1\APPLIC~1\ymsws_nav.dat
C:\DOCUME~1\v-cedlam\LOCALS~1\APPLIC~1\ymsws_navps.dat
[b]==> EGDACCESS <==/b
--------------------\\ ROOTKIT !!
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_TDSSSERV]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_TDSSSERV]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_TDSSSERV]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv]
--------------------\\ Cracks & Keygens ..
C:\DOCUME~1\v-cedlam\Application Data\bang\rsrc\bounties\frontier_town\most_wanted\extreme\crackshot_maude
C:\DOCUME~1\v-cedlam\Application Data\bang\rsrc\bounties\frontier_town\most_wanted\extreme\crackshot_maude\bounty.properties
C:\DOCUME~1\v-cedlam\Application Data\bang\rsrc\bounties\frontier_town\most_wanted\extreme\crackshot_maude\crackshot_maude.png
C:\DOCUME~1\v-cedlam\Application Data\bang\rsrc\bounties\frontier_town\most_wanted\extreme\crackshot_maude\gully.game
C:\DOCUME~1\v-cedlam\Application Data\bang\rsrc\bounties\frontier_town\most_wanted\extreme\crackshot_maude\high_shooter.game
C:\DOCUME~1\v-cedlam\Application Data\bang\rsrc\bounties\frontier_town\most_wanted\extreme\crackshot_maude\keep_em.game
1 - "C:\ToolBar SD\TB_1.txt" - 04/06/2009|11:01 - Option : [2]
-----------\\ Fin du rapport a 11:01:14,04
l'installation navilog a échoué. Aucune racourci ne se crée sur mon bureau, malgré la démarche suivie
• Télécharge Navilog1 (créé par IL-MAFIOSO)
• Enregistrer la cible (du lien) sous... et enregistre-le sur ton Bureau.
• Ensuite double clique sur navilog1.exe pour lancer l'installation.
• Une fois l'installation terminée, lance Navilog depuis le raccourci présent sur le Bureau
J'ai essayé en mode normal et en mode sans echec, sans résultat.
D'autre part G un zonealarmbarsetup.exe sur mon bureau que j'ai executé pensant que c'était bien Zonealarm alors qu'il est édité par ask.
Que faire maintenant? Merci.
Je comprends la cause de tous tes problèmes, tu as un rootkit TDSSServ, c'est lui qui bloque navilog et sans doute aussi tes navigateurs. On va s'en occuper :
/!\ A l'attention de ceux qui passent sur ce sujet /!\
Le logiciel qui suit n'est pas à utiliser à la légère et peut faire des dégâts s'il est mal utilisé ! Ne le faites que si un helpeur du forum qui connait bien cet outil vous l'a recommandé.
/!\ Désactive tous tes logiciels de protection /!\
• Télécharge ComboFix (de sUBs) sur ton Bureau.
• Double-clique sur ComboFix.exe afin de le lancer.
• Il va te demander d'installer la console de récupération : accepte.
• Ne touche à rien pendant le scan.
• Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Tutoriel officiel de Combofix : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
/!\ A l'attention de ceux qui passent sur ce sujet /!\
Le logiciel qui suit n'est pas à utiliser à la légère et peut faire des dégâts s'il est mal utilisé ! Ne le faites que si un helpeur du forum qui connait bien cet outil vous l'a recommandé.
/!\ Désactive tous tes logiciels de protection /!\
• Télécharge ComboFix (de sUBs) sur ton Bureau.
• Double-clique sur ComboFix.exe afin de le lancer.
• Il va te demander d'installer la console de récupération : accepte.
• Ne touche à rien pendant le scan.
• Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Tutoriel officiel de Combofix : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
voicile rapport combix
ComboFix 09-06-03.04 - v-cedlam 04/06/2009 16:32.1 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.33.1033.18.1015.678 [GMT 2:00]
Lancé depuis: c:\documents and settings\v-cedlam\Desktop\muffinz.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\v-cedlam\Local Settings\Application Data\ocwsiws.dat
c:\documents and settings\v-cedlam\Local Settings\Application Data\ocwsiws.exe
c:\documents and settings\v-cedlam\Local Settings\Application Data\ocwsiws_navps.dat
c:\documents and settings\v-cedlam\Local Settings\Application Data\ymsws.dat
c:\documents and settings\v-cedlam\Local Settings\Application Data\ymsws_nav.dat
c:\documents and settings\v-cedlam\Local Settings\Application Data\ymsws_navps.dat
c:\windows\vyxby.pil
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_TDSSSERV
((((((((((((((((((((((((((((( Fichiers créés du 2009-05-04 au 2009-06-04 ))))))))))))))))))))))))))))))))))))
.
2009-06-04 09:41 . 2009-06-04 09:41 -------- d-----w- c:\program files\Zone Labs
2009-06-04 09:39 . 2009-06-04 09:41 -------- d-----w- c:\windows\Internet Logs
2009-06-04 09:02 . 2009-06-04 11:24 -------- d-----w- c:\program files\Navilog1
2009-06-04 08:56 . 2009-06-04 09:29 -------- d-----w- C:\ToolBar SD
2009-06-03 11:46 . 2009-06-03 11:46 -------- d-----w- C:\Sauvegarde
2009-06-03 11:26 . 2009-06-03 11:33 -------- d-----w- c:\documents and settings\All Users\Application Data\RH_Backups
2009-06-03 11:26 . 2009-06-03 11:26 -------- d-----w- c:\program files\RegHealer
2009-06-02 10:36 . 2009-06-02 11:34 -------- d-----w- c:\program files\RegCleaner
2009-05-23 18:26 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-05-23 18:24 . 2009-05-23 18:24 -------- d-----w- c:\program files\Panda Security
2009-05-19 16:53 . 2009-05-19 16:53 -------- d-----w- c:\windows\system32\wbem\Repository
2009-05-19 15:42 . 2009-05-19 15:42 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-05-19 15:36 . 2009-06-02 11:42 -------- d-----w- c:\program files\Microsoft
2009-05-19 15:29 . 2009-05-19 15:29 -------- d-----w- c:\program files\Common Files\Windows Live
2009-05-07 16:00 . 2009-06-02 11:43 -------- d-----w- c:\program files\OE-Mail Recovery
2009-05-07 15:52 . 2009-06-02 11:46 -------- d-----w- c:\program files\MailNavigator(2)
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-04 14:35 . 2009-06-04 14:35 67 ----a-w- C:\NtfC.tmp
2009-06-04 14:35 . 2009-06-04 14:35 67 ----a-w- C:\Ntf1.tmp
2009-06-04 14:25 . 2006-10-20 10:36 -------- d-----w- c:\program files\CA
2009-06-04 09:15 . 2009-06-04 09:15 67 ----a-w- C:\Ntf9.tmp
2009-06-04 09:15 . 2009-06-04 09:15 67 ----a-w- C:\Ntf8.tmp
2009-06-04 09:05 . 2009-06-04 09:05 67 ----a-w- C:\Ntf7.tmp
2009-06-04 09:05 . 2009-06-04 09:05 67 ----a-w- C:\Ntf6.tmp
2009-06-03 18:06 . 2009-06-03 18:06 67 ----a-w- C:\Ntf5.tmp
2009-06-03 18:06 . 2009-06-03 18:06 67 ----a-w- C:\Ntf4.tmp
2009-06-02 13:42 . 2009-06-02 13:42 67 ----a-w- C:\Ntf3.tmp
2009-06-02 13:42 . 2009-06-02 13:42 67 ----a-w- C:\Ntf2.tmp
2009-06-02 13:32 . 2009-06-02 13:32 67 ----a-w- C:\NtfB.tmp
2009-06-02 13:32 . 2009-06-02 13:32 67 ----a-w- C:\NtfA.tmp
2009-06-02 11:50 . 2008-03-07 14:29 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-02 11:47 . 2008-09-06 17:17 -------- d-----w- c:\program files\a-squared Free
2009-06-02 11:45 . 2008-04-04 08:57 -------- d-----w- c:\program files\Windows Live Toolbar
2009-06-02 11:45 . 2008-04-04 08:49 -------- d-----w- c:\program files\Windows Live
2009-06-02 09:26 . 2008-02-14 13:01 -------- d-----w- c:\program files\Norton Security Scan
2009-05-18 13:55 . 2008-03-14 14:20 -------- d-----w- c:\program files\Java
2009-05-15 11:59 . 2006-10-20 10:56 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-15 11:59 . 2008-02-13 16:09 -------- d-----w- c:\program files\Google
2009-04-27 08:24 . 2008-10-29 21:08 -------- d-----w- c:\program files\BS.Player ControlBar
2009-04-22 10:39 . 2009-04-21 16:37 -------- d-----w- c:\program files\CPU Stress MT
2009-04-21 21:13 . 2009-04-21 17:47 -------- d-----w- c:\documents and settings\v-cedlam\Application Data\Uniblue
2009-04-21 21:13 . 2009-04-21 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\DriverScanner
2009-04-21 16:06 . 2009-04-21 16:06 0 ----a-w- c:\windows\nsreg.dat
2009-04-19 19:14 . 2008-05-29 09:37 -------- d-----w- c:\program files\TVAnts
2009-04-08 09:01 . 2009-04-08 09:01 -------- d-----w- c:\documents and settings\v-cedlam\Application Data\Unity
2009-03-24 16:33 . 2009-03-24 16:33 237264 ----a-w- c:\documents and settings\v-cedlam\Application Data\Mozilla\plugins\npgoogletalk.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 1200128]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-19 68856]
"Google Update"="c:\documents and settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-12-14 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2004-08-04 143360]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"fssui"="c:\program files\Windows Live\Family Safety\fssui.exe" [2007-10-17 243240]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-04 136600]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-04 110592]
"CARPService"="carpserv.exe" - c:\windows\system32\carpserv.exe [2003-01-23 4608]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"1"="Wscript" [X]
c:\documents and settings\v-cedlam\Start Menu\Programs\Startup\
OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Firewall Client Management.lnk - c:\windows\Installer\{199B7F78-69B7-47C5-8D4B-A3ED1391FB6B}\NewShortcut1_8C7A59A89ABE459A9A9308C281A4A264.exe [2006-10-20 53248]
Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-2-5 118784]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1721254763-462695806-1538882281-2580158\Scripts\Logon\[u]0/u\[u]0/u]
"Script"=script_wrapper.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1721254763-462695806-1538882281-2580158\Scripts\Logon\1\[u]0/u]
"Script"=script_wrapper.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1721254763-462695806-1538882281-2692121\Scripts\Logon\[u]0/u\[u]0/u]
"Script"=script_wrapper.cmd
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Documents and Settings\\v-cedlam\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\K-Lite Codec Pack\\Media Player Classic\\mplayerc.exe"=
"c:\\Documents and Settings\\v-cedlam\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\v-cedlam\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [23/05/2009 20:26 28544]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [04/04/2008 11:00 43816]
R2 FwcAgent;Firewall Client Agent;c:\program files\Microsoft Firewall Client 2004\FwcAgent.exe [23/12/2004 02:00 124248]
R2 SRUserService;IT Connection Manager;c:\program files\IT Connection Manager\SRUserService.exe [26/05/2005 20:00 187152]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [03/01/2008 13:10 88192]
S2 fsssvc;Windows Live OneCare Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 523816]
S3 OZSCR;O2Micro SmartCardBus Smartcard Reader;c:\windows\system32\drivers\ozscr.sys [20/10/2006 10:16 92550]
S3 StumbleUponUpdateService;StumbleUponUpdateService;c:\program files\StumbleUpon\StumbleUponUpdateService.exe [19/12/2008 00:05 120168]
.
Contenu du dossier 'Tâches planifiées'
2009-05-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2009-06-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1721254763-462695806-1538882281-2692121.job
- c:\documents and settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-14 18:50]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-COMMUNICATOR - c:\program files\Microsoft Office Communicator\Communicator.exe
HKCU-Run-ocwsiws - c:\documents and settings\v-cedlam\local settings\application data\ocwsiws.exe
HKCU-RunOnce-Shockwave Updater - c:\windows\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SU 3.14; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET
SafeBoot-procexp90.Sys
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 195.144.24.27:80
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
LSP: c:\program files\Microsoft Firewall Client 2004\FwcWsp.dll
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
FF - ProfilePath - c:\documents and settings\v-cedlam\Application Data\Mozilla\Firefox\Profiles\[u]0/uus0rm6v.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - plugin: c:\documents and settings\v-cedlam\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\v-cedlam\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJPI150_12.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPOJI610.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
---- PARAMETRES FIREFOX ----
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-04 16:36
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,aa,a8,f7,a1,99,
1e,94,c9,c8,28,51,af,b0,29,a3,98,72,68,29,61,fb,c4,44,df,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,0b,83,35,bb,91,
dd,4c,30,71,3b,04,66,8b,46,0d,96,cc,56,11,b7,03,9d,c4,a1,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,7a,dd,99,85,6e,
bd,24,a9,25,da,ec,7e,55,20,c9,26,2f,68,96,42,56,04,4f,09,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,c5,21,5f,20,d4,
44,62,4a,3e,1e,9e,e0,57,5a,93,61,b0,64,01,32,d6,d6,f8,82,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,93,4c,4a,bb,19,
a3,cc,e7,cd,44,cd,b9,a6,33,6c,cd,23,e3,99,b5,08,12,ab,07,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,f7,a6,62,71,3e,
f2,90,72,b0,18,ed,a7,3f,8d,37,a4,ef,68,56,5e,69,3f,c5,d6,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,bf,72,a2,85,79,
75,e5,01,31,77,e1,ba,b1,f8,68,02,c9,c0,ce,02,5f,2c,f2,02,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,27,5b,fd,e3,77,
7c,66,d1,83,6c,56,8b,a0,85,96,ab,c6,ae,6a,2f,e5,3e,04,0b,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,e0,ec,ba,02,40,
c0,99,25,51,fa,6e,91,28,9e,14,cc,0f,c3,af,44,bd,80,99,44,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,81,a0,dd,1f,d1,
66,5a,f7,b1,cd,45,5a,a8,c4,f8,b9,3e,b0,2f,e2,bf,ae,94,52,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,8c,73,82,03,7f,
35,c5,92,e3,0e,66,d5,eb,bc,2f,6b,45,e9,7a,90,fa,2b,3d,e5,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,f0,e6,58,4b,a2,
e1,68,3d,fa,ea,66,7f,d4,3b,6b,70,71,63,e6,b9,71,04,60,ac,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(656)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3732)
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\fr-fr\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\fr-fr\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\scardsvr.exe
c:\program files\a-squared Free\a2service.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\ccm\CcmExec.exe
c:\windows\system32\sessmgr.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\igfxsrvc.exe
c:\progra~1\MICROS~3\rapimgr.exe
c:\program files\Microsoft Firewall Client 2004\FwcMgmt.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2009-06-04 16:41 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-04 14:40
Avant-CF: 14 496 387 072 bytes free
Après-CF: 14 831 620 096 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
296 --- E O F --- 2008-01-04 11:04
ComboFix 09-06-03.04 - v-cedlam 04/06/2009 16:32.1 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.33.1033.18.1015.678 [GMT 2:00]
Lancé depuis: c:\documents and settings\v-cedlam\Desktop\muffinz.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\v-cedlam\Local Settings\Application Data\ocwsiws.dat
c:\documents and settings\v-cedlam\Local Settings\Application Data\ocwsiws.exe
c:\documents and settings\v-cedlam\Local Settings\Application Data\ocwsiws_navps.dat
c:\documents and settings\v-cedlam\Local Settings\Application Data\ymsws.dat
c:\documents and settings\v-cedlam\Local Settings\Application Data\ymsws_nav.dat
c:\documents and settings\v-cedlam\Local Settings\Application Data\ymsws_navps.dat
c:\windows\vyxby.pil
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_TDSSSERV
((((((((((((((((((((((((((((( Fichiers créés du 2009-05-04 au 2009-06-04 ))))))))))))))))))))))))))))))))))))
.
2009-06-04 09:41 . 2009-06-04 09:41 -------- d-----w- c:\program files\Zone Labs
2009-06-04 09:39 . 2009-06-04 09:41 -------- d-----w- c:\windows\Internet Logs
2009-06-04 09:02 . 2009-06-04 11:24 -------- d-----w- c:\program files\Navilog1
2009-06-04 08:56 . 2009-06-04 09:29 -------- d-----w- C:\ToolBar SD
2009-06-03 11:46 . 2009-06-03 11:46 -------- d-----w- C:\Sauvegarde
2009-06-03 11:26 . 2009-06-03 11:33 -------- d-----w- c:\documents and settings\All Users\Application Data\RH_Backups
2009-06-03 11:26 . 2009-06-03 11:26 -------- d-----w- c:\program files\RegHealer
2009-06-02 10:36 . 2009-06-02 11:34 -------- d-----w- c:\program files\RegCleaner
2009-05-23 18:26 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-05-23 18:24 . 2009-05-23 18:24 -------- d-----w- c:\program files\Panda Security
2009-05-19 16:53 . 2009-05-19 16:53 -------- d-----w- c:\windows\system32\wbem\Repository
2009-05-19 15:42 . 2009-05-19 15:42 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-05-19 15:36 . 2009-06-02 11:42 -------- d-----w- c:\program files\Microsoft
2009-05-19 15:29 . 2009-05-19 15:29 -------- d-----w- c:\program files\Common Files\Windows Live
2009-05-07 16:00 . 2009-06-02 11:43 -------- d-----w- c:\program files\OE-Mail Recovery
2009-05-07 15:52 . 2009-06-02 11:46 -------- d-----w- c:\program files\MailNavigator(2)
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-04 14:35 . 2009-06-04 14:35 67 ----a-w- C:\NtfC.tmp
2009-06-04 14:35 . 2009-06-04 14:35 67 ----a-w- C:\Ntf1.tmp
2009-06-04 14:25 . 2006-10-20 10:36 -------- d-----w- c:\program files\CA
2009-06-04 09:15 . 2009-06-04 09:15 67 ----a-w- C:\Ntf9.tmp
2009-06-04 09:15 . 2009-06-04 09:15 67 ----a-w- C:\Ntf8.tmp
2009-06-04 09:05 . 2009-06-04 09:05 67 ----a-w- C:\Ntf7.tmp
2009-06-04 09:05 . 2009-06-04 09:05 67 ----a-w- C:\Ntf6.tmp
2009-06-03 18:06 . 2009-06-03 18:06 67 ----a-w- C:\Ntf5.tmp
2009-06-03 18:06 . 2009-06-03 18:06 67 ----a-w- C:\Ntf4.tmp
2009-06-02 13:42 . 2009-06-02 13:42 67 ----a-w- C:\Ntf3.tmp
2009-06-02 13:42 . 2009-06-02 13:42 67 ----a-w- C:\Ntf2.tmp
2009-06-02 13:32 . 2009-06-02 13:32 67 ----a-w- C:\NtfB.tmp
2009-06-02 13:32 . 2009-06-02 13:32 67 ----a-w- C:\NtfA.tmp
2009-06-02 11:50 . 2008-03-07 14:29 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-02 11:47 . 2008-09-06 17:17 -------- d-----w- c:\program files\a-squared Free
2009-06-02 11:45 . 2008-04-04 08:57 -------- d-----w- c:\program files\Windows Live Toolbar
2009-06-02 11:45 . 2008-04-04 08:49 -------- d-----w- c:\program files\Windows Live
2009-06-02 09:26 . 2008-02-14 13:01 -------- d-----w- c:\program files\Norton Security Scan
2009-05-18 13:55 . 2008-03-14 14:20 -------- d-----w- c:\program files\Java
2009-05-15 11:59 . 2006-10-20 10:56 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-15 11:59 . 2008-02-13 16:09 -------- d-----w- c:\program files\Google
2009-04-27 08:24 . 2008-10-29 21:08 -------- d-----w- c:\program files\BS.Player ControlBar
2009-04-22 10:39 . 2009-04-21 16:37 -------- d-----w- c:\program files\CPU Stress MT
2009-04-21 21:13 . 2009-04-21 17:47 -------- d-----w- c:\documents and settings\v-cedlam\Application Data\Uniblue
2009-04-21 21:13 . 2009-04-21 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\DriverScanner
2009-04-21 16:06 . 2009-04-21 16:06 0 ----a-w- c:\windows\nsreg.dat
2009-04-19 19:14 . 2008-05-29 09:37 -------- d-----w- c:\program files\TVAnts
2009-04-08 09:01 . 2009-04-08 09:01 -------- d-----w- c:\documents and settings\v-cedlam\Application Data\Unity
2009-03-24 16:33 . 2009-03-24 16:33 237264 ----a-w- c:\documents and settings\v-cedlam\Application Data\Mozilla\plugins\npgoogletalk.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 1200128]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-19 68856]
"Google Update"="c:\documents and settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-12-14 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2004-08-04 143360]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"fssui"="c:\program files\Windows Live\Family Safety\fssui.exe" [2007-10-17 243240]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-04 136600]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-04 110592]
"CARPService"="carpserv.exe" - c:\windows\system32\carpserv.exe [2003-01-23 4608]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"1"="Wscript" [X]
c:\documents and settings\v-cedlam\Start Menu\Programs\Startup\
OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Firewall Client Management.lnk - c:\windows\Installer\{199B7F78-69B7-47C5-8D4B-A3ED1391FB6B}\NewShortcut1_8C7A59A89ABE459A9A9308C281A4A264.exe [2006-10-20 53248]
Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-2-5 118784]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1721254763-462695806-1538882281-2580158\Scripts\Logon\[u]0/u\[u]0/u]
"Script"=script_wrapper.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1721254763-462695806-1538882281-2580158\Scripts\Logon\1\[u]0/u]
"Script"=script_wrapper.cmd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1721254763-462695806-1538882281-2692121\Scripts\Logon\[u]0/u\[u]0/u]
"Script"=script_wrapper.cmd
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Documents and Settings\\v-cedlam\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\K-Lite Codec Pack\\Media Player Classic\\mplayerc.exe"=
"c:\\Documents and Settings\\v-cedlam\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\v-cedlam\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [23/05/2009 20:26 28544]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [04/04/2008 11:00 43816]
R2 FwcAgent;Firewall Client Agent;c:\program files\Microsoft Firewall Client 2004\FwcAgent.exe [23/12/2004 02:00 124248]
R2 SRUserService;IT Connection Manager;c:\program files\IT Connection Manager\SRUserService.exe [26/05/2005 20:00 187152]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [03/01/2008 13:10 88192]
S2 fsssvc;Windows Live OneCare Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 523816]
S3 OZSCR;O2Micro SmartCardBus Smartcard Reader;c:\windows\system32\drivers\ozscr.sys [20/10/2006 10:16 92550]
S3 StumbleUponUpdateService;StumbleUponUpdateService;c:\program files\StumbleUpon\StumbleUponUpdateService.exe [19/12/2008 00:05 120168]
.
Contenu du dossier 'Tâches planifiées'
2009-05-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2009-06-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1721254763-462695806-1538882281-2692121.job
- c:\documents and settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-14 18:50]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-COMMUNICATOR - c:\program files\Microsoft Office Communicator\Communicator.exe
HKCU-Run-ocwsiws - c:\documents and settings\v-cedlam\local settings\application data\ocwsiws.exe
HKCU-RunOnce-Shockwave Updater - c:\windows\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SU 3.14; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET
SafeBoot-procexp90.Sys
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 195.144.24.27:80
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
LSP: c:\program files\Microsoft Firewall Client 2004\FwcWsp.dll
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
FF - ProfilePath - c:\documents and settings\v-cedlam\Application Data\Mozilla\Firefox\Profiles\[u]0/uus0rm6v.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - plugin: c:\documents and settings\v-cedlam\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\v-cedlam\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPJPI150_12.dll
FF - plugin: c:\program files\Java\jre1.5.0_12\bin\NPOJI610.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
---- PARAMETRES FIREFOX ----
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-04 16:36
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,aa,a8,f7,a1,99,
1e,94,c9,c8,28,51,af,b0,29,a3,98,72,68,29,61,fb,c4,44,df,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,0b,83,35,bb,91,
dd,4c,30,71,3b,04,66,8b,46,0d,96,cc,56,11,b7,03,9d,c4,a1,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,7a,dd,99,85,6e,
bd,24,a9,25,da,ec,7e,55,20,c9,26,2f,68,96,42,56,04,4f,09,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,c5,21,5f,20,d4,
44,62,4a,3e,1e,9e,e0,57,5a,93,61,b0,64,01,32,d6,d6,f8,82,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,93,4c,4a,bb,19,
a3,cc,e7,cd,44,cd,b9,a6,33,6c,cd,23,e3,99,b5,08,12,ab,07,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,f7,a6,62,71,3e,
f2,90,72,b0,18,ed,a7,3f,8d,37,a4,ef,68,56,5e,69,3f,c5,d6,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,bf,72,a2,85,79,
75,e5,01,31,77,e1,ba,b1,f8,68,02,c9,c0,ce,02,5f,2c,f2,02,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,27,5b,fd,e3,77,
7c,66,d1,83,6c,56,8b,a0,85,96,ab,c6,ae,6a,2f,e5,3e,04,0b,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,e0,ec,ba,02,40,
c0,99,25,51,fa,6e,91,28,9e,14,cc,0f,c3,af,44,bd,80,99,44,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,81,a0,dd,1f,d1,
66,5a,f7,b1,cd,45,5a,a8,c4,f8,b9,3e,b0,2f,e2,bf,ae,94,52,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,8c,73,82,03,7f,
35,c5,92,e3,0e,66,d5,eb,bc,2f,6b,45,e9,7a,90,fa,2b,3d,e5,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,f0,e6,58,4b,a2,
e1,68,3d,fa,ea,66,7f,d4,3b,6b,70,71,63,e6,b9,71,04,60,ac,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(656)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3732)
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\fr-fr\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\fr-fr\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\scardsvr.exe
c:\program files\a-squared Free\a2service.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\ccm\CcmExec.exe
c:\windows\system32\sessmgr.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\igfxsrvc.exe
c:\progra~1\MICROS~3\rapimgr.exe
c:\program files\Microsoft Firewall Client 2004\FwcMgmt.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2009-06-04 16:41 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-04 14:40
Avant-CF: 14 496 387 072 bytes free
Après-CF: 14 831 620 096 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
296 --- E O F --- 2008-01-04 11:04
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Ok :)
Maintenant fais ce scan de vérification :
• Télécharge et installe Malwarebytes' Anti-Malware
• A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
• Lance MBAM et laisse les Mises à jour se télécharger (sinon fais les manuellement au lancement du programme)
• Puis va dans l'onglet "Recherche", coche "Exécuter un examen rapide" puis "Rechercher"
• Sélectionne tes disques durs" puis clique sur "Lancer l’examen"
• A la fin du scan, clique sur Afficher les résultats
• Coche tous les éléments détectés puis clique sur Supprimer la sélection
• Enregistre le rapport
• S'il t'est demandé de redémarrer, clique sur Yes
• Poste dans ta prochaine réponse le rapport apparaissant après la suppression stp
Est-ce que tes navigateurs refonctionnent ?
Je précise aussi que si jamais la restauration du système refonctionne, il ne faut surtout pas l'utiliser : en restaurant, tu ramènerais les infections qu'on a supprimé.
Maintenant fais ce scan de vérification :
• Télécharge et installe Malwarebytes' Anti-Malware
• A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
• Lance MBAM et laisse les Mises à jour se télécharger (sinon fais les manuellement au lancement du programme)
• Puis va dans l'onglet "Recherche", coche "Exécuter un examen rapide" puis "Rechercher"
• Sélectionne tes disques durs" puis clique sur "Lancer l’examen"
• A la fin du scan, clique sur Afficher les résultats
• Coche tous les éléments détectés puis clique sur Supprimer la sélection
• Enregistre le rapport
• S'il t'est demandé de redémarrer, clique sur Yes
• Poste dans ta prochaine réponse le rapport apparaissant après la suppression stp
Est-ce que tes navigateurs refonctionnent ?
Je précise aussi que si jamais la restauration du système refonctionne, il ne faut surtout pas l'utiliser : en restaurant, tu ramènerais les infections qu'on a supprimé.
grand malheur! j'ai installé comodo comme firewall et depuis je ne peux plus me connecter à internet comme je le pouvais jusqu'alors :(
Concernant malewarebytes il est déjà installé sur mon laptop, mais les mise à jour ne sont pas récentes 'environ un ou deux mois max).
Que dois-je faire?
Merci
Concernant malewarebytes il est déjà installé sur mon laptop, mais les mise à jour ne sont pas récentes 'environ un ou deux mois max).
Que dois-je faire?
Merci
Bonjour,
j'ai fait tourner la version non mise à jour de MBAM dont je t'ai parlé. Le rapport n'indique aucun élément détecté. J'ai tenté d'enregistrer l'application (install_www--2067-mbamrules.exe) sur une clé USB depuis un autre ordi, pour la lancer sur mon laptop infesté. Que ce soit en mode normal ou sans echec, cela a échoué (msg "download failed try again"). Il m'est tjs impossible de meconnecter mm en mode sans echec (msg "ieframe dll error") , alors qu'auparavant (mes 3 premiers post) je le pouvais.
Merci pour tes propositions
j'ai fait tourner la version non mise à jour de MBAM dont je t'ai parlé. Le rapport n'indique aucun élément détecté. J'ai tenté d'enregistrer l'application (install_www--2067-mbamrules.exe) sur une clé USB depuis un autre ordi, pour la lancer sur mon laptop infesté. Que ce soit en mode normal ou sans echec, cela a échoué (msg "download failed try again"). Il m'est tjs impossible de meconnecter mm en mode sans echec (msg "ieframe dll error") , alors qu'auparavant (mes 3 premiers post) je le pouvais.
Merci pour tes propositions
• Télécharge GMER
• Fais un clic-droit sur le dossier gmer.zip --> Extraire tout --> Choisis le Bureau comme destination.
• Renomme "gmer.exe" en "bypass.exe", puis lance le.
• Dans l'onglet "Rootkit", clique sur "SCAN" puis patiente...
• Si Gmer trouve un rootkit, il affichera la ligne en rouge → fais un clic-droit sur la ligne puis sur Kill the process si cette option est disponible. Ensuite, choisis « Delete the service » pour supprimer le rootkit.
• A la fin, clique sur "SAVE" et enregistre sur ton Bureau (040309.txt)
• Double clique sur "040309.txt", et copie/colle son contenu dans ta prochaine réponse.
• Fais un clic-droit sur le dossier gmer.zip --> Extraire tout --> Choisis le Bureau comme destination.
• Renomme "gmer.exe" en "bypass.exe", puis lance le.
• Dans l'onglet "Rootkit", clique sur "SCAN" puis patiente...
• Si Gmer trouve un rootkit, il affichera la ligne en rouge → fais un clic-droit sur la ligne puis sur Kill the process si cette option est disponible. Ensuite, choisis « Delete the service » pour supprimer le rootkit.
• A la fin, clique sur "SAVE" et enregistre sur ton Bureau (040309.txt)
• Double clique sur "040309.txt", et copie/colle son contenu dans ta prochaine réponse.
bonjour,
le rootkit dont tu m'as parlé, ni aucun autre n'a été détécté :( Que faire par la suite? Merci
===== L'affichage commence au décalage 408134 dans un fichier de longueur 539206. ====
===== Utiliser Fichier->Recharger (Commande+R) pour agrandir l'affichage. ====
7C9105D4 5 Bytes JMP 00901A10 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00904430 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00908460 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ntdll.dll!LdrGetProcedureAddress 7C919B88 5 Bytes JMP 009019F0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00901B30 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00901D90 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 00901AF0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00901AD0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00901D30 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00901A70 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00901A50 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00901A90 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00901D50 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!GetModuleHandleA 7C80B6A1 5 Bytes JMP 00901CF0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!GetModuleHandleW 7C80E43D 5 Bytes JMP 00901D10 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00901B50 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 00901C90 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!MoveFileW 7C821261 5 Bytes JMP 00901C10 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!OpenFile 7C821982 2 Bytes JMP 00901B10 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!OpenFile + 3 7C821985 2 Bytes [0E, 84]
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 00901BD0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CopyFileA 7C8286EE 5 Bytes JMP 00901B70 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CopyFileW 7C82F873 5 Bytes JMP 00901B90 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!DeleteFileA 7C831EAB 5 Bytes JMP 00901CB0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!DeleteFileW 7C831F31 5 Bytes JMP 00901CD0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!MoveFileExW 7C83565B 5 Bytes JMP 00901C50 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!MoveFileA 7C835E8F 5 Bytes JMP 00901BF0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!MoveFileWithProgressA 7C835EAE 5 Bytes JMP 00901C70 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!MoveFileExA 7C85D4C3 5 Bytes JMP 00901C30 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CopyFileExA 7C85E3C4 5 Bytes JMP 00901BB0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00901D70 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!LoadModule 7C86147E 5 Bytes JMP 00901AB0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ADVAPI32.dll!OpenServiceW 77DE6165 7 Bytes JMP 00901480 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ADVAPI32.dll!OpenServiceA 77DEB88C 7 Bytes JMP 00901640 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ADVAPI32.dll!CreateServiceA 77E37071 7 Bytes JMP 00901000 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ADVAPI32.dll!CreateServiceW 77E37209 7 Bytes JMP 00901250 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] USER32.dll!EndTask 7E459E75 5 Bytes JMP 00908100 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ole32.dll!CoCreateInstanceEx 774FFA6B 5 Bytes JMP 00907E10 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ole32.dll!CoGetClassObject 77515DB2 5 Bytes JMP 00907F90 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] SHELL32.dll!ShellExecuteExW 7CA0253B 5 Bytes JMP 00901E10 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] SHELL32.dll!ShellExecuteEx 7CA40DE5 5 Bytes JMP 00901DF0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] SHELL32.dll!ShellExecuteA 7CA41110 5 Bytes JMP 00901DB0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] SHELL32.dll!ShellExecuteW 7CAB5790 5 Bytes JMP 00901DD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtAllocateVirtualMemory 7C90D4DE 5 Bytes JMP 009F1950 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtClose 7C90D586 5 Bytes JMP 009F8530 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtCreateFile 7C90D682 5 Bytes JMP 009F18D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes JMP 009F1890 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes JMP 009F19B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtDeleteFile 7C90D88F 5 Bytes JMP 009F1910 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtFreeVirtualMemory 7C90DA48 5 Bytes JMP 009F1A30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtLoadDriver 7C90DB6E 5 Bytes JMP 009F1970 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes JMP 009F18F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 009F1930 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 009F19D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtUnloadDriver 7C90E8F7 5 Bytes JMP 009F1990 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 009F18B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!RtlAllocateHeap 7C9105D4 5 Bytes JMP 009F1A10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009F4430 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009F8460 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!LdrGetProcedureAddress 7C919B88 5 Bytes JMP 009F19F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 009F1B30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 009F1D90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 009F1AF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 009F1AD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 009F1D30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 009F1A70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 009F1A50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 009F1A90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 009F1D50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!GetModuleHandleA 7C80B6A1 5 Bytes JMP 009F1CF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!GetModuleHandleW 7C80E43D 5 Bytes JMP 009F1D10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 009F1B50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 009F1C90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!MoveFileW 7C821261 5 Bytes JMP 009F1C10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!OpenFile 7C821982 2 Bytes JMP 009F1B10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!OpenFile + 3 7C821985 2 Bytes [1D, 84]
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 009F1BD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CopyFileA 7C8286EE 5 Bytes JMP 009F1B70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CopyFileW 7C82F873 5 Bytes JMP 009F1B90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!DeleteFileA 7C831EAB 5 Bytes JMP 009F1CB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!DeleteFileW 7C831F31 5 Bytes JMP 009F1CD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!MoveFileExW 7C83565B 5 Bytes JMP 009F1C50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!MoveFileA 7C835E8F 5 Bytes JMP 009F1BF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!MoveFileWithProgressA 7C835EAE 5 Bytes JMP 009F1C70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!MoveFileExA 7C85D4C3 5 Bytes JMP 009F1C30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CopyFileExA 7C85E3C4 5 Bytes JMP 009F1BB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 009F1D70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!LoadModule 7C86147E 5 Bytes JMP 009F1AB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] SHELL32.dll!ShellExecuteExW 7CA0253B 5 Bytes JMP 009F1E10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] SHELL32.dll!ShellExecuteEx 7CA40DE5 5 Bytes JMP 009F1DF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] SHELL32.dll!ShellExecuteA 7CA41110 5 Bytes JMP 009F1DB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] SHELL32.dll!ShellExecuteW 7CAB5790 5 Bytes JMP 009F1DD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ADVAPI32.dll!OpenServiceW 77DE6165 7 Bytes JMP 009F1480 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ADVAPI32.dll!OpenServiceA 77DEB88C 7 Bytes JMP 009F1640 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ADVAPI32.dll!CreateServiceA 77E37071 7 Bytes JMP 009F1000 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ADVAPI32.dll!CreateServiceW 77E37209 7 Bytes JMP 009F1250 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] USER32.dll!EndTask 7E459E75 5 Bytes JMP 009F8100 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] WS2_32.dll!WSASocketW 71AB39CB 7 Bytes JMP 009F1E90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] WS2_32.dll!WSASocketA 71AB8769 5 Bytes JMP 009F1E70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ole32.dll!CoCreateInstanceEx 774FFA6B 5 Bytes JMP 009F7E10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ole32.dll!CoGetClassObject 77515DB2 5 Bytes JMP 009F7F90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtAllocateVirtualMemory 7C90D4DE 5 Bytes JMP 10001950 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtClose 7C90D586 5 Bytes JMP 10008530 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtCreateFile 7C90D682 5 Bytes JMP 100018D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes JMP 10001890 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes JMP 100019B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtDeleteFile 7C90D88F 5 Bytes JMP 10001910 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtFreeVirtualMemory 7C90DA48 5 Bytes JMP 10001A30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtLoadDriver 7C90DB6E 5 Bytes JMP 10001970 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes JMP 100018F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 10001930 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 100019D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtUnloadDriver 7C90E8F7 5 Bytes JMP 10001990 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 100018B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!RtlAllocateHeap 7C9105D4 5 Bytes JMP 10001A10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 10004430 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 10008460 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!LdrGetProcedureAddress 7C919B88 5 Bytes JMP 100019F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 10001B30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 10001D90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 10001AF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 10001AD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10001D30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 10001A70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 10001A50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 10001A90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 10001D50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!GetModuleHandleA 7C80B6A1 5 Bytes JMP 10001CF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!GetModuleHandleW 7C80E43D 5 Bytes JMP 10001D10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 10001B50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10001C90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!MoveFileW 7C821261 5 Bytes JMP 10001C10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!OpenFile 7C821982 2 Bytes JMP 10001B10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!OpenFile + 3 7C821985 2 Bytes [7E, 93] {JLE 0xffffffffffffff95}
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10001BD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CopyFileA 7C8286EE 5 Bytes JMP 10001B70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CopyFileW 7C82F873 5 Bytes JMP 10001B90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!DeleteFileA 7C831EAB 5 Bytes JMP 10001CB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!DeleteFileW 7C831F31 5 Bytes JMP 10001CD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!MoveFileExW 7C83565B 5 Bytes JMP 10001C50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!MoveFileA 7C835E8F 5 Bytes JMP 10001BF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!MoveFileWithProgressA 7C835EAE 5 Bytes JMP 10001C70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!MoveFileExA 7C85D4C3 5 Bytes JMP 10001C30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CopyFileExA 7C85E3C4 5 Bytes JMP 10001BB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 10001D70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!LoadModule 7C86147E 5 Bytes JMP 10001AB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!OpenServiceW 77DE6165 7 Bytes JMP 10001480 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!OpenServiceA 77DEB88C 7 Bytes JMP 10001640 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!CreateServiceA 77E37071 7 Bytes JMP 10001000 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!CreateServiceW 77E37209 7 Bytes JMP 10001250 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] USER32.dll!EndTask 7E459E75 5 Bytes JMP 10008100 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ole32.dll!CoCreateInstanceEx 774FFA6B 5 Bytes JMP 10007E10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ole32.dll!CoGetClassObject 77515DB2 5 Bytes JMP 10007F90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] SHELL32.dll!ShellExecuteExW 7CA0253B 5 Bytes JMP 10001E10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] SHELL32.dll!ShellExecuteEx 7CA40DE5 5 Bytes JMP 10001DF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] SHELL32.dll!ShellExecuteA 7CA41110 5 Bytes JMP 10001DB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] SHELL32.dll!ShellExecuteW 7CAB5790 5 Bytes JMP 10001DD0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtAllocateVirtualMemory 7C90D4DE 5 Bytes JMP 003C1950 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtClose 7C90D586 5 Bytes JMP 003C8530 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtCreateFile 7C90D682 5 Bytes JMP 003C18D0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes JMP 003C1890 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes JMP 003C19B0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtDeleteFile 7C90D88F 5 Bytes JMP 003C1910 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtFreeVirtualMemory 7C90DA48 5 Bytes JMP 003C1A30 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtLoadDriver 7C90DB6E 5 Bytes JMP 003C1970 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes JMP 003C18F0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 003C1930 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 003C19D0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtUnloadDriver 7C90E8F7 5 Bytes JMP 003C1990 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 003C18B0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!RtlAllocateHeap 7C9105D4 5 Bytes JMP 003C1A10 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 003C4430 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 003C8460 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!LdrGetProcedureAddress 7C919B88 5 Bytes JMP 003C19F0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 003C1B30 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 003C1D90 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 003C1AF0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 003C1AD0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 003C1D30 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 003C1A70 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 003C1A50 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 003C1A90 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 003C1D50 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!GetModuleHandleA 7C80B6A1 5 Bytes JMP 003C1CF0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!GetModuleHandleW 7C80E43D 5 Bytes JMP 003C1D10 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 003C1B50 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 003C1C90 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!MoveFileW 7C821261 5 Bytes JMP 003C1C10 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!OpenFile 7C821982 2 Bytes JMP 003C1B10 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!OpenFile + 3 7C821985 2 Bytes [BA, 83]
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 003C1BD0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CopyFileA 7C8286EE 5 Bytes JMP 003C1B70 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CopyFileW 7C82F873 5 Bytes JMP 003C1B90 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!DeleteFileA 7C831EAB 5 Bytes JMP 003C1CB0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!DeleteFileW 7C831F31 5 Bytes JMP 003C1CD0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!MoveFileExW 7C83565B 5 Bytes JMP 003C1C50 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!MoveFileA 7C835E8F 5 Bytes JMP 003C1BF0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!MoveFileWithProgressA 7C835EAE 5 Bytes JMP 003C1C70 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!MoveFileExA 7C85D4C3 5 Bytes JMP 003C1C30 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CopyFileExA 7C85E3C4 5 Bytes JMP 003C1BB0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 003C1D70 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!LoadModule 7C86147E 5 Bytes JMP 003C1AB0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ole32.dll!CoCreateInstanceEx 774FFA6B 5 Bytes JMP 003C7E10 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ole32.dll!CoGetClassObject 77515DB2 5 Bytes JMP 003C7F90 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ADVAPI32.dll!OpenServiceW 77DE6165 7 Bytes JMP 003C1480 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ADVAPI32.dll!OpenServiceA 77DEB88C 7 Bytes JMP 003C1640 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ADVAPI32.dll!CreateServiceA 77E37071 7 Bytes JMP 003C1000 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ADVAPI32.dll!CreateServiceW 77E37209 7 Bytes JMP 003C1250 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] USER32.dll!EndTask 7E459E75 5 Bytes JMP 003C8100 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] SHELL32.dll!ShellExecuteExW 7CA0253B 5 Bytes JMP 003C1E10 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] SHELL32.dll!ShellExecuteEx 7CA40DE5 5 Bytes JMP 003C1DF0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] SHELL32.dll!ShellExecuteA 7CA41110 5 Bytes JMP 003C1DB0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] SHELL32.dll!ShellExecuteW 7CAB5790 5 Bytes JMP 003C1DD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtAllocateVirtualMemory 7C90D4DE 5 Bytes JMP 00871950 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtClose 7C90D586 5 Bytes JMP 00878530 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtCreateFile 7C90D682 5 Bytes JMP 008718D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes JMP 00871890 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes JMP 008719B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtDeleteFile 7C90D88F 5 Bytes JMP 00871910 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtFreeVirtualMemory 7C90DA48 5 Bytes JMP 00871A30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtLoadDriver 7C90DB6E 5 Bytes JMP 00871970 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes JMP 008718F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 00871930 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 008719D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtUnloadDriver 7C90E8F7 5 Bytes JMP 00871990 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 008718B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!RtlAllocateHeap 7C9105D4 5 Bytes JMP 00871A10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00874430 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00878460 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!LdrGetProcedureAddress 7C919B88 5 Bytes JMP 008719F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00871B30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00871D90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 00871AF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00871AD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00871D30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00871A70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00871A50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00871A90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00871D50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!GetModuleHandleA 7C80B6A1 5 Bytes JMP 00871CF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!GetModuleHandleW 7C80E43D 5 Bytes JMP 00871D10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00871B50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 00871C90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!MoveFileW 7C821261 5 Bytes JMP 00871C10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!OpenFile 7C821982 2 Bytes JMP 00871B10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!OpenFile + 3 7C821985 2 Bytes [05, 84]
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 00871BD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CopyFileA 7C8286EE 5 Bytes JMP 00871B70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CopyFileW 7C82F873 5 Bytes JMP 00871B90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!DeleteFileA 7C831EAB 5 Bytes JMP 00871CB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!DeleteFileW 7C831F31 5 Bytes JMP 00871CD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!MoveFileExW 7C83565B 5 Bytes JMP 00871C50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!MoveFileA 7C835E8F 5 Bytes JMP 00871BF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!MoveFileWithProgressA 7C835EAE 5 Bytes JMP 00871C70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!MoveFileExA 7C85D4C3 5 Bytes JMP 00871C30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CopyFileExA 7C85E3C4 5 Bytes JMP 00871BB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00871D70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!LoadModule 7C86147E 5 Bytes JMP 00871AB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ADVAPI32.dll!OpenServiceW 77DE6165 3 Bytes JMP 00871480 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ADVAPI32.dll!OpenServiceW + 4 77DE6169 3 Bytes [88, CC, CC] {MOV AH, CL; INT 3 }
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ADVAPI32.dll!OpenServiceA 77DEB88C 7 Bytes JMP 00871640 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ADVAPI32.dll!CreateServiceA 77E37071 7 Bytes JMP 00871000 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ADVAPI32.dll!CreateServiceW 77E37209 7 Bytes JMP 00871250 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] USER32.dll!EndTask 7E459E75 5 Bytes JMP 00878100 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] WS2_32.dll!WSASocketW 71AB39CB 7 Bytes JMP 00871E90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] WS2_32.dll!WSASocketA 71AB8769 5 Bytes JMP 00871E70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ole32.dll!CoCreateInstanceEx 774FFA6B 5 Bytes JMP 00877E10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ole32.dll!CoGetClassObject 77515DB2 5 Bytes JMP 00877F90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] SHELL32.dll!ShellExecuteExW 7CA0253B 5 Bytes JMP 00871E10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] SHELL32.dll!ShellExecuteEx 7CA40DE5 5 Bytes JMP 00871DF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] SHELL32.dll!ShellExecuteA 7CA41110 5 Bytes JMP 00871DB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] SHELL32.dll!ShellExecuteW 7CAB5790 5 Bytes JMP 00871DD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] wininet.dll!InternetConnectA 42C249F2 5 Bytes JMP 00871E30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] wininet.dll!InternetConnectW 42C25BE0 5 Bytes JMP 00871E50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtAllocateVirtualMemory 7C90D4DE 5 Bytes JMP 003D1950 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtClose 7C90D586 5 Bytes JMP 003D8530 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtCreateFile 7C90D682 5 Bytes JMP 003D18D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes JMP 003D1890 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes JMP 003D19B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtDeleteFile 7C90D88F 5 Bytes JMP 003D1910 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtFreeVirtualMemory 7C90DA48 5 Bytes JMP 003D1A30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtLoadDriver 7C90DB6E 5 Bytes JMP 003D1970 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes JMP 003D18F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 003D1930 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 003D19D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtUnloadDriver 7C90E8F7 5 Bytes JMP 003D1990 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] nt
le rootkit dont tu m'as parlé, ni aucun autre n'a été détécté :( Que faire par la suite? Merci
===== L'affichage commence au décalage 408134 dans un fichier de longueur 539206. ====
===== Utiliser Fichier->Recharger (Commande+R) pour agrandir l'affichage. ====
7C9105D4 5 Bytes JMP 00901A10 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00904430 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00908460 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ntdll.dll!LdrGetProcedureAddress 7C919B88 5 Bytes JMP 009019F0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00901B30 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00901D90 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 00901AF0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00901AD0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00901D30 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00901A70 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00901A50 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00901A90 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00901D50 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!GetModuleHandleA 7C80B6A1 5 Bytes JMP 00901CF0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!GetModuleHandleW 7C80E43D 5 Bytes JMP 00901D10 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00901B50 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 00901C90 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!MoveFileW 7C821261 5 Bytes JMP 00901C10 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!OpenFile 7C821982 2 Bytes JMP 00901B10 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!OpenFile + 3 7C821985 2 Bytes [0E, 84]
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 00901BD0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CopyFileA 7C8286EE 5 Bytes JMP 00901B70 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CopyFileW 7C82F873 5 Bytes JMP 00901B90 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!DeleteFileA 7C831EAB 5 Bytes JMP 00901CB0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!DeleteFileW 7C831F31 5 Bytes JMP 00901CD0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!MoveFileExW 7C83565B 5 Bytes JMP 00901C50 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!MoveFileA 7C835E8F 5 Bytes JMP 00901BF0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!MoveFileWithProgressA 7C835EAE 5 Bytes JMP 00901C70 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!MoveFileExA 7C85D4C3 5 Bytes JMP 00901C30 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!CopyFileExA 7C85E3C4 5 Bytes JMP 00901BB0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00901D70 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] kernel32.dll!LoadModule 7C86147E 5 Bytes JMP 00901AB0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ADVAPI32.dll!OpenServiceW 77DE6165 7 Bytes JMP 00901480 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ADVAPI32.dll!OpenServiceA 77DEB88C 7 Bytes JMP 00901640 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ADVAPI32.dll!CreateServiceA 77E37071 7 Bytes JMP 00901000 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ADVAPI32.dll!CreateServiceW 77E37209 7 Bytes JMP 00901250 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] USER32.dll!EndTask 7E459E75 5 Bytes JMP 00908100 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ole32.dll!CoCreateInstanceEx 774FFA6B 5 Bytes JMP 00907E10 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] ole32.dll!CoGetClassObject 77515DB2 5 Bytes JMP 00907F90 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] SHELL32.dll!ShellExecuteExW 7CA0253B 5 Bytes JMP 00901E10 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] SHELL32.dll!ShellExecuteEx 7CA40DE5 5 Bytes JMP 00901DF0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] SHELL32.dll!ShellExecuteA 7CA41110 5 Bytes JMP 00901DB0 C:\WINDOWS\system32\guard32.dll
.text C:\WINDOWS\system32\ctfmon.exe[2836] SHELL32.dll!ShellExecuteW 7CAB5790 5 Bytes JMP 00901DD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtAllocateVirtualMemory 7C90D4DE 5 Bytes JMP 009F1950 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtClose 7C90D586 5 Bytes JMP 009F8530 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtCreateFile 7C90D682 5 Bytes JMP 009F18D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes JMP 009F1890 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes JMP 009F19B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtDeleteFile 7C90D88F 5 Bytes JMP 009F1910 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtFreeVirtualMemory 7C90DA48 5 Bytes JMP 009F1A30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtLoadDriver 7C90DB6E 5 Bytes JMP 009F1970 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes JMP 009F18F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 009F1930 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 009F19D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtUnloadDriver 7C90E8F7 5 Bytes JMP 009F1990 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 009F18B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!RtlAllocateHeap 7C9105D4 5 Bytes JMP 009F1A10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009F4430 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009F8460 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ntdll.dll!LdrGetProcedureAddress 7C919B88 5 Bytes JMP 009F19F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 009F1B30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 009F1D90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 009F1AF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 009F1AD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 009F1D30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 009F1A70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 009F1A50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 009F1A90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 009F1D50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!GetModuleHandleA 7C80B6A1 5 Bytes JMP 009F1CF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!GetModuleHandleW 7C80E43D 5 Bytes JMP 009F1D10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 009F1B50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 009F1C90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!MoveFileW 7C821261 5 Bytes JMP 009F1C10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!OpenFile 7C821982 2 Bytes JMP 009F1B10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!OpenFile + 3 7C821985 2 Bytes [1D, 84]
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 009F1BD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CopyFileA 7C8286EE 5 Bytes JMP 009F1B70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CopyFileW 7C82F873 5 Bytes JMP 009F1B90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!DeleteFileA 7C831EAB 5 Bytes JMP 009F1CB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!DeleteFileW 7C831F31 5 Bytes JMP 009F1CD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!MoveFileExW 7C83565B 5 Bytes JMP 009F1C50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!MoveFileA 7C835E8F 5 Bytes JMP 009F1BF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!MoveFileWithProgressA 7C835EAE 5 Bytes JMP 009F1C70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!MoveFileExA 7C85D4C3 5 Bytes JMP 009F1C30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!CopyFileExA 7C85E3C4 5 Bytes JMP 009F1BB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 009F1D70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] kernel32.dll!LoadModule 7C86147E 5 Bytes JMP 009F1AB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] SHELL32.dll!ShellExecuteExW 7CA0253B 5 Bytes JMP 009F1E10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] SHELL32.dll!ShellExecuteEx 7CA40DE5 5 Bytes JMP 009F1DF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] SHELL32.dll!ShellExecuteA 7CA41110 5 Bytes JMP 009F1DB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] SHELL32.dll!ShellExecuteW 7CAB5790 5 Bytes JMP 009F1DD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ADVAPI32.dll!OpenServiceW 77DE6165 7 Bytes JMP 009F1480 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ADVAPI32.dll!OpenServiceA 77DEB88C 7 Bytes JMP 009F1640 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ADVAPI32.dll!CreateServiceA 77E37071 7 Bytes JMP 009F1000 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ADVAPI32.dll!CreateServiceW 77E37209 7 Bytes JMP 009F1250 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] USER32.dll!EndTask 7E459E75 5 Bytes JMP 009F8100 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] WS2_32.dll!WSASocketW 71AB39CB 7 Bytes JMP 009F1E90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] WS2_32.dll!WSASocketA 71AB8769 5 Bytes JMP 009F1E70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ole32.dll!CoCreateInstanceEx 774FFA6B 5 Bytes JMP 009F7E10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2844] ole32.dll!CoGetClassObject 77515DB2 5 Bytes JMP 009F7F90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtAllocateVirtualMemory 7C90D4DE 5 Bytes JMP 10001950 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtClose 7C90D586 5 Bytes JMP 10008530 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtCreateFile 7C90D682 5 Bytes JMP 100018D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes JMP 10001890 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes JMP 100019B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtDeleteFile 7C90D88F 5 Bytes JMP 10001910 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtFreeVirtualMemory 7C90DA48 5 Bytes JMP 10001A30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtLoadDriver 7C90DB6E 5 Bytes JMP 10001970 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes JMP 100018F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 10001930 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 100019D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtUnloadDriver 7C90E8F7 5 Bytes JMP 10001990 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 100018B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!RtlAllocateHeap 7C9105D4 5 Bytes JMP 10001A10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 10004430 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 10008460 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!LdrGetProcedureAddress 7C919B88 5 Bytes JMP 100019F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 10001B30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 10001D90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 10001AF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 10001AD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10001D30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 10001A70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 10001A50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 10001A90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 10001D50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!GetModuleHandleA 7C80B6A1 5 Bytes JMP 10001CF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!GetModuleHandleW 7C80E43D 5 Bytes JMP 10001D10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 10001B50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 10001C90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!MoveFileW 7C821261 5 Bytes JMP 10001C10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!OpenFile 7C821982 2 Bytes JMP 10001B10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!OpenFile + 3 7C821985 2 Bytes [7E, 93] {JLE 0xffffffffffffff95}
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 10001BD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CopyFileA 7C8286EE 5 Bytes JMP 10001B70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CopyFileW 7C82F873 5 Bytes JMP 10001B90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!DeleteFileA 7C831EAB 5 Bytes JMP 10001CB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!DeleteFileW 7C831F31 5 Bytes JMP 10001CD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!MoveFileExW 7C83565B 5 Bytes JMP 10001C50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!MoveFileA 7C835E8F 5 Bytes JMP 10001BF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!MoveFileWithProgressA 7C835EAE 5 Bytes JMP 10001C70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!MoveFileExA 7C85D4C3 5 Bytes JMP 10001C30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!CopyFileExA 7C85E3C4 5 Bytes JMP 10001BB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 10001D70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] kernel32.dll!LoadModule 7C86147E 5 Bytes JMP 10001AB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!OpenServiceW 77DE6165 7 Bytes JMP 10001480 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!OpenServiceA 77DEB88C 7 Bytes JMP 10001640 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!CreateServiceA 77E37071 7 Bytes JMP 10001000 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!CreateServiceW 77E37209 7 Bytes JMP 10001250 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] USER32.dll!EndTask 7E459E75 5 Bytes JMP 10008100 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ole32.dll!CoCreateInstanceEx 774FFA6B 5 Bytes JMP 10007E10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ole32.dll!CoGetClassObject 77515DB2 5 Bytes JMP 10007F90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] SHELL32.dll!ShellExecuteExW 7CA0253B 5 Bytes JMP 10001E10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] SHELL32.dll!ShellExecuteEx 7CA40DE5 5 Bytes JMP 10001DF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] SHELL32.dll!ShellExecuteA 7CA41110 5 Bytes JMP 10001DB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] SHELL32.dll!ShellExecuteW 7CAB5790 5 Bytes JMP 10001DD0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtAllocateVirtualMemory 7C90D4DE 5 Bytes JMP 003C1950 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtClose 7C90D586 5 Bytes JMP 003C8530 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtCreateFile 7C90D682 5 Bytes JMP 003C18D0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes JMP 003C1890 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes JMP 003C19B0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtDeleteFile 7C90D88F 5 Bytes JMP 003C1910 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtFreeVirtualMemory 7C90DA48 5 Bytes JMP 003C1A30 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtLoadDriver 7C90DB6E 5 Bytes JMP 003C1970 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes JMP 003C18F0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 003C1930 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 003C19D0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtUnloadDriver 7C90E8F7 5 Bytes JMP 003C1990 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 003C18B0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!RtlAllocateHeap 7C9105D4 5 Bytes JMP 003C1A10 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 003C4430 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 003C8460 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ntdll.dll!LdrGetProcedureAddress 7C919B88 5 Bytes JMP 003C19F0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 003C1B30 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 003C1D90 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 003C1AF0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 003C1AD0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 003C1D30 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 003C1A70 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 003C1A50 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 003C1A90 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 003C1D50 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!GetModuleHandleA 7C80B6A1 5 Bytes JMP 003C1CF0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!GetModuleHandleW 7C80E43D 5 Bytes JMP 003C1D10 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 003C1B50 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 003C1C90 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!MoveFileW 7C821261 5 Bytes JMP 003C1C10 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!OpenFile 7C821982 2 Bytes JMP 003C1B10 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!OpenFile + 3 7C821985 2 Bytes [BA, 83]
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 003C1BD0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CopyFileA 7C8286EE 5 Bytes JMP 003C1B70 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CopyFileW 7C82F873 5 Bytes JMP 003C1B90 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!DeleteFileA 7C831EAB 5 Bytes JMP 003C1CB0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!DeleteFileW 7C831F31 5 Bytes JMP 003C1CD0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!MoveFileExW 7C83565B 5 Bytes JMP 003C1C50 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!MoveFileA 7C835E8F 5 Bytes JMP 003C1BF0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!MoveFileWithProgressA 7C835EAE 5 Bytes JMP 003C1C70 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!MoveFileExA 7C85D4C3 5 Bytes JMP 003C1C30 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!CopyFileExA 7C85E3C4 5 Bytes JMP 003C1BB0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 003C1D70 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] kernel32.dll!LoadModule 7C86147E 5 Bytes JMP 003C1AB0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ole32.dll!CoCreateInstanceEx 774FFA6B 5 Bytes JMP 003C7E10 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ole32.dll!CoGetClassObject 77515DB2 5 Bytes JMP 003C7F90 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ADVAPI32.dll!OpenServiceW 77DE6165 7 Bytes JMP 003C1480 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ADVAPI32.dll!OpenServiceA 77DEB88C 7 Bytes JMP 003C1640 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ADVAPI32.dll!CreateServiceA 77E37071 7 Bytes JMP 003C1000 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] ADVAPI32.dll!CreateServiceW 77E37209 7 Bytes JMP 003C1250 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] USER32.dll!EndTask 7E459E75 5 Bytes JMP 003C8100 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] SHELL32.dll!ShellExecuteExW 7CA0253B 5 Bytes JMP 003C1E10 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] SHELL32.dll!ShellExecuteEx 7CA40DE5 5 Bytes JMP 003C1DF0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] SHELL32.dll!ShellExecuteA 7CA41110 5 Bytes JMP 003C1DB0 C:\WINDOWS\system32\guard32.dll
.text C:\Documents and Settings\v-cedlam\Local Settings\Application Data\Google\Update\GoogleUpdate.exe[2860] SHELL32.dll!ShellExecuteW 7CAB5790 5 Bytes JMP 003C1DD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtAllocateVirtualMemory 7C90D4DE 5 Bytes JMP 00871950 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtClose 7C90D586 5 Bytes JMP 00878530 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtCreateFile 7C90D682 5 Bytes JMP 008718D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes JMP 00871890 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes JMP 008719B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtDeleteFile 7C90D88F 5 Bytes JMP 00871910 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtFreeVirtualMemory 7C90DA48 5 Bytes JMP 00871A30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtLoadDriver 7C90DB6E 5 Bytes JMP 00871970 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes JMP 008718F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 00871930 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 008719D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtUnloadDriver 7C90E8F7 5 Bytes JMP 00871990 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 008718B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!RtlAllocateHeap 7C9105D4 5 Bytes JMP 00871A10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00874430 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00878460 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ntdll.dll!LdrGetProcedureAddress 7C919B88 5 Bytes JMP 008719F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00871B30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00871D90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 00871AF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00871AD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00871D30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00871A70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00871A50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00871A90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00871D50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!GetModuleHandleA 7C80B6A1 5 Bytes JMP 00871CF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!GetModuleHandleW 7C80E43D 5 Bytes JMP 00871D10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00871B50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 00871C90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!MoveFileW 7C821261 5 Bytes JMP 00871C10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!OpenFile 7C821982 2 Bytes JMP 00871B10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!OpenFile + 3 7C821985 2 Bytes [05, 84]
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CopyFileExW 7C827B32 7 Bytes JMP 00871BD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CopyFileA 7C8286EE 5 Bytes JMP 00871B70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CopyFileW 7C82F873 5 Bytes JMP 00871B90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!DeleteFileA 7C831EAB 5 Bytes JMP 00871CB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!DeleteFileW 7C831F31 5 Bytes JMP 00871CD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!MoveFileExW 7C83565B 5 Bytes JMP 00871C50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!MoveFileA 7C835E8F 5 Bytes JMP 00871BF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!MoveFileWithProgressA 7C835EAE 5 Bytes JMP 00871C70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!MoveFileExA 7C85D4C3 5 Bytes JMP 00871C30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!CopyFileExA 7C85E3C4 5 Bytes JMP 00871BB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00871D70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] kernel32.dll!LoadModule 7C86147E 5 Bytes JMP 00871AB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ADVAPI32.dll!OpenServiceW 77DE6165 3 Bytes JMP 00871480 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ADVAPI32.dll!OpenServiceW + 4 77DE6169 3 Bytes [88, CC, CC] {MOV AH, CL; INT 3 }
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ADVAPI32.dll!OpenServiceA 77DEB88C 7 Bytes JMP 00871640 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ADVAPI32.dll!CreateServiceA 77E37071 7 Bytes JMP 00871000 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ADVAPI32.dll!CreateServiceW 77E37209 7 Bytes JMP 00871250 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] USER32.dll!EndTask 7E459E75 5 Bytes JMP 00878100 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] WS2_32.dll!WSASocketW 71AB39CB 7 Bytes JMP 00871E90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] WS2_32.dll!WSASocketA 71AB8769 5 Bytes JMP 00871E70 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ole32.dll!CoCreateInstanceEx 774FFA6B 5 Bytes JMP 00877E10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] ole32.dll!CoGetClassObject 77515DB2 5 Bytes JMP 00877F90 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] SHELL32.dll!ShellExecuteExW 7CA0253B 5 Bytes JMP 00871E10 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] SHELL32.dll!ShellExecuteEx 7CA40DE5 5 Bytes JMP 00871DF0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] SHELL32.dll!ShellExecuteA 7CA41110 5 Bytes JMP 00871DB0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] SHELL32.dll!ShellExecuteW 7CAB5790 5 Bytes JMP 00871DD0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] wininet.dll!InternetConnectA 42C249F2 5 Bytes JMP 00871E30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Microsoft Firewall Client 2004\FwcMgmt.exe[2940] wininet.dll!InternetConnectW 42C25BE0 5 Bytes JMP 00871E50 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtAllocateVirtualMemory 7C90D4DE 5 Bytes JMP 003D1950 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtClose 7C90D586 5 Bytes JMP 003D8530 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtCreateFile 7C90D682 5 Bytes JMP 003D18D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes JMP 003D1890 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes JMP 003D19B0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtDeleteFile 7C90D88F 5 Bytes JMP 003D1910 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtFreeVirtualMemory 7C90DA48 5 Bytes JMP 003D1A30 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtLoadDriver 7C90DB6E 5 Bytes JMP 003D1970 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtOpenFile 7C90DCFD 5 Bytes JMP 003D18F0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 003D1930 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 003D19D0 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] ntdll.dll!NtUnloadDriver 7C90E8F7 5 Bytes JMP 003D1990 C:\WINDOWS\system32\guard32.dll
.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2968] nt
j'avais essayé. malheureusemnt le fichier 040309.txt généré depuis gmer.log ne s'uploadait pas comme .txt mais comme gmer.log, ce type de fichier n'est pas explortable sur le site.
J'ai donc refait tourner l'appli (en mode sans echec) mais le rapport ne me semble pas le mm. Sont analysés IAT, Attached devices et REG (clés system et software), aucun rapport sur Files par exemple, alors que tous les sous-types à analyser sont cochés (system, sections, IAT/EAT, Devices etc etc). Je te laisse apprécier la qualité et (l'exploitablilité de ce rapport 040309bis.txt) http://ww38.toofiles.com/fr/oip/documents/txt/040309bis.html
Pour info, j'ai une toolbar ask qui s'était installée sur Mozilla. Info dont je te laisse apprécier l'utilité ou l'inutilité.
Deux questions également
Est ce ça change qq chose à opérer les manip en mode sans echec ou mode normal
Comodo doit-il être désactivé pendant ces manip?
merci
J'ai donc refait tourner l'appli (en mode sans echec) mais le rapport ne me semble pas le mm. Sont analysés IAT, Attached devices et REG (clés system et software), aucun rapport sur Files par exemple, alors que tous les sous-types à analyser sont cochés (system, sections, IAT/EAT, Devices etc etc). Je te laisse apprécier la qualité et (l'exploitablilité de ce rapport 040309bis.txt) http://ww38.toofiles.com/fr/oip/documents/txt/040309bis.html
Pour info, j'ai une toolbar ask qui s'était installée sur Mozilla. Info dont je te laisse apprécier l'utilité ou l'inutilité.
Deux questions également
Est ce ça change qq chose à opérer les manip en mode sans echec ou mode normal
Comodo doit-il être désactivé pendant ces manip?
merci
S'il y a des manip' à faire en mode sans échec, je le préciserai, Pour le reste, tu peux tout faire en mode normal ;)
Pour la toolbar Ask, on verra après (c'est effectivement une barre d'outil néfaste).
Là il y a plusieurs lignes du rapport Gmer qui indique les restes du rootkit TDSS... Je regarde comment on peut supprimer ça avec gmer et je te redis (désolé de te faire attendre).
Si je ne réponds pas d'ici 24h, n'hésite pas à faire remonter le sujet en postant un message.
Pour la toolbar Ask, on verra après (c'est effectivement une barre d'outil néfaste).
Là il y a plusieurs lignes du rapport Gmer qui indique les restes du rootkit TDSS... Je regarde comment on peut supprimer ça avec gmer et je te redis (désolé de te faire attendre).
Si je ne réponds pas d'ici 24h, n'hésite pas à faire remonter le sujet en postant un message.
merci pour ta réponse. J'attends la suite. A très vite, je ne désespère pas de récupérer mon ordi, mais le temps passe ;)
Excuse moi pour le délai de réponse :(
/!\ Il faut IMPERATIVEMENT désactiver tous tes logiciels de protection pour utiliser ce programme/!\
Clique sur menu démarrer --> Programmes --> Accessoires --> Invite de commandes.
Fais un copier/coller des lignes suivantes les unes après les autres (appuie sur entrée entre chacune d'elles pour les valider) :
gmer -del reg "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv"
gmer -del file "\systemroot\system32\drivers\TDSSserv.sys"
gmer -reboot
/!\ Il faut IMPERATIVEMENT désactiver tous tes logiciels de protection pour utiliser ce programme/!\
Clique sur menu démarrer --> Programmes --> Accessoires --> Invite de commandes.
Fais un copier/coller des lignes suivantes les unes après les autres (appuie sur entrée entre chacune d'elles pour les valider) :
gmer -del reg "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv"
gmer -del file "\systemroot\system32\drivers\TDSSserv.sys"
gmer -reboot
ça ne marche pas: message d'erreur 'gmer' n'est pas reconnu en tant que commande interne ou externe, un pg exécutable ou un fichier de commande
une astuce alternative?
une astuce alternative?
Tu as encore Gmer sur ton Bureau ?
Si oui, essaye de lui rendre son vrai nom (gmer.exe), puis recommence stp
Sinon il faut le retélécharger et le décompresser comme indiqué ici.
Si oui, essaye de lui rendre son vrai nom (gmer.exe), puis recommence stp
Sinon il faut le retélécharger et le décompresser comme indiqué ici.
mm réponse que précédemment: gmer n'est pas reconnu...
ma démarche:
G retéléchargé gmer depuis le site. Pour info, je le télécharge depuis un mac qui le dezippe automatiquement et enregistre gmer.exe.
J'enregistre gmer.exe sur une clé usb puis le copie-colle sur le bureau de mon xp en panne
j'accède à la console de commande, j'aboutis sur C:*touche backslash*Documents and Settings*touche backslash*v-cedlam> Je copie colle la ligne et je reçois le msg d'erreur.
faut-il que j'accède à C:*toche backslash*, si oui comment procéder? Jai tenté C:*backskash* mais je retombe sur la l'invite de commande C: documents and Setiings etc etc..
je me sens assez ned pour le coup, merci pour un nouveau tuto
ma démarche:
G retéléchargé gmer depuis le site. Pour info, je le télécharge depuis un mac qui le dezippe automatiquement et enregistre gmer.exe.
J'enregistre gmer.exe sur une clé usb puis le copie-colle sur le bureau de mon xp en panne
j'accède à la console de commande, j'aboutis sur C:*touche backslash*Documents and Settings*touche backslash*v-cedlam> Je copie colle la ligne et je reçois le msg d'erreur.
faut-il que j'accède à C:*toche backslash*, si oui comment procéder? Jai tenté C:*backskash* mais je retombe sur la l'invite de commande C: documents and Setiings etc etc..
je me sens assez ned pour le coup, merci pour un nouveau tuto
Hum...
Clique sur Menu Démarrer --> Executer --> tape "cmd" (sans les guillemets), puis clique sur OK.
Et réessaye de copier/coller les mêmes commandes que précédemment stp
Clique sur Menu Démarrer --> Executer --> tape "cmd" (sans les guillemets), puis clique sur OK.
Et réessaye de copier/coller les mêmes commandes que précédemment stp
désolé mais mm pb que précédemment: gmer n'est pas reconnu etc etc.
le pb peut venir de la désactivation des logiciels de protection? comodo est installé, je tente de le désactiver en quittant par les icones de la toolbar (en bas droite de l'écran). Or lorsque je liste le gestionnaire des tâches, apparait cmdagent.exe dans SYSTEM qui semble faire partie de Comodo. Lorsque je demande la fin du processus, j'ai un msg d'erreur l'opération n'a pas pu être terminée. Accés refusé. D'autre part je ne sais pas si d'autres logiciels de protection pourraient également être actifs.
Merci pour tes suggestions sur ces deux points et sur l'exécution des 3 commandes gmer -del à effectuer.
le pb peut venir de la désactivation des logiciels de protection? comodo est installé, je tente de le désactiver en quittant par les icones de la toolbar (en bas droite de l'écran). Or lorsque je liste le gestionnaire des tâches, apparait cmdagent.exe dans SYSTEM qui semble faire partie de Comodo. Lorsque je demande la fin du processus, j'ai un msg d'erreur l'opération n'a pas pu être terminée. Accés refusé. D'autre part je ne sais pas si d'autres logiciels de protection pourraient également être actifs.
Merci pour tes suggestions sur ces deux points et sur l'exécution des 3 commandes gmer -del à effectuer.
cmdagent correspond bien à Comodo. Il faudrait effectivement le désactiver, mais le problème ne vient pas de là à mon avis.
Je ne sais pas du tout comment fonctionne ce pare-feu, je ne pourrai donc pas t'expliquer comment le désactiver correctement. Mais si tu as du mal à l'utiliser, tu peux aussi choisir de le désinstaller (depuis le mode sans échec) pour en utiliser un plus simple ;)
On va faire autrement :
Supprime Combofix : clique sur Menu Démarrer --> Exécuter --> tape Combofix /u (l'espace entre Combofix et /u est important). Si ça ne suffit pas, supprime manuellement Combofix, qui est sur ton Bureau.
Puis retélécharge le ici et mets le sur ton Bureau.
• Télécharge ce dossier muffinz.zip
• Fais un clic-droit dessus --> Extraire tout --> choisis le Bureau comme destination
• Un autre dossier va apparaitre, prends le fichier CFScript.txt qui se trouve à l'intérieur et place le sur le Bureau.
• Désactive tes logiciels de protection
• Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe (comme sur ce lien)
• Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
• Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
• Si le fichier ne s'ouvre pas, il se trouve ici → C:\ComboFix.txt
Je ne sais pas du tout comment fonctionne ce pare-feu, je ne pourrai donc pas t'expliquer comment le désactiver correctement. Mais si tu as du mal à l'utiliser, tu peux aussi choisir de le désinstaller (depuis le mode sans échec) pour en utiliser un plus simple ;)
On va faire autrement :
Supprime Combofix : clique sur Menu Démarrer --> Exécuter --> tape Combofix /u (l'espace entre Combofix et /u est important). Si ça ne suffit pas, supprime manuellement Combofix, qui est sur ton Bureau.
Puis retélécharge le ici et mets le sur ton Bureau.
• Télécharge ce dossier muffinz.zip
• Fais un clic-droit dessus --> Extraire tout --> choisis le Bureau comme destination
• Un autre dossier va apparaitre, prends le fichier CFScript.txt qui se trouve à l'intérieur et place le sur le Bureau.
• Désactive tes logiciels de protection
• Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe (comme sur ce lien)
• Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
• Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
• Si le fichier ne s'ouvre pas, il se trouve ici → C:\ComboFix.txt
