Ouverture intempestive fenetre

Résolu
djelevif -  
Bonjour, depuis quelques jours des fenetres internet (gogoel,porno,pub...) s'ouvrent toutes seules ; j'ai passé toute une panoplie d'antivirus (avast,spyboot,ad remov,malvaresbytes..) mais rien n'y fait . j'ai xp sp3 .que faire ??
je vous post les rapports hijacks et navilog
merci d'avance pour un peu d'aide tant que l'ordi est encore en vie !!!

Fix Navipromo version 4.0.9 commencé le 27/01/2011 11:59:41,07

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\navilog1

Mise à jour le 24.11.2010 à 16h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) XP 2500+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : dje ( Administrator )
BOOT : Normal boot

Antivirus : avast! Antivirus 5.0.83952505 (Activated)

A:\ (USB)
C:\ (Local Disk) - NTFS - Total:76 Go (Free:41 Go)
D:\ (CD or DVD)
E:\ (USB)

Recherche executée en mode normal

[b]Aucune Infection Navipromo/Egdaccess trouvée/b

*** Scan terminé 27/01/2011 12:00:34,95 ***

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 09:30:44, on 07/01/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\sstray.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SFR\Kit\9props.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Plus500\main\InvestSoftProject.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\dje\Mes documents\RSIT.exe
C:\Program Files\trend micro\dje.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer fourni par 01net.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Aide à la navigation SFR - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LXCYCATS] rundll32 C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Connexion SFR 9props.exe] "C:\Program Files\SFR\Kit\9props.exe" /trayicon
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Barre d'état système d'ATI CATALYST.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
O9 - Extra button: PartyPoker.fr - {725EC34E-943C-4df6-B0B2-FBDE7F242276} - C:\Program Files\PartyFrance\PartyPokerFr\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.fr - {725EC34E-943C-4df6-B0B2-FBDE7F242276} - C:\Program Files\PartyFrance\PartyPokerFr\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe (file missing)
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: lxcy_device - - C:\WINDOWS\system32\lxcycoms.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

--
End of file - 6954 bytes

32 réponses

Résumé de la discussion

Des fenêtres publicitaires s'ouvrent spontanément et l'ordinateur sous Windows XP SP3 montre des signes d'infection, malgré plusieurs antivirus et outils anti-malware dont Avast et HijackThis. Les propositions des aides privilégient des méthodes de nettoyage plus profondes, incluant la création d'un script dump.cmd et l'analyse du MBR avec des outils comme bootkit remover et virustotal. D'autres interventions suggèrent Malwarebytes, OTL et GMER pour dépister les rootkits et les modules Avast, tandis que les résultats HijackThis et les rapports de dépistage servent à orienter le diagnostic. En cas de persistance, certains éléments évoquent des services et pilotes modifiés ou des clés de registre, ce qui peut nécessiter une remise à niveau ou une réinstallation.

Bobot (l’IA à votre service)
  1. Malekal_morte- Modérateur
    Salut,

    Télécharge et installe Malwarebyte : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
    Mets le à jour, fais un scan, supprime tout et poste le rapport ici.

    puis :

    Tu peux suivre les indications de cette page pour t'aider : https://www.malekal.com/tutorial-otl/

    * Télécharge http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ sur ton bureau.
    (Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)

    * Lance OTL
    * Sous Peronnalisation, copie-colle ce qu'il y a dans le cadre ci-dessous :
    netsvcs
    msconfig
    safebootminimal
    safebootnetwork
    activex
    drivers32
    %ALLUSERSPROFILE\%Application Data\*.
    %ALLUSERSPROFILE%\Application Data\*.exe /s
    %APPDATA%\*.
    %APPDATA%\*.exe /s
    %SYSTEMDRIVE%\*.exe
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32drivers\*.sys /lockedfiles
    %systemroot%\System32config\*.sav
    /md5start
    explorer.exe
    winlogon.exe
    wininit.exe
    /md5stop
    CREATERESTOREPOINT
    * Clique sur le bouton Analyse.
    * Quand le scan est fini, utilise le site http://www.cijoint.fr/ pour me donner les deux rapports : OTL.Txt et Extras.Txt.

    1. djelevif Auteur
      merci beaucoup pour ton aide malekal

      voici les liens pour "cijoint"

      otl txt : http://www.cijoint.fr/cjlink.php?file=cj201101/cijFUgY2Yo.txt
      otl extra txt : http://www.cijoint.fr/cjlink.php?file=cj201101/cijlC7dfBA.txt

      et un rapport de malwarebytes en mode sans echec

      Malwarebytes' Anti-Malware 1.50.1.1100
      www.malwarebytes.org

      Version de la base de données: 5617

      Windows 5.1.2600 Service Pack 3 (Safe Mode)
      Internet Explorer 8.0.6001.18702

      27/01/2011 15:17:52
      mbam-log-2011-01-27 (15-17-52).txt

      Type d'examen: Examen complet (C:\|)
      Elément(s) analysé(s): 184551
      Temps écoulé: 18 minute(s), 35 seconde(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 0
      Valeur(s) du Registre infectée(s): 0
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 0

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Valeur(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      (Aucun élément nuisible détecté)
      1. Malekal_morte- Modérateur
        otl txt : http://www.cijoint.fr/cjlink.php?file=cj201101/cijFUgY2Yo.txt

        c'est le rapport malwarebyte que tu as mis là et non le rapport OTL.TXT :)
        1. djelevif Auteur
          désolé malekal je me suis mélangé les pinceaux...

          voila le lien pour otl txt

          http://www.cijoint.fr/cjlink.php?file=cj201101/cij0z7N3mH.txt
          2. Malekal_morte- Modérateur
            Désinstalle Spybot et Trojan Remover.
            Servent à rien.

            Tes popups tu les as quand tu surfs ou quand tu fais des choses en particulier ?

            Si tu fais une recherche Google, tu attéris sur le bon site ?

            Fais ceci :

            Menu Démarrer / executer et tape : cmd puis clic sur OK.
            Dans la nouvelle fenêtre noire, tape (sans faute!) :
            ping www.google.fr >> c:testcnx.txt puis appuye sur la touche entrée du clavier
            Ferme toutes les fenêtres.

            ~~

            Passe TDSSkiller : https://forum.malekal.com/viewtopic.php?t=28637&start=
            Poste le rapport ici.
            1. djelevif Auteur
              les fenetres s'ouvrent des que la connection internet est active ; elles s'ouvrent a l'allumage de l'ordi , lorsque je ne fais rien sur le pc ou a l'ouverture d'une nouvelle page internet

              j'ai fait une recherche sur google et ça fonctionne normalement . aucune ouverture depuis un ptit moment

              j'ai fait ta manip et je pense qu'elle a marché .

              je te post le rapport de tdsskiller

              2011/01/27 17:48:43.0140 TDSS rootkit removing tool 2.4.15.0 Jan 22 2011 19:37:53
              2011/01/27 17:48:43.0140 ================================================================================
              2011/01/27 17:48:43.0140 SystemInfo:
              2011/01/27 17:48:43.0140
              2011/01/27 17:48:43.0140 OS Version: 5.1.2600 ServicePack: 3.0
              2011/01/27 17:48:43.0140 Product type: Workstation
              2011/01/27 17:48:43.0140 ComputerName: DJE-01D30545EBE
              2011/01/27 17:48:43.0140 UserName: dje
              2011/01/27 17:48:43.0140 Windows directory: C:\WINDOWS
              2011/01/27 17:48:43.0140 System windows directory: C:\WINDOWS
              2011/01/27 17:48:43.0140 Processor architecture: Intel x86
              2011/01/27 17:48:43.0140 Number of processors: 1
              2011/01/27 17:48:43.0140 Page size: 0x1000
              2011/01/27 17:48:43.0140 Boot type: Normal boot
              2011/01/27 17:48:43.0140 ================================================================================
              2011/01/27 17:48:43.0359 !crdlk
              2011/01/27 17:48:43.0406 Initialize success
              2011/01/27 17:48:46.0484 ================================================================================
              2011/01/27 17:48:46.0484 Scan started
              2011/01/27 17:48:46.0484 Mode: Manual;
              2011/01/27 17:48:46.0484 ================================================================================
              2011/01/27 17:48:46.0859 Aavmker4 (479c9835b91147be1a92cb76fad9c6de) C:\WINDOWS\system32\drivers\Aavmker4.sys
              2011/01/27 17:48:47.0000 ACPI (e5e6dbfc41ea8aad005cb9a57a96b43b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
              2011/01/27 17:48:47.0062 ACPIEC (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\drivers\ACPIEC.sys
              2011/01/27 17:48:47.0171 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
              2011/01/27 17:48:47.0250 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
              2011/01/27 17:48:47.0515 AmdK7 (d3dabc57be6d456dfd4bc026cfa582ff) C:\WINDOWS\system32\DRIVERS\amdk7.sys
              2011/01/27 17:48:47.0718 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
              2011/01/27 17:48:47.0921 aswFsBlk (cba53c5e29ae0a0ce76f9a2be3a40d9e) C:\WINDOWS\system32\drivers\aswFsBlk.sys
              2011/01/27 17:48:47.0968 aswMon2 (a1c52b822b7b8a5c2162d38f579f97b7) C:\WINDOWS\system32\drivers\aswMon2.sys
              2011/01/27 17:48:48.0015 aswRdr (b6e8c5874377a42756c282fac2e20836) C:\WINDOWS\system32\drivers\aswRdr.sys
              2011/01/27 17:48:48.0062 aswSP (b93a553c9b0f14263c8f016a44c3258c) C:\WINDOWS\system32\drivers\aswSP.sys
              2011/01/27 17:48:48.0125 aswTdi (1408421505257846eb336feeef33352d) C:\WINDOWS\system32\drivers\aswTdi.sys
              2011/01/27 17:48:48.0156 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
              2011/01/27 17:48:48.0218 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
              2011/01/27 17:48:48.0406 ati2mtag (03621f7f968ff63713943405deb777f9) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
              2011/01/27 17:48:48.0515 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
              2011/01/27 17:48:48.0578 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
              2011/01/27 17:48:48.0687 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
              2011/01/27 17:48:48.0937 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
              2011/01/27 17:48:49.0015 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
              2011/01/27 17:48:49.0093 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
              2011/01/27 17:48:49.0140 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
              2011/01/27 17:48:49.0421 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
              2011/01/27 17:48:49.0531 dmboot (f5deadd42335fb33edca74ecb2f36cba) C:\WINDOWS\system32\drivers\dmboot.sys
              2011/01/27 17:48:49.0609 dmio (5a7c47c9b3f9fb92a66410a7509f0c71) C:\WINDOWS\system32\drivers\dmio.sys
              2011/01/27 17:48:49.0671 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
              2011/01/27 17:48:49.0750 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
              2011/01/27 17:48:49.0828 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
              2011/01/27 17:48:49.0921 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
              2011/01/27 17:48:49.0968 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
              2011/01/27 17:48:50.0015 Fips (31f923eb2170fc172c81abda0045d18c) C:\WINDOWS\system32\drivers\Fips.sys
              2011/01/27 17:48:50.0046 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
              2011/01/27 17:48:50.0078 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
              2011/01/27 17:48:50.0125 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
              2011/01/27 17:48:50.0171 Ftdisk (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
              2011/01/27 17:48:50.0234 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
              2011/01/27 17:48:50.0312 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
              2011/01/27 17:48:50.0421 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
              2011/01/27 17:48:50.0531 i8042prt (a09bdc4ed10e3b2e0ec27bb94af32516) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
              2011/01/27 17:48:50.0578 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
              2011/01/27 17:48:50.0734 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
              2011/01/27 17:48:50.0781 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
              2011/01/27 17:48:50.0843 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
              2011/01/27 17:48:50.0906 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
              2011/01/27 17:48:50.0937 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
              2011/01/27 17:48:50.0984 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
              2011/01/27 17:48:51.0046 isapnp (355836975a67b6554bca60328cd6cb74) C:\WINDOWS\system32\DRIVERS\isapnp.sys
              2011/01/27 17:48:51.0078 Kbdclass (16813155807c6881f4bfbf6657424659) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
              2011/01/27 17:48:51.0125 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
              2011/01/27 17:48:51.0171 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
              2011/01/27 17:48:51.0312 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
              2011/01/27 17:48:51.0375 Modem (510ade9327fe84c10254e1902697e25f) C:\WINDOWS\system32\drivers\Modem.sys
              2011/01/27 17:48:51.0437 Mouclass (027c01bd7ef3349aaebc883d8a799efb) C:\WINDOWS\system32\DRIVERS\mouclass.sys
              2011/01/27 17:48:51.0468 mouhid (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
              2011/01/27 17:48:51.0500 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
              2011/01/27 17:48:51.0562 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
              2011/01/27 17:48:51.0640 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
              2011/01/27 17:48:51.0703 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
              2011/01/27 17:48:51.0765 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
              2011/01/27 17:48:51.0812 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
              2011/01/27 17:48:51.0875 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
              2011/01/27 17:48:51.0937 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
              2011/01/27 17:48:51.0968 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
              2011/01/27 17:48:52.0015 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
              2011/01/27 17:48:52.0046 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
              2011/01/27 17:48:52.0125 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
              2011/01/27 17:48:52.0156 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
              2011/01/27 17:48:52.0218 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
              2011/01/27 17:48:52.0281 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
              2011/01/27 17:48:52.0328 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
              2011/01/27 17:48:52.0406 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
              2011/01/27 17:48:52.0468 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
              2011/01/27 17:48:52.0531 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
              2011/01/27 17:48:52.0625 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
              2011/01/27 17:48:52.0703 nvax (5640fd98f8ffe02b7d835b8e733e9558) C:\WINDOWS\system32\drivers\nvax.sys
              2011/01/27 17:48:52.0765 NVENET (fbe448efa5484a256528e1d02b959bbc) C:\WINDOWS\system32\DRIVERS\NVENET.sys
              2011/01/27 17:48:52.0796 nvidesm (857acf58d21d6a7f2eab84fb54b4eda4) C:\WINDOWS\system32\drivers\nvidesm.sys
              2011/01/27 17:48:52.0843 nvnforce (971353f5216286dceeb471bbb957260d) C:\WINDOWS\system32\drivers\nvapu.sys
              2011/01/27 17:48:52.0906 nv_agp (db36442c20793c53b4128eb85f9a3d32) C:\WINDOWS\system32\DRIVERS\nv_agp.sys
              2011/01/27 17:48:52.0968 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
              2011/01/27 17:48:53.0015 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
              2011/01/27 17:48:53.0046 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
              2011/01/27 17:48:53.0125 Parport (8fd0bdbea875d06ccf6c945ca9abaf75) C:\WINDOWS\system32\DRIVERS\parport.sys
              2011/01/27 17:48:53.0156 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
              2011/01/27 17:48:53.0250 ParVdm (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
              2011/01/27 17:48:53.0296 PCASp50 (07c02c892e8e1a72d6bf35004f0e9c5e) C:\WINDOWS\system32\Drivers\PCASp50.sys
              2011/01/27 17:48:53.0375 PCI (043410877bda580c528f45165f7125bc) C:\WINDOWS\system32\DRIVERS\pci.sys
              2011/01/27 17:48:53.0437 PCIIde (f4bfde7209c14a07aaa61e4d6ae69eac) C:\WINDOWS\system32\DRIVERS\pciide.sys
              2011/01/27 17:48:53.0515 Pcmcia (f0406cbc60bdb0394a0e17ffb04cdd3d) C:\WINDOWS\system32\drivers\Pcmcia.sys
              2011/01/27 17:48:53.0859 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
              2011/01/27 17:48:53.0890 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
              2011/01/27 17:48:53.0937 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
              2011/01/27 17:48:54.0156 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
              2011/01/27 17:48:54.0203 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
              2011/01/27 17:48:54.0250 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
              2011/01/27 17:48:54.0296 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
              2011/01/27 17:48:54.0359 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
              2011/01/27 17:48:54.0390 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
              2011/01/27 17:48:54.0453 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
              2011/01/27 17:48:54.0515 redbook (d8eb2a7904db6c916eb5361878ddcbae) C:\WINDOWS\system32\DRIVERS\redbook.sys
              2011/01/27 17:48:54.0625 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
              2011/01/27 17:48:54.0703 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
              2011/01/27 17:48:54.0750 Serial (93d313c31f7ad9ea2b75f26075413c7c) C:\WINDOWS\system32\DRIVERS\serial.sys
              2011/01/27 17:48:54.0812 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
              2011/01/27 17:48:54.0968 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
              2011/01/27 17:48:55.0015 sr (39626e6dc1fb39434ec40c42722b660a) C:\WINDOWS\system32\DRIVERS\sr.sys
              2011/01/27 17:48:55.0093 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
              2011/01/27 17:48:55.0187 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
              2011/01/27 17:48:55.0218 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
              2011/01/27 17:48:55.0406 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
              2011/01/27 17:48:55.0484 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
              2011/01/27 17:48:55.0578 Tcpip6 (4e53bbcc4be37d7a4bd6ef1098c89ff7) C:\WINDOWS\system32\DRIVERS\tcpip6.sys
              2011/01/27 17:48:55.0640 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
              2011/01/27 17:48:55.0734 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
              2011/01/27 17:48:55.0781 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
              2011/01/27 17:48:55.0906 tunmp (8f861eda21c05857eb8197300a92501c) C:\WINDOWS\system32\DRIVERS\tunmp.sys
              2011/01/27 17:48:55.0968 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
              2011/01/27 17:48:56.0062 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
              2011/01/27 17:48:56.0140 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
              2011/01/27 17:48:56.0171 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
              2011/01/27 17:48:56.0250 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
              2011/01/27 17:48:56.0296 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
              2011/01/27 17:48:56.0375 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
              2011/01/27 17:48:56.0421 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
              2011/01/27 17:48:56.0453 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
              2011/01/27 17:48:56.0500 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
              2011/01/27 17:48:56.0593 VolSnap (46de1126684369bace4849e4fc8c43ca) C:\WINDOWS\system32\drivers\VolSnap.sys
              2011/01/27 17:48:56.0671 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
              2011/01/27 17:48:56.0750 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
              2011/01/27 17:48:57.0015 ================================================================================
              2011/01/27 17:48:57.0015 Scan finished
              2011/01/27 17:48:57.0015 ================================================================================
              1. Malekal_morte- Modérateur
                Envoice fichier sur http://upload.malekal.com : C:\WINDOWS\System32\14223465641.dll

                Tu as Combofix non ?
                Je vois que le 7 tu l'as utililisé.
                Tu peux poster le rapport C:\Combofix.txt stp.

                1. djelevif Auteur
                  je t'ai envoyé le fichier et je te post le rapport de combofix que j'ai reinstallé car il ne voulait plus fonctionner .

                  ComboFix 11-01-26.04 - dje 27/01/2011 18:30:57.2.1 - x86
                  Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1535.1146 [GMT 1:00]
                  Lancé depuis: c:\documents and settings\dje\Bureau\ComboFix.exe
                  AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
                  .

                  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                  .

                  c:\windows\system32\17291573441.dll

                  .
                  ((((((((((((((((((((((((((((( Fichiers créés du 2010-12-27 au 2011-01-27 ))))))))))))))))))))))))))))))))))))
                  .

                  2011-01-07 12:33 . 2011-01-07 12:33 -------- d-----w- c:\documents and settings\dje\Application Data\Malwarebytes
                  2011-01-07 12:33 . 2011-01-07 12:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
                  2011-01-07 12:33 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
                  2011-01-07 12:33 . 2011-01-21 18:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
                  2011-01-07 12:33 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
                  2011-01-07 12:22 . 2011-01-07 12:22 -------- d-----w- c:\documents and settings\dje\Local Settings\Application Data\Mozilla
                  2011-01-07 12:17 . 2011-01-27 17:26 -------- d-----w- c:\program files\Spybot - Search & Destroy
                  2011-01-07 12:17 . 2011-01-27 16:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
                  2011-01-07 08:30 . 2011-01-27 10:53 -------- d-----w- c:\program files\trend micro
                  2011-01-07 08:30 . 2011-01-07 08:32 -------- d-----w- C:\rsit
                  2010-12-31 17:11 . 2010-12-31 17:11 -------- d-----w- c:\program files\Fichiers communs\Data
                  2010-12-31 17:08 . 2010-12-31 17:08 197632 ----a-w- c:\program files\Fichiers communs\OnlineFilesManager.dll

                  .
                  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  2011-01-13 08:47 . 2010-10-13 11:17 188216 ----a-w- c:\windows\system32\aswBoot.exe
                  2011-01-13 08:41 . 2010-10-13 11:17 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
                  2011-01-13 08:40 . 2010-10-13 11:17 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
                  2011-01-13 08:40 . 2010-10-13 11:17 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
                  2011-01-13 08:39 . 2010-10-13 11:17 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
                  2011-01-13 08:37 . 2010-10-13 11:17 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
                  2011-01-13 08:37 . 2010-10-13 11:17 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
                  2011-01-13 08:37 . 2010-10-13 11:17 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
                  2010-12-31 20:06 . 2010-10-13 11:17 38848 ----a-w- c:\windows\avastSS.scr
                  2010-11-18 18:12 . 2010-10-13 09:35 86016 ----a-w- c:\windows\system32\isign32.dll
                  2010-11-09 14:52 . 2004-08-05 12:00 249856 ----a-w- c:\windows\system32\odbc32.dll
                  2010-11-06 00:21 . 2004-08-05 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
                  2010-11-06 00:21 . 2004-08-05 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
                  2010-11-06 00:21 . 2004-08-05 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
                  2010-11-03 12:26 . 2004-08-05 12:00 385024 ----a-w- c:\windows\system32\html.iec
                  2010-11-02 15:17 . 2004-08-05 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
                  .

                  ------- Sigcheck -------

                  [7] 2008-04-14 . C1F726EE0B043B074A68992BC4AEF8FD . 178176 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\w32time.dll
                  [7] 2008-04-14 . C1F726EE0B043B074A68992BC4AEF8FD . 178176 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\w32time.dll
                  [-] 2008-04-14 . 2E0AC39D8FAFAC770C6BACCD2646F262 . 178176 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll
                  [7] 2004-08-05 . FB89C8B1D6A3C260A39669320C5D5827 . 177664 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\w32time.dll
                  .
                  ((((((((((((((((((((((((((((( SnapShot@2011-01-11_12.49.50 )))))))))))))))))))))))))))))))))))))))))
                  .
                  + 2004-08-05 12:00 . 2011-01-26 08:49 84526 c:\windows\system32\perfc00C.dat
                  - 2004-08-05 12:00 . 2011-01-05 13:03 84526 c:\windows\system32\perfc00C.dat
                  - 2004-08-05 12:00 . 2011-01-05 13:03 71060 c:\windows\system32\perfc009.dat
                  + 2004-08-05 12:00 . 2011-01-26 08:49 71060 c:\windows\system32\perfc009.dat
                  + 2010-10-13 09:34 . 2008-04-14 02:34 18432 c:\windows\system32\dllcache\iedw.exe
                  + 2004-08-05 12:00 . 2011-01-26 08:49 510324 c:\windows\system32\perfh00C.dat
                  - 2004-08-05 12:00 . 2011-01-05 13:03 510324 c:\windows\system32\perfh00C.dat
                  - 2004-08-05 12:00 . 2011-01-05 13:03 441124 c:\windows\system32\perfh009.dat
                  + 2004-08-05 12:00 . 2011-01-26 08:49 441124 c:\windows\system32\perfh009.dat
                  + 2010-11-09 14:52 . 2010-11-09 14:52 249856 c:\windows\system32\dllcache\odbc32.dll
                  + 2010-11-09 14:52 . 2010-11-09 14:52 102400 c:\windows\system32\dllcache\msjro.dll
                  + 2010-11-09 14:52 . 2010-11-09 14:52 200704 c:\windows\system32\dllcache\msadox.dll
                  + 2010-11-09 14:52 . 2010-11-09 14:52 180224 c:\windows\system32\dllcache\msadomd.dll
                  + 2010-11-09 14:52 . 2010-11-09 14:52 536576 c:\windows\system32\dllcache\msado15.dll
                  + 2010-11-09 14:52 . 2010-11-09 14:52 143360 c:\windows\system32\dllcache\msadco.dll
                  + 2010-10-13 11:02 . 2011-01-12 22:22 37403080 c:\windows\system32\MRT.exe
                  .
                  ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  .
                  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                  REGEDIT4

                  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
                  2009-10-15 08:53 165184 ----a-w- c:\program files\SFR\Kit\SFRNavErrorHelper.dll

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Online Files]
                  @="{B82655E9-B81D-4A97-8154-0D84A4C048E4}"
                  [HKEY_CLASSES_ROOT\CLSID\{B82655E9-B81D-4A97-8154-0D84A4C048E4}]
                  2010-12-31 17:08 197632 ----a-w- c:\program files\Fichiers communs\OnlineFilesManager.dll

                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2009-10-15 959808]

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-05 61440]
                  "avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]
                  "LXCYCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXCYtime.dll" [2006-02-24 65536]

                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

                  c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
                  Barre d''tat systSme d'ATI CATALYST.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-8-6 61440]

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
                  2010-09-20 21:07 932288 ----a-r- c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
                  2010-09-23 02:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
                  2006-02-07 05:10 98304 ----a-w- c:\program files\Lexmark 3400 Series\ezprint.exe

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
                  2006-02-02 08:11 290816 ----a-w- c:\program files\Lexmark Fax Solutions\fm3032.exe

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcymon.exe]
                  2006-03-06 17:48 286720 ----a-w- c:\program files\Lexmark 3400 Series\lxcymon.exe

                  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
                  2010-09-08 09:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                  "%windir%\\system32\\sessmgr.exe"=
                  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                  "c:\\Program Files\\uTorrent\\uTorrent.exe"=
                  "c:\program files\SFR\Media Center\httpd\httpd.exe"= c:\program files\SFR\Media Center\httpd\httpd.exe:172.16.255.0/255.255.255.0,192.168.1.0/255.255.255.0:Enabled:Serveur de partage Media Center (Player SFR)

                  R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [13/10/2010 12:17 294608]
                  R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [13/10/2010 12:17 17744]
                  S2 gupdate;Service Google Update (gupdate);"c:\program files\Google\Update\GoogleUpdate.exe" /svc --> c:\program files\Google\Update\GoogleUpdate.exe [?]
                  S3 lxcy_device;lxcy_device;c:\windows\system32\lxcycoms.exe -service --> c:\windows\system32\lxcycoms.exe -service [?]
                  .
                  Contenu du dossier 'Tâches planifiées'

                  2011-01-21 c:\windows\Tasks\AppleSoftwareUpdate.job
                  - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

                  2011-01-27 c:\windows\Tasks\User_Feed_Synchronization-{57F15C37-9BC5-472F-A01B-F66B691512BE}.job
                  - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
                  .
                  .
                  ------- Examen supplémentaire -------
                  .
                  uStart Page = hxxp://www.yahoo.fr/
                  uInternet Settings,ProxyOverride = <local>
                  IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
                  IE: {{725EC34E-943C-4df6-B0B2-FBDE7F242276} - c:\program files\PartyFrance\PartyPokerFr\RunApp.exe
                  FF - ProfilePath - c:\documents and settings\dje\Application Data\Mozilla\Firefox\Profiles\eccqscqm.default\
                  FF - prefs.js: browser.startup.homepage - hxxp://fr.yahoo.com/
                  FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
                  FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
                  FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
                  .
                  - - - - ORPHELINS SUPPRIMES - - - -

                  MSConfigStartUp-TrojanScanner - c:\program files\Trojan Remover\Trjscan.exe

                  **************************************************************************

                  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2011-01-27 18:35
                  Windows 5.1.2600 Service Pack 3 NTFS

                  Recherche de processus cachés ...

                  Recherche d'éléments en démarrage automatique cachés ...

                  HKLM\Software\Microsoft\Windows\CurrentVersion\Run
                  LXCYCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

                  Recherche de fichiers cachés ...

                  Scan terminé avec succès
                  Fichiers cachés: 0

                  **************************************************************************
                  .
                  --------------------- CLES DE REGISTRE BLOQUEES ---------------------

                  [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
                  @Denied: (A 2) (Everyone)
                  @="FlashBroker"
                  "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

                  [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
                  "Enabled"=dword:00000001

                  [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
                  @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

                  [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
                  @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

                  [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
                  @Denied: (A 2) (Everyone)
                  @="IFlashBroker4"

                  [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
                  @="{00020424-0000-0000-C000-000000000046}"

                  [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
                  @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
                  "Version"="1.0"
                  .
                  --------------------- DLLs chargées dans les processus actifs ---------------------

                  - - - - - - - > 'winlogon.exe'(728)
                  c:\windows\system32\Ati2evxx.dll
                  .
                  Heure de fin: 2011-01-27 18:37:48
                  ComboFix-quarantined-files.txt 2011-01-27 17:37
                  ComboFix2.txt 2011-01-11 12:51

                  Avant-CF: 45 837 258 752 octets libres
                  Après-CF: 45 945 655 296 octets libres

                  - - End Of File - - 203DA74459D6DDE4C9C969897CA03296
                  1. Malekal_morte- Modérateur
                    OK, ton fichier n'est pas un executable, donc c'est pas ces DLL qui sont à l'origine des publicités.
                    ILy a qq chose en dessous style rk qui doit les créer.
                    Ce topic est identique : http://forums.malwarebytes.org/index.php?showtopic=670 (en anglais).
                    Y avait un driver mais tu ne sembles pas en avoir.

                    Ton sujet est interressant :)

                    Scan c:\windows\system32\w32time.dll sur https://www.virustotal.com/gui/
                    donne le lien de scan ici.

                    ~~

                    Télécharge GMER à partir de ce lien : http://www.gmer.net#files - clic sur « Download EXE » et télécharge le fichier sur ton bureau.
                    Voir le tutorial GMER, ça peut peut-être t'aider : https://www.malekal.com/tutorial-gmer/

                    Désactive tes logiciels de protection (antivirus, antispyware etc) et ferme tous les programmes ouverts.
                    Double-clic sur le fichier GMER téléchargé.
                    IMPORTANT: Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.
                    Clic sur l'onglet « rootkit »
                    Laisse tout coché.
                    Clic sur Scan
                    Lorsque le scan est terminé, clic sur « Copy »

                    Ouvre le bloc-note et clic sur le Menu Edition / Coller
                    Le rapport doit alors apparaître.
                    Envoie le rapport sur http://www.cijoint.fr
                    donne le lien ici

                    tjrs sur GMER :

                    Une fois lancé, fais un clic droit sur le fond blanc (comme ci-dessus) et clic sur « Only Non MS files »
                    Clic en bas à droite sur le bouton « Scan » pour lancer le scan.

                    https://www.malekal.com/fichiers/GMER/GMER_ScanType.png

                    Lorsque le scan est terminé, clic sur « Copy »

                    Ouvre le bloc-note et clic sur le Menu Edition / Coller
                    Le rapport doit alors apparaître.
                    Envoie le rapport sur http://www.cijoint.fr
                    donne le lien ici

                    Remember when you were young, you shone like the sun.
                    Shine on you crazy diamond.
                    Now there's a look in your eyes, like black holes in the sky.
                    Shine on you crazy diamond.
                    1. djelevif Auteur
                      désolé de n'avoir pu répondre plus tot

                      le lien pour le topic de malwarebytes ne fonctionne plus

                      le lien pour virustotal
                      http://www.virustotal.com/file-scan/report.html?id=ebddf5687706ab8176c491c8982a738248293ca87d0f986b96e8226dfaed36ee-1296161291

                      les rapports gmer sont des fichiers .log et "cijoint" ne prends pas les .log

                      scan gmer

                      GMER 1.0.15.15530 - http://www.gmer.net
                      Rootkit scan 2011-01-27 21:39:57
                      Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Scsi\nvidesm1Port0Path0Target0Lun0 Maxtor_6 rev.YAR4
                      Running: 3bbqdir3.exe; Driver: C:\DOCUME~1\dje\LOCALS~1\Temp\awnoyfoc.sys

                      ---- System - GMER 1.0.15 ----

                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwAllocateVirtualMemory [0xA524E728]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwClose [0xA52557EA]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateKey [0xA52556A2]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDeleteKey [0xA5255CA8]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDeleteValueKey [0xA5255BBE]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDuplicateObject [0xA5255276]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwFreeVirtualMemory [0xA524E7D8]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenKey [0xA525577E]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenProcess [0xA52551B2]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenThread [0xA5255218]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwProtectVirtualMemory [0xA524E870]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwQueryValueKey [0xA52558C2]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0xA5255D76]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRestoreKey [0xA5255880]
                      SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwSetValueKey [0xA5255A04]

                      Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xA526282E]
                      Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0xA5262652]
                      Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0xA526278C]
                      Code \??\C:\DOCUME~1\dje\LOCALS~1\Temp\catchme.sys pIofCallDriver
                      Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
                      Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
                      Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

                      ---- Kernel code sections - GMER 1.0.15 ----

                      .text ntoskrnl.exe!_abnormal_termination + B0 804E271C 4 Bytes JMP 32A52557
                      .text ntoskrnl.exe!_abnormal_termination + 270 804E28DC 4 Bytes CALL 317ACE05
                      PAGE ntoskrnl.exe!ObInsertObject 8056503A 5 Bytes JMP A525FC88 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
                      PAGE ntoskrnl.exe!NtCreateSection 805652B3 7 Bytes JMP A5262656 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
                      PAGE ntoskrnl.exe!ZwCreateProcessEx 8057FE4C 7 Bytes JMP A5262832 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
                      PAGE ntoskrnl.exe!ObMakeTemporaryObject 8059F8CA 5 Bytes JMP A525E1EE \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
                      PAGE ntoskrnl.exe!ZwLoadDriver 805A3B73 7 Bytes JMP A5262790 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
                      init C:\WINDOWS\system32\drivers\nvax.sys entry point in "init" section [0xBA7E6912]
                      ? C:\WINDOWS\system32\Drivers\PROCEXP113.SYS Le fichier spécifié est introuvable. !
                      ? C:\DOCUME~1\dje\LOCALS~1\Temp\catchme.sys Le fichier spécifié est introuvable. !

                      ---- User code sections - GMER 1.0.15 ----

                      .text C:\WINDOWS\system32\spoolsv.exe[536] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\system32\spoolsv.exe[536] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\system32\spoolsv.exe[536] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\spoolsv.exe[536] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\system32\winlogon.exe[728] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\system32\winlogon.exe[728] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\winlogon.exe[728] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\services.exe[772] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\system32\lsass.exe[808] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\system32\lsass.exe[808] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\lsass.exe[808] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[944] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[960] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\system32\svchost.exe[1056] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\system32\svchost.exe[1056] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1056] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\System32\svchost.exe[1152] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\System32\svchost.exe[1152] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\System32\svchost.exe[1152] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1224] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\system32\svchost.exe[1296] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\system32\svchost.exe[1296] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1296] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\system32\svchost.exe[1332] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\system32\svchost.exe[1332] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1332] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\svchost.exe[1368] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1592] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP }
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\Ati2evxx.exe[1632] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\explorer.exe[1664] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] ADVAPI32.dll!ChangeServiceConfigW + 4 77E07005 1 Byte [EC]
                      .text C:\WINDOWS\explorer.exe[1664] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] USER32.dll!GetCursorPos 7E3A974E 5 Bytes JMP 038AE5D7 C:\Program Files\Fichiers communs\Data\hd7_module.dat
                      .text C:\WINDOWS\explorer.exe[1664] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\explorer.exe[1664] USER32.dll!MessageBoxIndirectA 7E3BA082 5 Bytes JMP 038AE5A2 C:\Program Files\Fichiers communs\Data\hd7_module.dat
                      .text C:\WINDOWS\explorer.exe[1664] USER32.dll!MessageBoxIndirectW 7E3E64D5 5 Bytes JMP 038AE56D C:\Program Files\Fichiers communs\Data\hd7_module.dat
                      .text C:\WINDOWS\system32\wscntfy.exe[1796] ntdll.dll!LdrLoadDll 7C9263C3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\wscntfy.exe[1796] ntdll.dll!LdrUnloadDll 7C92738B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\wscntfy.exe[1796] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\wscntfy.exe[1796] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\wscntfy.exe[1796] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\wscntfy.exe[1796] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\wscntfy.exe[1796] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\wscntfy.exe[1796] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\wscntfy.exe[1796] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 3 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\wscntfy.exe[1796] ADVAPI32.dll!ChangeServiceConfigA + 4 77E06E6D 1 Byte [EC]
                      .text C:\WINDOWS\system32\wscntfy.exe[1796] ADVAPI32.dll!ChangeServiceConfigW 77E07001 3 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
                      .text C:\WINDOWS\system32\wscntfy.exe[1796] ADVAPI32.dll!ChangeServiceConfigW + 4
                      1. Malekal_morte- Modérateur
                        rapport OK.

                        tu en reçois encore des popups ??

                        parce que là tout semble ok :)
                        1. djelevif Auteur
                          bonjour malekal

                          oui j'ai toujours des fenetres de pub , de "gogoel" , et aussi des demandes d'installations par telechargement surtout le matin apres l'allumage de l'ordi
                          1. Malekal_morte- Modérateur
                            Quel logiciel ?

                            * ReLance OTL
                            * Sous Peronnalisation, copie-colle ce qu'il y a dans le cadre ci-dessous :
                            netsvcs
                            msconfig
                            safebootminimal
                            safebootnetwork
                            activex
                            drivers32
                            %ALLUSERSPROFILE\%Application Data\*.
                            %ALLUSERSPROFILE%\Application Data\*.exe /s
                            %APPDATA%\*.
                            %APPDATA%\*.exe /s
                            %temp%\.exe /s
                            %SYSTEMDRIVE%\*.exe
                            %systemroot%\*. /mp /s
                            %systemroot%\system32\*.dll /lockedfiles
                            %systemroot%\Tasks\*.job /lockedfiles
                            %systemroot%\system32\drivers\*.sys /lockedfiles
                            %systemroot%\System32\config\*.sav
                            /md5start
                            explorer.exe
                            winlogon.exe
                            wininit.exe
                            /md5stop
                            CREATERESTOREPOINT
                            nslookup www.google.fr /c
                            * Clique sur le bouton Analyse.
                            * Quand le scan est fini, utilise le site http://www.cijoint.fr/ pour me donner les deux rapports : OTL.Txt et Extras.Txt.

                            ~~

                            Fais un scan NOD32 voir s'il trouve des trucs : https://www.malekal.com/scan-antivirus-ligne-nod32/#NOD32Poste le rapport ici.
                            1. djelevif Auteur
                              si je me rapelle bien il y avait comme logiciel software.inc il faudrait que je fasse une capture d'ecran pour te montrer .

                              je n'ai pas de rapport de scan pour nod32 car il n'a trouvé aucunes infections

                              sur otl je n'ai pas eu de rapport "extras"

                              lien pour otl txt http://www.cijoint.fr/cjlink.php?file=cj201101/cij3Mxy0Mh.txt
                              2. djelevif Auteur
                                le dossier a été supprimé

                                pour remover un message d'erreur lors de l'installation :
                                " ATA_PASS_THROUGH_DIRECT is not supported by your disk controller "
                                SCSI_PASS_THROUGH_DIRECT will be use for disk I/0

                                voila un copier coller de remover
                                Bootkit Remover
                                (c) 2009 eSage Lab
                                www.esagelab.com

                                Program version: 1.2.0.0
                                OS Version: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)

                                System volume is \\.\C:
                                \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000'00007e00
                                ATA_Read(): DeviceIoControl() ERROR 1
                                Boot sector MD5 is: 580e12b06e588182236319551a05ba37

                                Size Device Name MBR Status
                                --------------------------------------------
                                76 GB \\.\PhysicalDrive0 Unknown boot code

                                Unknown boot code has been found on some of your physical disks.
                                To inspect the boot code manually, dump the master boot sector:
                                remover.exe dump <device_name> [output_file]
                                To disinfect the master boot sector, use the following command:
                                remover.exe fix <device_name>

                                Done;
                                Press any key to quit...

                                j'ai aussi une erreur lors du lancement du fichier fix.bat
                                "windows ne trouve pas remover.exe . verifier que vous avez entré le nom correct.....

                                j'ai recupéré aussi des adresses des pages qui s'ouvrent toutes seules

                                https://www.google.com/chrome/?installdataindex=nosearch&brand=CHIK&hl=fr-FR&utm_campaign=fr-FR&utm_source=fr-FR-oa-emea-uk-pt-ChromeFastEMEAQ34&utm_medium=oa

                                http://www.dream-marriage.com/members/new/aff6.php?cb11054=CD91987_

                                http://p.vadorcdn.com/sellpage/lng=fr&niche=19&offer=13&ptid=324460&phid=405677512&own=aHR0cDovL3Nydm12LmNvbS80Nzc1NTQ3MzU2LnBocA&mute=1&pu=1&ex=1

                                http://www.google.fr/...
                                1. djelevif Auteur
                                  je te post aussi un fichier que j'ai retrouvé

                                  Envoi d'une requ^te 'ping' sur www.l.google.com [209.85.147.106] avec 32 octets de donn'esÿ:

                                  R'ponse de 209.85.147.106ÿ: octets=32 temps=67 ms TTL=55

                                  R'ponse de 209.85.147.106ÿ: octets=32 temps=65 ms TTL=55

                                  R'ponse de 209.85.147.106ÿ: octets=32 temps=66 ms TTL=55

                                  R'ponse de 209.85.147.106ÿ: octets=32 temps=66 ms TTL=55

                                  Statistiques Ping pour 209.85.147.106:

                                  Paquetsÿ: envoy's = 4, re#us = 4, perdus = 0 (perte 0%),

                                  Dur'e approximative des boucles en millisecondes :

                                  Minimum = 65ms, Maximum = 67ms, Moyenne = 66ms
                                  1. Malekal_morte- Modérateur
                                    OK fais la manip pour dumper le MBR avec bootkit remover https://forum.malekal.com/viewtopic.php?t=29519&start=

                                    la partie avec le bloc-note et bootkit_remover dump \\.\PhysicalDrive0 copy_mbr

                                    Cela doit créer un fichier copy_mbr
                                    Tu le scannes sur https://www.virustotal.com/gui/
                                    et donne le lien de scan ici.

                                    Remember when you were young, you shone like the sun.
                                    Shine on you crazy diamond.
                                    Now there's a look in your eyes, like black holes in the sky.
                                    Shine on you crazy diamond.
                                    1. djelevif Auteur
                                      voila le lien pour virustotal

                                      http://www.virustotal.com/file-scan/report.html?id=a56f377471130fd38497de67ddd707ad90e590a8eeb9f1b2e6acba6cee76e02f-1296218382

                                      il y a toujours la meme erreur lors du lancement de bootkit

                                      Bootkit Remover
                                      (c) 2009 eSage Lab
                                      www.esagelab.com

                                      Program version: 1.2.0.0
                                      OS Version: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)

                                      System volume is \\.\C:
                                      \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000'00007e00
                                      ATA_Read(): DeviceIoControl() ERROR 1
                                      Boot sector MD5 is: 580e12b06e588182236319551a05ba37

                                      Size Device Name MBR Status
                                      --------------------------------------------
                                      76 GB \\.\PhysicalDrive0 Unknown boot code

                                      Unknown boot code has been found on some of your physical disks.
                                      To inspect the boot code manually, dump the master boot sector:
                                      remover.exe dump <device_name> [output_file]
                                      To disinfect the master boot sector, use the following command:
                                      remover.exe fix <device_name>

                                      Done;
                                      Press any key to quit...
                                      1. Malekal_morte- Modérateur
                                        Non c'est pas bon ce qui a été scanné.

                                        remover doit être présent sur le bureau.

                                        Ouvrir le Bloc-Note et copie/colle ce qu'il y a ci-dessous :
                                        ECHO OFF
                                        remover dump \\.\PhysicalDrive0 copy_mbr
                                        EXIT

                                        * Enregistre le fichier sur ton bureau sous le nom dump.cmd (le .cmd à la fin est important)
                                        * Double clic sur dump.cmd , ça doit ouvrir une fenêtre noir qui va se refermer.

                                        Cela doit créer un fichier copy_mbr
                                        Tu le scannes sur https://www.virustotal.com/gui/
                                        et donne le lien de scan ici.

                                        Remember when you were young, you shone like the sun.
                                        Shine on you crazy diamond.
                                        Now there's a look in your eyes, like black holes in the sky.
                                        Shine on you crazy diamond.
                                        • 1
                                        • 2

                                        Discussions similaires

                                        fenetre intempestive: avast! licensing Alert
                                        remsmi

                                        31 réponses
                                        Verrouillage par fermeture de coque Samsung Galaxy
                                        jicece33

                                        8 réponses
                                        Quel est le raccourci clavier pour le plein écran ?
                                        Carotte77

                                        19 réponses