Blocker un virus d'autre disque durs
Résolu
ANASS159
Messages postés
11
Statut
Membre
-
Le Tango des ouistitis -
Le Tango des ouistitis -
Bonjour,
J'ai 4 disque durs dans mon pc j'ai 1 et lautres de mes freres et ils sont infecter d'un virus .scr de dossiers j'ai formater mon disque durs et il a infecter une 2eme fois alors je veut une astuce pour que les autre disque durs n'infect pas le mien stp stp aider moi et merci d'avence .
J'ai 4 disque durs dans mon pc j'ai 1 et lautres de mes freres et ils sont infecter d'un virus .scr de dossiers j'ai formater mon disque durs et il a infecter une 2eme fois alors je veut une astuce pour que les autre disque durs n'infect pas le mien stp stp aider moi et merci d'avence .
A voir également:
- Blocker un virus d'autre disque durs
- Cloner disque dur - Guide
- Defragmenter disque dur - Guide
- Test disque dur - Télécharger - Informations & Diagnostic
- Chkdsk disque dur externe - Guide
- Nettoyage disque dur - Guide
10 réponses
il faut nettoyer car l'infection est importante et propagée!
nettoyer que ta partition ne servira à rien!!!
il y a l'infection confiker:
https://www.lepoint.fr/
http://marc-blanchard.com/
nettoyer que ta partition ne servira à rien!!!
il y a l'infection confiker:
https://www.lepoint.fr/
http://marc-blanchard.com/
slt spybot ne fera rien
c'est quoi le nom du virus ????
___________
Télécharge ici :
http://images.malwareremoval.com/random/RSIT.exe
random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.
Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.
Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
c'est quoi le nom du virus ????
___________
Télécharge ici :
http://images.malwareremoval.com/random/RSIT.exe
random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.
Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.
Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
Pour fusionner:
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
_______________
telecharge combofix:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !
_________________
Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
File::
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winexosa.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winaapr.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\w7304e2.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winkvuyaw.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winnnecam.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winmwjvp.exe
g:\documents and settings\mr.dark\jymdlf.exe
Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winqnuv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\ubgoyq.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winbiumcx.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\aydo.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\imtw.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\nkwifl.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\wingsuoib.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winlfih.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winkwsw.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winxcyver.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winvipe.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\tjyjq.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winiadf.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winjrwtwu.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\eslv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\wexv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\gflfwe.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\byurnr.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\isas.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\wincdxda.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\xabpc.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\vlna.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winquqy.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\htlh.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winpgmv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\windmjd.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winmktai.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winkanpe.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winfeqpie.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winmqkb.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\isceqg.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\syveek.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winrmyiav.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winiqwny.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\qrgn.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\svcmfb.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winkmeagy.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winuipyfy.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\xhqhxx.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winqqkcpn.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\pnwvel.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winwsgc.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\adhk.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winsdqsq.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\wineemec.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\xdlpmq.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\ghlhr.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\yqcio.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\jthai.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winmvjusu.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\aqxjgm.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winrgfaru.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winkefjni.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winpqcyi.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\windtnt.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winbtlpf.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winugoypr.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\wmjfpv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\lcya.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winwlaq.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winpcqgv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\exth.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winllswwq.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\wysiu.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winhwfiu.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\afht.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\pkvdv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\fkind.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\xifvg.exe"=-
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe
Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
_______________
telecharge combofix:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !
_________________
Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
File::
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winexosa.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winaapr.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\w7304e2.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winkvuyaw.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winnnecam.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winmwjvp.exe
g:\documents and settings\mr.dark\jymdlf.exe
Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winqnuv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\ubgoyq.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winbiumcx.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\aydo.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\imtw.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\nkwifl.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\wingsuoib.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winlfih.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winkwsw.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winxcyver.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winvipe.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\tjyjq.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winiadf.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winjrwtwu.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\eslv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\wexv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\gflfwe.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\byurnr.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\isas.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\wincdxda.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\xabpc.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\vlna.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winquqy.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\htlh.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winpgmv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\windmjd.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winmktai.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winkanpe.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winfeqpie.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winmqkb.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\isceqg.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\syveek.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winrmyiav.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winiqwny.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\qrgn.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\svcmfb.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winkmeagy.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winuipyfy.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\xhqhxx.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winqqkcpn.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\pnwvel.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winwsgc.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\adhk.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winsdqsq.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\wineemec.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\xdlpmq.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\ghlhr.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\yqcio.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\jthai.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winmvjusu.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\aqxjgm.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winrgfaru.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winkefjni.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winpqcyi.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\windtnt.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winbtlpf.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winugoypr.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\wmjfpv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\lcya.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winwlaq.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winpcqgv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\exth.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winllswwq.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\wysiu.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winhwfiu.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\afht.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\pkvdv.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\fkind.exe"=-
"G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\xifvg.exe"=-
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe
Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Tien jlpjlp :
================================log.txt=================================
Logfile of random's system information tool 1.06 (written by random/random)
Run by Mr.DARK at 2009-08-14 11:56:28
Microsoft Windows XP Professionnel Service Pack 2
System drive G: has 1 GB (3%) free of 38 GB
Total RAM: 511 MB (12% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59:23, on 14/08/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\csrss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Bonjour\mDNSResponder.exe
G:\Program Files\Java\jre6\bin\jqs.exe
G:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
G:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
G:\WINDOWS\system32\nvsvc32.exe
G:\WINDOWS\system32\svchost.exe
G:\Program Files\Internet Download Manager\IDMan.exe
G:\WINDOWS\system32\wbem\wmiapsrv.exe
G:\WINDOWS\system32\ctfmon.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winexosa.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winaapr.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\w7304e2.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winkvuyaw.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winnnecam.exe
G:\Program Files\LG Electronics\Modem USB LG Electronics\IEUM.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\Real\RealPlayer\realplay.exe
G:\WINDOWS\system32\SNDVOL32.EXE
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winmwjvp.exe
G:\Documents and Settings\Mr.DARK\Mes documents\Downloads\Programs\RSIT.exe
G:\WINDOWS\system32\wbem\wmiprvse.exe
G:\Program Files\trend micro\Mr.DARK.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://dufpy.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=g:\windows\system32\userinit.exe,g:\documents and settings\mr.dark\jymdlf.exe \s,G:\WINDOWS\system32\MPK\MPK.exe,G:\Documents and Settings\ANASS\fbca.exe \s
O1 - Hosts: 5.198.103.137 pes6gate-ec.winning-eleven.net
O1 - Hosts: 210.249.144.166 we9stun.winning-eleven.net
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - G:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Adobe PDF Interpreter - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9B2} - G:\Program Files\Adobe\AcroRd32.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - G:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - G:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - G:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - G:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: 2nd &Speech Center - {CFE40ED8-564E-4693-A9D9-80DB70C8E460} - G:\PROGRA~1\2NDSPE~1\tts4ie.dll
O4 - HKLM\..\Run: [AVP] "G:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "G:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [vmware-tray] "G:\Program Files\VMware\VMware Workstation\vmware-tray.exe"
O4 - HKLM\..\Run: [tsnpstd3] G:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] G:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [Google Desktop Search] "G:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [WinampAgent] "G:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [RavTimeXP] G:\WINDOWS\Mstray.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] G:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [UMService] G:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe
O4 - HKCU\..\Run: [msnmsgr] "G:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ares] "G:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [IDMan] G:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "G:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Télécharger avec IDM - G:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - G:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - G:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - G:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: g:\program files\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: g:\program files\vmware\vmware workstation\vsocklib.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{39614507-583A-41A7-993B-6F41E31F25F6}: NameServer = 192.168.50.55 196.12.230.202
O20 - AppInit_DLLs: G:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd.dll,G:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd3.dll,G:\PROGRA~1\KASPER~1\KASPER~2\adialhk.dll,G:\PROGRA~1\KASPER~1\KASPER~2\kloehk.dll G:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O21 - SSODL: OcnTvuFXNhjhO - {304A2957-9AE0-83FD-3922-975E61BB177D} - G:\WINDOWS\system32\cq.dll
O23 - Service: Kaspersky Internet Security (AVP) - Unknown owner - G:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - G:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ElevatorService - Unknown owner - G:\Program Files\WebVideoRip\ElevatorService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - G:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - G:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - G:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - G:\Program Files\WinPcap\rpcapd.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - G:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - G:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - G:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - G:\WINDOWS\system32\vmnat.exe
O23 - Service: wampapache - Apache Software Foundation - g:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - g:\wamp\bin\mysql\mysql5.1.30\bin\mysqld.exe
================================log.txt=================================
Logfile of random's system information tool 1.06 (written by random/random)
Run by Mr.DARK at 2009-08-14 11:56:28
Microsoft Windows XP Professionnel Service Pack 2
System drive G: has 1 GB (3%) free of 38 GB
Total RAM: 511 MB (12% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59:23, on 14/08/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\csrss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Bonjour\mDNSResponder.exe
G:\Program Files\Java\jre6\bin\jqs.exe
G:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
G:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
G:\WINDOWS\system32\nvsvc32.exe
G:\WINDOWS\system32\svchost.exe
G:\Program Files\Internet Download Manager\IDMan.exe
G:\WINDOWS\system32\wbem\wmiapsrv.exe
G:\WINDOWS\system32\ctfmon.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winexosa.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winaapr.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\w7304e2.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winkvuyaw.exe
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winnnecam.exe
G:\Program Files\LG Electronics\Modem USB LG Electronics\IEUM.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\Real\RealPlayer\realplay.exe
G:\WINDOWS\system32\SNDVOL32.EXE
G:\DOCUME~1\MR8E0C~1.DAR\LOCALS~1\Temp\winmwjvp.exe
G:\Documents and Settings\Mr.DARK\Mes documents\Downloads\Programs\RSIT.exe
G:\WINDOWS\system32\wbem\wmiprvse.exe
G:\Program Files\trend micro\Mr.DARK.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://dufpy.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=g:\windows\system32\userinit.exe,g:\documents and settings\mr.dark\jymdlf.exe \s,G:\WINDOWS\system32\MPK\MPK.exe,G:\Documents and Settings\ANASS\fbca.exe \s
O1 - Hosts: 5.198.103.137 pes6gate-ec.winning-eleven.net
O1 - Hosts: 210.249.144.166 we9stun.winning-eleven.net
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - G:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Adobe PDF Interpreter - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9B2} - G:\Program Files\Adobe\AcroRd32.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - G:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - G:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - G:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - G:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: 2nd &Speech Center - {CFE40ED8-564E-4693-A9D9-80DB70C8E460} - G:\PROGRA~1\2NDSPE~1\tts4ie.dll
O4 - HKLM\..\Run: [AVP] "G:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "G:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [vmware-tray] "G:\Program Files\VMware\VMware Workstation\vmware-tray.exe"
O4 - HKLM\..\Run: [tsnpstd3] G:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] G:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [Google Desktop Search] "G:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [WinampAgent] "G:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [RavTimeXP] G:\WINDOWS\Mstray.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] G:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [UMService] G:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe
O4 - HKCU\..\Run: [msnmsgr] "G:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ares] "G:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [IDMan] G:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "G:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Télécharger avec IDM - G:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - G:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - G:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - G:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: g:\program files\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: g:\program files\vmware\vmware workstation\vsocklib.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{39614507-583A-41A7-993B-6F41E31F25F6}: NameServer = 192.168.50.55 196.12.230.202
O20 - AppInit_DLLs: G:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd.dll,G:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd3.dll,G:\PROGRA~1\KASPER~1\KASPER~2\adialhk.dll,G:\PROGRA~1\KASPER~1\KASPER~2\kloehk.dll G:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O21 - SSODL: OcnTvuFXNhjhO - {304A2957-9AE0-83FD-3922-975E61BB177D} - G:\WINDOWS\system32\cq.dll
O23 - Service: Kaspersky Internet Security (AVP) - Unknown owner - G:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - G:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ElevatorService - Unknown owner - G:\Program Files\WebVideoRip\ElevatorService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - G:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - G:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - G:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - G:\Program Files\WinPcap\rpcapd.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - G:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - G:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - G:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - G:\WINDOWS\system32\vmnat.exe
O23 - Service: wampapache - Apache Software Foundation - g:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - g:\wamp\bin\mysql\mysql5.1.30\bin\mysqld.exe
