FENETRES PAUPOPUP ET SEARC'H Résolu

Question

BONJOURj'ai des fenetres type PAYPOPUP et SEARC'H qui s'ouvre en surfant sur le web.Voici mon log hijack. Merci de m'aider.Logfile of HijackThis v1.99.1Scan saved at 12:15:27, on 31/08/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\rundll32.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\AVPersonal\AVWUPSRV.EXEC:\PROGRA~1\Iomega\System32\AppServices.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exeC:\WINDOWS\System32\hcatztq.exeC:\WINDOWS\System32\hkcmd.exeC:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeC:\Program Files\Dell\Media Experience\PCMService.exeC:\Program Files\Iomega\DriveIcons\ImgIcon.exeC:\WINDOWS\System32\GSICON.EXEC:\WINDOWS\System32\dslagent.exeC:\Program Files\Iomega HotBurn Pro\Autolaunch.exeC:\WINDOWS\System32\dwwin.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\Program Files\Fichiers communs\Real\Update_OB\realsched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\WINDOWS\Explorer.exeC:\WINDOWS\System32\dwwin.exeC:\Program Files\Wanadoo\EspaceWanadoo.exeC:\Program Files\Wanadoo\ComComp.exeC:\Program Files\Wanadoo\Watch.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\MR BELLANDE\Mes documents\SB\DIVERS\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - {B9F36083-81D3-D75B-61DA-68DB62E3503F} - SYSTRAV.dll (file missing)F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exeO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeO4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /rO4 - HKLM\..\Run: [VirusScan] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exeO4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exeO4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exeO4 - HKLM\..\Run: [GSICONEXE] GSICON.EXEO4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USBO4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osbootO4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exeO4 - HKLM\..\Run: [prcmon] EXE32EXE.exeO4 - HKLM\..\Run: [panel_its] Dest068.exeO4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -uO4 - HKLM\..\Run: [udyvex] C:\WINDOWS\System32\hcatztq.exe rO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [killall] Bogobot.exeO4 - HKCU\..\Run: [WTFCTF] NsCplTray.exeO4 - HKCU\..\Run: [avpmondll] bnui.exeO4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = ?O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXEO8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLLO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O9 - Extra button: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - C:\Program Files\WareOut\WareOut.exe (file missing) (HKCU)O9 - Extra 'Tools' menuitem: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - C:\Program Files\WareOut\WareOut.exe (file missing) (HKCU)O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cabO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1102584932234O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://paris.tourismeville.wanadoo.fr/AxisCamControl.cabO16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{211B6530-3A92-4F96-844D-D10B419BB830}: NameServer = 80.10.246.130 80.10.246.3O17 - HKLM\System\CCS\Services\Tcpip\..\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}: NameServer = 195.95.218.1,85.255.112.7O17 - HKLM\System\CS1\Services\Tcpip\..\{211B6530-3A92-4F96-844D-D10B419BB830}: NameServer = 80.10.246.130 80.10.246.3O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO20 - Winlogon Notify: StillImage - C:\WINDOWS\system32\cTmocx.dllO23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXEO23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: System Startup Service  (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: AntiVir Update Temp (TmpUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\DOCUME~1\MRBELL~1\LOCALS~1\TEMP\_VWUPSRV.EXEO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

Real Mona · Answer

Bonjour, Imprime ceci pour ne rien oublier de faire : Méthode à suivre dans l'ordre... ---------------------------------------------------------------------------- ¤Télécharge ces logiciels (si tu ne les as pas) mais que tu n‘utilises pas tout de suite: 1/Spybot S&D 1.4 <exécuter->tape: services.msc Double-clique: Service: System Startup Service (SvcProc) Règle-le sur "Arrêté" et "Désactivé". ---------------------------------------------------------------------------- Ensuite double clic sur nail fix cmd http://www.noidea.us/easyfile/file.php?download=20050515010747824 ---------------------------------------------------------------------------- ¤ Passe Ad-Aware et vire tout ce qu’il trouve ---------------------------------------------------------------------------- ¤ Passe Spybot et vire tout ce qu’il trouve ---------------------------------------------------------------------------- > Tu vides ta poubelle et tu redémarres en mode normal et refait un HijackThis Précise tes soucis s’il en reste.... Tiens-moi au courant A+ M.

jean38 · Answer

salut,alors t'a une cochonnerie pas simple a déloger donc voici en premier lieu la manip à faire:ouvre le bloc note et copie colle ceci entre les etoiles (pas les etoiles) ******* REGEDIT4 [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "svcproc.exe"=- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\System Startup Service] "start"=dword:00000004 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\System Startup Service] "start"=- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SvcProc] "start"=dword:00000004 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SvcProc] "start"=- [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\System Startup Service] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\System Startup Service] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\System Startup Service] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\System Startup Service] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SvcProc] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SvcProc] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SvcProc] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SvcProc] ******* enregistre le sur ton bureau et nomme le yan.reg et dans type met sur tous fichier double clik sur se fichier et accepte la fusion et refait un hijack ne redemarre pas

Real Mona · Answer

Jean,Je savais bien que je m'attaquais à un truc trop compliqué pour moi, mais j'ai essayé, et maintenant grâce à toi, je sais mieux heureusement que tu es là ! (puisque Quentin fais sa tête de mule...)BisouM.

jean38 · Answer

salut  mona,on a degainé en même temps, ce truc c'est nail tu le vois en F2 (mais çà je ne t'apprends rien).nail est associé à un service O23 svcprocet un fichier aléatoire qui change de nom à chaque redemarrage. Il se trouve que tu peux faire toutes les manip, il se regenere chaque fois.il faut donc y aller en plusieurs étape, la première corrige le registre et pulverise le service O23, les autres manip (notemment l2mfix et nailfix et killbox) devraient le faire disparaitre. Je dis devrais car c'est un mutant de plus en plus complexe à virer, parfois rapide, parfois inkilable.mais là je crois que grace a toutes les manip qu'on a essayé et en compilant les resultats, j'ai une piste. A SUIVRE.bisesJeanPS j'ai pas suivi l'évol de quentin, caroline a tenter de m'en parler mais ???a+

Real Mona · Answer

Merci Jean pour tes explications claires ! je saurai maintenant !Pour Quentin, je pense que... non en fait j'en pense rien.... va voir http://www.commentcamarche.net/forum/affich-1768510-Petit-message-au-forumKiss,Mona

jean38 · Answer

alors super,premiere etape OK, attention imprime ce post et suis scrupuleusement les manip, tu es le 2° à la faire çà valide une nouvelle manip qui semble etre au top. Ce qui est très important c'est de ne pas laisser redemarrer l'ordi entre les etapes autrement qu'en mode sans echec.2)	telecharge ceci http://www.downloads.subratam.org/l2mfix.exe Telecharge: Pocket Killbox ici http://www.downloads.subratam.org/KillBox.exe regarde la video sur l’utilisation avec le block note, on va s’en servire plus tard:  http://pageperso.aol.fr/balltrap34/killbox.htm nailfix, telecharge le ici: http://www.noidea.us/easyfile/file.php?download=20050515010747824 mais ne fais rien de plus.3)	Lance L2mfix decompresse le double clik sur l2mfix.bat appuie sur n importe quelle touche et ensuite choisi l option 2 à la fin le prog devrait redémarrer ton système, des le lancement du bios, tapote sur la touche F8 afin de basculer en mode sans échec (attention c’est important)4)	Killbox1- Double-clic sur KillBox.exe 2- ouvre le bloc notes et copie la liste en gras ci-dessous 3- Sélectionne "Delete on Reboot" 4- reviens sur le bloc-notes et surligne toute la liste, puis clic droit dessus et clic sur copier 5- reviens sur killbox, et dans le menu du haut clic sur File, puis sur paste from clipboard 5- clic sur le rond rouge 6- une fenetre va apparaitre pour confirmation clic sur OUI 7- une seconde fenetre te demande si tu veux redemarrer clic sur OUI liste C:\WINDOWS\Nail.exe C:\WINDOWS\System32\gkhmocc.exe r quand killbox redemarre le pc, appuie immédiatement sur F8, pour passer en mode sans échecs 5)	lance hijackthis et supprime :R3 - URLSearchHook: (no name) - {B9F36083-81D3-D75B-61DA-68DB62E3503F} - SYSTRAV.dll (file missing) F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe O4 - HKLM\..\Run: [brwexde] C:\WINDOWS\System32\gkhmocc.exe r 6)	passe nailfix7)	repasse l2mfix option 2, laisse redemarrer normalement refait un log hijack Redemarre et refait un log hijack

jean38 · Answer

Quel message??

STBE41 · Answer

après la manip l2mfix, message: "editeur de registre": impossible d' exporter backregs(...).reg

balltrap34 · Answer

saluttu as un prog de securite qui empeche la modif de la base de registredesactive le le temp de faire la manip

jean38 · Answer

merci ball trap,l'est trop fort, a toujours la soluc.TSBE a toi de faire maintenant, tous nos yeux sont tournés vers toi.A+

STBE41 · Answer

bonjourj'ai désactivé ZONELAB et MICROSOFT ANTISPYWARE mais le mème message s'affiche au rebootage.merci.

balltrap34 · Answer

l2mfix tu le passe en mode sans echec?

balltrap34 · Answer

si se que j ai mis plus haut ne marche pas fait cecitelechargehttp://www.downloads.subratam.org/VX2Finder(126).exe execute VX2Finder /click to find/puis make logmet nous le rapport

STBE41 · Answer

Bonjourmerci pour votre aide.oui je reboot bien en mode sans echec.Voici le rapport VX2FINDER:Log for VX2.BetterInternet File Finder (msg126)Files Found--- Additional Files--- Keys Under Notify---crypt32chaincryptnetcscdlligfxcuiScCertPropSchedulesclgntfySensLogntermsrvwlballoonwzcnotifGuardian Key--- is called: User Agent String---{DC536E55-A293-7203-2FA2-8DD061C9EAE8}

balltrap34 · Answer

relance vx2 et clik sur le bouton user agent et dit oui redemarre et refait le vx2 et met le rapport

STBE41 · Answer

bonjourVoici le rapport:Log for VX2.BetterInternet File Finder (msg126)Files Found--- Additional Files--- Keys Under Notify---crypt32chaincryptnetcscdlligfxcuiScCertPropSchedulesclgntfySensLogntermsrvwlballoonwzcnotifGuardian Key--- is called: User Agent String---{DC536E55-A293-7203-2FA2-8DD061C9EAE8}

balltrap34 · Answer

http://pageperso.aol.fr/Balltrap34/DllCompare.exeexecute DllCompare.exepuis run locate/puis compare/ make a log/ puis oket met aussi le rapport-----------------et aussi cecihttp://computercops.biz/zx/Zupe/Find%20It%20NT-2K-XP.ziptelecharge le dans son propre dossier dezippe le dedans et clik sur find batet met le rapportla refaire un hijack sans redemarrer

STBE41 · Answer

voici le rapport DLL COMPARE: * DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ C:\WINDOWS\SYSTEM32\aamlib.dll Fri 24 Jun 2005 9:51:42 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\acsldpc.dll Mon 25 Jul 2005 8:25:10 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\adfsipc.dll Wed 6 Jul 2005 9:46:48 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\adlui.dll Mon 5 Sep 2005 9:30:40 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\aesldp.dll Mon 4 Jul 2005 9:08:08 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\afstream.dll Sat 3 Sep 2005 23:43:08 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ammparse.dll Sun 31 Jul 2005 16:18:54 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\aoycfilt.dll Fri 29 Jul 2005 9:16:38 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\arphelp.dll Sat 27 Aug 2005 11:00:40 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\assnt.dll Fri 2 Sep 2005 13:46:40 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\auaamon.dll Sat 3 Sep 2005 23:50:34 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\azrsvc.dll Tue 12 Jul 2005 8:26:12 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\bfotvid.dll Mon 11 Jul 2005 9:32:20 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ccrtmgr.dll Tue 9 Aug 2005 13:45:58 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\cctsrvut.dll Thu 28 Jul 2005 10:44:38 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\cgbw32.dll Wed 17 Aug 2005 9:07:08 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\chrpol.dll Mon 27 Jun 2005 9:26:32 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\codial32.dll Thu 1 Sep 2005 13:24:48 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\cqmcat.dll Thu 1 Sep 2005 17:24:58 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ctmocx.dll Fri 22 Jul 2005 16:44:58 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ctmodem.dll Wed 31 Aug 2005 12:41:40 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\cyedui.dll Wed 10 Aug 2005 16:03:08 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\dcvacm.dll Mon 15 Aug 2005 15:40:52 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\delayx.dll Fri 15 Jul 2005 9:50:54 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\djlay.dll Sun 21 Aug 2005 16:59:36 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\dqus10.dll Wed 10 Aug 2005 10:00:24 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\dtdlgs.dll Mon 22 Aug 2005 15:39:22 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\dynlobby.dll Fri 2 Sep 2005 12:20:00 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\eacimg.dll Mon 11 Jul 2005 8:38:04 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\etentprf.dll Thu 23 Jun 2005 16:42:26 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ewentlog.dll Tue 28 Jun 2005 13:40:14 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\fhsext32.dll Tue 9 Aug 2005 10:50:10 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\gnmf32.dll Fri 8 Jul 2005 13:44:22 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ib41_qc.dll Fri 24 Jun 2005 10:34:20 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ibxwan.dll Thu 11 Aug 2005 8:34:00 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\icircl.dll Wed 17 Aug 2005 9:16:28 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\idxmontr.dll Fri 2 Sep 2005 9:12:02 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ihxmontr.dll Tue 26 Jul 2005 8:29:04 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\iksrad.dll Sat 9 Jul 2005 23:46:04 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\iqv6mon.dll Wed 17 Aug 2005 8:47:24 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\irxmontr.dll Thu 30 Jun 2005 17:37:26 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\itengine.dll Sat 23 Jul 2005 14:50:48 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\iuss.dll Mon 15 Aug 2005 19:27:08 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ivlogmsg.dll Tue 30 Aug 2005 8:43:48 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ixetppui.dll Tue 28 Jun 2005 11:27:34 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ixign32.dll Thu 1 Sep 2005 13:11:58 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\jwaw400.dll Mon 5 Sep 2005 9:20:22 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\kadest.dll Sat 2 Jul 2005 15:28:42 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\kidal.dll Sat 9 Jul 2005 21:26:48 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\kqdal.dll Thu 7 Jul 2005 17:12:34 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\kxdsg.dll Fri 2 Sep 2005 12:21:40 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\kydcz1.dll Sat 2 Jul 2005 8:52:42 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\la32.dll Thu 4 Aug 2005 16:58:48 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\lrcwmi.dll Mon 15 Aug 2005 15:49:58 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\lrrhelp.dll Fri 2 Sep 2005 12:22:00 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mbminst.dll Fri 22 Jul 2005 15:24:52 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mfctf.dll Wed 31 Aug 2005 16:45:28 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mfi.dll Sun 21 Aug 2005 16:47:36 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mfieftp.dll Thu 30 Jun 2005 17:14:28 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mgpi32.dll Sun 7 Aug 2005 15:08:30 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\miafd.dll Fri 12 Aug 2005 10:02:00 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mmvcr70.dll Mon 29 Aug 2005 9:22:52 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mmyuv.dll Mon 8 Aug 2005 9:18:48 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mntext40.dll Thu 18 Aug 2005 8:41:12 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\moiseq.dll Wed 10 Aug 2005 11:28:36 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mopi32.dll Thu 1 Sep 2005 9:13:04 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mpltus40.dll Mon 29 Aug 2005 9:44:38 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mpxml2r.dll Sun 4 Sep 2005 16:23:38 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mrexch40.dll Fri 24 Jun 2005 10:42:30 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mriseq.dll Sat 3 Sep 2005 22:55:08 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mrutilse.dll Mon 11 Jul 2005 8:40:04 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mtsign32.dll Wed 13 Jul 2005 8:31:42 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mtwmdmsp.dll Fri 22 Jul 2005 15:24:56 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mvhtmled.dll Fri 1 Jul 2005 13:09:24 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mviole16.dll Thu 4 Aug 2005 16:26:26 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mwafd.dll Wed 27 Jul 2005 8:38:58 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mwconf.dll Thu 1 Sep 2005 13:05:50 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\mxobjs.dll Thu 1 Sep 2005 13:42:52 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32 cshrui.dll Sun 24 Jul 2005 9:57:16 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32 dtcfgx.dll Tue 28 Jun 2005 9:43:10 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32 ktui0.dll Fri 2 Sep 2005 12:15:58 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32 nxpnt.dll Wed 3 Aug 2005 8:36:46 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32 qhtml.dll Thu 1 Sep 2005 13:14:06 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32 staud~1.dll Wed 22 Jun 2005 12:32:10 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\obbcconf.dll Fri 2 Sep 2005 13:36:34 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ooeaccrc.dll Tue 28 Jun 2005 9:50:26 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\oofox32.dll Wed 29 Jun 2005 8:53:34 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\oreadm.dll Thu 18 Aug 2005 18:16:44 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\oxkley.dll Thu 7 Jul 2005 8:15:46 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\oyengl32.dll Wed 31 Aug 2005 8:39:20 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\pcrfdisk.dll Wed 31 Aug 2005 13:30:08 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\pgrfdisk.dll Sun 10 Jul 2005 0:16:20 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\piofmap.dll Thu 4 Aug 2005 9:42:36 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\plfmgr.dll Wed 22 Jun 2005 12:32:46 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ptdx5016.dll Wed 22 Jun 2005 12:32:50 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32 laenh.dll Fri 2 Sep 2005 9:44:10 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32 lmotepg.dll Thu 23 Jun 2005 12:51:18 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32 updd.dll Sat 9 Jul 2005 9:52:42 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32 uvpsp.dll Tue 12 Jul 2005 13:23:02 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\scell.dll Sat 20 Aug 2005 18:17:02 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\sdfolder.dll Wed 22 Jun 2005 12:33:34 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\shorder.dll Sun 7 Aug 2005 13:35:16 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\sjbcsp.dll Thu 23 Jun 2005 8:38:00 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\sjrwvdrv.dll Sun 4 Sep 2005 17:29:36 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\smc_os~1.dll Wed 24 Aug 2005 8:48:58 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\soc.dll Sat 25 Jun 2005 8:42:04 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\soorder.dll Fri 26 Aug 2005 8:41:30 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\spdoclc.dll Mon 4 Jul 2005 13:39:30 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\svartm~1.dll Fri 1 Jul 2005 9:12:20 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\swtupdll.dll Sat 13 Aug 2005 16:36:36 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\szlunirl.dll Sat 6 Aug 2005 8:59:56 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32 cbyuv.dll Wed 29 Jun 2005 8:48:06 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32 kpmib.dll Sat 3 Sep 2005 23:34:24 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\vla.dll Sat 3 Sep 2005 23:49:36 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\vms_ps.dll Thu 25 Aug 2005 8:35:12 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\vwpodbc.dll Fri 24 Jun 2005 13:25:34 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\vzsapi.dll Sat 6 Aug 2005 14:56:28 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\wbadmoe.dll Sun 21 Aug 2005 15:59:46 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\wcvemsp.dll Tue 23 Aug 2005 8:35:36 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\wlntrust.dll Tue 16 Aug 2005 8:37:08 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\wm2bticm.dll Sat 27 Aug 2005 11:50:56 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\wonhtt~1.dll Fri 5 Aug 2005 8:09:44 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\woploc.dll Thu 4 Aug 2005 18:06:32 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\wqninet.dll Mon 11 Jul 2005 10:35:16 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\wravideo.dll Thu 4 Aug 2005 16:40:48 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\wvcdlg.dll Wed 31 Aug 2005 13:25:02 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\ww2_32.dll Sun 4 Sep 2005 17:45:48 ..S.R 417 792 408,00 K C:\WINDOWS\SYSTEM32\wznsta.dll Wed 10 Aug 2005 18:13:20 ..S.R 417 792 408,00 K ________________________________________________ 1 443 items found: 1 443 files (128 H/S), 0 directories. Total of file sizes: 330 547 751 bytes 315,23 M Administrator Account = True --------------------End log----------------- voici le rapport FIND IT NT: Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. Find.bat is running from: C:\Documents and Settings\MR BELLANDE\Mes documents\SB\FIND IT NT ------- System Files in System32 Directory ------- Le volume dans le lecteur C n'a pas de nom. Le num‚ro de s‚rie du volume est BC8B-0FBE R‚pertoire de C:\WINDOWS\System32 05/09/2005 09:30 417ÿ792 adlui.dll 05/09/2005 09:20 417ÿ792 jwaw400.dll 04/09/2005 17:45 417ÿ792 ww2_32.dll 04/09/2005 17:29 417ÿ792 sjrwvdrv.dll 04/09/2005 16:23 417ÿ792 mpxml2r.dll 03/09/2005 23:50 417ÿ792 aUaamon.dll 03/09/2005 23:49 417ÿ792 vla.dll 03/09/2005 23:43 417ÿ792 afstream.dll 03/09/2005 23:34 417ÿ792 tkpmib.dll 03/09/2005 22:55 417ÿ792 mriseq.dll 02/09/2005 13:46 417ÿ792 assnt.dll 02/09/2005 13:36 417ÿ792 obbcconf.dll 02/09/2005 12:21 417ÿ792 lrrhelp.dll 02/09/2005 12:21 417ÿ792 kxdsg.dll 02/09/2005 12:19 417ÿ792 dynlobby.dll 02/09/2005 12:15 417ÿ792 nktui0.dll 02/09/2005 09:44 417ÿ792 rlaenh.dll 02/09/2005 09:12 417ÿ792 idxmontr.dll 01/09/2005 17:24 417ÿ792 cqmcat.dll 01/09/2005 13:42 417ÿ792 mxobjs.dll 01/09/2005 13:24 417ÿ792 codial32.dll 01/09/2005 13:14 417ÿ792 nqhtml.dll 01/09/2005 13:11 417ÿ792 IXIGN32.DLL 01/09/2005 13:05 417ÿ792 MWCONF.DLL 01/09/2005 09:13 417ÿ792 MOPI32.DLL 31/08/2005 17:31 417ÿ792 guard.tmp 31/08/2005 16:45 417ÿ792 MFCTF.dll 31/08/2005 13:30 417ÿ792 pcrfdisk.dll 31/08/2005 13:25 417ÿ792 wvcdlg.dll 31/08/2005 12:41 417ÿ792 CTMODEM.DLL 31/08/2005 08:39 417ÿ792 oyengl32.dll 30/08/2005 08:43 417ÿ792 ivlogmsg.dll 29/08/2005 09:44 417ÿ792 mpltus40.dll 29/08/2005 09:22 417ÿ792 mmvcr70.dll 27/08/2005 11:50 417ÿ792 WM2bticm.dll 27/08/2005 11:00 417ÿ792 arphelp.dll 26/08/2005 08:41 417ÿ792 SoOrder.dll 25/08/2005 08:35 417ÿ792 vms_ps.dll 24/08/2005 08:48 417ÿ792 smc_os.dll_ 23/08/2005 08:35 417ÿ792 wCvemsp.dll 22/08/2005 15:39 417ÿ792 dtdlgs.dll 21/08/2005 16:59 417ÿ792 djlay.dll 21/08/2005 16:47 417ÿ792 mfi.dll 21/08/2005 15:59 417ÿ792 wbadmoe.dll 20/08/2005 18:17 417ÿ792 scell.dll 18/08/2005 18:16 417ÿ792 oreadm.dll 18/08/2005 08:41 417ÿ792 mntext40.dll 17/08/2005 09:16 417ÿ792 icircl.dll 17/08/2005 09:07 417ÿ792 cGbw32.dll 17/08/2005 08:47 417ÿ792 iqv6mon.dll 16/08/2005 08:37 417ÿ792 wlntrust.dll 15/08/2005 19:27 417ÿ792 iuss.dll 15/08/2005 15:49 417ÿ792 LRCWMI.DLL 15/08/2005 15:40 417ÿ792 dcvacm.dll 13/08/2005 18:18 DLLCACHE 13/08/2005 16:36 417ÿ792 swtupdll.dll 12/08/2005 10:01 417ÿ792 miafd.dll 11/08/2005 08:33 417ÿ792 ibxwan.dll 10/08/2005 18:13 417ÿ792 wznsta.dll 10/08/2005 16:03 417ÿ792 cyedui.dll 10/08/2005 11:28 417ÿ792 moiseq.dll 10/08/2005 10:00 417ÿ792 dqus10.dll 09/08/2005 13:45 417ÿ792 ccrtmgr.dll 09/08/2005 10:50 417ÿ792 fhsext32.dll 08/08/2005 09:18 417ÿ792 mmyuv.dll 07/08/2005 15:08 417ÿ792 MGPI32.DLL 07/08/2005 13:35 417ÿ792 ShOrder.dll 06/08/2005 14:56 417ÿ792 vzsapi.dll 06/08/2005 08:59 417ÿ792 szlunirl.dll 05/08/2005 08:09 417ÿ792 WONHTTP(2).DLL 04/08/2005 18:06 417ÿ792 woploc.dll 04/08/2005 16:58 417ÿ792 la32.dll 04/08/2005 16:40 417ÿ792 wravideo.dll 04/08/2005 16:26 417ÿ792 mviole16.dll 04/08/2005 09:42 417ÿ792 piofmap.dll 03/08/2005 08:36 417ÿ792 nnxpnt.dll 31/07/2005 16:18 417ÿ792 ammparse.dll 29/07/2005 09:16 417ÿ792 aoycfilt.dll 28/07/2005 10:44 417ÿ792 cCtsrvut.dll 27/07/2005 08:38 417ÿ792 mwafd.dll 26/07/2005 08:29 417ÿ792 ihxmontr.dll 25/07/2005 08:25 417ÿ792 acsldpc.dll 24/07/2005 09:57 417ÿ792 ncshrui.dll 23/07/2005 14:50 417ÿ792 itengine.dll 22/07/2005 16:44 417ÿ792 cTmocx.dll 22/07/2005 15:24 417ÿ792 mtwmdmsp.dll 22/07/2005 15:24 417ÿ792 mbminst.dll 15/07/2005 09:50 417ÿ792 delayx.dll 13/07/2005 08:31 417ÿ792 mtsign32.dll 12/07/2005 13:23 417ÿ792 ruvpsp.dll 12/07/2005 08:26 417ÿ792 azrsvc.dll 11/07/2005 10:35 417ÿ792 wqninet.dll 11/07/2005 09:32 417ÿ792 bfotvid.dll 11/07/2005 08:40 417ÿ792 mrutilse.dll 11/07/2005 08:38 417ÿ792 eacimg.dll 10/07/2005 00:16 417ÿ792 pgrfdisk.dll 09/07/2005 23:46 417ÿ792 iKsrad.dll 09/07/2005 21:26 417ÿ792 kidal.dll 09/07/2005 09:52 417ÿ792 rupdd.dll 08/07/2005 13:44 417ÿ792 gnmf32.dll 07/07/2005 17:12 417ÿ792 kqdal.dll 07/07/2005 08:15 417ÿ792 oXkley.dll 06/07/2005 09:46 417ÿ792 adfsipc.dll 04/07/2005 13:39 417ÿ792 spdoclc.dll 04/07/2005 09:08 417ÿ792 aesldp.dll 02/07/2005 15:28 417ÿ792 kadest.dll 02/07/2005 08:52 417ÿ792 kydcz1.dll 01/07/2005 13:09 417ÿ792 mvhtmled.dll 01/07/2005 09:12 417ÿ792 SvartMenuXP.dll 30/06/2005 17:37 417ÿ792 irxmontr.dll 30/06/2005 17:14 417ÿ792 mfieftp.dll 29/06/2005 08:53 417ÿ792 oofox32.dll 29/06/2005 08:48 417ÿ792 tcbyuv.dll 28/06/2005 13:40 417ÿ792 ewentlog.dll 28/06/2005 11:27 417ÿ792 ixetppui.dll 28/06/2005 09:50 417ÿ792 ooeaccrc.dll 28/06/2005 09:43 417ÿ792 ndtcfgx.dll 27/06/2005 09:26 417ÿ792 chrpol.dll 25/06/2005 08:42 417ÿ792 soc.dll 24/06/2005 13:25 417ÿ792 VWPODBC.DLL 24/06/2005 10:42 417ÿ792 mrexch40.dll 24/06/2005 10:34 417ÿ792 ib41_qc.dll 24/06/2005 09:51 417ÿ792 aamlib.dll 23/06/2005 16:42 417ÿ792 etentprf.dll 23/06/2005 12:51 417ÿ792 RLMOTEPG.DLL 23/06/2005 08:37 417ÿ792 sjbcsp.dll 22/06/2005 12:33 417ÿ792 sdfolder.dll 22/06/2005 12:32 417ÿ792 ptdx5016.dll 22/06/2005 12:32 417ÿ792 plfmgr.dll 22/06/2005 12:32 417ÿ792 NSTAudioFile2.dll 14/03/2005 11:57 32 {4C6FC18A-2F57-4CC9-8BFC-4B00561978C5}.dat 06/03/2005 15:16 11ÿ690 KGyGaAvL.sys 24/12/2004 13:52 56 4B864AF98E.sys 11/10/2004 20:08 Microsoft 132 fichier(s) 53ÿ906ÿ946 octets 2 R‚p(s) 65ÿ896ÿ820ÿ736 octets libres ------- Hidden Files in System32 Directory ------- Le volume dans le lecteur C n'a pas de nom. Le num‚ro de s‚rie du volume est BC8B-0FBE R‚pertoire de C:\WINDOWS\System32 31/08/2005 13:26 890 vsconfig.xml 29/08/2005 09:43 4ÿ212 zllictbl.dat 13/08/2005 18:18 DLLCACHE 24/05/2005 13:15 488 WindowsLogon.manifest 24/05/2005 13:15 488 logonui.exe.manifest 24/05/2005 13:15 749 cdplayer.exe.manifest 24/05/2005 13:15 749 sapi.cpl.manifest 24/05/2005 13:15 749 nwc.cpl.manifest 24/05/2005 13:15 749 ncpa.cpl.manifest 24/05/2005 13:15 749 wuaucpl.cpl.manifest 14/03/2005 11:57 32 {4C6FC18A-2F57-4CC9-8BFC-4B00561978C5}.dat 06/03/2005 15:16 11ÿ690 KGyGaAvL.sys 24/12/2004 13:52 56 4B864AF98E.sys 12 fichier(s) 21ÿ601 octets 1 R‚p(s) 65ÿ896ÿ816ÿ640 octets libres ------------ Files Named "Guard" --------------- Le volume dans le lecteur C n'a pas de nom. Le num‚ro de s‚rie du volume est BC8B-0FBE R‚pertoire de C:\WINDOWS\System32 31/08/2005 17:31 417ÿ792 guard.tmp 1 fichier(s) 417ÿ792 octets 0 R‚p(s) 65ÿ896ÿ816ÿ640 octets libres ------ Temp Files in System32 Directory ------ Le volume dans le lecteur C n'a pas de nom. Le num‚ro de s‚rie du volume est BC8B-0FBE R‚pertoire de C:\WINDOWS\System32 31/08/2005 17:31 417ÿ792 guard.tmp 1 fichier(s) 417ÿ792 octets 0 R‚p(s) 65ÿ896ÿ816ÿ640 octets libres ------------------ User Agent ---------------- REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{DC536E55-A293-7203-2FA2-8DD061C9EAE8}"="" ------------- Keys Under Notify ------------- REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @="" "DLLName"="igfxsrvc.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ermsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif] "DLLName"="wzcdlg.dll" "Logon"="WZCEventLogon" "Logoff"="WZCEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000000 ------------- Locate.com Results ------------- C:\WINDOWS\SYSTEM32\ aamlib.dll Fri 24 Jun 2005 9:51:42 ..S.R 417 792 408,00 K acsldpc.dll Mon 25 Jul 2005 8:25:10 ..S.R 417 792 408,00 K adfsipc.dll Wed 6 Jul 2005 9:46:48 ..S.R 417 792 408,00 K adlui.dll Mon 5 Sep 2005 9:30:40 ..S.R 417 792 408,00 K aesldp.dll Mon 4 Jul 2005 9:08:08 ..S.R 417 792 408,00 K afstream.dll Sat 3 Sep 2005 23:43:08 ..S.R 417 792 408,00 K ammparse.dll Sun 31 Jul 2005 16:18:54 ..S.R 417 792 408,00 K aoycfilt.dll Fri 29 Jul 2005 9:16:38 ..S.R 417 792 408,00 K arphelp.dll Sat 27 Aug 2005 11:00:40 ..S.R 417 792 408,00 K assnt.dll Fri 2 Sep 2005 13:46:40 ..S.R 417 792 408,00 K auaamon.dll Sat 3 Sep 2005 23:50:34 ..S.R 417 792 408,00 K azrsvc.dll Tue 12 Jul 2005 8:26:12 ..S.R 417 792 408,00 K bfotvid.dll Mon 11 Jul 2005 9:32:20 ..S.R 417 792 408,00 K ccrtmgr.dll Tue 9 Aug 2005 13:45:58 ..S.R 417 792 408,00 K cctsrvut.dll Thu 28 Jul 2005 10:44:38 ..S.R 417 792 408,00 K cgbw32.dll Wed 17 Aug 2005 9:07:08 ..S.R 417 792 408,00 K chrpol.dll Mon 27 Jun 2005 9:26:32 ..S.R 417 792 408,00 K codial32.dll Thu 1 Sep 2005 13:24:48 ..S.R 417 792 408,00 K cqmcat.dll Thu 1 Sep 2005 17:24:58 ..S.R 417 792 408,00 K ctmocx.dll Fri 22 Jul 2005 16:44:58 ..S.R 417 792 408,00 K ctmodem.dll Wed 31 Aug 2005 12:41:40 ..S.R 417 792 408,00 K cyedui.dll Wed 10 Aug 2005 16:03:08 ..S.R 417 792 408,00 K dcvacm.dll Mon 15 Aug 2005 15:40:52 ..S.R 417 792 408,00 K delayx.dll Fri 15 Jul 2005 9:50:54 ..S.R 417 792 408,00 K djlay.dll Sun 21 Aug 2005 16:59:36 ..S.R 417 792 408,00 K dqus10.dll Wed 10 Aug 2005 10:00:24 ..S.R 417 792 408,00 K dtdlgs.dll Mon 22 Aug 2005 15:39:22 ..S.R 417 792 408,00 K dynlobby.dll Fri 2 Sep 2005 12:20:00 ..S.R 417 792 408,00 K eacimg.dll Mon 11 Jul 2005 8:38:04 ..S.R 417 792 408,00 K etentprf.dll Thu 23 Jun 2005 16:42:26 ..S.R 417 792 408,00 K ewentlog.dll Tue 28 Jun 2005 13:40:14 ..S.R 417 792 408,00 K fhsext32.dll Tue 9 Aug 2005 10:50:10 ..S.R 417 792 408,00 K gnmf32.dll Fri 8 Jul 2005 13:44:22 ..S.R 417 792 408,00 K guard.tmp Wed 31 Aug 2005 17:31:56 ..S.R 417 792 408,00 K ib41_qc.dll Fri 24 Jun 2005 10:34:20 ..S.R 417 792 408,00 K ibxwan.dll Thu 11 Aug 2005 8:34:00 ..S.R 417 792 408,00 K icircl.dll Wed 17 Aug 2005 9:16:28 ..S.R 417 792 408,00 K idxmontr.dll Fri 2 Sep 2005 9:12:02 ..S.R 417 792 408,00 K ihxmontr.dll Tue 26 Jul 2005 8:29:04 ..S.R 417 792 408,00 K iksrad.dll Sat 9 Jul 2005 23:46:04 ..S.R 417 792 408,00 K iqv6mon.dll Wed 17 Aug 2005 8:47:24 ..S.R 417 792 408,00 K irxmontr.dll Thu 30 Jun 2005 17:37:26 ..S.R 417 792 408,00 K itengine.dll Sat 23 Jul 2005 14:50:48 ..S.R 417 792 408,00 K iuss.dll Mon 15 Aug 2005 19:27:08 ..S.R 417 792 408,00 K ivlogmsg.dll Tue 30 Aug 2005 8:43:48 ..S.R 417 792 408,00 K ixetppui.dll Tue 28 Jun 2005 11:27:34 ..S.R 417 792 408,00 K ixign32.dll Thu 1 Sep 2005 13:11:58 ..S.R 417 792 408,00 K jwaw400.dll Mon 5 Sep 2005 9:20:22 ..S.R 417 792 408,00 K kadest.dll Sat 2 Jul 2005 15:28:42 ..S.R 417 792 408,00 K kidal.dll Sat 9 Jul 2005 21:26:48 ..S.R 417 792 408,00 K kqdal.dll Thu 7 Jul 2005 17:12:34 ..S.R 417 792 408,00 K kxdsg.dll Fri 2 Sep 2005 12:21:40 ..S.R 417 792 408,00 K kydcz1.dll Sat 2 Jul 2005 8:52:42 ..S.R 417 792 408,00 K la32.dll Thu 4 Aug 2005 16:58:48 ..S.R 417 792 408,00 K lrcwmi.dll Mon 15 Aug 2005 15:49:58 ..S.R 417 792 408,00 K lrrhelp.dll Fri 2 Sep 2005 12:22:00 ..S.R 417 792 408,00 K mbminst.dll Fri 22 Jul 2005 15:24:52 ..S.R 417 792 408,00 K mfctf.dll Wed 31 Aug 2005 16:45:28 ..S.R 417 792 408,00 K mfi.dll Sun 21 Aug 2005 16:47:36 ..S.R 417 792 408,00 K mfieftp.dll Thu 30 Jun 2005 17:14:28 ..S.R 417 792 408,00 K mgpi32.dll Sun 7 Aug 2005 15:08:30 ..S.R 417 792 408,00 K miafd.dll Fri 12 Aug 2005 10:02:00 ..S.R 417 792 408,00 K mmvcr70.dll Mon 29 Aug 2005 9:22:52 ..S.R 417 792 408,00 K mmyuv.dll Mon 8 Aug 2005 9:18:48 ..S.R 417 792 408,00 K mntext40.dll Thu 18 Aug 2005 8:41:12 ..S.R 417 792 408,00 K moiseq.dll Wed 10 Aug 2005 11:28:36 ..S.R 417 792 408,00 K mopi32.dll Thu 1 Sep 2005 9:13:04 ..S.R 417 792 408,00 K mpltus40.dll Mon 29 Aug 2005 9:44:38 ..S.R 417 792 408,00 K mpxml2r.dll Sun 4 Sep 2005 16:23:38 ..S.R 417 792 408,00 K mrexch40.dll Fri 24 Jun 2005 10:42:30 ..S.R 417 792 408,00 K mriseq.dll Sat 3 Sep 2005 22:55:08 ..S.R 417 792 408,00 K mrutilse.dll Mon 11 Jul 2005 8:40:04 ..S.R 417 792 408,00 K mtsign32.dll Wed 13 Jul 2005 8:31:42 ..S.R 417 792 408,00 K mtwmdmsp.dll Fri 22 Jul 2005 15:24:56 ..S.R 417 792 408,00 K mvhtmled.dll Fri 1 Jul 2005 13:09:24 ..S.R 417 792 408,00 K mviole16.dll Thu 4 Aug 2005 16:26:26 ..S.R 417 792 408,00 K mwafd.dll Wed 27 Jul 2005 8:38:58 ..S.R 417 792 408,00 K mwconf.dll Thu 1 Sep 2005 13:05:50 ..S.R 417 792 408,00 K mxobjs.dll Thu 1 Sep 2005 13:42:52 ..S.R 417 792 408,00 K ncshrui.dll Sun 24 Jul 2005 9:57:16 ..S.R 417 792 408,00 K ndtcfgx.dll Tue 28 Jun 2005 9:43:10 ..S.R 417 792 408,00 K nktui0.dll Fri 2 Sep 2005 12:15:58 ..S.R 417 792 408,00 K nnxpnt.dll Wed 3 Aug 2005 8:36:46 ..S.R 417 792 408,00 K nqhtml.dll Thu 1 Sep 2005 13:14:06 ..S.R 417 792 408,00 K nstaud~1.dll Wed 22 Jun 2005 12:32:10 ..S.R 417 792 408,00 K obbcconf.dll Fri 2 Sep 2005 13:36:34 ..S.R 417 792 408,00 K ooeaccrc.dll Tue 28 Jun 2005 9:50:26 ..S.R 417 792 408,00 K oofox32.dll Wed 29 Jun 2005 8:53:34 ..S.R 417 792 408,00 K oreadm.dll Thu 18 Aug 2005 18:16:44 ..S.R 417 792 408,00 K oxkley.dll Thu 7 Jul 2005 8:15:46 ..S.R 417 792 408,00 K oyengl32.dll Wed 31 Aug 2005 8:39:20 ..S.R 417 792 408,00 K pcrfdisk.dll Wed 31 Aug 2005 13:30:08 ..S.R 417 792 408,00 K pgrfdisk.dll Sun 10 Jul 2005 0:16:20 ..S.R 417 792 408,00 K piofmap.dll Thu 4 Aug 2005 9:42:36 ..S.R 417 792 408,00 K plfmgr.dll Wed 22 Jun 2005 12:32:46 ..S.R 417 792 408,00 K ptdx5016.dll Wed 22 Jun 2005 12:32:50 ..S.R 417 792 408,00 K rlaenh.dll Fri 2 Sep 2005 9:44:10 ..S.R 417 792 408,00 K rlmotepg.dll Thu 23 Jun 2005 12:51:18 ..S.R 417 792 408,00 K rupdd.dll Sat 9 Jul 2005 9:52:42 ..S.R 417 792 408,00 K ruvpsp.dll Tue 12 Jul 2005 13:23:02 ..S.R 417 792 408,00 K scell.dll Sat 20 Aug 2005 18:17:02 ..S.R 417 792 408,00 K sdfolder.dll Wed 22 Jun 2005 12:33:34 ..S.R 417 792 408,00 K shorder.dll Sun 7 Aug 2005 13:35:16 ..S.R 417 792 408,00 K sjbcsp.dll Thu 23 Jun 2005 8:38:00 ..S.R 417 792 408,00 K sjrwvdrv.dll Sun 4 Sep 2005 17:29:36 ..S.R 417 792 408,00 K smc_os~1.dll Wed 24 Aug 2005 8:48:58 ..S.R 417 792 408,00 K soc.dll Sat 25 Jun 2005 8:42:04 ..S.R 417 792 408,00 K soorder.dll Fri 26 Aug 2005 8:41:30 ..S.R 417 792 408,00 K spdoclc.dll Mon 4 Jul 2005 13:39:30 ..S.R 417 792 408,00 K svartm~1.dll Fri 1 Jul 2005 9:12:20 ..S.R 417 792 408,00 K swtupdll.dll Sat 13 Aug 2005 16:36:36 ..S.R 417 792 408,00 K szlunirl.dll Sat 6 Aug 2005 8:59:56 ..S.R 417 792 408,00 K tcbyuv.dll Wed 29 Jun 2005 8:48:06 ..S.R 417 792 408,00 K tkpmib.dll Sat 3 Sep 2005 23:34:24 ..S.R 417 792 408,00 K vla.dll Sat 3 Sep 2005 23:49:36 ..S.R 417 792 408,00 K vms_ps.dll Thu 25 Aug 2005 8:35:12 ..S.R 417 792 408,00 K vsconfig.xml Wed 31 Aug 2005 13:26:08 A..H. 890 0,87 K vwpodbc.dll Fri 24 Jun 2005 13:25:34 ..S.R 417 792 408,00 K vzsapi.dll Sat 6 Aug 2005 14:56:28 ..S.R 417 792 408,00 K wbadmoe.dll Sun 21 Aug 2005 15:59:46 ..S.R 417 792 408,00 K wcvemsp.dll Tue 23 Aug 2005 8:35:36 ..S.R 417 792 408,00 K wlntrust.dll Tue 16 Aug 2005 8:37:08 ..S.R 417 792 408,00 K wm2bticm.dll Sat 27 Aug 2005 11:50:56 ..S.R 417 792 408,00 K wonhtt~1.dll Fri 5 Aug 2005 8:09:44 ..S.R 417 792 408,00 K woploc.dll Thu 4 Aug 2005 18:06:32 ..S.R 417 792 408,00 K wqninet.dll Mon 11 Jul 2005 10:35:16 ..S.R 417 792 408,00 K wravideo.dll Thu 4 Aug 2005 16:40:48 ..S.R 417 792 408,00 K wvcdlg.dll Wed 31 Aug 2005 13:25:02 ..S.R 417 792 408,00 K ww2_32.dll Sun 4 Sep 2005 17:45:48 ..S.R 417 792 408,00 K wznsta.dll Wed 10 Aug 2005 18:13:20 ..S.R 417 792 408,00 K zllictbl.dat Mon 29 Aug 2005 9:43:24 ...H. 4 212 4,11 K 131 items found: 131 files, 0 directories. Total of file sizes: 53 900 270 bytes 51,40 M -------- Strings.exe Qoologic Results -------- --------- Strings.exe Aspack Results --------- C:\WINDOWS\SYSTEM32\jesterss.dll: .aspack C:\WINDOWS\SYSTEM32\jesterss.dll: .aspack -------------- HKLM Run Key ---------------- REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" "PCMService"="\"C:\Program Files\Dell\Media Experience\PCMService.exe\"" "UpdateManager"="\"C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe\" /r" "VirusScan"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" "Iomega Startup Options"="C:\Program Files\Iomega\Common\ImgStart.exe" "Iomega Drive Icons"="C:\Program Files\Iomega\DriveIcons\ImgIcon.exe" "GSICONEXE"="GSICON.EXE" "DSLAGENTEXE"="dslagent.exe USB" "Drag'n'Drop_Autolaunch"="\"C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe\"" "gcasServ"="\"C:\Program Files\Microsoft AntiSpyware\gcasServ.exe\"" "TkBellExe"="\"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe\" -osboot" "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" "QuickTime Task"="\"C:\Program Files\QuickTime\qttask.exe\" -atboottime" "WooCnxMon"="C:\PROGRA~1\Wanadoo\CnxMon.exe" "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" "HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe" "Zone Labs Client"="\"C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" voici le rapport HIJACK: Logfile of HijackThis v1.99.1 Scan saved at 12:53:38, on 05/09/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AVPersonal\AVWUPSRV.EXE C:\PROGRA~1\Iomega\System32\AppServices.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32 undll32.exe C:\WINDOWS\System32\dwwin.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Iomega\DriveIcons\ImgIcon.exe C:\WINDOWS\System32\GSICON.EXE C:\WINDOWS\System32\dslagent.exe C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\Wanadoo\CnxMon.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Fichiers communs\Sonic Shared\cinetray.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Wanadoo\EspaceWanadoo.exe C:\Program Files\Wanadoo\ComComp.exe C:\Program Files\Wanadoo\Watch.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Outlook Express\msimn.exe C:\Documents and Settings\MR BELLANDE\Mes documents\SB\DIVERS\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [VirusScan] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe" O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" -osboot O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = ? O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1102584932234 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://paris.tourismeville.wanadoo.fr/AxisCamControl.cab O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{211B6530-3A92-4F96-844D-D10B419BB830}: NameServer = 80.10.246.130 80.10.246.3 O17 - HKLM\System\CCS\Services\Tcpip\..\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}: NameServer = 195.95.218.1,85.255.112.7 O17 - HKLM\System\CS1\Services\Tcpip\..\{211B6530-3A92-4F96-844D-D10B419BB830}: NameServer = 80.10.246.130 80.10.246.3 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe O23 - Service: AntiVir Update Temp (TmpUpSrv) - Unknown owner - C:\DOCUME~1\MRBELL~1\LOCALS~1\TEMP\_VWUPSRV.EXE (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

balltrap34 · Answer

saluttelecharge ceciKill Box :       (ici)               http://www.florensac-chasse-trap.com/   section virusdemo    http://pageperso.aol.fr/balltrap34/killbox.htmutilise le avec la methode bloc note (voir demo)avec ceciC:\WINDOWS\SYSTEM32\aamlib.dll C:\WINDOWS\SYSTEM32\acsldpc.dllC:\WINDOWS\SYSTEM32\adfsipc.dll C:\WINDOWS\SYSTEM32\adlui.dll C:\WINDOWS\SYSTEM32\aesldp.dll  C:\WINDOWS\SYSTEM32\afstream.dll C:\WINDOWS\SYSTEM32\ammparse.dll C:\WINDOWS\SYSTEM32\aoycfilt.dll C:\WINDOWS\SYSTEM32\arphelp.dll C:\WINDOWS\SYSTEM32\assnt.dll C:\WINDOWS\SYSTEM32\auaamon.dll C:\WINDOWS\SYSTEM32\azrsvc.dll C:\WINDOWS\SYSTEM32\bfotvid.dll C:\WINDOWS\SYSTEM32\ccrtmgr.dll C:\WINDOWS\SYSTEM32\cctsrvut.dll C:\WINDOWS\SYSTEM32\cgbw32.dll C:\WINDOWS\SYSTEM32\chrpol.dll  C:\WINDOWS\SYSTEM32\codial32.dll C:\WINDOWS\SYSTEM32\cqmcat.dll C:\WINDOWS\SYSTEM32\ctmocx.dll C:\WINDOWS\SYSTEM32\ctmodem.dll C:\WINDOWS\SYSTEM32\cyedui.dll  C:\WINDOWS\SYSTEM32\dcvacm.dll C:\WINDOWS\SYSTEM32\delayx.dll  C:\WINDOWS\SYSTEM32\djlay.dll  C:\WINDOWS\SYSTEM32\dqus10.dll C:\WINDOWS\SYSTEM32\dtdlgs.dll  C:\WINDOWS\SYSTEM32\dynlobby.dll  C:\WINDOWS\SYSTEM32\eacimg.dll  C:\WINDOWS\SYSTEM32\etentprf.dll C:\WINDOWS\SYSTEM32\ewentlog.dll  C:\WINDOWS\SYSTEM32\fhsext32.dll  C:\WINDOWS\SYSTEM32\gnmf32.dll C:\WINDOWS\SYSTEM32\ib41_qc.dll C:\WINDOWS\SYSTEM32\ibxwan.dll  C:\WINDOWS\SYSTEM32\icircl.dll  C:\WINDOWS\SYSTEM32\idxmontr.dll C:\WINDOWS\SYSTEM32\ihxmontr.dll  C:\WINDOWS\SYSTEM32\iksrad.dll  C:\WINDOWS\SYSTEM32\iqv6mon.dll  C:\WINDOWS\SYSTEM32\irxmontr.dll  C:\WINDOWS\SYSTEM32\itengine.dll C:\WINDOWS\SYSTEM32\iuss.dll  C:\WINDOWS\SYSTEM32\ivlogmsg.dll C:\WINDOWS\SYSTEM32\ixetppui.dll C:\WINDOWS\SYSTEM32\ixign32.dll  C:\WINDOWS\SYSTEM32\jwaw400.dll  C:\WINDOWS\SYSTEM32\kadest.dll C:\WINDOWS\SYSTEM32\kidal.dll  C:\WINDOWS\SYSTEM32\kqdal.dll  C:\WINDOWS\SYSTEM32\kxdsg.dll C:\WINDOWS\SYSTEM32\kydcz1.dll  C:\WINDOWS\SYSTEM32\la32.dll C:\WINDOWS\SYSTEM32\lrcwmi.dll  C:\WINDOWS\SYSTEM32\lrrhelp.dll C:\WINDOWS\SYSTEM32\mbminst.dll  C:\WINDOWS\SYSTEM32\mfctf.dll C:\WINDOWS\SYSTEM32\mfi.dll  C:\WINDOWS\SYSTEM32\mfieftp.dll C:\WINDOWS\SYSTEM32\mgpi32.dll  C:\WINDOWS\SYSTEM32\miafd.dll C:\WINDOWS\SYSTEM32\mmvcr70.dll C:\WINDOWS\SYSTEM32\mmyuv.dll  C:\WINDOWS\SYSTEM32\mntext40.dll C:\WINDOWS\SYSTEM32\moiseq.dll  C:\WINDOWS\SYSTEM32\mopi32.dll  C:\WINDOWS\SYSTEM32\mpltus40.dll  C:\WINDOWS\SYSTEM32\mpxml2r.dll C:\WINDOWS\SYSTEM32\mrexch40.dll  C:\WINDOWS\SYSTEM32\mriseq.dll  C:\WINDOWS\SYSTEM32\mrutilse.dll  C:\WINDOWS\SYSTEM32\mtsign32.dllC:\WINDOWS\SYSTEM32\mtwmdmsp.dll C:\WINDOWS\SYSTEM32\mvhtmled.dll C:\WINDOWS\SYSTEM32\mviole16.dll  C:\WINDOWS\SYSTEM32\mwafd.dll  C:\WINDOWS\SYSTEM32\mwconf.dll C:\WINDOWS\SYSTEM32\mxobjs.dll C:\WINDOWS\SYSTEM32
cshrui.dll  C:\WINDOWS\SYSTEM32
dtcfgx.dll  C:\WINDOWS\SYSTEM32
ktui0.dll  C:\WINDOWS\SYSTEM32
nxpnt.dll C:\WINDOWS\SYSTEM32
qhtml.dll  C:\WINDOWS\SYSTEM32
staud~1.dll  C:\WINDOWS\SYSTEM32\obbcconf.dll  C:\WINDOWS\SYSTEM32\ooeaccrc.dll  C:\WINDOWS\SYSTEM32\oofox32.dll C:\WINDOWS\SYSTEM32\oreadm.dll C:\WINDOWS\SYSTEM32\oxkley.dll  C:\WINDOWS\SYSTEM32\oyengl32.dll C:\WINDOWS\SYSTEM32\pcrfdisk.dll C:\WINDOWS\SYSTEM32\pgrfdisk.dll C:\WINDOWS\SYSTEM32\piofmap.dll C:\WINDOWS\SYSTEM32\plfmgr.dll  C:\WINDOWS\SYSTEM32\ptdx5016.dll C:\WINDOWS\SYSTEM32laenh.dll C:\WINDOWS\SYSTEM32lmotepg.dll C:\WINDOWS\SYSTEM32updd.dll C:\WINDOWS\SYSTEM32uvpsp.dll C:\WINDOWS\SYSTEM32\scell.dll C:\WINDOWS\SYSTEM32\sdfolder.dll C:\WINDOWS\SYSTEM32\shorder.dll  C:\WINDOWS\SYSTEM32\sjbcsp.dll  C:\WINDOWS\SYSTEM32\sjrwvdrv.dll C:\WINDOWS\SYSTEM32\smc_os~1.dll C:\WINDOWS\SYSTEM32\soc.dll C:\WINDOWS\SYSTEM32\soorder.dll C:\WINDOWS\SYSTEM32\spdoclc.dll  C:\WINDOWS\SYSTEM32\svartm~1.dll C:\WINDOWS\SYSTEM32\swtupdll.dll C:\WINDOWS\SYSTEM32\szlunirl.dll C:\WINDOWS\SYSTEM32	cbyuv.dll  C:\WINDOWS\SYSTEM32	kpmib.dll C:\WINDOWS\SYSTEM32\vla.dll C:\WINDOWS\SYSTEM32\vms_ps.dll C:\WINDOWS\SYSTEM32\vwpodbc.dll C:\WINDOWS\SYSTEM32\vzsapi.dll C:\WINDOWS\SYSTEM32\wbadmoe.dll  C:\WINDOWS\SYSTEM32\wcvemsp.dll C:\WINDOWS\SYSTEM32\wlntrust.dll  C:\WINDOWS\SYSTEM32\wm2bticm.dll C:\WINDOWS\SYSTEM32\wonhtt~1.dll  C:\WINDOWS\SYSTEM32\woploc.dll  C:\WINDOWS\SYSTEM32\wqninet.dll C:\WINDOWS\SYSTEM32\wravideo.dll  C:\WINDOWS\SYSTEM32\wvcdlg.dll C:\WINDOWS\SYSTEM32\ww2_32.dll  C:\WINDOWS\SYSTEM32\wznsta.dll ________________________________________________  ouvre le bloc note et copie colle ceci entre les etoiles**********REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{DC536E55-A293-7203-2FA2-8DD061C9EAE8}"=-************enregistre le sur ton bureau et nomme le www.reget dans la case en dessous type met sur tous fichiersla vas sur ton bureau et double clik sur se fichier que tu vient de faire et accepte la fusion avec le registre------------&#9658; relance hijack coche ces lignes et  ensuite clik sur fixR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1102584932234 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://paris.tourismeville.wanadoo.fr/AxisCamControl.cab O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab ****************************************************************&#9658; redemarre en mode sans echecmode sans echec pour cela tu tapote la touche f8 des le debut de l allumage du pc sans t arreter une fenetre vas souvrir tute deplace avec les fleches du clavier sur demarreren mode sans echec une fois sur le bureau il ni auras pas toutes les couleurs et autres c est normal.si f8 ne marche pas utilise la touche f5****************************************************************&#9658; recherche et suppr ceciattention seulement les fichiers si tu trouveC:\WINDOWS\Nail.exe ****************************************************************&#9658;passe  adaware et vire tous se qu il trouve    ****************************************************************&#9658;passe spy boot et vire tous se qu il trouvent****************************************************************&#9658;passe a2****************************************************************tu vide ta poubelle et tu redemarre en mode normal et refait un hijack et precise ou en sont tes soucis-----------

STBE41 · Answer

Bonjour,mon problème de fenètres PAYPOPUP  et SEARC'H  semble êtrerésolu.merci à BALLTRAP34   et JEAN 38 pour votre aide.

balltrap34 · Answer

lolremet un hijack pour que l ont verifie

STBE41 · Answer

Voici mon hijack:

Logfile of HijackThis v1.99.1
Scan saved at 12:18:52, on 06/09/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\WINDOWS\System32\GSICON.EXE
C:\WINDOWS\System32\dslagent.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Wanadoo\CnxMon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\a2\a2guard.exe
C:\Program Files\Fichiers communs\Sonic Shared\cinetray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\dwwin.exe
C:\Program Files\Wanadoo\EspaceWanadoo.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\MR BELLANDE\Mes documents\SB\DIVERS\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [VirusScan] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a2\a2guard.exe"
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{211B6530-3A92-4F96-844D-D10B419BB830}: NameServer = 80.10.246.1 80.10.246.132
O17 - HKLM\System\CCS\Services\Tcpip\..\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}: NameServer = 195.95.218.1,85.255.112.7
O17 - HKLM\System\CS1\Services\Tcpip\..\{211B6530-3A92-4F96-844D-D10B419BB830}: NameServer = 80.10.246.1 80.10.246.132
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: AntiVir Update Temp (TmpUpSrv) - Unknown owner - C:\DOCUME~1\MRBELL~1\LOCALS~1\TEMP\_VWUPSRV.EXE (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

balltrap34 · Answer

salut
le temp de la manip desactive a2 et le the timer de spybot si il est activer
(voir demo) http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

► imprime ceci pour ne rien oublier et tous faire
tous faire dans l ordre imperativement
****************************************************************
► tous da bord telecharge ces programmes si tu ne les a pas et met les a jour mais ne les utilise pas encore et verifie que tu as les bonnes version c est imperatif

♪ ad-aware (1)version 1.06

(ici) http://www.florensac-chasse-trap.com/ section virus
voir demo
http://pageperso.aol.fr/balltrap34/adwseflash.zip
***
♪ spybot (2)version 1.4

(ici) http://www.florensac-chasse-trap.com/ section virus
voir demo
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm
***
et aussi ceci
♪ CleanUp40.exe(3)

voir demo
http://pageperso.aol.fr/balltrap34/democleanup.htm
***
♪ a2(4)

http://www.emsisoft.net/fr/
penser a le metre a jour avant de scanner le pc
***

****************************************************************
► desactive ta restauration systeme

pour ça tu fais clic droit sur poste de travail
propriété tu clique sur onglet restauration système
tu coche la case désactiver la restauration et applique
****************************************************************

► assure toi de ceci

Affiche tous les fichiers et dossiers :
cliquer sur démarrer/panneau de configuration/option des dossiers/affichage
Cocher afficher les dossiers cacher

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

Décocher masquer les extensions dont le type est connu
Puis fais «Ok» pour valider les changements.

Et appliquer
****************************************************************
► vide tes fichiers temps et tempory internet file sur tous les utilisateur

utilise ceci pour le faire
♪http://pageperso.aol.fr/Balltrap34/CleanUp40.exe

****************************************************************
► relance hijack coche ces lignes et ensuite clik sur fix
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}: NameServer = 195.95.218.1,85.255.112.7

****************************************************************
► redemarre en mode sans echec

mode sans echec pour cela tu tapote la touche f8
des le debut de l allumage du pc sans t arreter
une fenetre vas souvrir tute deplace avec les fleches du clavier sur demarreren mode sans echec
une fois sur le bureau il ni auras pas toutes les couleurs et autres c est normal.si f8 ne marche pas utilise la touche f5
****************************************************************
► recherche et suppr ceci

C:\WINDOWS\Nail.exe

****************************************************************

►passe adaware et vire tous se qu il trouve
****************************************************************
►passe spy boot et vire tous se qu il trouvent
****************************************************************
►passe a2
****************************************************************
tu vide ta poubelle et tu redemarre en mode normal
****************************************************************

télécharge ceci Registry Search Tool
http://www.billsway.com/vbspage/
decompresse le et tape
96CAC0E6-F5E6-4984-BA10-F330B930FC56
et copie colle le resultat dans le bloc note et donne le nous

et refait un hijack

et precise ou en sont tes soucis

--

STBE41 · Answer

voici le rapport REGISTRY SEARCH TOOL:

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "96CAC0E6-F5E6-4984-BA10-F330B930FC56" 07/09/2005 10:34:19

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)

voici le log HIJACK:

Logfile of HijackThis v1.99.1
Scan saved at 10:38:57, on 07/09/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\WINDOWS\System32\GSICON.EXE
C:\WINDOWS\System32\dslagent.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Wanadoo\CnxMon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\a2\a2guard.exe
C:\Program Files\Fichiers communs\Sonic Shared\cinetray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\dwwin.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\FlexiSIGN-PRO 7.5v3\Program\App.exe
C:\Program Files\Wanadoo\EspaceWanadoo.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\MR BELLANDE\Mes documents\SB\DIVERS\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [VirusScan] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a2\a2guard.exe"
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{211B6530-3A92-4F96-844D-D10B419BB830}: NameServer = 80.10.246.1 80.10.246.132
O17 - HKLM\System\CCS\Services\Tcpip\..\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}: NameServer = 195.95.218.1,85.255.112.7
O17 - HKLM\System\CS1\Services\Tcpip\..\{211B6530-3A92-4F96-844D-D10B419BB830}: NameServer = 80.10.246.1 80.10.246.132
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: AntiVir Update Temp (TmpUpSrv) - Unknown owner - C:\DOCUME~1\MRBELL~1\LOCALS~1\TEMP\_VWUPSRV.EXE (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters\General]
"InterfaceList"="\\DEVICE\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\2]
"ServiceName"="{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001]
"NetCfgInstanceId"="{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Connection]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces\Tcpip_{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PSched\Parameters\Adapters\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess\Interfaces\2]
"InterfaceName"="{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Adapters\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Parameters\Tcpip]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001]
"NetCfgInstanceId"="{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Connection]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\NetBT\Parameters\Interfaces\Tcpip_{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\PSched\Parameters\Adapters\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\RemoteAccess\Interfaces\2]
"InterfaceName"="{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Adapters\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Parameters\Tcpip]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001]
"NetCfgInstanceId"="{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Connection]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PSched\Parameters\Adapters\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\2]
"InterfaceName"="{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Parameters\Tcpip]

balltrap34 · Answer

tous d abord par securite vas dans la base de registre et fait clik droit sur ces clef et exporter
enregistre le sur ton bureau et donne lui le nom que tu veut suivi de .reg
fait le pour les deux clef si dessous
HKEY_LOCAL_MACHINE\SOFTWARE
HKEY_LOCAL_MACHINE\SYSTEM

ouvre le bloc note et copie colle ceci entre les etoiles
**********
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters\General]
"InterfaceList"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\2]
"ServiceName"=-

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001]
"NetCfgInstanceId"=-

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Control]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Connection]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces\Tcpip_{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PSched\Parameters\Adapters\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess\Interfaces\2]
"InterfaceName"=-

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Adapters\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Parameters]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Parameters\Tcpip]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001]
"NetCfgInstanceId"=-

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Connection]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\NetBT\Parameters\Interfaces\Tcpip_{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\PSched\Parameters\Adapters\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\RemoteAccess\Interfaces\2]
"InterfaceName"=-

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Adapters\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Parameters]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Parameters\Tcpip]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001]
"NetCfgInstanceId"=-

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Control]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Connection]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PSched\Parameters\Adapters\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\2]
"InterfaceName"=-

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Parameters]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Parameters\Tcpip]

*****************************************
enregistre le sur ton bureau et nomme le www.reg
et dans la case en dessous type met sur tous fichiers

la vas sur ton bureau et double clik sur se fichier que tu vient de faire et accepte la fusion avec le registre

relance hijack coche et fix
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}: NameServer = 195.95.218.1,85.255.112.7

redemarre refait un hijack
et a nouveau la recherche dans le registre
télécharge ceci Registry Search Tool
http://www.billsway.com/vbspage/
decompresse le et tape
96CAC0E6-F5E6-4984-BA10-F330B930FC56
et copie colle le resultat dans le bloc note et donne le nous

STBE41 · Answer

Merci.D' accord, mais comment faire pour aller dans la base de registre ?

jean38 · Answer

salut,

en l'absence de balltrap, deblocage. Pour aller dans la base de registre, tu vas dans le menu demarrer, executer, tu tapes regedit

ensuite tu navigues comme avec l'explorateur windows.

A+

(là je suis largué et ne eux t'aider, trop technique).

Jean

STBE41 · Answer

Voici le résultat Registry Search Tool:

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "96CAC0E6-F5E6-4984-BA10-F330B930FC56" 09/09/2005 15:51:05

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Control]

balltrap34 · Answer

tu as bien sauvegarder la base de registre

STBE41 · Answer

C' est une question ?

balltrap34 · Answer

oui

STBE41 · Answer

oui j'ai exporté les 2 clefs de la base de registre sur le bureau.

balltrap34 · Answer

oki
fait ceci
et apres un hijack sans redemarrer et aussi a nouveau la recherche avec
http://www.billsway.com/vbspage/
decompresse le et tape
96CAC0E6-F5E6-4984-BA10-F330B930FC56
et copie colle le resultat dans le bloc note et donne le nous

ne redemarre pas

STBE41 · Answer

résultat de RegSearch:

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "96CAC0E6-F5E6-4984-BA10-F330B930FC56" 11/09/2005 16:28:17

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Control]

balltrap34 · Answer

desoler je t est mis fait ceci sans te mettre se qu il faut faire lol je recommence

ouvre le bloc note et copie colle ceci entre les etoiles
**********
REGEDIT4
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Control]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}]
"SymbolicLink"="\\\\?\\PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{96CAC0E6-F5E6-4984-BA10-F330B930FC56}"

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}\##?#PCI#VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01#4&3b1caf2b&0&48F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}\#{96CAC0E6-F5E6-4984-BA10-F330B930FC56}\Control]

************
enregistre le sur ton bureau et nomme le www.reg
et dans la case en dessous type met sur tous fichiers

la vas sur ton bureau et double clik sur se fichier que tu vient de faire et accepte la fusion avec le registre

et apres un hijack sans redemarrer et aussi a nouveau la recherche avec
http://www.billsway.com/vbspage/
decompresse le et tape
96CAC0E6-F5E6-4984-BA10-F330B930FC56
et copie colle le resultat dans le bloc note et donne le nous

ne redemarre pas

FENETRES PAUPOPUP ET SEARC'H - Page 2

Discussions similaires

Newsletters