Virus Ohrda1.Dll Impossible de s'en debarasse Résolu

Question

Virus/trojan - Ohrda1.dll -

Voila j'ai depuis cette aprem ce virus, ou trojan, qui me cause des soucis.
Tout d'abord chaque fois que je veux acceder a mes fichiers ou windows explorer j'ai un message d'alert de mon anti virus.
J'ai regarde sur le net des post sur ce virus, je n'ai rien trouve a part des pages italiennes et un post sur ce forum, que j'ai essaye de suivre, mais je n'arrive pas a lancer blacklight il me refuse l'acces. de meme j'ai essaye d'acceder a des pages web notamment pour telecharger un anti virus prevx, malheureusement le virus me refuse l'acces et j'obtiens a tout les coup une erreur 404.

Bon j'ai reussi a telecharger et faire marcher Hijackthis, mais je sais pas comment proceder pour eliminer ce virus.

Voici le LOG :

Logfile of HijackThis v1.99.1
Scan saved at 21:04:41, on 26/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
c:\windows\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
c:\windows\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\AOL\1157408391\ee\AOLSoftware.exe
C:\Acer\eManager\anbmServ.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\acer\Wireless\Utility\WlanUtil.exe
C:\Program Files\Qurb\QSP-3.0.311.7\QOELoader.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32	cpsvcs.exe
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\program files\fichiers communs\aol\1157408391\ee\aim6.exe
C:\Program Files\Crazy Browser\Crazy Browser.exe
C:\Program Files\Winamp\winamp.exe
C:\Documents and Settings\Olivier Glantschnig\Bureau\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lycos.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {346D8699-DAC7-DD78-5CD4-CA50A929983C} - C:\WINDOWS\ohrda1.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Microsoft Office] C:\WINDOWS\system32\msoff.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1157408391\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [acerWireless] C:\Program Files\acer\Wireless\Utility\WlanUtil.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Fichiers communs\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\Qurb\QSP-3.0.311.7\QOELoader.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Iomega Automatic Backup Pro] "C:\Program Files\Iomega\Automatic Backup Pro\LiveSystem.exe" -s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [UnHackMe Monitor] C:\Program Files\UnHackMe\hackmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: RapidShare-Download - res://D:ppv4_-_43in1__AIO_\RapidShare - the way YOU like it!\more-rapid.exe/RsMenExt.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin
pjpi150_10.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin
pjpi150_10.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFrameWork/v10/StagingUI.cab40641.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} (MALPlaybackCtrl Class) - http://musicstore.connect.com/XSL/mb_us/html/activexplayer/SMALStreaming.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://www.gamespy.com
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner371290.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/StProxy.cab41227.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - The Firebird Project - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogEjn - Unknown owner - \?\C:\Program Files\Fichiers communs\System\lpt9.exe (file missing)
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcappcapd.exe" -d -f "%ProgramFiles%\WinPcappcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)



merci pour votre Aide!

Utilisateur anonyme · Answer

fixe deja ça

[?] - C:\Program Files\acer\eRecovery\Monitor.exe
[N] - O2 - BHO: Class - {346D8699-DAC7-DD78-5CD4-CA50A929983C} - C:\WINDOWS\ohrda1.dll (file missing)
[X] - O4 - HKLM\..\Run: [Microsoft Office] C:\WINDOWS\system32\msoff.exe
[?] - O4 - HKLM\..\Run: [acerWireless] C:\Program Files\acer\Wireless\Utility\WlanUtil.exe
[?] - O4 - HKCU\..\Run: [Iomega Automatic Backup Pro] "C:\Program Files\Iomega\Automatic Backup Pro\LiveSystem.exe" -s
[?] - O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} (MALPlaybackCtrl Class) - http://musicstore.connect.com/XSL/mb_us/html/activexplayer/SMALStreaming.cab
[X] - O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://www.gamespy.com
[X] - O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/
[?] - O23 - Service: LogEjn - Unknown owner - \?C:Program FilesFichiers communsSystemlpt9.exe (file missing)
[?] - O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)


a plus

Oli_G · Answer

Bon Voila j'en ai fixe certain, quelques uns j'ai laisse car je sais a quoi ils correspondent.

Bon apparement j'ai plus de difficulte ou des messages d'alertes en accedant a mon disque dur, cependant je ne peux toujours pas lance blacklight ni peux acceder a la page www.prevx.com.


Voici la Log file :



ogfile of HijackThis v1.99.1
Scan saved at 21:41:19, on 26/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
c:\windows\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
c:\windows\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\AOL\1157408391\ee\AOLSoftware.exe
C:\Acer\eManager\anbmServ.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\acer\Wireless\Utility\WlanUtil.exe
C:\Program Files\Qurb\QSP-3.0.311.7\QOELoader.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32	cpsvcs.exe
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\FSAUA\program\fsus.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\Crazy Browser\Crazy Browser.exe
c:\program files\fichiers communs\aol\1157408391\ee\aim6.exe
C:\Documents and Settings\Olivier Glantschnig\Bureau\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lycos.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1157408391\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [acerWireless] C:\Program Files\acer\Wireless\Utility\WlanUtil.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Fichiers communs\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\Qurb\QSP-3.0.311.7\QOELoader.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Iomega Automatic Backup Pro] "C:\Program Files\Iomega\Automatic Backup Pro\LiveSystem.exe" -s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [UnHackMe Monitor] C:\Program Files\UnHackMe\hackmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: RapidShare-Download - res://D:ppv4_-_43in1__AIO_\RapidShare - the way YOU like it!\more-rapid.exe/RsMenExt.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin
pjpi150_10.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin
pjpi150_10.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFrameWork/v10/StagingUI.cab40641.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner371290.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/StProxy.cab41227.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - The Firebird Project - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcappcapd.exe" -d -f "%ProgramFiles%\WinPcappcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Utilisateur anonyme · Answer

Regarde bien la dedans tu as une tonne de cochonneries a fixer

est est tu sur d'avoir le bon spybot and search and destroy






[Y] - C:\acer\epm\epm-dm.exe
[?] - C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
[?] - C:\Program Files\acer\eRecovery\Monitor.exe
[?] - C:\Program Files\Viewpoint\Common\ViewpointService.exe
[?] - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
[?] - c:\program files\google\googletoolbar3.dll
[?] - files\google\googletoolbar3.dll
[?] - O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control
[?] - O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program
[?] - Files\Logitech\Video\ISStart.exe
[?] - O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program
[?] - O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers
[?] - communs\Real\Update_OBealsched.exe" -osboot
[?] - O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition
[?] - O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop
[?] - Album Edition Découverte\3.0\Apps\apdproxy.exe"
[?] - O4 - HKLM\..\Run: [RemoteControl] "C:\Program
[?] - Files\CyberLink\PowerDVD\PDVDServ.exe"
[?] - O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers
[Y] - O4 - HKLM\..\Run: [LaunchApp] Alaunch
[?] - O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program
[?] - O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program
[?] - Files\Java\jre1.5.0_10\bin\jusched.exe"
[?] - O4 - HKLM\..\Run: [acerWireless] C:\Program
[?] - O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Fichiers
[?] - communs\AOL\IPHSend\IPHSend.exe
[?] - O4 - HKLM\..\Run: [QOELOADER] "C:\Program
[?] - Files\Qurb\QSP-3.0.311.7\QOELoader.exe"
[?] - O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program
[?] - O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program
[?] - Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
[?] - O4 - HKCU\..\Run: [Iomega Automatic Backup Pro] "C:\Program
[?] - Files\Iomega\Automatic Backup Pro\LiveSystem.exe" -s
[?] - O4 - HKCU\..\Run: [swg] C:\Program
[?] - O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers
[?] - communs\Adobe\Calibration\Adobe Gamma Loader.exe
[?] - O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
[?] - Office\Office\OSA9.EXE
[?] - O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program
[?] - Files\Adobe\Acrobat 7.0\Readereader_sl.exe
[?] - C:\Program Files\Java\jre1.5.0_10\bin
pjpi150_10.dll
[?] - Files\Java\jre1.5.0_10\bin
pjpi150_10.dll
[?] - %windir%\bdoscandel.exe (file missing)
[?] - O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 -
[?] - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
[?] - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
[?] - O9 - Extra 'Tools' menuitem: PartyPoker.com -
[?] - Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
[?] - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
[?] - O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
[?] - Diagnostic\xpnetdiag.exe (file missing)
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[X] - O10 - Unknown file in Winsock LSP: c:\program
[?] - files\f-secure\fsps\program\fslsp.dll
[?] - O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) -
[?] - O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
[?] - O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) -
[?] - O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) -
[?] - O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
[?] - O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
[?] - O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) -
[?] - O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
[?] - O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
[?] - O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
[?] - O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) -
[?] - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
[?] - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
[?] - O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers
[?] - O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. -
[?] - O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program
[?] - O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA
[?] - O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -

[?] - O23 - Service: EvtEng - Intel Corporation - C:\Program
[?] - O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure
[?] - O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) -
[?] - O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation -

[?] - O23 - Service: Google Updater Service (gusvc) - Google - C:\Program
[?] - O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation
[?] - O23 - Service: iPodService - Apple Computer, Inc. - C:\Program
[?] - O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program
[?] - O23 - Service: RegSrvc - Intel Corporation - C:\Program
[?] - O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) -
[?] - Unknown owner - %ProgramFiles%\WinPcappcapd.exe" -d -f
[?] - O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation -
[?] - O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program
[?] - O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program
[?] - Files\Viewpoint\Common\ViewpointService.exe
[?] - O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program

did71 · Answer

Bonsoir Oli_G, garybrax ,

apparemment, tu as droit a gromozon!

le résultat est bien souvent le formatage, désolé!

Essaie de passer un scan en ligne ici:

http://www.bitdefender.fr/scan8/ie.html

a+

Utilisateur anonyme · Answer

J'ai reçu ce message par erreur je te le transmet.


Bonsoir Oli_G, garybrax ,

apparemment, tu as droit a gromozon!

le résultat est bien souvent le formatage, désolé!

Essaie de passer un scan en ligne ici:

http://www.bitdefender.fr/scan8/ie.html

a+

did71 · Answer

re,

c'est pas par erreur!!

tu veux t'occuper de gromozon?

ok, bon courage!

tchao!

Utilisateur anonyme · Answer

Où habite Oli_g?

Région Suisse de l'est 
Département Thurgau 
Pays Suisse 

pas Oli_g

Signe astrologique 
Balance 
Date de naissance 
Je 23.10.1980 
Langue 
Allemand 
Passe-temps 
Mehr Fotos und mein Profil kannst du auf www.aooa.de anschauen unter oli_g.

Privatpage: www.gallmann.ch.vu 
A propos de lui/elle 
siehe www.aooa.de 
Clubs préférés 
Alpenmax, AlpenRock House, Arena Disco, Bolero Lifestyle, Château, Firehouse, 
Sulzer Areal, TOP10 

Où habite Oli_g?

Région Suisse de l'est 
Département Thurgau 
Pays Suisse 
garybrax

 pas virus moi ?

je Comprend pas trop ce que tu veux dire ?

did71 · Answer

re,

je veux dire qu'elle est infectée par gromozon!

une saleté qui amène dans 99% des cas un formatage!

tu verras, les antivirus, etc....seront bloqués si la bête est présente!

a+

Utilisateur anonyme · Answer

Ha ok

"gromozon " j'ai jamais rencontrer celui la ?


a +

Oli_G · Answer

Dites je ne comprends pas trop votre delire, surtout le truc que j'habite en suisse etc hahaha

Et puis j'ai pas gromozon, j'ai plus de virus, c'est bon. je fais tout de meme le scan de bitdefender, mais j'ai la version sur l'ordi et c'est pas folichon comme programme.

Sinon pour hijackthis et mon log je vais reverifier tout ca, je voulais pour l'instant juste m'occuper de ce truc qui me saoulait.

Et puis je voudrais bien des feedbacks sur le trip de garibrax... :)


Bah ecoutez j'avais fais un scan auparavant avec antivir et bitdefender rien de gromozon....

Oli_G · Answer

Bah apparement j'ai pas gromozon, car le probleme n'est pas reapparu...

Utilisateur anonyme · Answer

Non t'inquiette ya pas de truc bizzard c'etait  juste une mauvaise conprehension avec  did71 
salut

Utilisateur anonyme · Answer

Alors c'est cool !

Oli_G · Answer

merci bcp pr votre aide, j'ai beaucoup apprecie!

did71 · Answer

re,

ceci:

O2 - BHO: Class - {346D8699-DAC7-DD78-5CD4-CA50A929983C} - C:\WINDOWS\ohrda1.dll (file missing) 


et :

O23 - Service: LogEjn - Unknown owner - \?\C:\Program Files\Fichiers communs\System\lpt9.exe (file missing)

sont des signes d'une infection profonde! (malgré le file missing)

je voudrais vérifier quelquechose!

Étape 1: 
Télécharge eScan Antivirus Toolkit ici: 

http://www.spywareinfo.dk/download/mwav.exe 

Sauvegarde-le sur ton Bureau. 
Avant de lancer le programme, il faut le mettre à jour tel qu'indiqué à l'étape 2. 

Étape 2: 
Voici comment mettre l'outil à jour : 

1.) Double-clique le fichier mwav.exe qui se trouve sur le Bureau ; dézippe les fichiers dans le nouveau dossier suggéré (C:\Kaspersky). Le programme va se lancer, et tu dois le quitter (clique sur "Exit" puis "Exit"). 

2.) Double-clique sur le Poste de travail, puis double-clique sur le lecteur principal (habituellement C:\), double-clique sur le dossier Kaspersky ; ensuite, double-clique sur le fichier kavupd.exe. Tu verras maintenant une fenêtre DOS apparaître, et la mise à jour se complètera en quelques minutes. 

3.) Lorsque la mise à jour sera complétée, tu verras "Press any key to continue" ; tape sur une clé pour continuer. Deux nouveaux répertoires (dossiers) ont été créés lors de la mise à jour (C:\Bases et C:\Downloads). 

4.) Sélectionne/copie tous les fichiers présents dans le dossier C:\Downloads, puis colle-les dans le dossier C:\Kaspersky. Accepte à l'invite de remplacer les fichiers existants. 

Ne pas lancer le scan tout de suite ! 

Étape 3: 
Redémarre en mode Sans Échec : 
1) Redémarre ton ordi 
2) Tapote la touche F8 immédiatement, juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisi la première option : Sans Échec, et valide avec "Entrée" 
5) Choisi ton compte régulier, et non Administrateur 


Étape 4: 
Du mode Sans Échec, voici comment utiliser le programme : 

1.) Pour lancer "eScan Antivirus Toolkit", trouve le fichier mwavscan.com situé dans le dossier C:\Kaspersky 

2.) Double-clique sur mwavscan.com ; l'interface d'eScan va apparaître à l'écran. 

3.) Il est très important de bien cocher ces boîtes sous Scan Option : Memory, Registry, Startup Folders, System Folders, Services. 

4.) Coche la boîte Drive, ce qui donne accès à une nouvelle boîte Drive (bouton rond) juste dessous ; coche ce bouton "Drive" (très important..), et tu verras une nouvelle boîte de navigation apparaître à la droite. Clique sur la petite flèche de cette boîte and choisi la lettre de ton disque dur, habituellement C:\. 

5.) Juste au-dessous, assure-toi que Scan All Files est coché, et non Program Files. 

6.) Clique sur Scan Clean et laisse le tool vérifier tout le disque dur (ça peut être long..). Lorsque terminé, tu verras Scan Completed. Ne pas quitter tout de suite ! 

7.) Ouvre un nouveau fichier Bloc notes (clique sur "Démarrer" >> "Programmes" >>"Accessoires" >> "Bloc notes"), puis copie/colle tout le contenu de la fenêtre Virus Log Information (la deuxième, au bas) dans le fichier texte, et sauvegarde le. eScan génère également un rapport complet dans le dossier C:\Kaspersky (nommé mwav.log), mais il est trop lourd pour poster sur le forum. 

Ferme le programme. Redémarre ton PC en mode Normal. Poste (copie/colle) le rapport que tu as sauvegardé dans ta prochaine réponse.

a+

Oli_G · Answer

Ca marche!

Merci encore

Oli_G · Answer

Voila scan Fini

Voici le Virus Log :


File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobPerfectCodec.zip infected by "Password-protected-EXE" Virus. Action Taken: File Renamed.


Que dois-je faire a present....

did71 · Answer

re,

Télécharge clean.zip 

http://www2.malekal.com/download/clean.zip 

Décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean. 
Ouvre le dossier Clean qui se trouve sur ton bureau. 
Double-clic sur clean.cmd. 
Une fenêtre noire va apparaître, choisis l'option 1. 

Poste le rapport qui se trouve ici C:\rapport_clean.txt 

a+

Oli_G · Answer

Voici Voila :


Rapport clean par Malekal_morte - http://www.malekal.com 
Option 1, executee le 27/01/2007 a  2:22:55,39 
 
*** Recherche de fichiers sur C: 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
C:\WINDOWS\system32\check.exe FOUND 
"C:\Documents and Settings\Olivier Glantschnig\Application Data\ezpinst.exe" FOUND 
 
"C:\Program Files\Viewpoint\" FOUND 
*** Fin du rapport ! 



Merci encore!!!

did71 · Answer

re,

1)relance cleanzip, 

Choisis cette fois l'option 2! 

Poste le rapport ensuite 

2)  Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau: 

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici : 
Redémarre ton ordinateur 
Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde). 
A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître. 
Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée". 
Choisis ton compte. 
Déroule la liste des instructions ci-dessous : 
Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.bat pour lancer le script. 
Appuie sur Y pour commencer le processus de nettoyage. 
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
Appuie sur une touche pour redémarrer le PC. 
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

a+

Oli_G · Answer

Voici La premiere Partie :

Script execute en mode normal 
Rapport clean par Malekal_morte - http://www.malekal.com 
Option 2, executee le 27/01/2007 a  2:42:25,64 

Microsoft Windows XP [version 5.1.2600]
 
*** Suppression de fichiers sur C: 
 
*** Suppression des fichiers dans C:\WINDOWS\ 
 
*** Suppression des fichiers dans C:\WINDOWS\system32 
tentative de suppression de C:\WINDOWS\system32\check.exe 
tentative de suppression de "C:\Documents and Settings\Olivier Glantschnig\Application Data\ezpinst.exe" 
 
tentative de suppression de "C:\Program Files\Viewpoint\" 
Impossible de supprimer "C:\Program Files\Viewpoint\"  
 
*** Suppression des clefs du registre effectuee.. 
*** Fin du rapport ! 



La suite a venir!

Oli_G · Answer

Le report Txt :


SDFix: Version 1.62

27/01/2007 -  2:53:12,70

Microsoft Windows XP [version 5.1.2600]

Running From: C:\Documents and Settings\Olivier Glantschnig\Bureau\SDFix

Safe Mode:
Checking Services: 

Name:
SVKP

Path:
\??\C:\WINDOWS\system32\SVKP.sys 

SVKP Deleted

Restoring Windows Registry Entries
Restoring Default Hosts File


Rebooting...

Normal Mode:
Checking Files:

Files will be copied to Backups folder and removed:

C:\DOCUME~1\OLIVIE~1\LOCALS~1\Temp	mp3.tmp - Deleted
C:\DOCUME~1\OLIVIE~1\LOCALS~1\Temp	mp4.tmp - Deleted
C:\DOCUME~1\OLIVIE~1\LOCALS~1\Temp	mp5.tmp - Deleted
C:\DOCUME~1\OLIVIE~1\LOCALS~1\Temp	mp6.tmp - Deleted
C:\DOCUME~1\OLIVIE~1\LOCALS~1\Temp	mp7.tmp - Deleted
C:\DOCUME~1\OLIVIE~1\LOCALS~1\Temp	mp8.tmp - Deleted
C:\DOCUME~1\OLIVIE~1\LOCALS~1\Temp	mp9.tmp - Deleted
C:\DOCUME~1\OLIVIE~1\LOCALS~1\Temp	mpA.tmp - Deleted
C:\DOCUME~1\OLIVIE~1\LOCALS~1\Temp	mpB.tmp - Deleted
C:\DOCUME~1\OLIVIE~1\LOCALS~1\Temp	mpC.tmp - Deleted
C:\DOCUME~1\OLIVIE~1\LOCALS~1\Temp	mpD.tmp - Deleted
C:\DOCUME~1\OLIVIE~1\LOCALS~1\Temp	mpE.tmp - Deleted
C:\DOCUME~1\OLIVIE~1\LOCALS~1\Temp	mpF.tmp - Deleted
C:\WINDOWS\system32\SVKP.SYS - Deleted



Alternate Streams Check:

C:\WINDOWS\system32
No streams found.

                                 Final Check:

Remaining Services:
------------------


Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"


Remaining Files:
---------------

Backups Folder: - C:\DOCUME~1\OLIVIE~1\Bureau\SDFix\backups\backups.zip


Checking For Files with Hidden Attributes :

C:\NTDETECT.COM
C:\WINDOWS\system32\NTICDMK7.dll
C:\WINDOWS\system32\NTIMPEG2.dll
C:\WINDOWS\system32\NTIMP3.dll
C:\WINDOWS\system32\NTIFCD3.dll
C:\WINDOWS\system32\NTIBUN4.dll
C:\Program Files\Image-Line\FL Studio 7 public beta\REX Shared Library.dll
C:\WINDOWS\system32\cdplayer.exe.manifest
C:\WINDOWS\system32\logonui.exe.manifest
C:\Program Files\Fichiers communs\Adobe\ESD\DLMCleanup.exe
C:\Program Files\Messenger\msmsgs.exe
C:\IO.SYS
C:\MSDOS.SYS
C:\pagefile.sys
C:\hiberfil.sys
C:\WINDOWS\et.sys

                                 Finished




Log file de Hijackthis :


Logfile of HijackThis v1.99.1
Scan saved at 03:16:56, on 27/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
c:\windows\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\windows\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\eManager\anbmServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32	cpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\windows\system32
otepad.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\AOL\1157408391\ee\AOLSoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\acer\Wireless\Utility\WlanUtil.exe
C:\Program Files\Qurb\QSP-3.0.311.7\QOELoader.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Crazy Browser\Crazy Browser.exe
c:\program files\fichiers communs\aol\1157408391\ee\aim6.exe
C:\Documents and Settings\Olivier Glantschnig\Bureau\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lycos.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1157408391\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [acerWireless] C:\Program Files\acer\Wireless\Utility\WlanUtil.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Fichiers communs\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\Qurb\QSP-3.0.311.7\QOELoader.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Iomega Automatic Backup Pro] "C:\Program Files\Iomega\Automatic Backup Pro\LiveSystem.exe" -s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: RapidShare-Download - res://D:ppv4_-_43in1__AIO_\RapidShare - the way YOU like it!\more-rapid.exe/RsMenExt.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin
pjpi150_10.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin
pjpi150_10.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFrameWork/v10/StagingUI.cab40641.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner371290.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/StProxy.cab41227.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - The Firebird Project - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcappcapd.exe" -d -f "%ProgramFiles%\WinPcappcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)



Merci :)

Oli_G · Answer

Besoin de Feedback de did71 


Merci.

did71 · Answer

Bonjour,

SDFix a bien bossé!

je reviens plus tard!

je ne t'ababdonne pas!

a+

Oli_G · Answer

Tres bien, Merci encore...

Prends ton temps. :)

did71 · Answer

bonsoir,

Télécharge Blacklight (de F-Secure), sauvegarde le sur ton Bureau: 

https://europe.f-secure.com/exclude/blacklight/index.shtml 

Double-clique blbeta.exe et accepte la licence ;clique Scan puis Next 

Tu verras une liste de fichiers détectés apparaître. Tu verras également un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres). 

Copie et colle le contenu de ce rapport dans ta prochaine réponse!

a+

Oli_G · Answer

Bonsoir, 

Alors pour Blacklight, comme je l'avais deja poste auparavant il m'ecrit ceci :

" f-secure couldn't acquire necessary privileges

-your computer settings may preventing acquiring these privileges
- a malicious program might have disabled these privileges "

...

did71 · Answer

re,

on va restaurer tes droits!

Télécharge Look2Me-Destroyer.exe sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=7

* Ferme toutes les fenêtres actives avant de passer à l'étape suivante.
* Double-clique Look2Me-Destroyer.exe afin de lancer l'outil.
* Coche Run this program as a task
* Un message s'affichera, te disant ceci : "Look2Me-Destroyer will close and re-open in approximately 10 seconds". Clique OK
* Il se relancera après les 10 secondes, puis clique sur le bouton Scan for L2M; les icônes de ton Bureau vont disparaître : c'est normal.
* Lorsque le scan termine, clique sur le bouton Remove L2M
* Un message Done Scanning apparaîtra, clique OK.
* Un nouveau message s'affichera : Done removing infected files! Look2Me-Destroyer will now shutdown your computer; clique OK.
* Ton PC va maintenant s'éteindre.
* Démarre ton PC normalement.
* Colle le rapport généré, situé ici : C:\Look2Me-Destroyer.txt , dans ta prochaine réponse.

#Si Look2Me-Destroyer ne se relance pas automatiquement après les 10 secondes, redémarre et essaie à nouveau.

##Si tu reçois un message de ton parefeu que l'outil tente d'accéder à l'internet : accepte.

###Si un message runtime error '339' s'affiche : télécharge MSWINSCK.OCX du lien ci-bas, et place-le dans le dossier C:\Windows\System32.
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

a+

Oli_G · Answer

Desole mais je n'arrive pas a executer ton programme, je l'ai lance plsrs fois il ne se demarre pas...

did71 · Answer

re,

on va essayer autrement!

télécharge VX2finder :

http://www.downloads.subratam.org/VX2Finder.exe

lance le puis clique sur restore policy!

Ensuite essaie de relancer blacklight!

a+

Oli_G · Answer

Cela n'a malheureusement pas fonctionne...

Je rencontre encore la meme erreur avec Blacklight apres avoir fais restore policy.

did71 · Answer

re,

ça conforte mon idée pour ce gromozon de M.....!

J'ai quelques idées pour les manip suivante mais j'attends confirmation!

je reviens!

a+

Oli_G · Answer

Tres bien...


En tout cas si il s'agit de cela, alors je ne vais pas pouvoir formater de suite vu que je suis pas chez moi actuellement mais a l'etranger.

Puis je me demande dans quelle mesure ce virus affecte mon systeme.

did71 · Answer

re,

peux tu passer un scan en ligne?

essaie ici:

http://www.bitdefender.fr/scan8/ie.html

poste le rapport

a+

Oli_G · Answer

Ca marche mais ca va prendre des eternites...

did71 · Answer

re,

je ne lâche pas facilement prise, lol!

Ensuite, télécharge gmer:

https://www.majorgeeks.com/downloadget.php?id=5198&file=9&evp=3f18075291813a665b2a25536a70b307

décompresse-le. Double-clique sur l'icone Gmer, puis sélectionne l'onglet "Rootkit" ; vérifie que tout soit coché à droite :

1. System
2. Devices
3. Proceses
4. Libraries
5. Modules
6. Services
7. Registry
8. Files

Clique ensuite sur "Scan" et laisse-le faire son travail. A la fin du scan clique sur "Copy", et dans ton prochain message -> clic droit/coller 

a+

Oli_G · Answer

Rapport Bitdefender :


BitDefender Online Scanner
	

 
	

 

Rapport d'analyse généré à: Sat, Jan 27, 2007 - 23:13:46

 
	

 
	

 

Voie d'analyse: C:\;D:\;
	

 
	

 

 
	

 
	

 

Statistiques

Temps
	

01:35:43

Fichiers
	

455196

Directoires
	

7759

Secteurs de boot
	

4

Archives
	

20268

Paquets programmes
	

41074
	

 
	

 

Résultats

Virus identifiés
	

0

Fichiers infectés
	

0

Fichiers suspects
	

0

Avertissements
	

0

Désinfectés
	

0

Fichiers effacés
	

0
	

 
	

 

Info sur les moteurs

Définition virus
	

391637

Version des moteurs
	

AVCORE v1.0 (build 2371) (i386) (Dec 13 2006 11:16:42)

Analyse des plugins
	

14

Archive des plugins
	

38

Unpack des plugins
	

6

E-mail plugins
	

6

Système plugins
	

1
	

 
	

 

Paramètres d'analyse

Première action
	

Désinfecté

Seconde Action
	

Supprimé

Heuristique
	

Oui

Acceptez les avertissements
	

Oui

Extensions analysées
	

*;

Excludez les extensions
	

 

Analyse d'emails
	

Oui

Analyse des Archives
	

Oui

Analyser paquets programmes
	

Oui

Analyse des fichiers
	

Oui

Analyse de boot
	

Oui
	

 
	

 
 

Fichier analysé
	

 Statut

Aucun virus trouvé.

Oli_G · Answer

Bon Le Gmer truc ne s'execute pas....

did71 · Answer

re,

aucun virus, certes mais pas normal, tu devrais avoir les droits!

Passe Gmer!

a+

Oli_G · Answer

Gmer ne se lance Pas...

did71 · Answer

re,

tu as un message d'erreur??

a+

Oli_G · Answer

Aucun Message, rien ne s'affiche, je double clique, rien ne se passe...

did71 · Answer

Télécharge ce petit outil sur le bureau:

http://download.bleepingcomputer.com/
grinler/dumpwin.zip

Clique-droit sur le fichier [b]dumpwin.zip[/b] et choisis "Tout extraire" vers le bureau
Ouvrir le dossier dumpwin et double-clique [b]dumpwin.bat[/b].
Le bloc-note ouvrira un fichier [b]win.txt[/b]. Copie et poste son contenu ici

a+

Oli_G · Answer

Voila :



REGEDIT4

[Windows]
"AppInit_DLLs"="\\?\C:\WINDOWS\system32\com6.hvu"
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

did71 · Answer

re,

télécharge fixgromozon :

http://aknow.prevx.com/zeroL/FixGrom.exe

a+

Oli_G · Answer

Erreur Net - serveur introuvable -

did71 · Answer

re,

essaie ceci:

http://www.prevx.com/gromozon.asp

a+

Oli_G · Answer

Erreur Net - Serveur Introuvable -

did71 · Answer

re,

c'est grave ton infection, je reviens!

a+

Oli_G · Answer

Ecoute j'ai dmde a un ami de me dl le removal kit du site web je vais l'executer ok?

did71 · Answer

re,

il n'y a aucun removal!

je peux te l'assurer!

on pourra te désinfecter mais il faudra être patient!

j'attends les copains!

a+

Oli_G · Answer

Ok merci

salwa5 · Answer

bonsoir just une suggestion essay de telecharger le programe a partir d'un autre ordi et ensuite le transferer sur ton ordi a l'aide d'une clée usb 

a+++

Oli_G · Answer

C'est Bon J'ai demande a un ami de me le passer je l'ai lance voici ce que ca m'a donne :


Launching Scan
Removing rootkit file...
Scanning: C:\Program Files\Fichiers communs
Scanning Windows Directory...
C:\WINDOWS\ohrda1.dll is infected with Adware LinkOptimizer
Scanning Temporary files...
Trojan.Gromozon Removed!

Scan finished normally
For a detailed log, please refer to \gromozon_removal.log

Maintenant je peux acceder normalement le site www.prevx.com qui avant ete bloque par le rootkit.... apparement c'est bon. Je vais essayer Blacklight.

Oli_G · Answer

Bon Did71, j'ai des nvelles...

Tout d'abord les programmes, look2Me, gmer, fonctionne maintenant, parcontre pour blacklight j'ai encore la meme erreur.

J'ai telecharger le antivirus prevx je vais l'installer...

did71 · Answer

re,

quel log as tu utiliser pour virer la bête?

a+

Oli_G · Answer

http://www.prevx.com/gromozon.asp


Il y a un tool a telecharger, cependant si on est infecte, on ne peut pas acceder a cette page web ainsi qu' a d'autres pages web. Il en est de meme pour certains programmes qui pourraient constituer une menace pour le ******.

Donc pour l'eliminer il faut que quelqu'un te passe le removal kit et il suffit de le lancer, eteindre tout tes anti virus et Voila.

Cependant blacklight il veut tjrs pas se lancer, tjrs la meme erreur, mais c'est sans doute rien de grave...


Merci encore pour l'aide, j'ai vraiment beaucoup apprecie!!

did71 · Answer

re, je te signale que je t'avais suggèrer :

http://www.prevx.com/gromozon.asp

au post 47!!!

a+

pour moi, l'infection est toujours présente!

a+

Oli_G · Answer

Bah le probleme c'est que quand je l'avais sur moi ( l'infection ) je ne pouvais pas acceder a la page!
car elle m'en empechait!


J'ai juste demander cette fois ci a un ami de me filer le removal kit et voila.

Pourquoi est ce qu'elle est encore presente selon ton avis?

salwa5 · Answer

c'est ce qu'il a utilisé je pense 

a+++

did71 · Answer

car au post 47, j'avais demandé le même outil!!

salwa, tu veux dire quoi? Pas compris?

a+

Oli_G · Answer

Ecoute DID je vais t'expliquer...

Quand j'avais l'infection, celle ci m'empechait d'acceder a cette page.
Et quand tu m'a reposte le link, je ne pouvais tjrs pas y acceder...

alors je me suis dis, je vais demander a un ami d'aller sur cette page et de me telecharger l'outil sur la page et de me l'envoyer, vu que moi je ne peux pas y acceder.

Donc il m'a envoye le fichier par Aim, et moi je l'ai execute, des qu'il a repere gromozon ou je ne sais trop quoi, il me l'a supprime, j'ai reboote et la miracle j'ai essayer d'acceder a ton lien et je pouvais!
Et de meme pour les outils que tu m'avais envoyes, je ne pouvais tout simplement pas les executer, sans messages d'erreurs.

Voila.

salwa5 · Answer

rien d'important j'ai just repondu a ton post 58 , pour dire qu'il a utilisé le fix que tu lui avait suggerrer 

a+++

did71 · Answer

re,

c'est très important ce que tu dis!

donc, tu n'as pas accès au site mais tu peux recevoir les programmes?

et les exécuter??

a+

Oli_G · Answer

TOUT a fait tu ne peux acceder a certains sites, mais tu peux exectuer leur tools.

salwa5 · Answer

d'apres ce que j'ai compris il ne pouvais  pas accedé au site  pour telecharger le fix alors il a demandé a un ami de le lui  envoyé et c comme ca qu'il a pu executer le fix  :p 

a+++

Oli_G · Answer

exactement LOL

Bon voici un Lien   http://www.antirootkit.com/articles/gromozo/The-strange-case-of-Dr-Rootkit-and-Mr-Adware.htm

Tout a la fin il te mets le sites auquels tu ne peux pas avoir acces quand t'es infecte, puis egalement les programmes que tu ne peux pas executer.

Malekal_morte- · Answer

Salut,

Oli_G, tu peux redémarrer ton ordinateur.

Puis refaire les manips du post 43.
Tenter d'aller sur www.prevx.com et www.malwareremoval.com stp ?

did71 · Answer

re,

ce site, je connais depuis longtemps!

mais ce qui est important, c'est de savoir qu'on peut t'envoyer le fix et que tu peux l'executer!

Je vais regarder de plus près!

je vais essayer de choper l'infection!

a+

did71 · Answer

Salut Malekal,

merci d'intervenir!

a+

Oli_G · Answer

j'ai deja reboote a plusieurs reprises et oui je peux acceder a ces sites!!!


:)

salwa5 · Answer

rebonsoir :) d'apres ce que j'ai compris  cette infection bloque certain programe , es possible de contourner ca en renommant le programe en question , comme par exemple renomer gmer en abcd ???

a+++

Oli_G · Answer

AUCUNE IDEE PAS VRAIMENT ENVIE D ESSAYER :)

did71 · Answer

re salwa,

non, cette infection est beaucoup plus maligne!

Malekal, tu en penses quoi? gromozon est toujours présent?

Pour moi,  c'est nettoyé mais je doute, c'est difficile cette bête!

a+

Malekal_morte- · Answer

Faudrait refaire la manip du post 43
un scan gmer
et un scan en ligne.

Oli_G · Answer

JE VOUS FAIS UN GMER, le scan en ligne n'avait rien donne...

did71 · Answer

Oli_G,

tu dors??

fais ce que demande Malekal!

a+

Oli_G · Answer

Voila le Scan de Gmer :

GMER 1.0.12.12011 - http://www.gmer.net
Rootkit scan 2007-01-28 02:22:18
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.12 ----

SSDT    pxfsf.sys                                                                                                                                                                                                     ZwAlertResumeThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwAllocateUserPhysicalPages
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwAllocateVirtualMemory
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwClose
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCompactKeys
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCompressKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwConnectPort
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateDirectoryObject
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateEvent
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateEventPair
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreateFile
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateIoCompletion
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateJobObject
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreateKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateMailslotFile
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateMutant
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateNamedPipeFile
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreatePort
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreateProcess
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreateProcessEx
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreateSection
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateSemaphore
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateSymbolicLinkObject
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateTimer
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateToken
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreateWaitablePort
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwDeleteFile
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwDeleteKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwDeleteValueKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwDeviceIoControlFile
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwDuplicateObject
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwEnumerateKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwEnumerateValueKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwFreeUserPhysicalPages
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwFreeVirtualMemory
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwImpersonateAnonymousToken
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwImpersonateThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwLoadDriver
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwLoadKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwLoadKey2
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwLockRegistryKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwLockVirtualMemory
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwMapViewOfSection
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwOpenFile
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwOpenKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwOpenProcess
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwOpenProcessToken
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwOpenSection
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwOpenThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwOpenThreadToken
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwProtectVirtualMemory
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueryInformationProcess
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueryInformationThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueryKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueryMultipleValueKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueryOpenSubKeys
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueryValueKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueueApcThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwReadFile
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwReadVirtualMemory
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwRenameKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwReplaceKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwRequestWaitReplyPort
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwRestoreKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwResumeProcess
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwResumeThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSaveKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSaveKeyEx
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSaveMergedKeys
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwSecureConnectPort
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSetContextThread
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwSetInformationFile
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSetInformationKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSetInformationProcess
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSetInformationThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSetSystemInformation
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwSetValueKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSuspendProcess
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSuspendThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSystemDebugControl
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwTerminateJobObject
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwTerminateProcess
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwTerminateThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwUnloadDriver
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwUnloadKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwUnloadKeyEx
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwUnlockVirtualMemory
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwUnmapViewOfSection
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwWriteFile
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.12 ----

.text   ntkrnlpa.exe!ZwCallbackReturn + 23A4                                                                                                                                                                          805010A8 8 Bytes  [ 6F, 78, 31, F7, D0, 38, 73, ... ]
.text   ntkrnlpa.exe!ZwCallbackReturn + 23B4                                                                                                                                                                          805010B8 24 Bytes  [ 79, 78, 31, F7, 83, 78, 31, ... ]
.text   ntkrnlpa.exe!ZwCallbackReturn + 23D0                                                                                                                                                                          805010D4 16 Bytes  [ D0, B0, 73, EE, BF, 78, 31, ... ]
.text   ntkrnlpa.exe!ZwCallbackReturn + 23E4                                                                                                                                                                          805010E8 8 Bytes  [ 60, 3C, 73, EE, E0, 9E, 73, ... ]
.text   ntkrnlpa.exe!ZwCallbackReturn + 23ED                                                                                                                                                                          805010F1 3 Bytes  [ A1, 73, EE ]
.text   ...                                                                                                                                                                                                           
.text   USBPORT.SYS!DllUnload                                                                                                                                                                                         F701562C 5 Bytes  JMP 866F9960 

---- Devices - GMER 1.0.12 ----

Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_CREATE                                                                                                                                                                   867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_CLOSE                                                                                                                                                                    867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_READ                                                                                                                                                                     867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_WRITE                                                                                                                                                                    867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_INFORMATION                                                                                                                                                        867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_INFORMATION                                                                                                                                                          867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_EA                                                                                                                                                                 867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_EA                                                                                                                                                                   867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_FLUSH_BUFFERS                                                                                                                                                            867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_VOLUME_INFORMATION                                                                                                                                                 867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_VOLUME_INFORMATION                                                                                                                                                   867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_DIRECTORY_CONTROL                                                                                                                                                        867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_FILE_SYSTEM_CONTROL                                                                                                                                                      867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_DEVICE_CONTROL                                                                                                                                                           867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_SHUTDOWN                                                                                                                                                                 867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_LOCK_CONTROL                                                                                                                                                             867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_CLEANUP                                                                                                                                                                  867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_PNP                                                                                                                                                                      867CF1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_CREATE                                                                                                                                                                     8640F1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_CLOSE                                                                                                                                                                      8640F1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_READ                                                                                                                                                                       8640F1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_WRITE                                                                                                                                                                      8640F1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_QUERY_INFORMATION                                                                                                                                                          8640F1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_SET_INFORMATION                                                                                                                                                            8640F1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_QUERY_VOLUME_INFORMATION                                                                                                                                                   8640F1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_DIRECTORY_CONTROL                                                                                                                                                          8640F1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_FILE_SYSTEM_CONTROL                                                                                                                                                        8640F1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_DEVICE_CONTROL                                                                                                                                                             8640F1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_LOCK_CONTROL                                                                                                                                                               8640F1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_CLEANUP                                                                                                                                                                    8640F1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_PNP                                                                                                                                                                        8640F1D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_CREATE                                                                                                                                                                      8640F1D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_CLOSE                                                                                                                                                                       8640F1D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_READ                                                                                                                                                                        8640F1D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_WRITE                                                                                                                                                                       8640F1D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_QUERY_INFORMATION                                                                                                                                                           8640F1D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_SET_INFORMATION                                                                                                                                                             8640F1D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_QUERY_VOLUME_INFORMATION                                                                                                                                                    8640F1D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_DIRECTORY_CONTROL                                                                                                                                                           8640F1D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_FILE_SYSTEM_CONTROL                                                                                                                                                         8640F1D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_DEVICE_CONTROL                                                                                                                                                              8640F1D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_LOCK_CONTROL                                                                                                                                                                8640F1D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_CLEANUP                                                                                                                                                                     8640F1D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_PNP                                                                                                                                                                         8640F1D8
Device  \Driver\Tcpip \Device\Ip IRP_MJ_CREATE                                                                                                                                                                        [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE                                                                                                                                                                         [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL                                                                                                                                                                [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                                       [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP                                                                                                                                                                       [EE7452A0] vsdatant.sys
Device  \Driver\NetBT \Device\NetBT_Tcpip_{B0DF44C1-0D4C-4ECE-ACF2-5C500683358A} IRP_MJ_CREATE                                                                                                                        8642C568
Device  \Driver\NetBT \Device\NetBT_Tcpip_{B0DF44C1-0D4C-4ECE-ACF2-5C500683358A} IRP_MJ_CLOSE                                                                                                                         8642C568
Device  \Driver\NetBT \Device\NetBT_Tcpip_{B0DF44C1-0D4C-4ECE-ACF2-5C500683358A} IRP_MJ_DEVICE_CONTROL                                                                                                                8642C568
Device  \Driver\NetBT \Device\NetBT_Tcpip_{B0DF44C1-0D4C-4ECE-ACF2-5C500683358A} IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                       8642C568
Device  \Driver\NetBT \Device\NetBT_Tcpip_{B0DF44C1-0D4C-4ECE-ACF2-5C500683358A} IRP_MJ_CLEANUP                                                                                                                       8642C568
Device  \Driver\NetBT \Device\NetBT_Tcpip_{B0DF44C1-0D4C-4ECE-ACF2-5C500683358A} IRP_MJ_PNP                                                                                                                           8642C568
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_CREATE                                                                                                                                                                86545980
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_CLOSE                                                                                                                                                                 86545980
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_DEVICE_CONTROL                                                                                                                                                        86545980
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                               86545980
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_POWER                                                                                                                                                                 86545980
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                        86545980
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_PNP                                                                                                                                                                   86545980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_CREATE                                                                                                                                                                86545980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_CLOSE                                                                                                                                                                 86545980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_DEVICE_CONTROL                                                                                                                                                        86545980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                               86545980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_POWER                                                                                                                                                                 86545980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                        86545980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_PNP                                                                                                                                                                   86545980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_CREATE                                                                                                                                                                86545980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_CLOSE                                                                                                                                                                 86545980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_DEVICE_CONTROL                                                                                                                                                        86545980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                               86545980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_POWER                                                                                                                                                                 86545980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                        86545980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_PNP                                                                                                                                                                   86545980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_CREATE                                                                                                                                                                86545980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_CLOSE                                                                                                                                                                 86545980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_DEVICE_CONTROL                                                                                                                                                        86545980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                               86545980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_POWER                                                                                                                                                                 86545980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                        86545980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_PNP                                                                                                                                                                   86545980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_CREATE                                                                                                                                                                8627E980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_CLOSE                                                                                                                                                                 8627E980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_DEVICE_CONTROL                                                                                                                                                        8627E980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                               8627E980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_POWER                                                                                                                                                                 8627E980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                        8627E980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_PNP                                                                                                                                                                   8627E980
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE                                                                                                                                                                       [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE                                                                                                                                                                        [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL                                                                                                                                                               [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                                      [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP                                                                                                                                                                      [EE7452A0] vsdatant.sys
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE                                                                                                                                                          867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_READ                                                                                                                                                            867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_WRITE                                                                                                                                                           867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS                                                                                                                                                   867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL                                                                                                                                                  867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                         867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN                                                                                                                                                        867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CLEANUP                                                                                                                                                         867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_POWER                                                                                                                                                           867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                  867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_PNP                                                                                                                                                             867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE                                                                                                                                                          867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_READ                                                                                                                                                            867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_WRITE                                                                                                                                                           867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_FLUSH_BUFFERS                                                                                                                                                   867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_DEVICE_CONTROL                                                                                                                                                  867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                         867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SHUTDOWN                                                                                                                                                        867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CLEANUP                                                                                                                                                         867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_POWER                                                                                                                                                           867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                  867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_PNP                                                                                                                                                             867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CREATE                                                                                                                                                          867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_READ                                                                                                                                                            867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_WRITE                                                                                                                                                           867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_FLUSH_BUFFERS                                                                                                                                                   867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_DEVICE_CONTROL                                                                                                                                                  867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                         867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SHUTDOWN                                                                                                                                                        867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CLEANUP                                                                                                                                                         867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_POWER                                                                                                                                                           867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                  867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_PNP                                                                                                                                                             867631D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE                                                                                                                                                     867D01D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CLOSE                                                                                                                                                      867D01D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CONTROL                                                                                                                                             867D01D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                    867D01D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_POWER                                                                                                                                                      867D01D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SYSTEM_CONTROL                                                                                                                                             867D01D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_PNP                                                                                                                                                        867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE                                                                                                                                                              867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE                                                                                                                                                               867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CONTROL                                                                                                                                                      867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                             867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_POWER                                                                                                                                                               867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                      867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP                                                                                                                                                                 867D01D8
Device  \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE                                                                                                                                                         8642C568
Device  \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLOSE                                                                                                                                                          8642C568
Device  \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_DEVICE_CONTROL                                                                                                                                                 8642C568
Device  \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                        8642C568
Device  \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLEANUP                                                                                                                                                        8642C568
Device  \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_PNP                                                                                                                                                            8642C568
Device  \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CREATE                                                                                                                                                                8642C568
Device  \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLOSE                                                                                                                                                                 8642C568
Device  \Driver\NetBT \Device\NetbiosSmb IRP_MJ_DEVICE_CONTROL                                                                                                                                                        8642C568
Device  \Driver\NetBT \Device\NetbiosSmb IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                               8642C568
Device  \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLEANUP                                                                                                                                                               8642C568
Device  \Driver\NetBT \Device\NetbiosSmb IRP_MJ_PNP                                                                                                                                                                   8642C568
Device  \Driver\NetBT \Device\NetBT_Tcpip_{5D72E26C-F032-4CC0-A959-B8105A1C1CA7} IRP_MJ_CREATE                                                                                                                        8642C568
Device  \Driver\NetBT \Device\NetBT_Tcpip_{5D72E26C-F032-4CC0-A959-B8105A1C1CA7} IRP_MJ_CLOSE                                                                                                                         8642C568
Device  \Driver\NetBT \Device\NetBT_Tcpip_{5D72E26C-F032-4CC0-A959-B8105A1C1CA7} IRP_MJ_DEVICE_CONTROL                                                                                                                8642C568
Device  \Driver\NetBT \Device\NetBT_Tcpip_{5D72E26C-F032-4CC0-A959-B8105A1C1CA7} IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                       8642C568
Device  \Driver\NetBT \Device\NetBT_Tcpip_{5D72E26C-F032-4CC0-A959-B8105A1C1CA7} IRP_MJ_CLEANUP                                                                                                                       8642C568
Device  \Driver\NetBT \Device\NetBT_Tcpip_{5D72E26C-F032-4CC0-A959-B8105A1C1CA7} IRP_MJ_PNP                                                                                                                           8642C568
Device  \Driver\Tcpip \Device\Udp IRP_MJ_CREATE                                                                                                                                                                       [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE                                                                                                                                                                        [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL                                                                                                                                                               [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                                      [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP                                                                                                                                                                      [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE                                                                                                                                                                     [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE                                                                                                                                                                      [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL                                                                                                                                                             [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                                    [EE7452A0] vsdatant.sys
Device  \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP                                                                                                                                                                    [EE7452A0] vsdatant.sys
Device  \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_CREATE                                                                                                                                                                86545980
Device  \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_CLOSE                                                                                                                                                                 86545980
Device  \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_DEVICE_CONTROL                                                                                                                                                        86545980
Device  \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                               86545980
Device  \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_POWER                                                                                                                                                                 86545980
Device  \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                        86545980
Device  \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_PNP                                                                                                                                                                   86545980
Device  \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_CREATE                                                                                                                                                                86545980
Device  \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_CLOSE                                                                                                                                                                 86545980
Device  \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_DEVICE_CONTROL                                                                                                                                                        86545980
Device  \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                               86545980
Device  \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_POWER                                                                                                                                                                 86545980
Device  \Driver\usbuh

did71 · Answer

re,

fais aussi ceci:

Télécharge ce petit outil sur le bureau: 

http://download.bleepingcomputer.com/ 
grinler/dumpwin.zip 

Clique-droit sur le fichier [b]dumpwin.zip[/b] et choisis "Tout extraire" vers le bureau 
Ouvrir le dossier dumpwin et double-clique [b]dumpwin.bat[/b]. 
Le bloc-note ouvrira un fichier [b]win.txt[/b]. Copie et poste son contenu ici 

a+

Oli_G · Answer

REGEDIT4

[Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

did71 · Answer

re,

j'attends la réponse de Malekal mais pour moi, gromozon n'est plus présent!

à toi de me dire Malekak!

a+

Oli_G · Answer

Cool!!!


Merci en tout cas!

Je pense que Malekak est entrain de dormir!

Malekal_morte- · Answer

Le rapport gmer n'est pas entier.

Oli_G · Answer

Rapport Gmer :


GMER 1.0.12.12011 - http://www.gmer.net
Rootkit scan 2007-01-28 19:15:26
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.12 ----

SSDT    pxfsf.sys                                                                                                                                                                                                     ZwAlertResumeThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwAllocateUserPhysicalPages
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwAllocateVirtualMemory
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwClose
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCompactKeys
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCompressKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwConnectPort
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateDirectoryObject
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateEvent
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateEventPair
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreateFile
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateIoCompletion
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateJobObject
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreateKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateMailslotFile
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateMutant
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateNamedPipeFile
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreatePort
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreateProcess
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreateProcessEx
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreateSection
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateSemaphore
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateSymbolicLinkObject
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateTimer
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwCreateToken
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwCreateWaitablePort
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwDeleteFile
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwDeleteKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwDeleteValueKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwDeviceIoControlFile
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwDuplicateObject
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwEnumerateKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwEnumerateValueKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwFreeUserPhysicalPages
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwFreeVirtualMemory
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwImpersonateAnonymousToken
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwImpersonateThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwLoadDriver
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwLoadKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwLoadKey2
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwLockRegistryKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwLockVirtualMemory
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwMapViewOfSection
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwOpenFile
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwOpenKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwOpenProcess
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwOpenProcessToken
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwOpenSection
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwOpenThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwOpenThreadToken
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwProtectVirtualMemory
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueryInformationProcess
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueryInformationThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueryKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueryMultipleValueKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueryOpenSubKeys
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueryValueKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwQueueApcThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwReadFile
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwReadVirtualMemory
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwRenameKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwReplaceKey
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwRequestWaitReplyPort
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwRestoreKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwResumeProcess
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwResumeThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSaveKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSaveKeyEx
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSaveMergedKeys
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwSecureConnectPort
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSetContextThread
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwSetInformationFile
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSetInformationKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSetInformationProcess
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSetInformationThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSetSystemInformation
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwSetValueKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSuspendProcess
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSuspendThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwSystemDebugControl
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwTerminateJobObject
SSDT    \SystemRoot\System32\vsdatant.sys                                                                                                                                                                             ZwTerminateProcess
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwTerminateThread
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwUnloadDriver
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwUnloadKey
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwUnloadKeyEx
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwUnlockVirtualMemory
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwUnmapViewOfSection
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwWriteFile
SSDT    pxfsf.sys                                                                                                                                                                                                     ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.12 ----

.text   ntkrnlpa.exe!ZwCallbackReturn + 23A4                                                                                                                                                                          805010A8 8 Bytes  [ 6F, 78, 31, F7, D0, 28, 77, ... ]
.text   ntkrnlpa.exe!ZwCallbackReturn + 23B4                                                                                                                                                                          805010B8 24 Bytes  [ 79, 78, 31, F7, 83, 78, 31, ... ]
.text   ntkrnlpa.exe!ZwCallbackReturn + 23D0                                                                                                                                                                          805010D4 16 Bytes  [ D0, A0, 77, EE, BF, 78, 31, ... ]
.text   ntkrnlpa.exe!ZwCallbackReturn + 23E4                                                                                                                                                                          805010E8 8 Bytes  [ 60, 2C, 77, EE, E0, 8E, 77, ... ]
.text   ntkrnlpa.exe!ZwCallbackReturn + 23ED                                                                                                                                                                          805010F1 3 Bytes  [ 91, 77, EE ]
.text   ...                                                                                                                                                                                                           
.text   USBPORT.SYS!DllUnload                                                                                                                                                                                         F700B62C 5 Bytes  JMP 864415B0 

---- User code sections - GMER 1.0.12 ----

.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] kernel32.dll!LoadResource                                                                                                                                     7C809FB5 7 Bytes  JMP 27001960 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] kernel32.dll!FindResourceExW                                                                                                                                  7C80AC88 7 Bytes  JMP 270018E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] kernel32.dll!FindResourceW                                                                                                                                    7C80BBCE 7 Bytes  JMP 27001860 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] kernel32.dll!SizeofResource                                                                                                                                   7C80BC69 7 Bytes  JMP 27001A00 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] kernel32.dll!LockResource                                                                                                                                     7C80CC97 5 Bytes  JMP 27001A90 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] kernel32.dll!CreateEventA                                                                                                                                     7C8308AD 5 Bytes  JMP 27001650 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] kernel32.dll!SetUnhandledExceptionFilter                                                                                                                      7C84479D 5 Bytes  JMP 004E12D0 C:\Program Files\MSN Messenger\msnmsgr.exe
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] USER32.dll!PeekMessageW                                                                                                                                       77D1929B 5 Bytes  JMP 27003510 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] USER32.dll!CreateWindowExW                                                                                                                                    77D1FF50 5 Bytes  JMP 27003020 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] USER32.dll!SetWindowRgn                                                                                                                                       77D202DD 7 Bytes  JMP 27004840 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] USER32.dll!CreateDialogParamW                                                                                                                                 77D284EE 5 Bytes  JMP 27004BC0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] USER32.dll!SetWindowPlacement                                                                                                                                 77D2DF46 5 Bytes  JMP 27004760 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] USER32.dll!FlashWindow                                                                                                                                        77D55C5C 5 Bytes  JMP 270048E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] USER32.dll!MessageBoxIndirectW                                                                                                                                77D66093 5 Bytes  JMP 27004D20 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] USER32.dll!TrackPopupMenuEx                                                                                                                                   77D6CB1A 5 Bytes  JMP 27003CE0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] WS2_32.dll!send                                                                                                                                               719F428A 5 Bytes  JMP 27009360 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] WS2_32.dll!WSARecv                                                                                                                                            719F4318 5 Bytes  JMP 27009150 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] WS2_32.dll!recv                                                                                                                                               719F615A 5 Bytes  JMP 27008FC0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] WS2_32.dll!WSASend                                                                                                                                            719F6233 5 Bytes  JMP 270094E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] WS2_32.dll!closesocket                                                                                                                                        719F9639 5 Bytes  JMP 270096F0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] SHELL32.dll!Shell_NotifyIconW                                                                                                                                 7CA31B5A 5 Bytes  JMP 27002960 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] ole32.dll!CoInitializeEx                                                                                                                                      774BEF6B 5 Bytes  JMP 27001AF0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] ole32.dll!CoRegisterClassObject                                                                                                                               774D8720 5 Bytes  JMP 27001BF0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] WININET.dll!InternetCloseHandle                                                                                                                               771BE85D 5 Bytes  JMP 27008230 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] WININET.dll!HttpOpenRequestA                                                                                                                                  771C160A 5 Bytes  JMP 27007F50 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] WININET.dll!InternetReadFile                                                                                                                                  771C5BAA 5 Bytes  JMP 270080B0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text   C:\Program Files\MSN Messenger\msnmsgr.exe[696] WININET.dll!HttpSendRequestA                                                                                                                                  771C7519 5 Bytes  JMP 27008180 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll

---- Devices - GMER 1.0.12 ----

Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_CREATE                                                                                                                                                                   867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_CLOSE                                                                                                                                                                    867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_READ                                                                                                                                                                     867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_WRITE                                                                                                                                                                    867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_INFORMATION                                                                                                                                                        867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_INFORMATION                                                                                                                                                          867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_EA                                                                                                                                                                 867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_EA                                                                                                                                                                   867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_FLUSH_BUFFERS                                                                                                                                                            867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_VOLUME_INFORMATION                                                                                                                                                 867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_VOLUME_INFORMATION                                                                                                                                                   867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_DIRECTORY_CONTROL                                                                                                                                                        867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_FILE_SYSTEM_CONTROL                                                                                                                                                      867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_DEVICE_CONTROL                                                                                                                                                           867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_SHUTDOWN                                                                                                                                                                 867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_LOCK_CONTROL                                                                                                                                                             867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_CLEANUP                                                                                                                                                                  867CF1D8
Device  \FileSystem\Fastfat \FatCdrom IRP_MJ_PNP                                                                                                                                                                      867CF1D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_CREATE                                                                                                                                                                     865361D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_CLOSE                                                                                                                                                                      865361D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_READ                                                                                                                                                                       865361D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_WRITE                                                                                                                                                                      865361D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_QUERY_INFORMATION                                                                                                                                                          865361D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_SET_INFORMATION                                                                                                                                                            865361D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_QUERY_VOLUME_INFORMATION                                                                                                                                                   865361D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_DIRECTORY_CONTROL                                                                                                                                                          865361D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_FILE_SYSTEM_CONTROL                                                                                                                                                        865361D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_DEVICE_CONTROL                                                                                                                                                             865361D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_LOCK_CONTROL                                                                                                                                                               865361D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_CLEANUP                                                                                                                                                                    865361D8
Device  \FileSystem\Udfs \UdfsCdRom IRP_MJ_PNP                                                                                                                                                                        865361D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_CREATE                                                                                                                                                                      865361D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_CLOSE                                                                                                                                                                       865361D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_READ                                                                                                                                                                        865361D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_WRITE                                                                                                                                                                       865361D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_QUERY_INFORMATION                                                                                                                                                           865361D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_SET_INFORMATION                                                                                                                                                             865361D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_QUERY_VOLUME_INFORMATION                                                                                                                                                    865361D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_DIRECTORY_CONTROL                                                                                                                                                           865361D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_FILE_SYSTEM_CONTROL                                                                                                                                                         865361D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_DEVICE_CONTROL                                                                                                                                                              865361D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_LOCK_CONTROL                                                                                                                                                                865361D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_CLEANUP                                                                                                                                                                     865361D8
Device  \FileSystem\Udfs \UdfsDisk IRP_MJ_PNP                                                                                                                                                                         865361D8
Device  \Driver\Tcpip \Device\Ip IRP_MJ_CREATE                                                                                                                                                                        [EE7842A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE                                                                                                                                                                         [EE7842A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL                                                                                                                                                                [EE7842A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                                       [EE7842A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP                                                                                                                                                                       [EE7842A0] vsdatant.sys
Device  \Driver\NetBT \Device\NetBT_Tcpip_{B0DF44C1-0D4C-4ECE-ACF2-5C500683358A} IRP_MJ_CREATE                                                                                                                        864164E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{B0DF44C1-0D4C-4ECE-ACF2-5C500683358A} IRP_MJ_CLOSE                                                                                                                         864164E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{B0DF44C1-0D4C-4ECE-ACF2-5C500683358A} IRP_MJ_DEVICE_CONTROL                                                                                                                864164E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{B0DF44C1-0D4C-4ECE-ACF2-5C500683358A} IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                       864164E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{B0DF44C1-0D4C-4ECE-ACF2-5C500683358A} IRP_MJ_CLEANUP                                                                                                                       864164E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{B0DF44C1-0D4C-4ECE-ACF2-5C500683358A} IRP_MJ_PNP                                                                                                                           864164E8
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_CREATE                                                                                                                                                                86511980
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_CLOSE                                                                                                                                                                 86511980
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_DEVICE_CONTROL                                                                                                                                                        86511980
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                               86511980
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_POWER                                                                                                                                                                 86511980
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                        86511980
Device  \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_PNP                                                                                                                                                                   86511980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_CREATE                                                                                                                                                                86511980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_CLOSE                                                                                                                                                                 86511980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_DEVICE_CONTROL                                                                                                                                                        86511980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                               86511980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_POWER                                                                                                                                                                 86511980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                        86511980
Device  \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_PNP                                                                                                                                                                   86511980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_CREATE                                                                                                                                                                86511980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_CLOSE                                                                                                                                                                 86511980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_DEVICE_CONTROL                                                                                                                                                        86511980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                               86511980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_POWER                                                                                                                                                                 86511980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                        86511980
Device  \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_PNP                                                                                                                                                                   86511980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_CREATE                                                                                                                                                                86511980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_CLOSE                                                                                                                                                                 86511980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_DEVICE_CONTROL                                                                                                                                                        86511980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                               86511980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_POWER                                                                                                                                                                 86511980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                        86511980
Device  \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_PNP                                                                                                                                                                   86511980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_CREATE                                                                                                                                                                862F3980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_CLOSE                                                                                                                                                                 862F3980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_DEVICE_CONTROL                                                                                                                                                        862F3980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                               862F3980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_POWER                                                                                                                                                                 862F3980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                        862F3980
Device  \Driver\usbehci \Device\USBPDO-4 IRP_MJ_PNP                                                                                                                                                                   862F3980
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE                                                                                                                                                                       [EE7842A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE                                                                                                                                                                        [EE7842A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL                                                                                                                                                               [EE7842A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                                      [EE7842A0] vsdatant.sys
Device  \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP                                                                                                                                                                      [EE7842A0] vsdatant.sys
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE                                                                                                                                                          867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_READ                                                                                                                                                            867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_WRITE                                                                                                                                                           867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS                                                                                                                                                   867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL                                                                                                                                                  867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                         867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN                                                                                                                                                        867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CLEANUP                                                                                                                                                         867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_POWER                                                                                                                                                           867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                  867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_PNP                                                                                                                                                             867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE                                                                                                                                                          867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_READ                                                                                                                                                            867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_WRITE                                                                                                                                                           867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_FLUSH_BUFFERS                                                                                                                                                   867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_DEVICE_CONTROL                                                                                                                                                  867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                         867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SHUTDOWN                                                                                                                                                        867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CLEANUP                                                                                                                                                         867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_POWER                                                                                                                                                           867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                  867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_PNP                                                                                                                                                             867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CREATE                                                                                                                                                          867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_READ                                                                                                                                                            867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_WRITE                                                                                                                                                           867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_FLUSH_BUFFERS                                                                                                                                                   867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_DEVICE_CONTROL                                                                                                                                                  867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                         867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SHUTDOWN                                                                                                                                                        867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CLEANUP                                                                                                                                                         867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_POWER                                                                                                                                                           867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                  867631D8
Device  \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_PNP                                                                                                                                                             867631D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE                                                                                                                                                     867D01D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CLOSE                                                                                                                                                      867D01D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CONTROL                                                                                                                                             867D01D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                    867D01D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_POWER                                                                                                                                                      867D01D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SYSTEM_CONTROL                                                                                                                                             867D01D8
Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_PNP                                                                                                                                                        867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE                                                                                                                                                              867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE                                                                                                                                                               867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CONTROL                                                                                                                                                      867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                             867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_POWER                                                                                                                                                               867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SYSTEM_CONTROL                                                                                                                                                      867D01D8
Device  \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP                                                                                                                                                                 867D01D8
Device  \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE                                                                                                                                                         864164E8
Device  \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLOSE                                                                                                                                                          864164E8
Device  \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_DEVICE_CONTROL                                                                                                                                                 864164E8
Device  \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_INTERNAL_DEVICE_CONTROL                                                                                                                                        864164E8
Device  \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLEANUP

afideg · Answer

Bonsoir tout le monde

Merci salwa d'avoir posé cette question ( à tester absolument ) :
« d'apres ce que j'ai compris cette infection bloque certain programe , es possible de contourner ca en renommant le programe en question , comme par exemple renomer gmer en abcd ???  » 


Bonne chance
Al.

did71 · Answer

Bonsoir à tous,

Oli_G, as tu toujours accès à tous les utilitaires cités tout au long de ce sujet?

Peux tu passer un scan en ligne ici:

http://www.bitdefender.fr/scan8/ie.html

et poster le rapport!

Pour Al, j'ai déjà répondu que ça ne servait à rien de renommer Gmer!!

a+

Oli_G · Answer

Oauis j'ai acces a tous les programmes etc...

Encore un truc Bitdefender.... Ecoute j'ai Bitdefender sur mon Ordi, c'est pas efficace. Il ne m'a pas protege, alors le scan online de chez eux....

Voila.

did71 · Answer

re,

le scan on line de bitdefender est très intéressant!

je voudrais voir le rapport qu'il montrera!

a+

Oli_G · Answer

Bon Bah Patiente une bonne 1H30...

did71 · Answer

re,

sans problème!

je serais là!

a+

Oli_G · Answer

Rapport Bitdefender :


BitDefender Online Scanner
	

 
	

 

Rapport d'analyse généré à: Mon, Jan 29, 2007 - 00:51:41

 
	

 
	

 

Voie d'analyse: C:\;D:\;
	

 
	

 

 
	

 
	

 

Statistiques

Temps
	

02:07:27

Fichiers
	

450779

Directoires
	

7825

Secteurs de boot
	

4

Archives
	

19197

Paquets programmes
	

40789
	

 
	

 

Résultats

Virus identifiés
	

0

Fichiers infectés
	

0

Fichiers suspects
	

0

Avertissements
	

0

Désinfectés
	

0

Fichiers effacés
	

0
	

 
	

 

Info sur les moteurs

Définition virus
	

394334

Version des moteurs
	

AVCORE v1.0 (build 2371) (i386) (Dec 13 2006 11:16:42)

Analyse des plugins
	

14

Archive des plugins
	

38

Unpack des plugins
	

6

E-mail plugins
	

6

Système plugins
	

1
	

 
	

 

Paramètres d'analyse

Première action
	

Désinfecté

Seconde Action
	

Supprimé

Heuristique
	

Oui

Acceptez les avertissements
	

Oui

Extensions analysées
	

*;

Excludez les extensions
	

 

Analyse d'emails
	

Oui

Analyse des Archives
	

Oui

Analyser paquets programmes
	

Oui

Analyse des fichiers
	

Oui

Analyse de boot
	

Oui
	

 
	

 
 

Fichier analysé
	

 Statut

Aucun virus trouvé.

did71 · Answer

re,

donc ça conforte mon point de vue!

la bébéte est morte!

Le pc tourne normalement?

Aucune alerte?

a+

Oli_G · Answer

Tout tourne merveilleusement, j'ai comme l'impression qu'il tourne plus rapidement, les problemes que j'avais avec ie7 ont disparus ( il etait lent ), plus aucune alerte, stabilite 100%. bref tout pour le mieux dans le meilleur des mondes :)


Merci Encore a toi Did71 et a Malekal!

je sais pas comment vous remercier!!!!

Virus Ohrda1.Dll Impossible de s'en debarasse

93 réponses

Discussions similaires

Newsletters