hclean32.exe reperé mais invisible !!

Question

salut a moe31 et autres pros de la securité !

je me trimballe un probleme qui semble commun a certaines personnes ici, depuis qq temps et je suis dans l'impossibilité d'y remedier seul! si qq pouvait m'apporter ses lumieres sur le sujet

Windows 2000

1: au lancement d'une page internet explorer (et meme de firefox installé recement) j'ai une signalisation de virus par norton , au choix: mssosxrt.exe ou cisvvc.exe ou les deux

2: suite a cela ,c'est une succession de pop up soit une bulle pour me dire que mon Pc est en danger ,soit une fenetre de type windows pour me dire le meme truc, ces 2 fenetres reviennent regulierement , si je relance une session ou je reboote, plus rien..

3:meme en desactivant l'affichage des messages dans "outils d'administration ->services ,les messages s'affichent toujours

4: je precise que j'utilise aussi crazy browser et avec lui aucun souci, tous mes problemes arrivent lors du lancement d'une page internet independante de crazy ou au lancement de firefox (un comble pour moi qui souhaiter passer a firefox pour eviter certains desagrements!)

5:les fichiers .exe que j'ai cité sont introuvables dans le system32, pas plus que dans le registre , idem pour hclean.32 qui est souvent reperé par norton et mis en quarantaine, jai eu l'espoir de trouver q trucs supplementaires en decochant "masquer les fichiers proteges du systeme d'exploitation dans option des dossiers,mais rien..

6: je pense effectivement avoir eu wareout a un moment mais il n'en subsiste aucune trace visible sur mon PC , dans le registre ou autre

7:j'ai utilisé killbox qui a reperé une premiere fois hclean32.exe
mais maintnant il me signale que ce fichier n'existe pas malgre le fait que Norton l'ai detecté et mis en quarantaine(au passage ,lorsque j'ai relancé norton pour un scan une demi heure plus tard sur le dossier systeme 32 plus de hclean.., va comprendre...) dans l'historique il apparait cependant bien.

8:avant ,il me suffisait de demarrer en mode sans echec pour supprimer les fichiers recalcitrants mais là, je ne les trouve simplement pas!(particulierement ce hclean32.exe)

9:Hijack ne me donne aucune info dans ce sens

10: this website is not authorized to host this activx. control, ca c le message que j'obtiens lorsque j'essaye de lancer un online scan par bitdefender...dommage je pensais avoir qq infos supp' par ce biais là..

11: je suis a court d'idées et avant de me resigner a faire une reinstall de ma partition systeme , jai l'espoir que qq pourra m'apporter un debut de solution, merci d'avance!!

Afficher la suite

Utilisateur anonyme · Answer

saluttelecharge hijackthis:http://www.merijn.org/files/hijackthis.zip Dezippe le dans un dossier prévu a cet effet.Par exemple C:\hijacket surtout pas dans un dossier temporaire (temp)lance le puis:clic sur "do a system scan and save logfile" et pas autre choseLe bloc note va s'ouvrir, copie tout le contenu et colle le ici a la suite de ton message.Si tu as du mal, regarde ceci:http://pageperso.aol.fr/balltrap34/demohijack.htm telecharge silentrunners ici:http://www.silentrunners.org/Silent%20Runners.vbsdezippe le et poste le rapport (il faut autoriser le script, quand norton te le demandera)a+

honlo · Answer

merci d'avoir repondu aussi vite!voici HJ:Logfile of HijackThis v1.99.1Scan saved at 23:39:28, on 26/08/2005Platform: Windows 2000 SP4 (WinNT 5.00.2195)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\csrss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\LEXBCES.EXEC:\WINNT\system32\spoolsv.exeC:\WINNT\system32\LEXPPS.EXEC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINNT\System32\svchost.exeC:\Program Files\Norton AntiVirus\navapsvc.exeC:\Program Files\Norton Utilities\NProtect.exeC:\WINNT\System32\nvsvc32.exeC:\WINNT\system32\regsvc.exeC:\WINNT\system32\MSTask.exeC:\Program Files\Speed Disk\nopdb.exeC:\WINNT\system32\stisvc.exeC:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeC:\WINNT\system32\ZoneLabs\vsmon.exeC:\WINNT\System32\WBEM\WinMgmt.exeC:\WINNT\system32\svchost.exeC:\WINNT\System32\svchost.exeC:\WINNT\system32\ZoneLabs\minilog.exeC:\WINNT\Explorer.EXEC:\WINNT\htpatch.exeC:\PROGRA~1\Wanadoo\CnxMon.exeC:\PROGRA~1\MESSAG~1\Demon.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\BillP Studios\WinPatrol\winpatrol.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeC:\WINNT\system32\internat.exeC:\Program Files\SAGEM\SAGEM F@st800\dslmon.exeC:\Documents and Settings\All Users\Application Data\Spontania4IM\spontania4IM.exeC:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXEC:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exeC:\Program Files\SpywareGuard\sgmain.exeC:\WINNT\system32\wuauclt.exeC:\Program Files\SpywareGuard\sgbhp.exeC:\PROGRA~1\Wanadoo\EspaceWanadoo.exeC:\PROGRA~1\Wanadoo\ComComp.exeC:\PROGRA~1\Wanadoo\Watch.exeC:\Program Files\Crazy Browser\Crazy Browser.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Outlook Express\msimn.exeD:\LoGs AuG2005\bsplayer132\bsplayer.exeD:\LoGs AuG2005\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logonO4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exeO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exeO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [Demon] C:\PROGRA~1\MESSAG~1\Demon.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [LXBLKsk] C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exeO4 - HKLM\..\Run: [MemoryCardManager] C:\Program Files\Lexmark\Lexmark Photo Center\MemoryCardManager.exe -startupO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXEO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exeO4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exeO4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintrayO4 - HKCU\..\Run: [internat.exe] internat.exeO4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st800\dslmon.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Spontania Monitor.lnk = C:\Documents and Settings\All Users\Application Data\Spontania4IM\spontania4IM.exeO4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXEO4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dllO9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cabO16 - DPF: Interface Chat Wanadoo - http://chat4.x-echo.com/version6/Applet/wchatsign.cabO16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cabO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cabO16 - DPF: {2D37B9E8-C14C-482C-B1CF-939C5440E179} (VTToolkit Control) - http://videomessages.wanadoo.fr/VTToolkit.ocxO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cabO16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cabO16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{884FA64A-4951-4813-BD12-E05FF1487509}: NameServer = 69.50.176.157,85.255.112.6O17 - HKLM\System\CCS\Services\Tcpip\..\{A0559B99-064D-4D49-8C48-856E8482C980}: NameServer = 80.10.246.1 80.10.246.132O17 - HKLM\System\CCS\Services\Tcpip\..\{C0065321-F2F6-4019-93FA-D7CDED9EEC2E}: NameServer = 69.50.176.157,85.255.112.6O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXEO23 - Service: TrueVector Basic Logging Client (minilog) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\minilog.exeO23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NProtect.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exeO23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exeet SR:"Silent Runners.vbs", revision 40, http://www.silentrunners.org/Operating System: Windows 2000Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"internat.exe" = "internat.exe" [MS]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++}"notepad.exe" = (empty string)HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"Synchronization Manager" = "mobsync.exe /logon" [MS]"HTpatch" = "C:\WINNT\htpatch.exe" [null data]"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]"NvCplDaemon" = "RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup" [MS]"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]"NeroCheck" = "C:\WINNT\System32\NeroCheck.exe" ["Ahead Software Gmbh"]"WooCnxMon" = "C:\PROGRA~1\Wanadoo\CnxMon.exe" [empty string]"Demon" = "C:\PROGRA~1\MESSAG~1\Demon.exe" ["France Telecom"]"WOOWATCH" = "C:\PROGRA~1\Wanadoo\Watch.exe" ["France Télécom R&D"]"WOOTASKBARICON" = "C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" ["France Télécom R&D"]"LXBLKsk" = "C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exe" [" "]"MemoryCardManager" = "C:\Program Files\Lexmark\Lexmark Photo Center\MemoryCardManager.exe -startup" [null data]"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]"ccRegVfy" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"" ["Symantec Corporation"]"Advanced Tools Check" = "C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE" ["Symantec Corporation"]"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe" ["Symantec Corporation"]"SSC_UserPrompt" = "C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe" ["Symantec Corporation"]"MessengerPlus3" = ""C:\Program Files\MessengerPlus! 3\MsgPlus.exe"" ["Patchou"]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"WinPatrol" = "C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" ["BillP Studios"]"hclean32.exe" = "C:\WINNT\system32\hclean32.exe" [file not found]"SpySweeper" = ""C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray" ["Webroot Software, Inc."]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]{4A368E80-174F-4872-96B5-0B27DDD11DB2}\(Default) = "SpywareGuard Download Protection"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\SpywareGuard\dlprotect.dll" [null data]{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"  -> {CLSID}\InProcServer32\(Default) = "C:\WINNT\System32\hticons.dll" ["Hilgraeve, Inc."]"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"

Utilisateur anonyme · Answer

salutil manque un bout de silentrunner

balltrap34 · Answer

ton log de silence runner n est pas complet

honlo · Answer

Dsl !voila:"Silent Runners.vbs", revision 40, http://www.silentrunners.org/Operating System: Windows 2000Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"internat.exe" = "internat.exe" [MS]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++}"notepad.exe" = (empty string)HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"Synchronization Manager" = "mobsync.exe /logon" [MS]"HTpatch" = "C:\WINNT\htpatch.exe" [null data]"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]"NvCplDaemon" = "RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup" [MS]"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]"NeroCheck" = "C:\WINNT\System32\NeroCheck.exe" ["Ahead Software Gmbh"]"WooCnxMon" = "C:\PROGRA~1\Wanadoo\CnxMon.exe" [empty string]"Demon" = "C:\PROGRA~1\MESSAG~1\Demon.exe" ["France Telecom"]"WOOWATCH" = "C:\PROGRA~1\Wanadoo\Watch.exe" ["France Télécom R&D"]"WOOTASKBARICON" = "C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" ["France Télécom R&D"]"LXBLKsk" = "C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exe" [" "]"MemoryCardManager" = "C:\Program Files\Lexmark\Lexmark Photo Center\MemoryCardManager.exe -startup" [null data]"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]"ccRegVfy" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"" ["Symantec Corporation"]"Advanced Tools Check" = "C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE" ["Symantec Corporation"]"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe" ["Symantec Corporation"]"SSC_UserPrompt" = "C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe" ["Symantec Corporation"]"MessengerPlus3" = ""C:\Program Files\MessengerPlus! 3\MsgPlus.exe"" ["Patchou"]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"WinPatrol" = "C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" ["BillP Studios"]"hclean32.exe" = "C:\WINNT\system32\hclean32.exe" [file not found]"SpySweeper" = ""C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray" ["Webroot Software, Inc."]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]{4A368E80-174F-4872-96B5-0B27DDD11DB2}\(Default) = "SpywareGuard Download Protection"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\SpywareGuard\dlprotect.dll" [null data]{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"  -> {CLSID}\InProcServer32\(Default) = "C:\WINNT\System32\hticons.dll" ["Hilgraeve, Inc."]"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"  -> {CLSID}\InProcServer32\(Default) = "C:\WINNT\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINNT\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINNT\system32\nvshell.dll" ["NVIDIA Corporation"]"{CA5FEE26-14C1-4B5A-86E9-233FC0EE2682}" = "IZArc DragDrop Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]"{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}" = "IZArc Shell Context Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]"{3c249f62-e26e-11d4-97f0-009027769c61}" = "Format Shell"  -> {CLSID}\InProcServer32\(Default) = "C:\WINNT\System32\SMSHELL.DLL" ["OnSpec Electronic, Inc."]"{03FF3962-D823-11D4-97F0-009027769C61}" = "Data Caching Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\WINNT\System32\FlashShl.dll" [" "]"{59850401-6664-101B-B21C-00AA004BA90B}" = "Microsoft Office Binder Unbind"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\1036\UNBIND.DLL" [MS]"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{516EC4D3-4AD9-11D5-AA6A-00E0189008B3}" = "The Core Media Player Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\CORECO~1\THECOR~1\System\CORESH~1.CLL" [null data]"{81559C35-8464-49F7-BB0E-07A383BEF910}" = "SpywareGuard.Handler" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\SpywareGuard\spywareguard.dll" [null data]"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" = "Webroot Spy Sweeper Context Menu Integration"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."]"{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}" = "SnagIt"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll" ["TechSmith Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\INFECTION WARNING! "{81559C35-8464-49F7-BB0E-07A383BEF910}" = "SpywareGuard.Handler" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\SpywareGuard\spywareguard.dll" [null data]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\INFECTION WARNING! "System" = "csywg.exe" [null data]HKLM\Software\Classes\*\shellex\ContextMenuHandlers\IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\CoreShellAgent\(Default) = "{516EC4D3-4AD9-11D5-AA6A-00E0189008B3}"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\CORECO~1\THECOR~1\System\CORESH~1.CLL" [null data]IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\SpySweeper\(Default) = "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."]Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]Active Desktop and Wallpaper:-----------------------------Active Desktop is enabled at this entry:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellStateHKCU\Software\Microsoft\Internet Explorer\Desktop\General\"Wallpaper" = "C:\WINNT\ACD Wallpaper.cmp"Startup items in "Indi1" & "All Users" startup folders:-------------------------------------------------------C:\Documents and Settings\Indi1\Menu Démarrer\Programmes\Démarrage"Adobe Gamma Loader.exe" -> shortcut to: "C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]"SpywareGuard" -> shortcut to: "C:\Program Files\SpywareGuard\sgmain.exe" [null data]C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st800\dslmon.exe /W" [empty string]"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS]"Spontania Monitor" -> shortcut to: "C:\Documents and Settings\All Users\Application Data\Spontania4IM\spontania4IM.exe" [null data]"Symantec Fax Starter Edition Port" -> shortcut to: "C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXE" [MS]"ZoneAlarm" -> shortcut to: "C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe -nopopup" ["Zone Labs Inc."]Enabled Scheduled Tasks:------------------------"Norton AntiVirus - Scan my computer" -> launches: "C:\PROGRA~1\NORTON~1\NAVW32.exe /task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca" ["Symantec Corporation"]"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\rnr20.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\msafd.dll [MS], 01 - 03, 06 - 17%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------ToolbarsHKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Internet Explorer\Toolbar\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]Extensions (Tools menu items, main toolbar menu buttons)HKCU\Software\Microsoft\Internet Explorer\Extensions\{1462651F-F4BA-4C76-A001-C4284D0FE16E}\"ButtonText" = "Wanadoo""Exec" = "http://www.wanadoo.fr" [file not found]HKLM\Software\Microsoft\Internet Explorer\Extensions\{36ECAF82-3300-8F84-092E-AFF36D6C7040}\"ButtonText" = "Run WinHTTrack""MenuText" = "Launch WinHTTrack""CLSIDExtension" = "{86529161-034E-4F8A-88D2-3C625E612E04}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll" [null data]{85D1F590-48F4-11D9-9669-0800200C9A66}\"MenuText" = "Uninstall BitDefender Online Scanner v8""Exec" = "%windir%\bdoscandel.exe" [null data]Miscellaneous IE Hijack Points------------------------------C:\WINNT\INF\IERESET.INF (used to "Reset Web Settings")Added lines (compared with English-language version):[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"Missing lines (compared with English-language version):[Strings]: 1 lineRunning Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------LexBce Server, LexBceS, "C:\WINNT\system32\LEXBCES.EXE" ["Lexmark International, Inc."]Norton AntiVirus Auto Protect Service, navapsvc, ""C:\Program Files\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"]Norton Unerase Protection, NProtectService, "C:\Program Files\Norton Utilities\NProtect.exe" ["Symantec Corporation"]NVIDIA Display Driver Service, NVSvc, "C:\WINNT\System32\nvsvc32.exe" ["NVIDIA Corporation"]Speed Disk service, Speed Disk service, "C:\Program Files\Speed Disk\nopdb.exe" ["Symantec Corporation"]Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]Système d'événements de COM+, EventSystem, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\es.dll" [null data]}TrueVector Basic Logging Client, minilog, "C:\WINNT\system32\ZoneLabs\minilog.exe -service" ["Zone Labs Inc."]TrueVector Internet Monitor, vsmon, "C:\WINNT\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs Inc."]Webroot Spy Sweeper Engine, svcWRSSSDK, "C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe" ["Webroot Software, Inc."]----------+ This report excludes default entries except where indicated.+ To see *everywhere* the script checks and *everything* it finds,  launch it from a command prompt or a shortcut with the -all parameter.+ To search all directories of local fixed drives for DESKTOP.INI  DLL launch points and all Registry CLSIDs for dormant Explorer Bars,  use the -supp parameter or answer "Yes" at the first message box.---------- (total run time: 46 seconds, including 18 seconds for message boxes)

balltrap34 · Answer

peut tu rechercher se fichier internat.exe  et l analyser ici23 editeur d anti virushttp://www.virustotal.com/xhtml/virustotal_en.htmlclik sur parcourir localise le fichier et clik sur send attend le rapportet donne nous lesi tu en trouve plusieurs fait les tous analyser-----------------------

Utilisateur anonyme · Answer

okjuste une derniere verif, telecharge ce bat ici:http://get.yourfile.net/qy64993.zipdezippe le et lance rsdn.bat, le bloc notes va s'ouvrir, copie et colle le contenu ici

honlo · Answer

voilaThis is a report processed by VirusTotal on 08/26/2005 at 23:53:02 (CET) after scanning the file "internat.exe" file.Antivirus Version Update Result AntiVir 6.31.1.0 08.26.2005 no virus found Avast 4.6.695.0 08.26.2005 no virus found AVG 718 08.26.2005 no virus found Avira 6.31.1.0 08.26.2005 no virus found BitDefender 7.0 08.26.2005 no virus found CAT-QuickHeal 8.00 08.26.2005 no virus found ClamAV devel-20050725 08.26.2005 no virus found DrWeb 4.32b 08.26.2005 no virus found eTrust-Iris 7.1.194.0 08.26.2005 no virus found eTrust-Vet 11.9.1.0 08.26.2005 no virus found Fortinet 2.41.0.0 08.26.2005 no virus found F-Prot 3.16c 08.25.2005 no virus found Ikarus 0.2.59.0 08.26.2005 no virus found Kaspersky 4.0.2.24 08.26.2005 no virus found McAfee 4568 08.26.2005 no virus found NOD32v2 1.1202 08.25.2005 no virus found Norman 5.70.10 08.26.2005 no virus found Panda 8.02.00 08.26.2005 no virus found Sophos 3.97.0 08.26.2005 no virus found Sybari 7.5.1314 08.26.2005 no virus found Symantec 8.0 08.26.2005 no virus found TheHacker 5.8.2.095 08.26.2005 no virus found VBA32 3.10.4 08.26.2005 no virus found

honlo · Answer

Rapport fait à  0:05:10,92 le sam. 27/08/2005Executé à partir de D:\LoGs AuG2005\rdsnOS: Microsoft Windows 2000 [Version 5.00.2195]Recherche processus démarrage...Recherche dossier Internet Explorer... Le volume dans le lecteur D s'appelle Disque local Le num‚ro de s‚rie du volume est 0E45-CA19 R‚pertoire de D:\LoGs AuG2005\rdsnRecherche Recherche presence rdsndin.exe ... non trouvé...

balltrap34 · Answer

celui la il m inquiete

Utilisateur anonyme · Answer

Telecharge: Pocket Killbox icihttp://www.downloads.subratam.org/KillBox.exel'aide détaillé de la manip est téléchargeable ici:http://get.yourfile.net/qn53063.zipou en video ici:http://pageperso.aol.fr/balltrap34/killbox.htm lance hijackthis et supprime:O17 - HKLM\System\CCS\Services\Tcpip\..\{884FA64A-4951-4813-BD12-E05FF1487509}: NameServer = 69.50.176.157,85.255.112.6 O17 - HKLM\System\CCS\Services\Tcpip\..\{C0065321-F2F6-4019-93FA-D7CDED9EEC2E}: NameServer = 69.50.176.157,85.255.112.6 deconnecte toi du netouvre le bloc note et fais un copier coller de ce qui est en gras ci-dessous:REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"=- "System"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion] "Disabled"=- [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionuins] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hclean32.exe"=- Puis enregistrer sous et dans: Nom du fichier, met fix.reg Type de fichier: selectionne "tous les fichiers" clic sur enregistrer ensuite double clic sur fix.reg et accepte de fusionner1- Double-clic sur KillBox.exe2- ouvre le bloc notes et copie la liste en gras ci-dessous3- Selectionne "Delete on Reboot"4- reviens sur le bloc-notes et surligne toute la liste, puis clic droit dessus et clic sur copier5- reviens sur killbox, et dans le menu du haut clic sur File, puis sur paste from clipboard5- clic sur le rond rouge6- une fenetre va apparaitre pour confirmation clic sur OUI7- une seconde fenetre te demande si tu veux redemarrer clic sur OUIliste:C:\WINNT\system32\hclean32.exeC:\WINNT\system32\csywg.exeC:\WINNT\SYSTEM32
tfsnlpa.exe C:\WINNT\System32\CISVVC.EXEC:\WINNT\SYSTEM32\CSVMC.EXE C:\WINNT\SYSTEM32dsndin.exe C:\WINNT\SYSTEM32\gpsresl32.exeC:\WINNT\SYSTEM32\LOADCTR.EXE C:\WINNT\SYSTEM32\DRV2CLTR.DLLC:\WINNT\RDT.INIC:\WINNT\SYSTEM32\__delete_on_reboot__ntfsnlpa.exeC:\WINNT\balloon.wavC:\WINNT\system32\gpsresl32.exe C:\WINNT\SYSTEM32\GPSRESL.EXE C:\WINNT\System32\pxpcya64.exe  C:\WINNT\SYSTEM32\loadctr32.exetous ne sont peut etre pas présent, killbox fera le tri, si le pc ne redemarre pas tout seul, redemarre le manuellement, ensuite reposte un hijack + un silentrunners

balltrap34 · Answer

moe ou ta pecher cette liste?

Utilisateur anonyme · Answer

j'ai écumé pas mal de forums sur cette saleté et à chaque fois c'est les memes qui reviennent, d'habitude, ils sont pas tous là à la fois, mais j'ai fais une liste + celui qu'on trouve dans silentrunner (celui que tu voulais lui faire analyser), qui change de nom à chaque redemarragepour le reg il faut que je retrouve le lien

honlo · Answer

je n'ai pas compris a quel endroit je devais enregistrer le fichier fix.reg ,dans quel dossier?

balltrap34 · Answer

te prend pas la tete c est bon

Utilisateur anonyme · Answer

tu l'enregistre sur le bureau et tu le lance

honlo · Answer

voila g tout fait je crois:les nouveaux logs:HJ:Logfile of HijackThis v1.99.1Scan saved at 00:45:53, on 27/08/2005Platform: Windows 2000 SP4 (WinNT 5.00.2195)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\csrss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\LEXBCES.EXEC:\WINNT\system32\spoolsv.exeC:\WINNT\system32\LEXPPS.EXEC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINNT\System32\svchost.exeC:\Program Files\Norton AntiVirus\navapsvc.exeC:\Program Files\Norton Utilities\NProtect.exeC:\WINNT\System32\nvsvc32.exeC:\WINNT\system32\regsvc.exeC:\WINNT\system32\MSTask.exeC:\Program Files\Speed Disk\nopdb.exeC:\WINNT\system32\stisvc.exeC:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeC:\WINNT\Explorer.EXEC:\WINNT\system32\ZoneLabs\vsmon.exeC:\WINNT\System32\WBEM\WinMgmt.exeC:\WINNT\system32\svchost.exeC:\WINNT\System32\svchost.exeC:\WINNT\system32\ZoneLabs\minilog.exeC:\WINNT\htpatch.exeC:\PROGRA~1\Wanadoo\CnxMon.exeC:\PROGRA~1\MESSAG~1\Demon.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\BillP Studios\WinPatrol\winpatrol.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeC:\WINNT\system32\internat.exeC:\Program Files\SAGEM\SAGEM F@st800\dslmon.exeC:\Documents and Settings\All Users\Application Data\Spontania4IM\spontania4IM.exeC:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXEC:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exeC:\Program Files\SpywareGuard\sgmain.exeC:\Program Files\SpywareGuard\sgbhp.exeC:\WINNT\system32\wuauclt.exeC:\WINNT\system32\NOTEPAD.EXED:\LoGs AuG2005\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logonO4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exeO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exeO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [Demon] C:\PROGRA~1\MESSAG~1\Demon.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [LXBLKsk] C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exeO4 - HKLM\..\Run: [MemoryCardManager] C:\Program Files\Lexmark\Lexmark Photo Center\MemoryCardManager.exe -startupO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXEO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exeO4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exeO4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintrayO4 - HKCU\..\Run: [internat.exe] internat.exeO4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st800\dslmon.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Spontania Monitor.lnk = C:\Documents and Settings\All Users\Application Data\Spontania4IM\spontania4IM.exeO4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXEO4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dllO9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cabO16 - DPF: Interface Chat Wanadoo - http://chat4.x-echo.com/version6/Applet/wchatsign.cabO16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cabO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cabO16 - DPF: {2D37B9E8-C14C-482C-B1CF-939C5440E179} (VTToolkit Control) - http://videomessages.wanadoo.fr/VTToolkit.ocxO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cabO16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cabO16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cabO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXEO23 - Service: TrueVector Basic Logging Client (minilog) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\minilog.exeO23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NProtect.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exeO23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exeSR:"Silent Runners.vbs", revision 40, http://www.silentrunners.org/Operating System: Windows 2000Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"internat.exe" = "internat.exe" [MS]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++}"notepad.exe" = (empty string)HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"Synchronization Manager" = "mobsync.exe /logon" [MS]"HTpatch" = "C:\WINNT\htpatch.exe" [null data]"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]"NvCplDaemon" = "RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup" [MS]"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]"NeroCheck" = "C:\WINNT\System32\NeroCheck.exe" ["Ahead Software Gmbh"]"WooCnxMon" = "C:\PROGRA~1\Wanadoo\CnxMon.exe" [empty string]"Demon" = "C:\PROGRA~1\MESSAG~1\Demon.exe" ["France Telecom"]"WOOWATCH" = "C:\PROGRA~1\Wanadoo\Watch.exe" ["France Télécom R&D"]"WOOTASKBARICON" = "C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" ["France Télécom R&D"]"LXBLKsk" = "C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exe" [" "]"MemoryCardManager" = "C:\Program Files\Lexmark\Lexmark Photo Center\MemoryCardManager.exe -startup" [null data]"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]"ccRegVfy" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"" ["Symantec Corporation"]"Advanced Tools Check" = "C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE" ["Symantec Corporation"]"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe" ["Symantec Corporation"]"SSC_UserPrompt" = "C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe" ["Symantec Corporation"]"MessengerPlus3" = ""C:\Program Files\MessengerPlus! 3\MsgPlus.exe"" ["Patchou"]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"WinPatrol" = "C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" ["BillP Studios"]"SpySweeper" = ""C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray" ["Webroot Software, Inc."]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]{4A368E80-174F-4872-96B5-0B27DDD11DB2}\(Default) = "SpywareGuard Download Protection"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\SpywareGuard\dlprotect.dll" [null data]{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"  -> {CLSID}\InProcServer32\(Default) = "C:\WINNT\System32\hticons.dll" ["Hilgraeve, Inc."]"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"  -> {CLSID}\InProcServer32\(Default) = "C:\WINNT\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINNT\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINNT\system32\nvshell.dll" ["NVIDIA Corporation"]"{CA5FEE26-14C1-4B5A-86E9-233FC0EE2682}" = "IZArc DragDrop Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]"{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}" = "IZArc Shell Context Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]"{3c249f62-e26e-11d4-97f0-009027769c61}" = "Format Shell"  -> {CLSID}\InProcServer32\(Default) = "C:\WINNT\System32\SMSHELL.DLL" ["OnSpec Electronic, Inc."]"{03FF3962-D823-11D4-97F0-009027769C61}" = "Data Caching Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\WINNT\System32\FlashShl.dll" [" "]"{59850401-6664-101B-B21C-00AA004BA90B}" = "Microsoft Office Binder Unbind"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\1036\UNBIND.DLL" [MS]"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{516EC4D3-4AD9-11D5-AA6A-00E0189008B3}" = "The Core Media Player Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\CORECO~1\THECOR~1\System\CORESH~1.CLL" [null data]"{81559C35-8464-49F7-BB0E-07A383BEF910}" = "SpywareGuard.Handler" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\SpywareGuard\spywareguard.dll" [null data]"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" = "Webroot Spy Sweeper Context Menu Integration"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."]"{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}" = "SnagIt"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll" ["TechSmith Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\INFECTION WARNING! "{81559C35-8464-49F7-BB0E-07A383BEF910}" = "SpywareGuard.Handler" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\SpywareGuard\spywareguard.dll" [null data]HKLM\Software\Classes\*\shellex\ContextMenuHandlers\IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\CoreShellAgent\(Default) = "{516EC4D3-4AD9-11D5-AA6A-00E0189008B3}"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\CORECO~1\THECOR~1\System\CORESH~1.CLL" [null data]IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\SpySweeper\(Default) = "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."]Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]Active Desktop and Wallpaper:-----------------------------Active Desktop is enabled at this entry:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellStateHKCU\Software\Microsoft\Internet Explorer\Desktop\General\"Wallpaper" = "C:\WINNT\ACD Wallpaper.cmp"Startup items in "Indi1" & "All Users" startup folders:-------------------------------------------------------C:\Documents and Settings\Indi1\Menu Démarrer\Programmes\Démarrage"Adobe Gamma Loader.exe" -> shortcut to: "C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]"SpywareGuard" -> shortcut to: "C:\Program Files\SpywareGuard\sgmain.exe" [null data]C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st800\dslmon.exe /W" [empty string]"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS]"Spontania Monitor" -> shortcut to: "C:\Documents and Settings\All Users\Application Data\Spontania4IM\spontania4IM.exe" [null data]"Symantec Fax Starter Edition Port" -> shortcut to: "C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXE" [MS]"ZoneAlarm" -> shortcut to: "C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe -nopopup" ["Zone Labs Inc."]Enabled Scheduled Tasks:------------------------"Norton AntiVirus - Scan my computer" -> launches: "C:\PROGRA~1\NORTON~1\NAVW32.exe /task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca" ["Symantec Corporation"]"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\rnr20.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\msafd.dll [MS], 01 - 03, 06 - 17%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------ToolbarsHKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Internet Explorer\Toolbar\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]Extensions (Tools menu items, main toolbar menu buttons)HKCU\Software\Microsoft\Internet Explorer\Extensions\{1462651F-F4BA-4C76-A001-C4284D0FE16E}\"ButtonText" = "Wanadoo""Exec" = "http://www.wanadoo.fr" [file not found]HKLM\Software\Microsoft\Internet Explorer\Extensions\{36ECAF82-3300-8F84-092E-AFF36D6C7040}\"ButtonText" = "Run WinHTTrack""MenuText" = "Launch WinHTTrack""CLSIDExtension" = "{86529161-034E-4F8A-88D2-3C625E612E04}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll" [null data]{85D1F590-48F4-11D9-9669-0800200C9A66}\"MenuText" = "Uninstall BitDefender Online Scanner v8""Exec" = "%windir%\bdoscandel.exe" [null data]Miscellaneous IE Hijack Points------------------------------C:\WINNT\INF\IERESET.INF (used to "Reset Web Settings")Added lines (compared with English-language version):[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"Missing lines (compared with English-language version):[Strings]: 1 lineRunning Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------LexBce Server, LexBceS, "C:\WINNT\system32\LEXBCES.EXE" ["Lexmark International, Inc."]Norton AntiVirus Auto Protect Service, navapsvc, ""C:\Program Files\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"]Norton Unerase Protection, NProtectService, "C:\Program Files\Norton Utilities\NProtect.exe" ["Symantec Corporation"]NVIDIA Display Driver Service, NVSvc, "C:\WINNT\System32\nvsvc32.exe" ["NVIDIA Corporation"]Speed Disk service, Speed Disk service, "C:\Program Files\Speed Disk\nopdb.exe" ["Symantec Corporation"]Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]Système d'événements de COM+, EventSystem, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\es.dll" [null data]}TrueVector Basic Logging Client, minilog, "C:\WINNT\system32\ZoneLabs\minilog.exe -service" ["Zone Labs Inc."]TrueVector Internet Monitor, vsmon, "C:\WINNT\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs Inc."]Webroot Spy Sweeper Engine, svcWRSSSDK, "C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe" ["Webroot Software, Inc."]----------+ This report excludes default entries except where indicated.+ To see *everywhere* the script checks and *everything* it finds,  launch it from a command prompt or a shortcut with the -all parameter.+ To search all directories of local fixed drives for DESKTOP.INI  DLL launch points and all Registry CLSIDs for dormant Explorer Bars,  use the -supp parameter or answer "Yes" at the first message box.---------- (total run time: 38 seconds, including 18 seconds for message boxes)

Utilisateur anonyme · Answer

tu peux poster un hijack fait en etant connecté, pour verifier les 017

honlo · Answer

voila:Logfile of HijackThis v1.99.1Scan saved at 01:05:02, on 27/08/2005Platform: Windows 2000 SP4 (WinNT 5.00.2195)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\csrss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\LEXBCES.EXEC:\WINNT\system32\spoolsv.exeC:\WINNT\system32\LEXPPS.EXEC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINNT\System32\svchost.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton Utilities\NProtect.exeC:\WINNT\System32
vsvc32.exeC:\WINNT\system32egsvc.exeC:\WINNT\system32\MSTask.exeC:\Program Files\Speed Disk
opdb.exeC:\WINNT\system32\stisvc.exeC:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeC:\WINNT\Explorer.EXEC:\WINNT\system32\ZoneLabs\vsmon.exeC:\WINNT\System32\WBEM\WinMgmt.exeC:\WINNT\system32\svchost.exeC:\WINNT\System32\svchost.exeC:\WINNT\system32\ZoneLabs\minilog.exeC:\WINNT\htpatch.exeC:\PROGRA~1\Wanadoo\CnxMon.exeC:\PROGRA~1\MESSAG~1\Demon.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\BillP Studios\WinPatrol\winpatrol.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeC:\WINNT\system32\internat.exeC:\Program Files\SAGEM\SAGEM F@st800\dslmon.exeC:\Documents and Settings\All Users\Application Data\Spontania4IM\spontania4IM.exeC:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXEC:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exeC:\Program Files\SpywareGuard\sgmain.exeC:\Program Files\SpywareGuard\sgbhp.exeC:\WINNT\system32\wuauclt.exeC:\PROGRA~1\Wanadoo\EspaceWanadoo.exeC:\PROGRA~1\Wanadoo\ComComp.exeC:\Program Files\Crazy Browser\Crazy Browser.exeC:\PROGRA~1\Wanadoo\Watch.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Outlook Express\msimn.exeD:\LoGs AuG2005\bsplayer132\bsplayer.exeD:\LoGs AuG2005\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logonO4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exeO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exeO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [Demon] C:\PROGRA~1\MESSAG~1\Demon.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [LXBLKsk] C:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exeO4 - HKLM\..\Run: [MemoryCardManager] C:\Program Files\Lexmark\Lexmark Photo Center\MemoryCardManager.exe -startupO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXEO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exeO4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exeO4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintrayO4 - HKCU\..\Run: [internat.exe] internat.exeO4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st800\dslmon.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Spontania Monitor.lnk = C:\Documents and Settings\All Users\Application Data\Spontania4IM\spontania4IM.exeO4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXEO4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dllO9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cabO16 - DPF: Interface Chat Wanadoo - http://chat4.x-echo.com/version6/Applet/wchatsign.cabO16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cabO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cabO16 - DPF: {2D37B9E8-C14C-482C-B1CF-939C5440E179} (VTToolkit Control) - http://videomessages.wanadoo.fr/VTToolkit.ocxO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cabO16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cabO16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{A0559B99-064D-4D49-8C48-856E8482C980}: NameServer = 80.10.246.130 80.10.246.3O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXEO23 - Service: TrueVector Basic Logging Client (minilog) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\minilog.exeO23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NProtect.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32
vsvc32.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk
opdb.exeO23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

je vois plus rien de suspect, et de ton coté, il y a du mieux ?est ce que tu arrive à faire un scan chez bitdef ?

honlo · Answer

impossible pour bitdef ,toujours le meme message:this website is not authorized to host this activx. controlje vais tenter de lancer firefox et une page internet independante pour voir si g de nouveau norton qui s'active...j'essaye de passer par firefox pour bitdefmerci de t'interesser a mon cas ;-)

honlo · Answer

par firefox, il me dit que jai besoin d'une version equivalente ou sup a IE4 pour un scan online , je suis a IE6 , comprends pas.pour l'instant , jai lancé IE (hors crazy) et firefox, jai pas de reveil de Norton. il faut que je relance ca demain et voir si ca delire de nouveau (la premiere fois que javais utilisé killbox javais eu qq heures de repit et puis tout avait foiré de nouveau...)par curiosité , quelle est l'action du fichier fix.reg ? et tu m'as fait supprimé les 2 lignes 017 dans HJ log, que representaient elles?j'essaye d'y comprendre qq chose meme si je sais etre largué grave dans ce domaine..merci de ton aide

Utilisateur anonyme · Answer

les 017, correspondent à ta connection (adresse ip fai et dns), elles avaient été modifiés par celle ci 69.50.176.157http://www.dnsstuff.com/tools/whois.ch?ip=69.50.176.157qui correspond à atrivo (alias coolwebsearch).pour le reg il enleve hclean32.exe du demarrage + un autre exe qui n'apparait pas dans hijack mais qu'on peut reperer avec silentrunner et 2 autres entréeje pense que tout ca est lié à wareout, vérifie dans c:\program file s'il y a des prog que tu ne connais pas ou qui te paraissent suspectspour le scan avec ie, essaye:ie > outils >options internet >securitéclic sur la zone internet et clic sur niveau par defautvalidereferme ie et reouvre lereessaye de lancer le scanj'arrete pour ce soir, je repasse demain pour la suitea++

honlo · Answer

dans tous les cas, impossible de lancer un scan bitdefmerci pour les explicationsgoodnight@+

balltrap34 · Answer

salut a tu essayer se lien pour defenderScan bit defenderhttp://www.bitdefender.frclik sur scan on line a gauche et suis la procedure

honlo · Answer

c le lien que j'ai suivi sans succes , jai toujours droit au meme message.cependant je tiens a signaler a moe que depuis 24 heures en lançant firefox et IE sans passer par firefox je n'ai norton qui s'excite en me signalant ce que j'ai indiqué en debut de topic.donc( si ca tient )..., un million de merci a moe pour son aide !! et a toi aussi balltrap pour vous etre penché sur mon probleme; si ca derive a nouveau dans les jours qui viennent je vous tient au courant..ya le sens de l'entraide sur ce site.. ;-))

balltrap34 · Answer

j est du mal a comprendre tu lance IE en passent par firefox????????

honlo · Answer

non pas du tout ,en fait j'utilise crazy browser qui meme etant juste un cache sur IE fonctionne parfaitement. le probleme venait lorsque je cliquai par exemple sur la boite courrier sur msn une fenetre de IE se lancait independamment et =probleme hclean et autres , idem lorsque je lancais firefox qui pourtant a ce que je crois est independant de IE , et bien memes soucis ! chaque fois que je cliquai sur l'icone IE et que j'avais une page flottante de IE yavait un bleme ...jespere que je suis clair , je connais pas trop de terme technique pour expliquer sorry..

Utilisateur anonyme · Answer

salut honloest ce que tu ne peux faire aucuns scan av en ligne ou est ce que c'est juste chez bitdef que ca coince ?a+

honlo · Answer

salut moescan av ? si jessaye de faire le scan par firefox j'ai ça:il me demande une version IE4 ou sup (jai la version 6 deja)si jessaye par crazy ca donne:this website is not authorized to host this activx. control

Utilisateur anonyme · Answer

salutscan av= scan antivirus en ligneessaye ici pour voir:http://webscanner.kaspersky.fr/apres le chargement du control active X, clic sur suivantpuis clic sur configuration et choisis "étendue"Choisis l'analyse répertoire et choisis ton ou tes disques dursposte le rapport du scana+

balltrap34 · Answer

je ne connait pas  crazy mais il ny aurait pas dedans une option qui bloque les actives x

honlo · Answer

le scan de kaspersy..(!!!):------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Sunday, August 28, 2005 12:36:40 Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 28/08/2005 Kaspersky Anti-Virus database records: 145961-------------------------------------------------------------------------------Scan Settings:	Scan using the following antivirus database: extended	Scan Archives: true	Scan Mail Bases: trueScan Target - Folders:	C:\Scan Statistics:	Total number of scanned objects: 34851	Number of viruses found: 46	Number of infected objects: 236	Number of suspicious objects: 1	Duration of the scan process: 2060 secInfected Object Name - Virus NameC:\Program Files\Norton AntiVirus\Quarantine\001F09EF.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\00B05D97.exe	Infected: Trojan-Downloader.Win32.Agent.kiC:\Program Files\Norton AntiVirus\Quarantine\01934CDF.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\0205643F	Infected: Trojan.Win32.Qhost.qrC:\Program Files\Norton AntiVirus\Quarantine\021D24DA.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\02614CCD.exe	Infected: Trojan-Downloader.Win32.Small.uvC:\Program Files\Norton AntiVirus\Quarantine\0290517C.htm	Infected: Exploit.HTML.MhtC:\Program Files\Norton AntiVirus\Quarantine\03A150DA.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\03A47AD6.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\03CC25D7.htm	Infected: Trojan.HTML.StartPage.iC:\Program Files\Norton AntiVirus\Quarantine\040A4A00.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\0414457F.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\043C2CD2.htm	Infected: Exploit.HTML.MhtC:\Program Files\Norton AntiVirus\Quarantine\044056CF.htm	Infected: Exploit.VBS.Phel.aC:\Program Files\Norton AntiVirus\Quarantine\044954C4.exe	Infected: Trojan-Downloader.Win32.Agent.hzC:\Program Files\Norton AntiVirus\Quarantine\04607AAB.htm	Infected: Exploit.VBS.Phel.aC:\Program Files\Norton AntiVirus\Quarantine\04772092.exe	Infected: Trojan-Downloader.Win32.Agent.hzC:\Program Files\Norton AntiVirus\Quarantine\04772092.gif	Infected: Trojan-Downloader.Win32.Agent.hzC:\Program Files\Norton AntiVirus\Quarantine\04C21250.exe	Infected: Trojan-Downloader.Win32.Small.aodC:\Program Files\Norton AntiVirus\Quarantine\04EC3421.exe	Infected: Trojan-Downloader.Win32.Small.aodC:\Program Files\Norton AntiVirus\Quarantine\04F52A36.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\063809F7.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\0684429E.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\06915C51.exe	Infected: Trojan-Downloader.Win32.Small.aodC:\Program Files\Norton AntiVirus\Quarantine\0695064E.exe	Infected: Trojan-Downloader.Win32.Small.aodC:\Program Files\Norton AntiVirus\Quarantine\0699765A.htm	Infected: Trojan.HTML.StartPage.iC:\Program Files\Norton AntiVirus\Quarantine\07370F45.exe	Infected: Trojan-Downloader.Win32.Zlob.gC:\Program Files\Norton AntiVirus\Quarantine\073A7427.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\07963633.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\08645668.exe	Infected: Trojan-Downloader.Win32.Small.aodC:\Program Files\Norton AntiVirus\Quarantine\08B72A2F.htm	Infected: Trojan.HTML.StartPage.iC:\Program Files\Norton AntiVirus\Quarantine\08C90427.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\08D437C5.exe	Infected: Trojan-Downloader.Win32.WarSpy.dC:\Program Files\Norton AntiVirus\Quarantine\08D761C1.jar/BlackBox.class	Infected: Exploit.Java.ByteVerifyC:\Program Files\Norton AntiVirus\Quarantine\08D761C1.jar/VerifierBug.class	Infected: Exploit.Java.ByteVerifyC:\Program Files\Norton AntiVirus\Quarantine\08D761C1.jar/Beyond.class	Infected: Trojan-Downloader.Java.OpenConnection.aaC:\Program Files\Norton AntiVirus\Quarantine\08D761C1.jar	Infected: Trojan-Downloader.Java.OpenConnection.aaC:\Program Files\Norton AntiVirus\Quarantine\09AC653D.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\09B30CD6	Infected: Trojan-PSW.Win32.Agent.amC:\Program Files\Norton AntiVirus\Quarantine\0A526C67.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\0A686C7A.exe	Infected: Trojan-Downloader.Win32.WarSpy.hC:\Program Files\Norton AntiVirus\Quarantine\0A744853.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\0AB85302.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\0ACF263F.htm	Infected: Exploit.VBS.Phel.aC:\Program Files\Norton AntiVirus\Quarantine\0C8E1154.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\0C9F3DAD.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\0CCA046B.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\0F0F23BA.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\1224222D	Infected: Trojan.Win32.Qhost.qrC:\Program Files\Norton AntiVirus\Quarantine\13E65DAD.exe	Infected: Trojan-Downloader.Win32.Agent.kiC:\Program Files\Norton AntiVirus\Quarantine\140A41B8.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\14B108CE.htm	Suspicious: Exploit.HTML.MhtC:\Program Files\Norton AntiVirus\Quarantine\15436920.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\166E3B29.htm	Infected: Trojan.HTML.StartPage.iC:\Program Files\Norton AntiVirus\Quarantine\16777A46.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\16846110.exe	Infected: Trojan-Downloader.Win32.Small.aodC:\Program Files\Norton AntiVirus\Quarantine\16A82EE8.exe	Infected: Trojan-Downloader.Win32.Small.aodC:\Program Files\Norton AntiVirus\Quarantine\18D177CE	Infected: Trojan.Java.ClassLoader.Dummy.aC:\Program Files\Norton AntiVirus\Quarantine\1943240B.htm	Infected: Trojan.HTML.StartPage.iC:\Program Files\Norton AntiVirus\Quarantine\1A4A5645	Infected: Trojan.Win32.Qhost.qrC:\Program Files\Norton AntiVirus\Quarantine\1A4C78DE	Infected: Trojan-Downloader.Java.OpenConnection.vC:\Program Files\Norton AntiVirus\Quarantine\1C6510C2.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\1D756C4C.exe	Infected: Trojan-Downloader.Win32.Agent.kiC:\Program Files\Norton AntiVirus\Quarantine\1E6839C0.htm	Infected: Exploit.HTML.MhtC:\Program Files\Norton AntiVirus\Quarantine\1E7137B6.exe	Infected: Trojan-Downloader.Win32.Small.uvC:\Program Files\Norton AntiVirus\Quarantine\1E7561B2.exe	Infected: Trojan-Downloader.Win32.Small.uvC:\Program Files\Norton AntiVirus\Quarantine\1F554587.htm	Infected: Exploit.VBS.Phel.aC:\Program Files\Norton AntiVirus\Quarantine\20085BEC.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\20563087.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\20D427C3.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\21156F7C.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\21191978.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\214B7B3B.exe	Infected: Trojan-Downloader.Win32.Agent.kiC:\Program Files\Norton AntiVirus\Quarantine\21CA61EA.exe	Infected: Backdoor.Win32.Rbot.genC:\Program Files\Norton AntiVirus\Quarantine\23E25F2E.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\246B1BC3.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\246E45C0.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\24716FBC.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\25255589.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\25995E31.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\26D0326C.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\27295B0C.htm	Infected: Exploit.HTML.MhtC:\Program Files\Norton AntiVirus\Quarantine\27C62280	Infected: Trojan.Java.ClassLoader.cC:\Program Files\Norton AntiVirus\Quarantine\2B071CCA.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\2B0B46C6.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\2C5549A7.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\2DE10A1B.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\2E0776B7.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\2E10259D.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\2E2315AD.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\2E3512B7.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\2E383CB4.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\302C38FC.com	Infected: Trojan-Downloader.Win32.Delf.ksC:\Program Files\Norton AntiVirus\Quarantine\302F62F8.exe	Infected: Trojan-Downloader.Win32.Delf.ksC:\Program Files\Norton AntiVirus\Quarantine\30320CF5.com	Infected: Trojan-Downloader.Win32.Delf.ksC:\Program Files\Norton AntiVirus\Quarantine\303960ED.exe	Infected: Trojan-Downloader.Win32.Delf.ksC:\Program Files\Norton AntiVirus\Quarantine\30B13F22.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\3242340F.exe	Infected: Trojan-Downloader.Win32.Small.aodC:\Program Files\Norton AntiVirus\Quarantine\3318167B.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\33935082.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\33EB4798.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\34967E1D.htm	Infected: Exploit.VBS.Phel.aC:\Program Files\Norton AntiVirus\Quarantine\36D4328B.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\37017FBE	Infected: Trojan-Downloader.Win32.Small.asyC:\Program Files\Norton AntiVirus\Quarantine\3814220B.exe	Infected: Trojan-Downloader.Win32.Zlob.iC:\Program Files\Norton AntiVirus\Quarantine\384747B1.htm	Infected: Trojan.HTML.StartPage.iC:\Program Files\Norton AntiVirus\Quarantine\38B940C8.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\391D21CF.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\3A3D3229.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\3AB40FAC	Infected: Trojan-Downloader.Win32.Agent.qhC:\Program Files\Norton AntiVirus\Quarantine\3C016846.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\3C051242.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\3C667EF4.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\3C996ECE.exe	Infected: Trojan-Downloader.Win32.Small.uvC:\Program Files\Norton AntiVirus\Quarantine\3D9301C1.exe	Infected: P2P-Worm.Win32.Tibick.dC:\Program Files\Norton AntiVirus\Quarantine\3F4603EF.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\3F492DEB.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\3F7858E6.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\3F7B02E3.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\40544BBB.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\42237F51.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\45D54E42.exe	Infected: Trojan-Downloader.Win32.WarSpy.dC:\Program Files\Norton AntiVirus\Quarantine\46E31AD9.exe	Infected: Trojan-Downloader.Win32.WarSpy.dC:\Program Files\Norton AntiVirus\Quarantine\47087E1B.exe	Infected: Trojan-Downloader.Win32.Agent.kiC:\Program Files\Norton AntiVirus\Quarantine\47ED55D7.htm	Infected: Trojan.HTML.StartPage.iC:\Program Files\Norton AntiVirus\Quarantine\491B7061.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\49EE1A28.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\4C0067F6.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\4CC44585.exe	Infected: P2P-Worm.Win32.Tibick.dC:\Program Files\Norton AntiVirus\Quarantine\4D216A2B.exe	Infected: Trojan-Downloader.Win32.Small.awaC:\Program Files\Norton AntiVirus\Quarantine\4E1D26EE.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\4E51200F	Infected: Worm.Win32.Lovesan.aC:\Program Files\Norton AntiVirus\Quarantine\4E7226F4.jar/BlackBox.class	Infected: Exploit.Java.ByteVerifyC:\Program Files\Norton AntiVirus\Quarantine\4E7226F4.jar/VerifierBug.class	Infected: Exploit.Java.ByteVerifyC:\Program Files\Norton AntiVirus\Quarantine\4E7226F4.jar/Beyond.class	Infected: Trojan-Downloader.Java.OpenConnection.aaC:\Program Files\Norton AntiVirus\Quarantine\4E7226F4.jar	Infected: Trojan-Downloader.Java.OpenConnection.aaC:\Program Files\Norton AntiVirus\Quarantine\4E916226.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\4F9402D8.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\511A7C67.htm	Infected: Trojan.HTML.StartPage.iC:\Program Files\Norton AntiVirus\Quarantine\51AC31DA.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\52CD1A26.exe	Infected: Trojan.Win32.SpoofDNS.bC:\Program Files\Norton AntiVirus\Quarantine\54AB2C5F.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\553572B3.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\554879BC.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\55657F83.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\55D13A7A.exe	Infected: Trojan-Downloader.Win32.Small.asyC:\Program Files\Norton AntiVirus\Quarantine\55F97485.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\5600487E.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\56C84BED.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\574E0559.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\576E2936.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\57B31AEA.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\57EB64AD.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\57F138A6.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\586A7EF8.exe	Infected: Trojan-Downloader.Win32.Small.axpC:\Program Files\Norton AntiVirus\Quarantine\58BC3178.exe	Infected: Trojan-Downloader.Win32.Small.aodC:\Program Files\Norton AntiVirus\Quarantine\58C455E1.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\590C79C2.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\5A121C4E.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\5A16464A.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\5AB132CF.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\5AEC636D.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\5B011547.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\5B2920F6.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\5BEC6445.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\5C741BF4.htm	Infected: Exploit.VBS.Phel.aC:\Program Files\Norton AntiVirus\Quarantine\5CE32BC7.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\5D337070.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\5D532390.exe	Infected: Trojan-Downloader.Win32.Small.awaC:\Program Files\Norton AntiVirus\Quarantine\5D532390.jar/BlackBox.class	Infected: Exploit.Java.ByteVerifyC:\Program Files\Norton AntiVirus\Quarantine\5D532390.jar/VerifierBug.class	Infected: Exploit.Java.ByteVerifyC:\Program Files\Norton AntiVirus\Quarantine\5D532390.jar/Beyond.class	Infected: Trojan-Downloader.Java.OpenConnection.aaC:\Program Files\Norton AntiVirus\Quarantine\5D532390.jar	Infected: Trojan-Downloader.Java.OpenConnection.aaC:\Program Files\Norton AntiVirus\Quarantine\5D564D8D.exe	Infected: Trojan-Downloader.Win32.Small.awaC:\Program Files\Norton AntiVirus\Quarantine\5DE07C1F.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\5E871A8B.jar/BlackBox.class	Infected: Exploit.Java.ByteVerifyC:\Program Files\Norton AntiVirus\Quarantine\5E871A8B.jar/VerifierBug.class	Infected: Exploit.Java.ByteVerifyC:\Program Files\Norton AntiVirus\Quarantine\5E871A8B.jar/Beyond.class	Infected: Trojan-Downloader.Java.OpenConnection.aaC:\Program Files\Norton AntiVirus\Quarantine\5E871A8B.jar	Infected: Trojan-Downloader.Java.OpenConnection.aaC:\Program Files\Norton AntiVirus\Quarantine\5E874CC8.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\60FD6B47.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\616F28C9.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\61AE1F5F.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\636A53AA.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\650A7F02.exe	Infected: Trojan-Downloader.Win32.Small.uvC:\Program Files\Norton AntiVirus\Quarantine\66620F1D.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\66653919.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\67335FDC.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\673609D8.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\68143EC2.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\689608B4.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\68B43A34.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\69500E4B.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\69543847.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\6A21444F.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\6A986314.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\6B464D8C.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\6C5E1267.htm	Infected: Exploit.HTML.MhtC:\Program Files\Norton AntiVirus\Quarantine\6C9C3023.dll	Infected: Trojan.Win32.StartPage.xbC:\Program Files\Norton AntiVirus\Quarantine\6CCF3E86.htm	Infected: Trojan-Downloader.JS.genC:\Program Files\Norton AntiVirus\Quarantine\6D647C7B.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\6D7F7F8A.exe	Infected: Trojan-Downloader.Win32.Small.uvC:\Program Files\Norton AntiVirus\Quarantine\6D8A73EE.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\6E5C70BE.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\6ED75E2E.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\6FB359EE.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\70465E82	Infected: Exploit.Java.BytverifyC:\Program Files\Norton AntiVirus\Quarantine\70B1785C.dll	Infected: Trojan-Spy.Win32.Banker.mgC:\Program Files\Norton AntiVirus\Quarantine\7116025C.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\71827776.dll	Infected: Trojan-Downloader.Win32.Small.aqeC:\Program Files\Norton AntiVirus\Quarantine\71C01532.exe	Infected: Trojan.Win32.StartPage.vtC:\Program Files\Norton AntiVirus\Quarantine\724F11C0.tmp	Infected: Trojan-Downloader.Win32.Small.vqC:\Program Files\Norton AntiVirus\Quarantine\73305EA1.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\733736C1.tmp	Infected: Trojan-Downloader.Win32.Small.vqC:\Program Files\Norton AntiVirus\Quarantine\73A9681A.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\7471303C	Infected: Trojan-Dropper.Win32.Small.wiC:\Program Files\Norton AntiVirus\Quarantine\78647C7D.exe	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\7867267A.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\786B5076.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\Program Files\Norton AntiVirus\Quarantine\79C44754	Infected: Trojan.Win32.Small.fbC:\Program Files\Norton AntiVirus\Quarantine\7B4667E7.jar/BlackBox.class	Infected: Exploit.Java.ByteVerifyC:\Program Files\Norton AntiVirus\Quarantine\7B4667E7.jar/VerifierBug.class	Infected: Exploit.Java.ByteVerifyC:\Program Files\Norton AntiVirus\Quarantine\7B4667E7.jar/Beyond.class	Infected: Trojan-Downloader.Java.OpenConnection.aaC:\Program Files\Norton AntiVirus\Quarantine\7B4667E7.jar	Infected: Trojan-Downloader.Java.OpenConnection.aaC:\Program Files\Norton AntiVirus\Quarantine\7BD75017	Infected: Trojan-Dropper.Win32.Agent.gpC:\Program Files\Norton AntiVirus\Quarantine\7E681C65.exe	Infected: Trojan-Clicker.Win32.Agent.dbC:\WINNT\addld32.exe	Infected: Trojan-Downloader.Win32.Agent.bqC:\WINNT\system32\fixmapirs.exe	Infected: not-a-virus:AdWare.FindSpy.aC:\WINNT\system32\loadctr.exe/data0006	Infected: Trojan-Dropper.Win32.Small.zxC:\WINNT\system32\loadctr.exe	Infected: Trojan-Dropper.Win32.Small.zxC:\WINNT\system32\msad32.dll	Infected: Trojan-Downloader.Win32.Agent.bcC:\WINNT\system32\msvcrta.dll	Infected: Trojan.Win32.Agent.qC:\WINNT\system32
tfsnlpa.exe	Infected: not-a-virus:AdWare.Msnagent.bC:\WINNT\system32dsndin.exe	Infected: not-a-virus:AdWare.FindSpy.aC:\WINNT\system32\vbsys2.dll	Infected: Trojan-Clicker.Win32.Agent.acC:\WINNT\system32\winlogon32.dll	Infected: Trojan-Downloader.Win32.Small.aldC:\WINNT\{78E765E2-4A9E-4650-9D15-FB7A8825C1F8}.dat:vzoif:$DATA	Infected: Trojan-Downloader.Win32.Agent.bqScan process completed.

balltrap34 · Answer

salutceux ci tu les suppr en sans echecC:\WINNT\addld32.exe C:\WINNT\system32\fixmapirs.exe C:\WINNT\system32\loadctr.exe/data0006C:\WINNT\system32\loadctr.exe C:\WINNT\system32\msad32.dll C:\WINNT\system32\msvcrta.dll C:\WINNT\system32
tfsnlpa.exeC:\WINNT\system32dsndin.exe C:\WINNT\system32\vbsys2.dllC:\WINNT\system32\winlogon32.dllC:\WINNT\{78E765E2-4A9E-4650-9D15-FB7A8825C1F8}.les autres sont dans la quarantaines de norton vide la

honlo · Answer

voila c faitjai tout supp sauf ces 2 là ,introuvables meme dans le registre:C:\WINNT\system32\loadctr.exe/data0006C:\WINNT\{78E765E2-4A9E-4650-9D15-FB7A8825C1F8}.egalement g vidé l'historique Nortontu vois une autre manip' a faire?thanx

Utilisateur anonyme · Answer

salutest ce que tu peux faire ceci:telecharge ce prog:http://www.billsway.com/vbspage/vbsfiles/RegSrch.zipdezippe le, lance le (autorise le scrip quand norton va te le demander)dans la fenetre, tape ruinsvalide et poste le resultatmerci

honlo · Answer

REGEDIT4; RegSrch.vbs © Bill James; Registry search results for string "ruins" 28/08/2005 14:03:52; NOTE: This file will be deleted when you close WordPad.; You must manually save this file to a new location if you want to refer to it again later.; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Windows\CurrentVersion\ruins]

Utilisateur anonyme · Answer

demarrer > executer tape cmddans la fenetre dos qui apparait, copie et colle ceciregedit /e C:\rap.txt "HKEY_LOCAL_MACHINE\Software\CLASSES\Software\Microsoft\Windows\CurrentVersion\ruins"valide, et copie et colle le contenu du fichier C:\rap.txt ici

honlo · Answer

voila:Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\Software\CLASSES\Software\Microsoft\Windows\CurrentVersion\ruins]

honlo · Answer

a quoi correspond cette clé de registre?

Utilisateur anonyme · Answer

au trojan (hclean et compagnie)

apparement la clé et vide, tu peux la supprimer si tu veux
HKEY_LOCAL_MACHINE\Software\CLASSES\Software\Microsoft\Windows\CurrentVersion\clic droit sur ruins et clic sur supprimer.

c'est tout ce que je voulais savoir.
merci

a+

balltrap34 · Answer

pour ces deux
C:\WINNT\system32\loadctr.exe/data0006
C:\WINNT\{78E765E2-4A9E-4650-9D15-FB7A8825C1F8}.

telecharge la killbox et met ceci si dessus
avec la methode bloc note (voir demo)
Kill Box :

(ici) http://www.florensac-chasse-trap.com/ section virus

demo http://pageperso.aol.fr/balltrap34/killbox.htm

honlo · Answer

killbox m'indique que ces 2 valeurs ont deja été effacés par un processus externe (raison pour laquelle peut etre je ne les trouvais nulle part...)

balltrap34 · Answer

refait un scan kaspr pour voir

honlo · Answer

dernier resultat:

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Sunday, August 28, 2005 16:55:08
Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 28/08/2005
Kaspersky Anti-Virus database records: 145987
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - Folders:
C:\

Scan Statistics:
Total number of scanned objects: 35279
Number of viruses found: 1
Number of infected objects: 1
Number of suspicious objects: 0
Duration of the scan process: 2428 sec

Infected Object Name - Virus Name
C:\WINNT\{78E765E2-4A9E-4650-9D15-FB7A8825C1F8}.dat:vzoif:$DATA Infected: Trojan-Downloader.Win32.Agent.bq

Scan process completed.

balltrap34 · Answer

essai de voir si tu le trouveC:\WINNT\{78E765E2-4A9E-4650-9D15-FB7A8825C1F8}.dat

honlo · Answer

je nai aucun fichier dat de ce genre dans winnt

Utilisateur anonyme · Answer

Lance hijackthis, clic sur [Open the misc tools section]
clic sur [Open ADS spy]
assure toi que les cases devant:
Quick Scan
et
Ignore safe system infos stream
soient COCHES
Clic sur Scan, puis sur Save log
poste le rapport

Utilisateur anonyme · Answer

Juste une ptite question:lors du passage de ad aware et/ou spybot, y avait il une infection ware out ?

honlo · Answer

resutat du scan HJC:\WINNT\NSREX.INI : gifsy  (0 bytes)C:\WINNT\{78E765E2-4A9E-4650-9D15-FB7A8825C1F8}.dat : vzoif  (63488 bytes)

honlo · Answer

et concernant wareout le probleme en fait vient des consequences de l'introduction de ce log sur mon PC ya bien longtemps, jamais aucun scan ne m'avait signaler qq chose en nommant wareout que javais desinstallé assez rapidement d'ailleurs) ce n'est qu'en lisant des posts sur ce forum que j'ai fait l'association entre wareout et les soucis de ma machine

balltrap34 · Answer

et stpvas dans le registre et cherche cette clefHKCR\exefile\shell\open\command@< nom de fichier > "%1" % * "et suppr le nom de fichier pas se qu il y a apres

honlo · Answer

en fait c marqué par defaut , ya pas de nom de fichier.. c koi cette clé?

balltrap34 · Answer

dans la colone donnée il doit y avoir ceci "%1" % * "

Utilisateur anonyme · Answer

Lance hijackthis, clic sur [Open the misc tools section]A coté du bouton [Générate startuplist log]coche les 2 casespuis clic sur  [Générate startuplist log]copie et colle le rapport icia+

balltrap34 · Answer

fait se que moe ta mis au n°53

Utilisateur anonyme · Answer

pour balltrap

dans le post de yohan et dans le rapport de hc.bat, regarde les fichiers crees à la meme date que hclean, le dossier system32\driver est mentionné
question:
y aurait pas un .sys qui regenere tout ca ?
c'est ce que je veux verifier avec le log etendu d'hijack

balltrap34 · Answer

tu peut essayer a voir si il vas le voir

stael · Answer

salut baltrap et moepour virer les sponsor de msn plus on f comment ???merci d'avance

balltrap34 · Answer

staelFaite votre propre message comme ceciVoir demohttp://pageperso.aol.fr/balltrap34/demofairesontmessage.htmet met un hijack

stael · Answer

c pas pour moihttp://www.commentcamarche.net/forum/affich-1763259-Msn-plus-probl%E8mesencore desoler de scouater le post

honlo · Answer

pour balltrap, g effectivement repere HKCR\exefile\shell\open\command mais comme je te l'ai dit en fait il n'y a pas de nom c marqué "par defaut" si je fais modifier je ne peuxpas changer le nom ; effectivement dans la colonne il y a ceci:"%1" % * (je laisse comme ca ?)je n'ai pas de n° 53 , c un peu bizarre ca passe du 52 au 54 direct(??)donc g manqué ce ke moe m'avait ditpour moe , voici le rapport:StartupList report, 28/08/2005, 20:30:26StartupList version: 1.52.2Started from : D:\LoGs AuG2005\HijackThis\HijackThis.EXEDetected: Windows 2000 SP4 (WinNT 5.00.2195)Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)* Using default options* Including empty and uninteresting sections* Showing rarely important sections==================================================Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\csrss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\LEXBCES.EXEC:\WINNT\system32\spoolsv.exeC:\WINNT\system32\LEXPPS.EXEC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINNT\System32\svchost.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton Utilities\NProtect.exeC:\WINNT\System32
vsvc32.exeC:\WINNT\system32egsvc.exeC:\WINNT\system32\MSTask.exeC:\Program Files\Speed Disk
opdb.exeC:\WINNT\system32\stisvc.exeC:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeC:\WINNT\Explorer.EXEC:\WINNT\system32\ZoneLabs\vsmon.exeC:\WINNT\System32\WBEM\WinMgmt.exeC:\WINNT\system32\svchost.exeC:\WINNT\System32\svchost.exeC:\WINNT\system32\ZoneLabs\minilog.exeC:\WINNT\htpatch.exeC:\PROGRA~1\Wanadoo\CnxMon.exeC:\PROGRA~1\MESSAG~1\Demon.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\PROGRA~1\Lexmark\PHOTOC~1\LXBLKsk.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\BillP Studios\WinPatrol\winpatrol.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeC:\WINNT\system32\internat.exeC:\Program Files\SAGEM\SAGEM F@st800\dslmon.exeC:\Documents and Settings\All Users\Application Data\Spontania4IM\spontania4IM.exeC:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXEC:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exeC:\Program Files\SpywareGuard\sgmain.exeC:\Program Files\SpywareGuard\sgbhp.exeC:\WINNT\system32\wuauclt.exeC:\PROGRA~1\Wanadoo\EspaceWanadoo.exeC:\Program Files\Crazy Browser\Crazy Browser.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Outlook Express\msimn.exeC:\PROGRA~1\Wanadoo\ComComp.exeC:\PROGRA~1\Wanadoo\Watch.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\WINNT\system32
otepad.exeC:\WINNTegedit.exeD:\LoGs AuG2005\HijackThis\HijackThis.exe--------------------------------------------------Listing of startup folders:Shell folders Startup:[C:\Documents and Settings\Indi1\Menu Démarrer\Programmes\Démarrage]Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeSpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exeShell folders AltStartup:*Folder not found*User shell folders Startup:*Folder not found*User shell folders AltStartup:*Folder not found*Shell folders Common Startup:[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st800\dslmon.exeMicrosoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXESpontania Monitor.lnk = C:\Documents and Settings\All Users\Application Data\Spontania4IM\spontania4IM.exeSymantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXEZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exeShell folders Common AltStartup:*Folder not found*User shell folders Common Startup:*Folder not found*User shell folders Alternate Common Startup:*Folder not found*--------------------------------------------------Checking Windows NT UserInit:[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]UserInit = C:\WINNT\system32\userinit.exe,[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]*Registry key not found*[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]*Registry value not found*[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunSynchronization Manager = mobsync.exe /logon--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce*No values found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*No values found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices*No values found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\Runinternat.exe = internat.exe--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce*No values found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\Run[OptionalComponents]*No values found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\Run*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------File association entry for .EXE:HKEY_CLASSES_ROOT\exefile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .COM:HKEY_CLASSES_ROOT\comfile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .BAT:HKEY_CLASSES_ROOT\batfile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .PIF:HKEY_CLASSES_ROOT\piffile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .SCR:HKEY_CLASSES_ROOT\scrfile\shell\open\command(Default) = "%1" /S--------------------------------------------------File association entry for .HTA:HKEY_CLASSES_ROOT\htafile\shell\open\command(Default) = C:\WINNT\System32\mshta.exe "%1" %*--------------------------------------------------File association entry for .TXT:HKEY_CLASSES_ROOT	xtfile\shell\open\command(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1--------------------------------------------------Enumerating Active Setup stub paths:HKLM\Software\Microsoft\Active Setup\Installed Components(* = disabled by HKCU twin)[>{26923b43-4d38-484f-9b9e-de460746276c}] *StubPath = "C:\WINNT\system32\shmgrate.exe" OCInstallUserConfigIE[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *StubPath = "C:\WINNT\system32\shmgrate.exe" OCInstallUserConfigOE[{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] *StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\mplayer2.inf,PerUserStub.NT[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT[{6A5110B5-E14B-4268-A065-EF89FF33C325}] *StubPath = regsvr32.exe /s /n /i:"S 2 true 3 true 4 true 5 true 6 true 7 true" initpki.dll[{7790769C-0471-11d2-AF11-00C04FA35D02}] *StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install[{89820200-ECBD-11cf-8B85-00AA005B4340}] *StubPath = regsvr32.exe /s /n /i:U shell32.dll[{89820200-ECBD-11cf-8B85-00AA005B4383}] *StubPath = %SystemRoot%\System32\ie4uinit.exe[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *StubPath = %SystemRoot%\System32\updcrl.exe -e -u %SystemRoot%\System32\verisignpub1.crl--------------------------------------------------Enumerating ICQ Agent Autostart apps:HKCU\Software\Mirabilis\ICQ\Agent\Apps*Registry key not found*--------------------------------------------------Load/Run keys from C:\WINNT\WIN.INI:load=*INI section not found*run=*INI section not found*Load/Run keys from Registry:HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*HKCU\..\Windows NT\CurrentVersion\Windows: load=HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=--------------------------------------------------Shell & screensaver key from C:\WINNT\SYSTEM.INI:Shell=*INI section not found*SCRNSAVE.EXE=*INI section not found*drivers=*INI section not found*Shell & screensaver key from Registry:Shell=explorer.exeSCRNSAVE.EXE=*Registry value not found*drivers=*Registry value not found*Policies Shell key:HKCU\..\Policies: Shell=*Registry value not found*HKLM\..\Policies: Shell=*Registry value not found*--------------------------------------------------Checking for EXPLORER.EXE instances:C:\WINNT\Explorer.exe: PRESENT!C:\Explorer.exe: not presentC:\WINNT\Explorer\Explorer.exe: not presentC:\WINNT\System\Explorer.exe: not presentC:\WINNT\System32\Explorer.exe: not presentC:\WINNT\Command\Explorer.exe: not presentC:\WINNT\Fonts\Explorer.exe: not present--------------------------------------------------Checking for superhidden extensions:.lnk: HIDDEN! (arrow overlay: yes).pif: HIDDEN! (arrow overlay: yes).exe: not hidden.com: not hidden.bat: not hidden.hta: not hidden.scr: not hidden.shs: HIDDEN!.shb: HIDDEN!.vbs: not hidden.vbe: not hidden.wsh: not hidden.scf: HIDDEN! (arrow overlay: NO!).url: HIDDEN! (arrow overlay: yes).js: not hidden.jse: not hidden--------------------------------------------------Verifying REGEDIT.EXE integrity:- Regedit.exe found in C:\WINNT- .reg open command is normal (regedit.exe %1)- Regedit.exe has no CompanyName property! It is either missing or named something else.- Regedit.exe has no OriginalFilename property! It is either missing or named something else.- Regedit.exe has no FileDescription property! It is either missing or named something else.Registry check failed!--------------------------------------------------Enumerating Browser Helper Objects:(no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}SpywareGuard Download Protection - C:\Program Files\SpywareGuard\dlprotect.dll - {4A368E80-174F-4872-96B5-0B27DDD11DB2}NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}--------------------------------------------------Enumerating Task Scheduler jobs:Norton AntiVirus - Scan my computer.jobSymantec NetDetect.job--------------------------------------------------Enumerating Download Program Files:[DirectAnimation Java Classes]CODEBASE = file://C:\WINNT\Java\classes\dajava.cabOSD = C:\WINNT\Downloaded Program Files\DirectAnimation Java Classes.osd[fdjeux]CODEBASE = https://www.fdjeux.net/classes/fdjeux.cabOSD = C:\WINNT\Downloaded Program Files\fdjeux.osd[Interface Chat Wanadoo]CODEBASE = http://chat4.x-echo.com/version6/Applet/wchatsign.cabOSD = C:\WINNT\Downloaded Program Files\Interface Chat Wanadoo.osd[Microsoft XML Parser for Java]CODEBASE = file://C:\WINNT\Java\classes\xmldso.cabOSD = C:\WINNT\Downloaded Program Files\Microsoft XML Parser for Java.osd[Yahoo! Chat]CODEBASE = http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cabOSD = C:\WINNT\Downloaded Program Files\Yahoo! Chat.osd[Checkers Class]InProcServer32 = C:\WINNT\Downloaded Program Files\msgrchkr.dllCODEBASE = http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab[QuickTime Object]InProcServer32 = C:\Program Files\QuickTime\QTPlugin.ocxCODEBASE = http://www.apple.com/qtactivex/qtplugin.cab[CKAVWebScan Object]InProcServer32 = C:\WINNT\system32\Kaspersky Lab\Kaspersky On-line Scanner\kavwebscan.dllCODEBASE = http://webscanner.kaspersky.fr/kavwebscan_unicode.cab[MessengerStatsClient Class]InProcServer32 = C:\WINNT\Downloaded Program Files\MessengerStatsPAClient.dllCODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab[Minesweeper Flags Class]InProcServer32 = C:\WINNT\Downloaded Program Files\minesweeper.dllCODEBASE = http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab[Yahoo! Audio Conferencing]InProcServer32 = C:\WINNT\DOWNLO~1\yacscom.dllCODEBASE = http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab[VTToolkit Control]InProcServer32 = C:\WINNT\DOWNLO~1\VTTOOL~1.OCXCODEBASE = http://videomessages.wanadoo.fr/VTToolkit.ocx[{32564D57-0000-0010-8000-00AA00389B71}]CODEBASE = http://codecs.microsoft.com/codecs/i386/wmv8ax.cab[BDSCANONLINE Control]InProcServer32 = C:\WINNT\DOWNLO~1\oscan8.ocxCODEBASE = http://www.bitdefender.fr/scan8/oscan8.cab[MessengerStatsClient Class]InProcServer32 = C:\WINNT\Downloaded Program Files\messengerstatsclient.dllCODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab[PhotoPickConvert Class]InProcServer32 = C:\WINNT\Downloaded Program Files\PhtPkMSN.dllCODEBASE = http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab[Update Class]InProcServer32 = C:\WINNT\System32\iuctl.dllCODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38514.2265856481[BatchDownloader Class]InProcServer32 = C:\WINNT\Downloaded Program Files\DigWXMSN.dllCODEBASE = http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab[ZoneIntro Class]InProcServer32 = C:\WINNT\Downloaded Program Files\ZIntro.ocxCODEBASE = http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab[Shockwave Flash Object]InProcServer32 = C:\WINNT\system32\macromed\flash\Flash.ocxCODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab[ZoneChess Object]InProcServer32 = C:\WINNT\Downloaded Program Files\Chess.ocxCODEBASE = http://messenger.zone.msn.com/binary/Chess.cab31267.cab--------------------------------------------------Enumerating Winsock LSP files:NameSpace #1: C:\WINNT\System32nr20.dllNameSpace #2: C:\WINNT\System32\winrnr.dllProtocol #1: C:\WINNT\system32\msafd.dllProtocol #2: C:\WINNT\system32\msafd.dllProtocol #3: C:\WINNT\system32\msafd.dllProtocol #4: C:\WINNT\system32svpsp.dllProtocol #5: C:\WINNT\system32svpsp.dllProtocol #6: C:\WINNT\system32\msafd.dllProtocol #7: C:\WINNT\system32\msafd.dllProtocol #8: C:\WINNT\system32\msafd.dllProtocol #9: C:\WINNT\system32\msafd.dllProtocol #10: C:\WINNT\system32\msafd.dllProtocol #11: C:\WINNT\system32\msafd.dllProtocol #12: C:\WINNT\system32\msafd.dllProtocol #13: C:\WINNT\system32\msafd.dllProtocol #14: C:\WINNT\system32\msafd.dllProtocol #15: C:\WINNT\system32\msafd.dllProtocol #16: C:\WINNT\system32\msafd.dllProtocol #17: C:\WINNT\system32\msafd.dll--------------------------------------------------Enumerating Windows NT/2000/XP servicesPilote ACPI Microsoft: System32\DRIVERS\ACPI.sys (system)General Purpose USB Driver (adildr.sys): System32\Drivers\adildr.sys (autostart)USB ADSL WAN Adapter: System32\DRIVERS\adiusbaw.sys (manual start)Environnement de prise en charge de réseau AFD: \SystemRoot\System32\drivers\afd.sys (autostart)Avertissement: %SystemRoot%\System32\services.exe (manual start)Gestion d'applications: %SystemRoot%\system32\services.exe (manual start)Pilote de média asynchrone RAS: System32\DRIVERS\asyncmac.sys (manual start)Contrôleur de disque dur IDE/ESDI standard: System32\DRIVERS\atapi.sys (system)Protocole client ATM ARP: System32\DRIVERS\atmarpc.sys (manual start)Pilote audio Stub: System32\DRIVERS\audstub.sys (manual start)Service de transfert intelligent en arrière-plan: %SystemRoot%\System32\svchost.exe -k BITSgroup (autostart)Explorateur d'ordinateur: %SystemRoot%\System32\services.exe (autostart)ICatch (VI) PC Camera: System32\Drivers\SPCA561.SYS (manual start)Closed Caption Decoder: System32\DRIVERS\CCDECODE.sys (manual start)Symantec Event Manager: "C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe" (autostart)Symantec Password Validation Service: "C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe" (manual start)Pilote de CD-ROM: System32\DRIVERS\cdrom.sys (system)Gestionnaire de l'Album: %SystemRoot%\system32\clipsrv.exe (manual start)C-Media WDM Audio Interface: system32\drivers\cmuda.sys (manual start)Client DHCP: %SystemRoot%\System32\services.exe (autostart)Pilote de disque: System32\DRIVERS\disk.sys (system)Service d'administration du Gestionnaire de disque logique: %SystemRoot%\System32\dmadmin.exe /com (manual start)dmboot: System32\drivers\dmboot.sys (disabled)Pilote de Gestionnaire de disque logique: System32\drivers\dmio.sys (system)dmload: System32\drivers\dmload.sys (system)Gestionnaire de disque logique: %SystemRoot%\System32\services.exe (autostart)Synthé logiciel Microsoft DirectMusic (WDM): system32\drivers\DMusic.sys (manual start)Client DNS: %SystemRoot%\System32\services.exe (autostart)Mia Service: system32\drivers\echo24.sys (manual start)Journal des événements: %SystemRoot%\system32\services.exe (autostart)Système d'événements de COM+: C:\WINNT\System32\svchost.exe -k netsvcs (manual start)Service de télécopie: %systemroot%\system32\faxsvc.exe (manual start)Pilote de contrôleur de lecteur de disquettes: System32\DRIVERS\fdc.sys (manual start)Pilote de lecteur de disquettes: System32\DRIVERS\flpydisk.sys (manual start)FltMgr: system32\drivers\fltmgr.sys (system)Pilote du Gestionnaire de volume: System32\DRIVERS\ftdisk.sys (system)Game Port Enumerator: System32\DRIVERS\gameenum.sys (manual start)Classificateur de paquets générique: System32\DRIVERS\msgpc.sys (manual start)Pilote pour clavier i8042 et souris sur port PS/2: System32\DRIVERS\i8042prt.sys (system)Pilote de filtre de trafic IP: System32\DRIVERS\ipfltdrv.sys (manual start)Pilote de tunnelage IP dans IP: System32\DRIVERS\ipinip.sys (manual start)Traducteur d'adresses réseau IP: System32\DRIVERS\ipnat.sys (manual start)Pilote IPSEC: System32\DRIVERS\ipsec.sys (manual start)IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)Pilote de bus Plug-and-Play ISA/EISA: System32\DRIVERS\isapnp.sys (system)Pilote de la classe Clavier: System32\DRIVERS\kbdclass.sys (system)Mélangeur audio Wave de noyau Microsoft: system32\drivers\kmixer.sys (manual start)Serveur: %SystemRoot%\System32\services.exe (autostart)Station de travail: %SystemRoot%\System32\services.exe (autostart)LexBce Server: C:\WINNT\system32\LEXBCES.EXE (autostart)Service d'application d'assistance TCP/IP NetBIOS: %SystemRoot%\System32\services.exe (autostart)mchInjDrv: \??\C:\WINNT\TEMP\mc22.tmp (disabled)Affichage des messages: %SystemRoot%\System32\services.exe (disabled)TrueVector Basic Logging Client: C:\WINNT\system32\ZoneLabs\minilog.exe -service (autostart)Partage de Bureau à distance NetMeeting: C:\WINNT\System32\mnmsrvc.exe (manual start)Pilote de la classe Souris: System32\DRIVERS\mouclass.sys (system)BDA MPE Filter: System32\DRIVERS\MPE.sys (manual start)MRXSMB: System32\DRIVERS\mrxsmb.sys (system)Distributed Transaction Coordinator: C:\WINNT\System32\msdtc.exe (manual start)Windows Installer: C:\WINNT\system32\msiexec.exe /V (manual start)Proxy de service de répartition Microsoft: system32\drivers\MSKSSRV.sys (manual start)Proxy d'horloge de répartition Microsoft: system32\drivers\MSPCLOCK.sys (manual start)Proxy de gestion de qualité de répartition Microsoft: system32\drivers\MSPQM.sys (manual start)Microsoft Streaming Tee/Sink-to-Sink Converter: system32\drivers\MSTEE.sys (manual start)NABTS/FEC VBI Codec: System32\DRIVERS\NABTSFEC.sys (manual start)Norton AntiVirus Auto Protect Service: "C:\Program Files\Norton AntiVirus
avapsvc.exe" (autostart)NAVENG: \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20050826.018\NAVENG.Sys (manual start)NAVEX15: \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20050826.018\NavEx15.Sys (manual start)Microsoft TV/Video Connection: System32\DRIVERS\NdisIP.sys (manual start)Pilote TAPI NDIS d'accès à distance: System32\DRIVERS
distapi.sys (manual start)NDIS Protocole mode utilisateur E/S: System32\DRIVERS
disuio.sys (manual start)Pilote réseau étendu NDIS d'accès à distance: System32\DRIVERS
diswan.sys (manual start)Interface NetBIOS: System32\DRIVERS
etbios.sys (system)NetBT: System32\DRIVERS
etbt.sys (system)DDE réseau: %SystemRoot%\system32
etdde.exe (manual start)DSDM DDE réseau: %SystemRoot%\system32
etdde.exe (manual start)NetDetect: \SystemRoot\system32\drivers
etdtect.sys (manual start)Ouverture de session réseau: %SystemRoot%\System32\lsass.exe (manual start)Connexions réseau: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Norton Unerase Protection Driver: \??\C:\WINNT\System32\Drivers\NPDRIVER.SYS (manual start)Norton Unerase Protection: C:\Program Files\Norton Utilities\NProtect.exe (autostart)Fournisseur de la prise en charge de sécurité LM NT: %SystemRoot%\System32\lsass.exe (manual start)Médias amovibles: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)nv: System32\DRIVERS
v4_mini.sys (manual start)nVidia WDM Video Capture (universal): System32\DRIVERS
vcap.sys (autostart)NVIDIA Display Driver Service: %SystemRoot%\System32
vsvc32.exe (autostart)nVidia WDM A/V Crossbar: System32\DRIVERS\NVxbar.sys (autostart)Pilote de filtre de trafic IPX: System32\DRIVERS
wlnkflt.sys (manual start)Pilote de transfert de trafic IPX: System32\DRIVERS
wlnkfwd.sys (manual start)Pilote de contrôleur hôte ouvert USB Microsoft: System32\DRIVERS\openhci.sys (manual start)Pilote de classe parallèle: System32\DRIVERS\parallel.sys (manual start)Pilote de port parallèle: System32\DRIVERS\parport.sys (system)PCI Bus Driver: System32\DRIVERS\pci.sys (system)PCIIde: System32\DRIVERS\pciide.sys (system)Plug-and-Play: %SystemRoot%\system32\services.exe (autostart)Agent de stratégie IPSEC: %SystemRoot%\System32\lsass.exe (autostart)Miniport réseau étendu (PPTP): System32\DRIVERSaspptp.sys (manual start)StarForce Protection Environment Driver v6: \SystemRoot\System32\drivers\prodrv06.sys (system)StarForce Protection Helper Driver v2: System32\drivers\prohlp02.sys (system)Emplacement protégé: %SystemRoot%\system32\services.exe (autostart)Planificateur de paquets QoS: System32\DRIVERS\psched.sys (manual start)Pilote de liaison parallèle directe: System32\DRIVERS\ptilink.sys (manual start)Pilote de connexion automatique d'accès distant: System32\DRIVERSasacd.sys (system)Gestionnaire de connexion automatique d'accès distant: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Miniport réseau étendu (L2TP): System32\DRIVERSasl2tp.sys (manual start)Gestionnaire de connexions d'accès distant: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Parallèle direct: System32\DRIVERSaspti.sys (manual start)Microsoft Streaming Network Raw Channel Access: system32\drivers\RCA.sys (manual start)Rdbss: System32\DRIVERSdbss.sys (system)EDIROL PCR: System32\Driversdwm1027.sys (manual start)Pilote de filtre de lecture digitale de CD audio: System32\DRIVERSedbook.sys (system)Routage et accès distant: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)Service d'accès à distance au Registre: %SystemRoot%\system32egsvc.exe (autostart)Localisateur d'appels de procédure distante (RPC): %SystemRoot%\System32\locator.exe (manual start)Appel de procédure distante (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)QoS RSVP: %SystemRoot%\System32svp.exe -s (manual start)SABProcEnum: \??\C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABProcEnum.sys (manual start)Gestionnaire de comptes de sécurité: %SystemRoot%\system32\lsass.exe (autostart)SAVRT: \??\C:\WINNT\system32\Drivers\SAVRT.SYS (manual start)SAVRTPEL: \??\C:\WINNT\system32\Drivers\SAVRTPEL.SYS (autostart)ScriptBlocking Service: C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe (autostart)Prise en charge des cartes à puces: %SystemRoot%\System32\SCardSvr.exe (manual start)Carte à puce: %SystemRoot%\System32\SCardSvr.exe (manual start)Planificateur de tâches: %SystemRoot%\system32\MSTask.exe (autostart)SDdriver: \??\C:\WINNT\system32\Drivers\sddriver.sys (manual start)Service d'exécution par délégation: %SystemRoot%\system32\services.exe (autostart)Notification d'événement système: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)MAT Serial port driver: system32\DRIVERS\ser2pl.sys (manual start)Serenum Filter Driver: System32\DRIVERS\serenum.sys (manual start)Pilote de port série: System32\DRIVERS\serial.sys (system)StarForce Protection Environment Driver (version 1.x): System32\drivers\sfdrv01.sys (system)StarForce Protection Helper Driver: System32\drivers\sfhlp01.sys (system)StarForce Protection Helper Driver (version 2.x): System32\drivers\sfhlp02.sys (system)Partage de connexion Internet: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)SiS AGP Filter: System32\DRIVERS\SISAGPx.sys (system)SiS PCI Fast Ethernet Adapter Driver: System32\DRIVERS\sisnic.sys (manual start)BDA Slip De-Framer: System32\DRIVERS\SLIP.sys (manual start)Dual Mode Camera (8000 VGA): system32\DRIVERS\sndhv71.sys (manual start)Symantec Network Drivers Service: C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe (manual start)Speed Disk service: C:\Program Files\Speed Disk
opdb.exe (autostart)Spouleur d'impression: %SystemRoot%\system32\spoolsv.exe (autostart)Srv: System32\DRIVERS\srv.sys (manual start)Still Image Service: %systemroot%\system32\stisvc.exe (autostart)BDA IPSink: System32\DRIVERS\StreamIP.sys (manual start)Webroot Spy Sweeper Engine: C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe (autostart)Pilote de bus logiciel: System32\DRIVERS\swenum.sys (manual start)Synthétiseur de table de sons GC noyau Microsoft: system32\drivers\swmidi.sys (manual start)SymEvent: \??\C:\Program Files\Symantec\SYMEVENT.SYS (manual start)SYMREDRV: \SystemRoot\System32\Drivers\SYMREDRV.SYS (manual start)SYMTDI: \SystemRoot\System32\Drivers\SYMTDI.SYS (system)SymWMI Service: C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe (autostart)Périphérique audio système Microsoft: system32\drivers\sysaudio.sys (manual start)Journaux et alertes de performance: %SystemRoot%\system32\smlogsvc.exe (manual start)Téléphonie: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Pilote du protocole TCP/IP: System32\DRIVERS	cpip.sys (system)Telnet: %SystemRoot%\system32	lntsvr.exe (manual start)Client de suivi de lien distribué: %SystemRoot%\system32\services.exe (autostart)Pilote de mise à jour microcode: System32\DRIVERS\update.sys (manual start)Onduleur: %SystemRoot%\System32\ups.exe (manual start)Pilote de concentrateur standard USB Microsoft: System32\DRIVERS\usbhub.sys (manual start)Classe d'imprimantes USB Microsoft: System32\DRIVERS\usbprint.sys (manual start)Pilote de stockage de masse USB: System32\DRIVERS\USBSTOR.SYS (manual start)Gestionnaire d'utilitaires: %SystemRoot%\System32\UtilMan.exe (manual start)VgaSave: \SystemRoot\System32\drivers\vga.sys (system)vsdatant: \??\C:\WINNT\System32\vsdatant.sys (autostart)TrueVector Internet Monitor: C:\WINNT\system32\ZoneLabs\vsmon.exe -service (autostart)Horloge Windows: %SystemRoot%\System32\services.exe (manual start)Pilote ARP IP d'accès à distance: System32\DRIVERS\wanarp.sys (manual start)Pilote WINMM de compatibilité audio WDM Microsoft: system32\drivers\wdmaud.sys (manual start)Infrastructure de gestion Windows: %SystemRoot%\System32\WBEM\WinMgmt.exe (autostart)Extensions du pilote WMI: %SystemRoot%\system32\Services.exe (manual start)World Standard Teletext Codec: System32\DRIVERS\WSTCODEC.SYS (manual start)Mises à jour automatiques: %systemroot%\system32\svchost.exe -k wugroup (autostart)Configuration sans fil: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)--------------------------------------------------Enumerating Windows NT logon/logoff scripts:*No scripts set to run*Windows NT checkdisk command:BootExecute = autocheck autochk *Windows NT 'Wininit.ini':PendingFileRenameOperations: *Registry value not found*--------------------------------------------------Enumerating ShellServiceObjectDelayLoad items:Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dllSysTray: stobject.dll--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Runnotepad.exe = --------------------------------------------------End of report, 34 492 bytesReport generated in 1,985 secondsCommand line options:   /verbose  - to add additional info on each section   /complete - to include empty sections and unsuspicious data   /full     - to include several rarely-important sections   /force9x  - to include Win9x-only startups even if running on WinNT   /forcent  - to include WinNT-only startups even if running on Win9x   /forceall - to include all Win9x and WinNT startups, regardless of platform   /history  - to list version history onlyjespere ke je n'ai rien oublié..

Utilisateur anonyme · Answer

je vois rien de suspect à part:HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run notepad.exe = fais ceci (le post53):http://www.commentcamarche.net/forum/affich-1760709-hclean32-exe-reper%E9-mais-invisible#53et ensuite telecharge hclsrch.zip ici:http://get.yourfile.net/aa73401.zipdezippe le et lance hs.bat et poste le rapport

balltrap34 · Answer

moe j est un doute sur celui ciFile association entry for .HTA: HKEY_CLASSES_ROOT\htafile\shell\open\command (Default) = C:\WINNT\System32\mshta.exe "%1" %* http://www.bleepingcomputer.com/startups/Mshta.exe_...filename.hta-5544.html

Utilisateur anonyme · Answer

chez moi elle y est aussi et mentionné dans system32, et chez toi ?

balltrap34 · Answer

c est bon je l est

Utilisateur anonyme · Answer

ouf, lol

honlo · Answer

moe fais un copier coller du post 53 stp , il n'apparrait pas chez moi!pour le rapport:Rapport fait à 21:38:21,29 le dim. 28/08/2005Executé à partir de D:\LoGs AuG2005\hclsrch\hclsrchOS: Microsoft Windows 2000 [Version 5.00.2195]Recherche registre ...Recherche dossier Internet Explorer... Le volume dans le lecteur D s'appelle Disque local Le num‚ro de s‚rie du volume est 0E45-CA19 R‚pertoire de D:\LoGs AuG2005\hclsrch\hclsrchRecherche presence  hclean32.exe... non trouvé...

balltrap34 · Answer

il est audessus du 51

honlo · Answer

voila ce ke j'ai : # < 52 > - hclean32.exe reperé mais invisible !! Membre CCMAjouté par balltrap34 (28/08/2005 à 18:58 GMT+2) et stp vas dans le registre et cherche cette clef HKCR\exefile\shell\open\command @ < nom de fichier > "%1" % * " et suppr le nom de fichier pas se qu il y a apres -- la chasse et le balltrap ma vrai passion voir site perso dans profil [ Continuer la discussion ][ Répondre à balltrap34 ] # < 54 > - hclean32.exe reperé mais invisible !! Non membre CCMAjouté par honlo (28/08/2005 à 19:34 GMT+2) en fait c marqué par defaut , ya pas de nom de fichier.. c koi cette clé? [ Continuer la discussion ][ Répondre à honlo ] # < 55 > - hclean32.exe reperé mais invisible !! Membre CCMAjouté par balltrap34 (28/08/2005 à 19:45 GMT+2) dans la colone donnée il doit y avoir ceci "%1" % * " -- la chasse et le balltrap ma vrai passion voir site perso dans profil [ Continuer la discussion ][ Répondre à balltrap34 ] # < 56 > - hclean32.exe reperé mais invisible !! Membre CCMAjouté par moe31 (28/08/2005 à 19:46 GMT+2) Lance hijackthis, clic sur [Open the misc tools section] A coté du bouton [Générate startuplist log] coche les 2 cases puis clic sur [Générate startuplist log] etc ...ca passe de 52 a 54 direct, g manqué un chapitre...

balltrap34 · Answer

< 53 > - hclean32.exe reperé mais invisible !!Ajouté par moe31 (28/08/2005 à 19:15 GMT+2)  Lance hijackthis, clic sur [Open the misc tools section] clic sur [Open ADS spy] assure toi que les cases devant: Quick Scan et Ignore safe system infos stream soient COCHES Clic sur Scan, selectionne les deux fichiers et clic sur remove selected

honlo · Answer

merci balltrap!operation effectuée

Utilisateur anonyme · Answer

bon ca avance bien, telecharge hclsrch.zip ici: http://get.yourfile.net/aa73401.zip dezippe le et lance hs.bat et poste le rapport

honlo · Answer

je l'avais fait au post 69je le refait:Rapport fait à 22:20:17,12 le dim. 28/08/2005Executé à partir de D:\LoGs AuG2005\Logs detection hclean32.exe\hclsrch\hclsrchOS: Microsoft Windows 2000 [Version 5.00.2195]Recherche registre ...Recherche dossier Internet Explorer... Le volume dans le lecteur D s'appelle Disque local Le num‚ro de s‚rie du volume est 0E45-CA19 R‚pertoire de D:\LoGs AuG2005\Logs detection hclean32.exe\hclsrch\hclsrchRecherche presence  hclean32.exe... non trouvé...

Utilisateur anonyme · Answer

ok, juste pour verifrefais un scan che kav pour voir si tout est oket de ton coté, toujours des soucis ?

honlo · Answer

je lance un scan kaspersky je te dis des que c finispour l'instant tout ce passe bien ,je suis sur firefox sans souci, j 'ai lancé aussi IE x fois sans problemel'espoir est au bout du chemin!...

honlo · Answer

hallelujah !rapport Kasper:------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Sunday, August 28, 2005 23:46:03 Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 28/08/2005 Kaspersky Anti-Virus database records: 146041-------------------------------------------------------------------------------Scan Settings:	Scan using the following antivirus database: extended	Scan Archives: true	Scan Mail Bases: trueScan Target - Folders:	C:\Scan Statistics:	Total number of scanned objects: 38503	Number of viruses found: 0	Number of infected objects: 0	Number of suspicious objects: 0	Duration of the scan process: 4466 secNo malware has been detected. The sections that have been scanned are CLEAN.Scan process completed.si vous me dites ke c bon les gars, jvais mettre un cierge pour vous a l'église!

balltrap34 · Answer

la tenasiter de moe a payer lol

honlo · Answer

yora un ptit cierge pour toi aussi balltrap! lolMerci bcp les gars ;-))))si jamais y'a de nouveau qq chose qui cloche ,je vous dit; et en tout cas tout ca m'a donné envie de naviguer un peu sur ce site et de m'informer@+

balltrap34 · Answer

mercia++

Utilisateur anonyme · Answer

de riena+

honlo · Answer

salut mimi,a mon avis ,tu devrais creer un sujet a part afin que ton probleme soit reperé par tous les participants a ce forum et obtenir plus d'aideles symptomes que tu decris semblent similaires mais il ya peut etre des procedures specifiques a executer sur  ta machine qui n'ont pas été decrites dans ce topicdans tous les cas , crée un sujet a part c plus efficace( la preuve pour moi !)bon courage :-)

Utilisateur anonyme · Answer

salut mimi, honlomimi, honlo a raison, fait ton propre message pour eviter la confusion et dans ton nouveau message, poste un rapport hijackthisa+

Hclean32.exe reperé mais invisible !!

83 réponses

Votre réponse

Discussions similaires

Newsletters