virus ( cheval de troi ) récurrant !

Question

Salut,

J'ai un virus.
Mon antivirus avast et ( ou ) Avg  le repère, le supprime mais il réapparaît toujours...
avg le repère comme étant : une variante de win32/Rootkit.Agent.dp (cheval de Troie)
sa localisation : C:\WINDOWS\System32\ip6fw.sys j'ai souvent ce virus qui revient avec avast : win32 : agent kir et small epg !

Même manuellement si je le supprime, il réapparaît...

Le virus s'active quand je me connecte à internet. Mon pc devient très-lent alors que normalement ça va plus vite (j'écris en mode sans échec avec prise du réseau..).

J'ai essayé avec Ad-Aware et d'autres logiciels que je possède mais il ne voit rien.

Yuki · Answer

Logfile of HijackThis v1.99.1
Scan saved at 23:52:32, on 20/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.fr/8SEFRFR030000TBR/InstallSuccess
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mono.exe] C:\WINDOWS\mono.exe
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Performance Monitor] C:\WINDOWS\perfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 2.0esources\fr-FR\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2ce861a41e324489ac465c2b9d28c6a7
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2ce861a41e324489ac465c2b9d28c6a7
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Performance Monitor - Unknown owner - C:\WINDOWS\perfmon.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Userinit Logon Application - Unknown owner - C:\WINDOWS\userinit.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Yuki · Answer

avec navilog :

Search Navipromo version 3.1.0 commencé le 20/09/2007 à 23:54:49,40

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Program Files
avilog1
Mise a jour le 20.09.2007 a 14h00 by IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180 


*** Recherche Programmes installes ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\Barros\Application Data ***


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***


*** Recherche avec BlackLight Engine/F-secure ***
BlackLight Engine est un produit de F-secure, pour + d'infos :
https://www.f-secure.com/en


F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR
======================================

Copyright 2005-2006 F-Secure Corporation. All rights reserved.
This is a beta version. It will expire on 1st of October, 2007.
Version information: 2.2.1064.

[+] Started on 09/20/07 at 23:54:51.
[-] ERROR: F-Secure BlackLight cannot be used in safe mode.
[+] Exited on 09/20/07 at 23:54:51 (return code = 3).


*** Recherche avec GenericNaviSearch ***
!!! Tous Ces résultats peuvent révéler des fichiers légitimes !!!
!!! A verifier impérativement avant toute suppression manuelle !!!

* Scan C:\WINDOWS\system32 *

* Scan C:\Documents and Settings\Barros\local settings\application data *



*** Recherche fichiers *** 




*** Recherche cles registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

2)Recherche Heuristique :



3)Recherche Certificats :

Certificat Egroup absent !


*** Analyse Terminé le 20/09/2007 à 23:54:58,18 ***

Yuki · Answer

après  analyse de mon pc avec AVG antivirus, celui-ci m'à effacé 12 virus, mais après redemarrage le pc est toujours infecté !

Yuki · Answer

et là je fait un scan online avec BitDefender : toujours en cours, plus de 30 lignes infectés ( dont certains qu'il ne peut supprimer ! )

Lyonnais92 · Answer

Bonjour,

Télécharge MSNFix.zip (de !aur3n7) sur ton bureau:
http://sosvirus.changelog.fr/MSNFix.zip

Décompresse-le (clic droit >> Extraire ici) et place les fichiers dans C:\MSNFix (très important).

Double cliquer sur le fichier MSNFix.bat.
- Exécutez l'option R.
-- Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage

Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal

- Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.txt

Quand Bit Defender aura fini, poste aussi le rapport complet (avec nom et emplacement des fichiers infectés).
@+

Lyonnais92 · Answer

Re,

je recopie ici le rapport de SuspectFile que tu avais mis dans le post d'emmeliness.

SystemScan - www.suspectfile.com - ver. 3.2.0 

Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1) 
System directory: C:\WINDOWS 

Date: 20/09/2007 
Time: 22:45:21 

Output limited to: 
-Recent files 
-PC accounts 
-Registry Run Keys 
-Autoplay settings (autorun.inf) 
-Scheduled jobs 
-Services and Drivers (all) 
-Duplicates in BAK folders 
-Svchost.exe instances 
-Network settings 
-Include HOSTS file 
-Loaded Dlls 
-Alternate Data Sreams 
-Encrypted Files 
-Hidden objects 
-Suspicious Files 
-Installed Applications 

===================== Accounts on this PC ===================== 


Users on this computer: 
Is Admin? | Username 
------------------ 
Yes | Administrateur 
| ASPNET 
Yes | Barros 
| HelpAssistant (Disabled) 
| Invité (Disabled) 
| SUPPORT_388945a0 (Disabled) 

### users folders 

25/05/2006 20:30:50 (DIR) 0 byte 483 days old -- LocalService 
25/05/2006 20:30:50 (DIR) 0 byte 483 days old -- NetworkService 
06/09/2006 20:25:10 (DIR) 0 byte 379 days old -- Default User 
06/09/2006 20:25:13 (DIR) 0 byte 379 days old -- All Users 
20/09/2007 12:05:26 (DIR) 0 byte 0 days old -- Barros 
20/09/2007 13:07:58 (DIR) 0 byte 0 days old -- Administrateur 

===================== Recent files (30 days old)===================== 

----- recent files in C:\ 
12/09/2007 23:32:53 (DIR) 0 byte 8 days old -- Séries-files 
18/09/2007 15:37:34 71525 byte 2 days old -- hpfr3500.log 
20/09/2007 12:17:33 216 byte 0 days old -- boot.ini 
20/09/2007 13:07:57 (DIR) 0 byte 0 days old -- Documents and Settings 
20/09/2007 13:10:05 (DIR) 0 byte 0 days old -- RECYCLER 
20/09/2007 21:39:09 266621 byte 0 days old -- MSNFix.zip 
20/09/2007 21:52:18 (DIR) 0 byte 0 days old -- Program Files 
20/09/2007 22:04:59 838860800 byte 0 days old -- pagefile.sys 
20/09/2007 22:36:37 (DIR) 0 byte 0 days old -- WINDOWS 
20/09/2007 22:42:24 (DIR) 0 byte 0 days old -- MSNFix 
20/09/2007 22:45:21 (DIR) 0 byte 0 days old -- suspectfile 

----- recent files in C:\WINDOWS\ 
24/08/2007 09:35:00 (DIR) 0 byte 27 days old -- Help 
24/08/2007 20:22:45 215783 byte 27 days old -- setupact.log 
29/08/2007 08:25:48 (DIR) 0 byte 22 days old -- $hf_mig$ 
29/08/2007 12:52:37 (DIR) 0 byte 22 days old -- $NtUninstallKB933360$ 
29/08/2007 12:52:44 23518 byte 22 days old -- KB933360.log 
31/08/2007 01:19:27 (DIR) 0 byte 20 days old -- $NtUninstallKB939683$ 
31/08/2007 01:19:31 7127 byte 20 days old -- KB939683.log 
17/09/2007 16:16:18 388096 byte 3 days old -- mono.exe 
18/09/2007 15:40:46 54156 byte 2 days old -- QTFont.qfn 
20/09/2007 06:58:41 20464 byte 0 days old -- preconfig.log 
20/09/2007 06:59:51 2157 byte 0 days old -- DAASINST.LOG 
20/09/2007 07:00:17 75342 byte 0 days old -- FSAVINST.LOG 
20/09/2007 07:00:18 110 byte 0 days old -- FSAVES_inst.log 
20/09/2007 07:00:19 6631 byte 0 days old -- FSHIPS.LOG 
20/09/2007 07:00:19 6359 byte 0 days old -- FSASWINS.LOG 
20/09/2007 07:00:23 100891 byte 0 days old -- fsauains.LOG 
20/09/2007 07:00:24 1971 byte 0 days old -- fsdginst.log 
20/09/2007 07:00:24 52988 byte 0 days old -- fstnbins.LOG 
20/09/2007 07:00:25 17410 byte 0 days old -- FSGUIINS.LOG 
20/09/2007 07:00:26 215328 byte 0 days old -- FSPROD.log 
20/09/2007 07:00:26 4649 byte 0 days old -- FSSYSUPD.LOG 
20/09/2007 07:00:26 1274118 byte 0 days old -- FSSETUP.log 
20/09/2007 07:00:26 3085623 byte 0 days old -- FSSFM.log 
20/09/2007 07:00:26 696 byte 0 days old -- FSSSINST.log 
20/09/2007 07:00:26 6059 byte 0 days old -- FSPSINST.LOG 
20/09/2007 07:00:26 16483 byte 0 days old -- HELPINST.LOG 
20/09/2007 07:00:26 1410 byte 0 days old -- FSSCINST.log 
20/09/2007 07:00:26 17321 byte 0 days old -- fsmainst.log 
20/09/2007 07:00:26 19698 byte 0 days old -- fsavunin.log 
20/09/2007 07:00:26 611 byte 0 days old -- fsav_db_setup.log 
20/09/2007 07:00:26 9954 byte 0 days old -- FSAVCSIN.LOG 
20/09/2007 07:00:26 3898 byte 0 days old -- UNINPLUG.log 
20/09/2007 07:00:26 155337 byte 0 days old -- RunSetup.log 
20/09/2007 07:00:26 4115 byte 0 days old -- FSGKIAIN.log 
20/09/2007 07:00:26 3383 byte 0 days old -- FSLDIN.LOG 
20/09/2007 07:00:26 3490 byte 0 days old -- FSGemini.LOG 
20/09/2007 07:56:54 (DIR) 0 byte 0 days old -- Minidump 
20/09/2007 08:10:00 8318 byte 0 days old -- pegasus_inst.log 
20/09/2007 08:10:00 912 byte 0 days old -- FSGEMINST.LOG 
20/09/2007 08:10:02 21714 byte 0 days old -- fwinst.log 
20/09/2007 08:10:03 29011 byte 0 days old -- fwesinst.log 
20/09/2007 08:10:12 1251729 byte 0 days old -- FSISU.log 
20/09/2007 08:10:12 1580 byte 0 days old -- FSPSUNI.LOG 
20/09/2007 12:17:33 227 byte 0 days old -- system.ini 
20/09/2007 12:17:33 621 byte 0 days old -- win.ini 
20/09/2007 12:19:26 3760 byte 0 days old -- POSTINSTALL.LOG 
20/09/2007 12:51:07 1917 byte 0 days old -- imsins.BAK 
20/09/2007 12:52:29 911824 byte 0 days old -- FaxSetup.log 
20/09/2007 12:52:31 183962 byte 0 days old -- ntdtcsetup.log 
20/09/2007 12:52:31 45259 byte 0 days old -- msgsocm.log 
20/09/2007 12:52:31 350474 byte 0 days old -- tsoc.log 
20/09/2007 12:52:31 49488 byte 0 days old -- ocmsn.log 
20/09/2007 12:52:31 305764 byte 0 days old -- comsetup.log 
20/09/2007 12:52:31 437196 byte 0 days old -- ocgen.log 
20/09/2007 12:52:31 1917 byte 0 days old -- imsins.log 
20/09/2007 12:52:31 141672 byte 0 days old -- iis6.log 
20/09/2007 13:03:17 (DIR) 0 byte 0 days old -- Downloaded Program Files 
20/09/2007 13:34:02 106312 byte 0 days old -- FSUNINST.log 
20/09/2007 14:03:52 25003 byte 0 days old -- Q-Klez.log 
20/09/2007 14:04:17 7997 byte 0 days old -- fsihcomptest.log 
20/09/2007 14:09:30 8941 byte 0 days old -- fswil.log 
20/09/2007 14:46:09 3647 byte 0 days old -- FSPRODRM.LOG 
20/09/2007 14:46:09 5026 byte 0 days old -- fssgpex.LOG 
20/09/2007 15:32:32 935310824 byte 0 days old -- FSDEPH.log 
20/09/2007 15:32:42 1259395292 byte 0 days old -- uninstaller.log 
20/09/2007 15:55:20 152260 byte 0 days old -- ih8.config.xml.log 
20/09/2007 15:55:20 30872 byte 0 days old -- ih8.fssg.xml.log 
20/09/2007 15:55:23 859954 byte 0 days old -- fsinstaller.log 
20/09/2007 16:08:47 50 byte 0 days old -- wiaservc.log 
20/09/2007 16:14:42 216 byte 0 days old -- wiadebug.log 
20/09/2007 16:35:05 (DIR) 0 byte 0 days old -- inf 
20/09/2007 17:05:37 116 byte 0 days old -- NeroDigital.ini 
20/09/2007 20:00:02 309878 byte 0 days old -- setupapi.log 
20/09/2007 20:28:05 105 byte 0 days old -- FSSTM.LOG 
20/09/2007 20:42:42 14542 byte 0 days old -- userinit.exe 
20/09/2007 21:59:37 (DIR) 0 byte 0 days old -- Prefetch 
20/09/2007 21:59:40 (DIR) 0 byte 0 days old -- Installer 
20/09/2007 22:00:21 32516 byte 0 days old -- SchedLgU.Txt 
20/09/2007 22:01:04 (DIR) 0 byte 0 days old -- temp 
20/09/2007 22:04:16 1225116 byte 0 days old -- WindowsUpdate.log 
20/09/2007 22:05:04 2048 byte 0 days old -- bootstat.dat 
20/09/2007 22:05:41 0 byte 0 days old -- 0.log 
20/09/2007 22:22:38 1493150 byte 0 days old -- ntbtlog.txt 
20/09/2007 22:36:06 3 byte 0 days old -- presreg.txt 
20/09/2007 22:36:27 114 byte 0 days old -- presf.txt 
20/09/2007 22:36:27 (DIR) 0 byte 0 days old -- system32 
20/09/2007 22:36:37 753 byte 0 days old -- msnfix.txt 

----- recent files in C:\WINDOWS\Downloaded Program Files\ 

----- recent files in C:\WINDOWS\system\ 

----- recent files in C:\WINDOWS\system32\ 
29/08/2007 12:52:37 249356 byte 22 days old -- TZLog.log 
31/08/2007 01:19:28 (DIR) 0 byte 20 days old -- dllcache 
06/09/2007 04:50:42 17474680 byte 14 days old -- MRT.exe 
19/09/2007 21:07:06 0 byte 1 days old -- 5_exception.nls 
20/09/2007 20:23:10 46080 byte 0 days old -- ftp.exe 
20/09/2007 20:37:50 (DIR) 0 byte 0 days old -- CatRoot2 
20/09/2007 22:03:43 3072 byte 0 days old -- CONFIG.NT 
20/09/2007 22:05:44 1158 byte 0 days old -- wpa.dbl 
20/09/2007 22:06:53 (DIR) 0 byte 0 days old -- drivers 
20/09/2007 22:09:27 1031442 byte 0 days old -- PerfStringBackup.INI 
20/09/2007 22:09:28 472238 byte 0 days old -- perfh00C.dat 
20/09/2007 22:09:28 64230 byte 0 days old -- perfc009.dat 
20/09/2007 22:09:28 77350 byte 0 days old -- perfc00C.dat 
20/09/2007 22:09:28 405022 byte 0 days old -- perfh009.dat 
20/09/2007 22:36:37 (DIR) 0 byte 0 days old -- Microsoft 

----- recent files in C:\WINDOWS\system32\drivers\ 

----- recent files in C:\WINDOWS	emp\ 
22/08/2007 09:12:24 0 byte 29 days old -- JET948F.tmp 
23/08/2007 08:31:50 0 byte 28 days old -- JET8E26.tmp 
24/08/2007 09:32:44 16384 byte 27 days old -- Perflib_Perfdata_548.dat 
24/08/2007 09:32:54 0 byte 27 days old -- JET927C.tmp 
24/08/2007 16:23:09 0 byte 27 days old -- JET8925.tmp 
25/08/2007 09:27:12 0 byte 26 days old -- JET8869.tmp 
25/08/2007 20:04:44 0 byte 26 days old -- JET883B.tmp 
26/08/2007 12:09:14 16384 byte 25 days old -- Perflib_Perfdata_4b0.dat 
26/08/2007 12:09:34 0 byte 25 days old -- JETB555.tmp 
27/08/2007 12:40:51 0 byte 24 days old -- JETF00D.tmp 
28/08/2007 09:40:10 0 byte 23 days old -- JET9191.tmp 
28/08/2007 21:03:26 0 byte 23 days old -- JET858B.tmp 
29/08/2007 21:39:53 16384 byte 22 days old -- Perflib_Perfdata_54c.dat 
29/08/2007 21:40:02 0 byte 22 days old -- JET8BA6.tmp 
29/08/2007 23:29:31 0 byte 22 days old -- JET762A.tmp 
30/08/2007 21:40:59 0 byte 21 days old -- JET9AE8.tmp 
31/08/2007 18:06:57 0 byte 20 days old -- JET8702.tmp 
01/09/2007 14:09:07 0 byte 19 days old -- JET8656.tmp 
01/09/2007 23:58:05 0 byte 19 days old -- JET8983.tmp 
03/09/2007 12:41:21 16384 byte 17 days old -- Perflib_Perfdata_5fc.dat 
03/09/2007 12:41:30 0 byte 17 days old -- JET8731.tmp 
04/09/2007 12:47:05 16384 byte 16 days old -- Perflib_Perfdata_618.dat 
04/09/2007 12:47:36 0 byte 16 days old -- JETDE0B.tmp 
05/09/2007 11:15:09 0 byte 15 days old -- JET7E19.tmp 
05/09/2007 21:10:33 16384 byte 15 days old -- Perflib_Perfdata_5ec.dat 
05/09/2007 21:11:00 0 byte 15 days old -- JETCD33.tmp 
06/09/2007 09:34:56 16384 byte 14 days old -- Perflib_Perfdata_4a4.dat 
06/09/2007 09:35:26 0 byte 14 days old -- JETDC27.tmp 
06/09/2007 16:41:51 16384 byte 14 days old -- Perflib_Perfdata_4ac.dat 
06/09/2007 16:42:27 0 byte 14 days old -- JETF934.tmp 
07/09/2007 21:07:12 16384 byte 13 days old -- Perflib_Perfdata_518.dat 
07/09/2007 21:07:36 0 byte 13 days old -- JETF443.tmp 
08/09/2007 21:53:59 0 byte 12 days old -- JET9347.tmp 
10/09/2007 14:45:45 16384 byte 10 days old -- Perflib_Perfdata_550.dat 
10/09/2007 14:45:56 0 byte 10 days old -- JET9DD6.tmp 
11/09/2007 12:48:05 16384 byte 9 days old -- Perflib_Perfdata_540.dat 
11/09/2007 12:48:15 0 byte 9 days old -- JET9858.tmp 
12/09/2007 21:20:17 16384 byte 8 days old -- Perflib_Perfdata_544.dat 
12/09/2007 21:20:29 0 byte 8 days old -- JET9CCC.tmp 
13/09/2007 09:35:36 0 byte 7 days old -- JETD273.tmp 
14/09/2007 07:43:27 0 byte 6 days old -- JET8E55.tmp 
14/09/2007 18:27:24 0 byte 6 days old -- JET8A00.tmp 
15/09/2007 14:26:44 16384 byte 5 days old -- Perflib_Perfdata_50c.dat 
15/09/2007 14:27:19 0 byte 5 days old -- JETF4FE.tmp 
17/09/2007 13:25:34 0 byte 3 days old -- JETEA50.tmp 
18/09/2007 12:29:17 0 byte 2 days old -- JETF7EC.tmp 
19/09/2007 21:06:19 0 byte 1 days old -- JET39.tmp 
19/09/2007 23:34:16 0 byte 1 days old -- JET6AFF.tmp 
20/09/2007 00:00:37 16384 byte 0 days old -- Perflib_Perfdata_52c.dat 
20/09/2007 00:41:05 0 byte 0 days old -- JET738A.tmp 
20/09/2007 01:01:59 16384 byte 0 days old -- Perflib_Perfdata_524.dat 
20/09/2007 05:23:32 0 byte 0 days old -- JET8760.tmp 
20/09/2007 06:31:27 16384 byte 0 days old -- Perflib_Perfdata_520.dat 
20/09/2007 07:01:59 0 byte 0 days old -- JET5081.tmp 
20/09/2007 07:08:55 0 byte 0 days old -- JET516B.tmp 
20/09/2007 07:24:12 0 byte 0 days old -- JET4CF8.tmp 
20/09/2007 07:30:19 0 byte 0 days old -- JET5B8D.tmp 
20/09/2007 07:47:14 0 byte 0 days old -- JET493E.tmp 
20/09/2007 07:53:32 (DIR) 0 byte 0 days old -- ih8.tmp 
20/09/2007 08:18:17 0 byte 0 days old -- JET566D.tmp 
20/09/2007 08:37:53 0 byte 0 days old -- JET538E.tmp 
20/09/2007 09:17:32 0 byte 0 days old -- JET5573.tmp 
20/09/2007 09:28:23 0 byte 0 days old -- JET5796.tmp 
20/09/2007 10:27:28 0 byte 0 days old -- JET5F94.tmp 
20/09/2007 10:45:45 0 byte 0 days old -- JET4C6A.tmp 
20/09/2007 11:29:53 16384 byte 0 days old -- Perflib_Perfdata_5a8.dat 
20/09/2007 11:34:23 16384 byte 0 days old -- Perflib_Perfdata_564.dat 
20/09/2007 11:34:32 0 byte 0 days old -- JET7F90.tmp 
20/09/2007 11:41:09 16384 byte 0 days old -- Perflib_Perfdata_558.dat 
20/09/2007 11:41:23 0 byte 0 days old -- JET9A5B.tmp 
20/09/2007 11:51:32 (DIR) 0 byte 0 days old -- fsaua.tmp 
20/09/2007 12:11:47 0 byte 0 days old -- JET47F5.tmp 
20/09/2007 12:18:22 0 byte 0 days old -- JET4CE7.tmp 
20/09/2007 12:42:20 0 byte 0 days old -- JET5A16.tmp 
20/09/2007 13:36:55 0 byte 0 days old -- JET4BED.tmp 
20/09/2007 16:15:26 0 byte 0 days old -- JET4C2C.tmp 
20/09/2007 16:40:34 0 byte 0 days old -- JET56BB.tmp 
20/09/2007 20:24:27 0 byte 0 days old -- JET96C0.tmp 
20/09/2007 21:26:07 (DIR) 0 byte 0 days old -- _avast4_ 
20/09/2007 22:04:57 21504 byte 0 days old -- startdrv.exe 
20/09/2007 22:05:40 255 byte 0 days old -- WGAErrLog.txt 
20/09/2007 22:05:46 409 byte 0 days old -- WGANotify.settings 

----- recent files in C:\Program Files\ 
02/09/2007 19:44:26 (DIR) 0 byte 18 days old -- BitTorrent 
04/09/2007 12:58:26 (DIR) 0 byte 16 days old -- Neuf 
06/09/2007 13:40:05 (DIR) 0 byte 14 days old -- TVUPlayer 
19/09/2007 21:35:30 (DIR) 0 byte 1 days old -- Mozilla Firefox 
19/09/2007 22:58:56 (DIR) 0 byte 1 days old -- Grisoft 
20/09/2007 01:01:03 (DIR) 0 byte 0 days old -- YourWare Solutions 
20/09/2007 15:55:20 (DIR) 0 byte 0 days old -- Pack Securite 
20/09/2007 21:52:24 (DIR) 0 byte 0 days old -- CCleaner 
20/09/2007 22:27:08 (DIR) 0 byte 0 days old -- Hijackthis Version Française 

----- recent files in C:\Program Files\Fichiers communs\ 

----- recent files in C:\Documents and Settings\Barros\Application Data\ 
27/08/2007 19:09:05 (DIR) 0 byte 24 days old -- BitTorrent 
06/09/2007 13:39:43 (DIR) 0 byte 14 days old -- TVU Networks 
19/09/2007 21:36:23 (DIR) 0 byte 1 days old -- EoRezo 
20/09/2007 07:28:33 (DIR) 0 byte 0 days old -- F-Secure 
20/09/2007 22:07:00 (DIR) 0 byte 0 days old -- Grisoft 

----- recent files in C:\DOCUME~1\Barros\LOCALS~1\Temp\ 
20/09/2007 05:33:18 49152 byte 0 days old -- ~DFF4D1.tmp 
20/09/2007 06:58:41 17518 byte 0 days old -- prodsett.ini 
20/09/2007 07:09:37 (DIR) 0 byte 0 days old -- WERfc58.dir00 
20/09/2007 07:17:51 (DIR) 0 byte 0 days old -- plugtmp 
20/09/2007 07:31:24 (DIR) 0 byte 0 days old -- WER12ce.dir00 
20/09/2007 07:49:52 (DIR) 0 byte 0 days old -- WERbfef.dir00 
20/09/2007 08:09:59 18870 byte 0 days old -- fs-1.tmp 
20/09/2007 08:18:58 (DIR) 0 byte 0 days old -- WERfc63.dir00 
20/09/2007 08:19:41 95 byte 0 days old -- fsa03164.xml 
20/09/2007 08:20:34 15748 byte 0 days old -- fs-4.tmp 
20/09/2007 08:38:54 (DIR) 0 byte 0 days old -- WER495e.dir00 
20/09/2007 08:40:02 95 byte 0 days old -- fsa02916.xml 
20/09/2007 08:44:21 15748 byte 0 days old -- fs-5.tmp 
20/09/2007 09:43:17 95 byte 0 days old -- fsa03972.xml 
20/09/2007 09:43:43 15748 byte 0 days old -- fs-A.tmp 
20/09/2007 10:41:24 426 byte 0 days old -- IMTF.xml 
20/09/2007 10:41:24 2026 byte 0 days old -- IMTE.xml 
20/09/2007 10:41:25 805418 byte 0 days old -- IMT10.xml 
20/09/2007 10:41:39 2026 byte 0 days old -- IMT1B.xml 
20/09/2007 10:41:39 426 byte 0 days old -- IMT1C.xml 
20/09/2007 10:41:43 1022 byte 0 days old -- IMT1E.dtd 
20/09/2007 10:41:43 2787756 byte 0 days old -- IMT1D.xml 
20/09/2007 10:41:50 426 byte 0 days old -- IMT29.xml 
20/09/2007 10:41:50 2026 byte 0 days old -- IMT28.xml 
20/09/2007 10:41:51 805418 byte 0 days old -- IMT2A.xml 
20/09/2007 10:41:59 426 byte 0 days old -- IMT36.xml 
20/09/2007 10:41:59 805418 byte 0 days old -- IMT37.xml 
20/09/2007 10:41:59 2026 byte 0 days old -- IMT35.xml 
20/09/2007 10:46:45 (DIR) 0 byte 0 days old -- WER1c68.dir00 
20/09/2007 11:07:40 (DIR) 0 byte 0 days old -- plugtmp-1 
20/09/2007 11:29:34 (DIR) 0 byte 0 days old -- ~nsu.tmp 
20/09/2007 11:38:27 (DIR) 0 byte 0 days old -- WER1e66.dir00 
20/09/2007 11:42:09 (DIR) 0 byte 0 days old -- WER4434.dir00 
20/09/2007 11:47:37 49152 byte 0 days old -- ~DF78ED.tmp 
20/09/2007 11:53:27 95 byte 0 days old -- fsa01736.xml 
20/09/2007 11:53:29 (DIR) 0 byte 0 days old -- WERa01a.dir00 
20/09/2007 12:12:23 (DIR) 0 byte 0 days old -- WERd56e.dir00 
20/09/2007 12:18:51 (DIR) 0 byte 0 days old -- WERb990.dir00 
20/09/2007 12:56:56 (DIR) 0 byte 0 days old -- plugtmp-2 
20/09/2007 13:49:40 (DIR) 0 byte 0 days old -- Installer 
20/09/2007 13:53:39 2 byte 0 days old -- Twain001.Mtx 
20/09/2007 13:53:39 0 byte 0 days old -- Twunk002.MTX 
20/09/2007 13:53:42 477 byte 0 days old -- TWAIN.LOG 
20/09/2007 13:53:42 156 byte 0 days old -- Twunk001.MTX 
20/09/2007 14:15:29 (DIR) 0 byte 0 days old -- ih8.tmp 
20/09/2007 15:55:18 181003 byte 0 days old -- setupgui.log 
20/09/2007 15:55:18 35999 byte 0 days old -- setupguimngr.log 
20/09/2007 16:15:45 (DIR) 0 byte 0 days old -- WER97f7.dir00 
20/09/2007 18:59:59 (DIR) 0 byte 0 days old -- _avast4_ 
20/09/2007 20:22:42 (DIR) 0 byte 0 days old -- WPDNSE 
20/09/2007 20:35:32 49152 byte 0 days old -- ~DFD7E9.tmp 
20/09/2007 21:59:19 (DIR) 0 byte 0 days old -- {4B9BB601-13E9-4042-A3BC-E7955BF4A98F} 
20/09/2007 21:59:19 55459 byte 0 days old -- caevents.log 
20/09/2007 21:59:19 2665 byte 0 days old -- KLeaner.log 
20/09/2007 21:59:40 95258 byte 0 days old -- kl-install-2007-09-20-21-58-55.log 
20/09/2007 22:06:20 3404 byte 0 days old -- kl-install-2007-09-20-22-06-18.log 
20/09/2007 22:29:35 (DIR) 0 byte 0 days old -- plugtmp-3 
20/09/2007 22:45:01 16384 byte 0 days old -- ~DF656E.tmp 
20/09/2007 22:45:21 (DIR) 0 byte 0 days old -- nsj87.tmp 

===================== Duplicates in BAK folders ===================== 

No BAK folders found 

===================== REGISTRY SCAN ===================== 


-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run----- 

[Run] 
"TkBellExe"="\"C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe\" -osboot" 
"QuickTime Task"="\"C:\Program Files\QuickTime\qttask.exe\" -atboottime" 
"HostManager"="C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe" 
"Adobe Photo Downloader"="\"C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe\"" 
"Adobe Reader Speed Launcher"="\"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe\"" 
"mono.exe"="C:\WINDOWS\mono.exe" 
"startdrv"="C:\WINDOWS\Temp\startdrv.exe" 
"SoundMax"="\"C:\Program Files\Analog Devices\SoundMAX\smax4.exe\" /tray" 
"!AVG Anti-Spyware"="\"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe\" /minimized" 

[Run\OptionalComponents] 
@="" 

[Run\OptionalComponents\IMAIL] 
"Installed"="1" 
@="" 

[Run\OptionalComponents\MAPI] 
"Installed"="1" 
"NoChange"="1" 
@="" 

[Run\OptionalComponents\MSFS] 
"Installed"="1" 
@="" 

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run----- 

[Run] 
@SACL= 
"MsnMsgr"="\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background" 
"MSMSGS"="\"C:\Program Files\Messenger\msmsgs.exe\" /background" 
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe\"" 
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9" 
"Neuf Media Center"="\"C:\Program Files\Neuf\Media Center\MediaCenter.exe\"" 
"FreeRAM XP"="\"C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe\" -win" 

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run----- 

[Run] 
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" 

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run----- 

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run----- 

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows----- 

[Windows] 
"AppInit_DLLs"="" 

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad----- 

[ShellServiceObjectDelayLoad] 
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" 
#### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll" 
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" 
#### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll" 
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" 
#### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"%SystemRoot%\system32\webcheck.dll" 
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" 
#### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\system32\stobject.dll" 
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" 
#### HKCR\CLSID\{AAA288BA-9A4C-45B0-95D7-94D524869DB5}\InprocServer32 @="C:\WINDOWS\system32\WPDShServiceObj.dll" 

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks----- 

[ShellExecuteHooks] 
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" 
#### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll" 
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" 
#### HKCR\CLSID\{57B86673-276A-48B2-BAE7-C6DBB3020EB8}\InprocServer32 @="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" 

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon----- 

[Winlogon] 
"Shell"="Explorer.exe" 
"System"="" 
"Userinit"="C:\WINDOWS\system32\userinit.exe," 
"VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\"" 
"UIHost"=expand:"logonui.exe" 
"LogonType"=dword:00000001 
"WinStationsDisabled"="0" 

[Winlogon\GPExtensions] 

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}] 
"@="Quota du disque Microsoft" 
"DllName"=expand:"dskquota.dll" 

[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}] 
"@="Mappage de zones Internet Explorer" 
"DllName"=expand:"iedkcs32.dll" 

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}] 
"DllName"=expand:"scecli.dll" 
"@="Security" 

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}] 
"DllName"=expand:"iedkcs32.dll" 
"@="Personnalisation de Internet Explorer" 

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}] 
"DllName"=expand:"scecli.dll" 
"@="EFS recovery" 

[Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}] 
"@="Microsoft Offline Files" 
"DllName"=expand:"%SystemRoot%\System32\cscui.dll" 

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}] 
"@="Installation de logiciel" 
"DllName"=expand:"appmgmts.dll" 

[Winlogon\Notify] 

[Winlogon\Notify\crypt32chain] 
"DllName"=expand:"crypt32.dll" 
"Logoff"="ChainWlxLogoffEvent" 

[Winlogon\Notify\cryptnet] 
"DllName"=expand:"cryptnet.dll" 
"Logoff"="CryptnetWlxLogoffEvent" 

[Winlogon\Notify\cscdll] 
"DLLName"="cscdll.dll" 
"Logon"="WinlogonLogonEvent" 
"Logoff"="WinlogonLogoffEvent" 
"ScreenSaver"="WinlogonScreenSaverEvent" 
"Startup"="WinlogonStartupEvent" 
"StartShell"="WinlogonStartShellEvent" 

[Winlogon\Notify\ScCertProp] 
"DLLName"="wlnotify.dll" 
"Logon"="SCardStartCertProp" 
"Logoff"="SCardStopCertProp" 
"Lock"="SCardSuspendCertProp" 
"Unlock"="SCardResumeCertProp" 
"Enabled"=dword:00000001 

[Winlogon\Notify\Schedule] 
"DllName"=expand:"wlnotify.dll" 
"StartShell"="SchedStartShell" 
"Logoff"="SchedEventLogOff" 

[Winlogon\Notify\sclgntfy] 
"Logoff"="WLEventLogoff" 
"DllName"=expand:"sclgntfy.dll" 

[Winlogon\Notify\SensLogn] 
"DLLName"="WlNotify.dll" 
"Lock"="SensLockEvent" 
"Logon"="SensLogonEvent" 
"Logoff"="SensLogoffEvent" 
"Safe"=dword:00000001 
"MaxWait"=dword:00000258 
"StartScreenSaver"="SensStartScreenSaverEvent" 
"StopScreenSaver"="SensStopScreenSaverEvent" 
"Startup"="SensStartupEvent" 
"StartShell"="SensStartShellEvent" 
"PostShell"="SensPostShellEvent" 
"Disconnect"="SensDisconnectEvent" 
"Reconnect"="SensReconnectEvent" 
"Unlock"="SensUnlockEvent" 

[Winlogon\Notify	ermsrv] 
"DllName"=expand:"wlnotify.dll" 
"Logoff"="TSEventLogoff" 
"Logon"="TSEventLogon" 
"PostShell"="TSEventPostShell" 
"StartShell"="TSEventStartShell" 
"Startup"="TSEventStartup" 
"MaxWait"=dword:00000258 
"Reconnect"="TSEventReconnect" 
"Disconnect"="TSEventDisconnect" 

[Winlogon\Notify\WgaLogon] 
"Logon"="WLEventLogon" 
"Logoff"="WLEventLogoff" 
"Startup"="WLEventStartup" 
"StartScreenSaver"="WLEventStartScreenSaver" 
"StopScreenSaver"="WLEventStopScreenSaver" 
"Lock"="WLEventLock" 
"Unlock"="WLEventUnlock" 
"StartShell"="WLEventStartShell" 
"PostShell"="WLEventPostShell" 
"Disconnect"="WLEventDisconnect" 
"Reconnect"="WLEventReconnect" 
"SafeMode"=dword:00000001 
"MaxWait"=dword:ffffffff 
"DllName"=expand:"WgaLogon.dll" 

[Winlogon\Notify\WgaLogon\Settings] 

[Winlogon\Notify\wlballoon] 
"DLLName"="wlnotify.dll" 
"Logon"="RegisterTicketExpiredNotificationEvent" 
"Logoff"="UnregisterTicketExpiredNotificationEvent" 

[Winlogon\SpecialAccounts] 

[Winlogon\SpecialAccounts\UserList] 
"HelpAssistant"=dword:00000000 
"TsInternetUser"=dword:00000000 
"SQLAgentCmdExec"=dword:00000000 
"NetShowServices"=dword:00000000 
"IWAM_"=dword:00010000 
"IUSR_"=dword:00010000 
"VUSR_"=dword:00010000 
"ASPNET"=dword:00000000 

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon----- 

[Winlogon] 
@SACL= 
"ParseAutoexec"="1" 
"ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp" 
"BuildNumber"=dword:00000a28 

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options----- 

[Image File Execution Options\Your Image File Name Here without a path] 
"Debugger"="ntsd -d" 

-----HKLM\System\CurrentControlSet\Control\Session Manager\----- 

[Session Manager] 
"BootExecute"=multi:"autocheck autochk *\00\00" 

[Session Manager\SubSystems] 
"Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16" 

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW----- 

[WOW] 
"cmdline"=expand:"%SystemRoot%\system32
tvdm.exe" 
"wowcmdline"=expand:"%SystemRoot%\system32
tvdm.exe -a %SystemRoot%\system32\krnl386" 

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run----- 

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce----- 

[RunOnce] 

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx----- 

[RunOnceEx] 

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices----- 

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce----- 

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce----- 

[RunOnce] 

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx----- 

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices----- 

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run----- 

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce----- 

-----HKLM\Software\Microsoft\Command Processor\Autorun----- 

-----HKCU\Software\Microsoft\Command Processor\Autorun----- 

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load----- 

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup----- 

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon----- 

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon----- 

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce----- 

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run----- 

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wdsdpwd\StartupPrograms----- 

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce----- 

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler----- 

[SharedTaskScheduler] 
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui" 
#### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll" 
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant" 
#### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll" 

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects----- 

[Browser Helper Objects] 

[Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}] 
#### HKCR\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\InprocServer32 @="C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll" 
"NoExplorer"=dword:00000001 

[Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 
@="" 

[Browser Helper Objects\{58b525f4-b7d7-4600-86f4-46d30a9cc183}] 
#### HKCR\CLSID\{58b525f4-b7d7-4600-86f4-46d30a9cc183}\InprocServer32 @="C:\Program Files\jeanmarcmorandini	bjean.dll" 
@="" 

[Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}] 
#### HKCR\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}\InprocServer32 @="C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll" 
@="EoRezoBHO" 

[Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 
#### HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\InprocServer32 @="C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" 
"NoExplorer"=dword:00000001 

[Browser Helper Objects\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}] 
#### HKCR\CLSID\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}\InprocServer32 @="C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll" 
@="AOL Toolbar Launcher" 

[Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] 
@="" 

[Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] 
#### HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\InprocServer32 @="C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" 

[Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}] 
#### HKCR\CLSID\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\InprocServer32 @="C:\Program Files\Windows Live Toolbar\msntb.dll" 
@="" 

[Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\NoExplorer] 
@=dword:00000001 

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks----- 

[URLSearchHooks] 
@SACL= 
"{EA756889-2338-43DB-8F07-D1CA6FB9C90D}"="Recherche" 
#### HKCR\CLSID\{EA756889-2338-43DB-8F07-D1CA6FB9C90D}\InprocServer32 @="C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll" 
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="" 
#### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @=expand:"%SystemRoot%\system32\shdocvw.dll" 
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"="" 
#### HKCR\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32 @="C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll" 
"{58b525f4-b7d7-4600-86f4-46d30a9cc183}"="" 
#### HKCR\CLSID\{58b525f4-b7d7-4600-86f4-46d30a9cc183}\InprocServer32 @="C:\Program Files\jeanmarcmorandini	bjean.dll" 

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder----- 

[startupfolder] 

-----HKCU\Control Panel\Desktop\----- 

[Desktop] 
"SCRNSAVE.EXE"="C:\WINDOWS\system32\SSGORG~1.SCR" 

[Desktop\WindowMetrics] 

-----HKEY_CLASSES_ROOT\exefile\shell\open\command----- 

[command] 
@="\"%1\" %*" 

-----HKEY_CLASSES_ROOT\comfile\shell\open\command----- 

[command] 
@="\"%1\" %*" 

-----HKEY_CLASSES_ROOT\batfile\shell\open\command----- 

[command] 
@="\"%1\" %*" 

-----HKEY_CLASSES_ROOT\piffile\shell\open\command----- 

[command] 
@="\"%1\" %*" 

-----HKEY_CLASSES_ROOT\scrFile\shell\open\command----- 

[command] 
@="\"%1\" /S" 

-----HKEY_CLASSES_ROOT\htafile\shell\open\command----- 

[Command] 
@="C:\WINDOWS\system32\mshta.exe \"%1\" %*" 

-----HKEY_CLASSES_ROOT\logfile\shell\open\command----- 

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL----- 

[URL] 

[URL\DefaultPrefix] 
@="http://" 

[URL\Prefixes] 
"ftp"="ftp://" 
"gopher"="gopher://" 
"home"="http://" 
"mosaic"="http://" 
"www"="http://" 

-----HKLM\SYSTEM\CurrentControlSet\Control\Lsa----- 

[Lsa] 
"Authentication Packages"=multi:"msv1_0\00\00" 
"Bounds"=hex:00,30,00,00,00,20,00,00 
"Security Packages"=multi:"kerberos\00msv1_0\00schannel\00wdigest\00\00" 
"ImpersonatePrivilegeUpgradeToolHasRun"=dword:00000001 
"LsaPid"=dword:00000210 
"SecureBoot"=dword:00000001 
"auditbaseobjects"=dword:00000000 
"crashonauditfail"=dword:00000000 
"disabledomaincreds"=dword:00000000 
"everyoneincludesanonymous"=dword:00000000 
"fipsalgorithmpolicy"=dword:00000000 
"forceguest"=dword:00000001 
"fullprivilegeauditing"=hex:00 
"limitblankpassworduse"=dword:00000001 
"lmcompatibilitylevel"=dword:00000000 
"nodefaultadminowner"=dword:00000001 
"nolmhash"=dword:00000000 
"restrictanonymous"=dword:00000000 
"restrictanonymoussam"=dword:00000001 
"Notification Packages"=multi:"scecli\00\00" 

[Lsa\AccessProviders] 
"ProviderOrder"=multi:"Windows NT Access Provider\00\00" 

[Lsa\AccessProviders\Windows NT Access Provider] 
"ProviderPath"=expand:"%SystemRoot%\system32
tmarta.dll" 

[Lsa\Audit] 

[Lsa\Audit\PerUserAuditing] 

[Lsa\Audit\PerUserAuditing\System] 

[Lsa\Data] 
@Class="d914ae1b" 
"Pattern"=hex:27,8f,ce,66,f1,f7,ab,a7,f1,e7,66,e9,7c,55,6c,c8,64,39,31,34,61,\ 
65,31,62,00,00,00,00,76,71,00,00,18,ca,06,00,99,d0,b5,71,04,ca,06,00,10,00,\ 
00,00,00,00,00,00,a5,bc,88,fc,a9,e1,14,5d,f6,31,6b,d9 

[Lsa\GBG] 
@Class="a5e110a9" 
"GrafBlumGroup"=hex:9f,b6,fc,d2,6b,9f,63,ef,c1 

[Lsa\JD] 
@Class="f66bfc5d" 
"Lookup"=hex:ac,74,6a,d3,c7,93 

[Lsa\Kerberos] 

[Lsa\Kerberos\Domains] 

[Lsa\Kerberos\SidCache] 

[Lsa\msv1_0] 
"ntlmminclientsec"=dword:00000000 
"ntlmminserversec"=dword:00000000 

[Lsa\Skew1] 
@Class="88bc31db" 
"SkewMatrix"=hex:ad,24,a7,0b,fc,5c,dd,a2,b8,14,59,36,a0,f3,1e,65 

[Lsa\SSO] 

[Lsa\SSO\Passport1.4] 
"SSOURL"="http://www.passport.com" 

[Lsa\SspiCache] 
"Time"=hex:7a,25,c4,cb,ef,d1,c6,01 

[Lsa\SspiCache\digest.dll] 
"Name"="Digest" 
"Comment"="Digest SSPI Authentication Package" 
"Capabilities"=dword:00004050 
"RpcId"=dword:0000ffff 
"Version"=dword:00000001 
"TokenSize"=dword:0000ffff 
"Time"=hex:00,c8,6b,0f,a9,7a,c4,01 
"Type"=dword:00000031 

[Lsa\SspiCache\msapsspc.dll] 
"Name"="DPA" 
"Comment"="DPA Security Package" 
"Capabilities"=dword:00000037 
"RpcId"=dword:00000011 
"Version"=dword:00000001 
"TokenSize"=dword:00000300 
"Time"=hex:00,c8,6b,0f,a9,7a,c4,01 
"Type"=dword:00000031 

[Lsa\SspiCache\msnsspc.dll] 
"Name"="MSN" 
"Comment"="MSN Security Package" 
"Capabilities"=dword:00000037 
"RpcId"=dword:00000012 
"Version"=dword:00000001 
"TokenSize"=dword:00000300 
"Time"=hex:00,c8,6b,0f,a9,7a,c4,01 
"Type"=dword:00000031 

-----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess----- 

[SharedAccess] 
"DependOnGroup"=multi:"\00" 
"DependOnService"=multi:"Netman\00WinMgmt\00\00" 
"Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique." 
"DisplayName"="Pare-feu Windows / Partage de connexion Internet" 
"ErrorControl"=dword:00000001 
"ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs" 
"ObjectName"="LocalSystem" 
"Start"=dword:00000002 
"Type"=dword:00000020 

[SharedAccess\Epoch] 
"Epoch"=dword:0001131e 

[SharedAccess\Parameters] 
"ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll" 

[SharedAccess\Parameters\FirewallPolicy] 

[SharedAccess\Parameters\FirewallPolicy\DomainProfile] 

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications] 

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] 
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" 
"C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe:*:Enabled:AOL" 
"C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe:*:Enabled:AOL" 
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" 
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" 
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" 
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" 
"C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL" 

[SharedAccess\Parameters\FirewallPolicy\StandardProfile] 
"EnableFirewall"=dword:00000001 
"DoNotAllowExceptions"=dword:00000000 
"DisableNotifications"=dword:00000000 

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications] 

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" 
"C:\Program Files\Acer\Acer eConsole\MediaSync.exe"="C:\Program Files\Acer\Acer eConsole\MediaSync.exe:LocalSubNet:Enabled:Media Synchoronizer" 
"C:\Program Files\Acer\Acer eConsole\eConsole.exe"="C:\Program Files\Acer\Acer eConsole\eConsole.exe:LocalSubNet:Enabled:eConsole" 
"C:\Program Files\Acer\Acer eConsole\MediaServerService.exe"="C:\Program Files\Acer\Acer eConsole\MediaServerService.exe:LocalSubNet:Enabled:Acer Media Server" 
"C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe:*:Enabled:AOL" 
"C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe:*:Enabled:AOL" 
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" 
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" 
"C:\WINDOWS\system32\mshta.exe"="C:\WINDOWS\system32\mshta.exe:*:Enabled:Microsoft (R) HTML Application host" 
"C:\Program Files\Fichiers communs\NewTech Infosystems\LiveUpdate\LiveUpdate.exe"="C:\Program Files\Fichiers communs\NewTech Infosystems\LiveUpdate\LiveUpdate.exe:*:Enabled:LiveUpdate" 
"C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"="C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime" 
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" 
"C:\Program Files\Fichiers communs\AOL\Loader\aolload.exe"="C:\Program Files\Fichiers communs\AOL\Loader\aolload.exe:*:Enabled:AOL Loader" 
"C:\Program Files\Fichiers communs\AOL\1157577326\ee\aolsoftware.exe"="C:\Program Files\Fichiers communs\AOL\1157577326\ee\aolsoftware.exe:*:Enabled:AOL Services" 
"C:\Program Files\TVUPlayer\TVUPlayer.exe"="C:\Program Files\TVUPlayer\TVUPlayer.exe:*:Enabled:TVU Player Component" 
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" 
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" 
"C:\Program Files\MaxTV\maxtv.exe"="C:\Program Files\MaxTV\maxtv.exe:*:Enabled:MaxTV Online" 
"K:\Emule2\eMule\emule.exe"="K:\Emule2\eMule\emule.exe:*:Enabled:eMule" 
"C:\Program Files\adslTV\adslTV.exe"="C:\Program Files\adslTV\adslTV.exe:*:Enabled:adslTV" 
"C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL" 
"C:\Program Files\BitTorrent_DNA\dna.exe"="C:\Program Files\BitTorrent_DNA\dna.exe:*:Enabled:DNA" 
"C:\Program Files\adslTV\vlc.exe"="C:\Program Files\adslTV\vlc.exe:*:Enabled:VLC media player" 
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Browser" 
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer" 
"C:\Program Files\Real\RealPlayerealplay.exe"="C:\Program Files\Real\RealPlayerealplay.exe:*:Enabled:RealPlayer" 
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent" 
"C:\WINDOWS\perfmon.exe"="C:\WINDOWS\perfmon.exe:*:Disabled:perfmon" 
"C:\Program Files\Neuf\Media Center\httpd\httpd.exe"="C:\Program Files\Neuf\Media Center\httpd\httpd.exe:172.16.255.0/255.255.255.0:Enabled:Serveur de partage Media Center (Player Neuf Cegetel)" 

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts] 

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] 

[SharedAccess\Setup] 
"ServiceUpgrade"=dword:00000001 

[SharedAccess\Setup\InterfacesUnfirewalledAtUpdate] 
"All"=dword:00000001 

-----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\----- 

-----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2----- 

-----HKLM\Software\Microsoft\Ole----- 

[Ole] 
"DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\ 
14,00,00,00,02,00,48,00,03,00,00,00,00,00,18,00,1f,00,00,00,01,02,00,00,00,\ 
00,00,05,20,00,00,00,20,02,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,\ 
00,05,04,00,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,00,05,12,00,00,\ 
00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,\ 
20,00,00,00,20,02,00,00 
"MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\ 
14,00,00,00,02,00,34,00,02,00,00,00,00,00,18,00,1f,00,00,00,01,02,00,00,00,\ 
00,00,05,20,00,00,00,20,02,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,\ 
00,01,00,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,\ 
00,00,00,00,05,20,00,00,00,20,02,00,00 
"MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\ 
14,00,00,00,02,00,30,00,02,00,00,00,00,00,14,00,03,00,00,00,01,01,00,00,00,\ 
00,00,05,07,00,00,00,00,00,14,00,07,00,00,00,01,01,00,00,00,00,00,01,00,00,\ 
00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,\ 
05,20,00,00,00,20,02,00,00 
"EnableDCOM"="Y" 

[Ole\AppCompat] 

[Ole\AppCompat\ActivationSecurityCheckExemptionList] 
"{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1" 
"{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1" 
"{0040D221-54A1-11D1-9DE0-006097042D69}"="1" 
"{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1" 

[Ole\NONREDIST] 
"System.EnterpriseServices.Thunk.dll"="" 

-----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\----- 

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\----- 

[Security Center] 
"FirstRunDisabled"=dword:00000001 
"AntiVirusDisableNotify"=dword:00000001 
"FirewallDisableNotify"=dword:00000000 
"UpdatesDisableNotify"=dword:00000000 
"AntiVirusOverride"=dword:00000001 
"FirewallOverride"=dword:00000000 

[Security Center\Monitoring] 

[Security Center\Monitoring\AhnlabAntiVirus] 

[Security Center\Monitoring\ComputerAssociatesAntiVirus] 

[Security Center\Monitoring\KasperskyAntiVirus] 

[Security Center\Monitoring\McAfeeAntiVirus] 

[Security Center\Monitoring\McAfeeFirewall] 

[Security Center\Monitoring\PandaAntiVirus] 

[Security Center\Monitoring\PandaFirewall] 

[Security Center\Monitoring\SophosAntiVirus] 

[Security Center\Monitoring\SymantecAntiVirus] 

[Security Center\Monitoring\SymantecFirewall] 

[Security Center\Monitoring\TinyFirewall] 

[Security Center\Monitoring\TrendAntiVirus] 

[Security Center\Monitoring\TrendFirewall] 

[Security Center\Monitoring\ZoneLabsFirewall] 

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\----- 

[SystemRestore] 
"DisableSR"=dword:00000000 
"CreateFirstRunRp"=dword:00000001 
"DSMin"=dword:000000c8 
"DSMax"=dword:00000190 
"RPSessionInterval"=dword:00000000 
"RPGlobalInterval"=dword:00015180 
"RPLifeInterval"=dword:0076a700 
"CompressionBurst"=dword:0000003c 
"TimerInterval"=dword:00000078 
"DiskPercent"=dword:0000000c 
"ThawInterval"=dword:00000384 
"RestoreDiskSpaceError"=dword:00000000 

[SystemRestore\Cfg] 
"DiskPercent"=dword:0000000c 
"MachineGuid"="{6C8E7B52-D81C-4AFE-8CB4-40363E703700}" 

[SystemRestore\SnapshotCallbacks] 
@="" 

-----HKEY_CURRENT_USER\Software\VB and VBA Program Settings----- 

[VB and VBA Program Settings] 

[VB and VBA Program Settings\a-d-s-l-t-v] 

[VB and VBA Program Settings\a-d-s-l-t-v\p-a-r-e-n-t] 

[VB and VBA Program Settings\CCleaner] 

[VB and VBA Program Settings\CCleaner\Options] 

-----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\----- 

[MountPoints2] 
@SACL= 

[MountPoints2\A] 
"BaseClass"="Drive" 

[MountPoints2\C] 
"BaseClass"="Drive" 

[MountPoints2\D] 
"BaseClass"="Drive" 

[MountPoints2\E] 
"BaseClass"="Drive" 

[MountPoints2\F] 
@SACL= 
"BaseClass"="Drive" 

[MountPoints2\G] 
@SACL= 
"BaseClass"="Drive" 

[MountPoints2\H] 
@SACL= 
"BaseClass"="Drive" 

[MountPoints2\I] 
@SACL= 
"BaseClass"="Drive" 

[MountPoints2\J] 
"BaseClass"="Drive" 
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\ 
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,cf,5f,5f,5f,5f,5f,cf,\ 
cf,5f,5f,5f,5f,cf,cf,cf,cf,cf,df,df,df,5f,df,df,00,5f,5f,5f,5f,5f,5f,5f,5f,\ 
5f,5f,00,01,00,00,00,08,00,00,00 

[MountPoints2\K] 
"BaseClass"="Drive" 
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\ 
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,cf,5f,5f,5f,5f,5f,00,\ 
01,00,01,01,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\ 
ff,ff,00,01,00,00,00,09,00,00,00 

[MountPoints2\K\_Autorun] 

[MountPoints2\K\_Autorun\DefaultIcon] 
@="K:\AUTORUN\WDLOGO.ICO" 

[MountPoints2\L] 
"BaseClass"="Drive" 

[MountPoints2\{0b2ffa44-eaf1-11da-87f6-806d6172696f}] 
"BaseClass"="Drive" 

[MountPoints2\{0b2ffa45-eaf1-11da-87f6-806d6172696f}] 
"BaseClass"="Drive" 

[MountPoints2\{0b2ffa47-eaf1-11da-87f6-806d6172696f}] 
"BaseClass"="Drive" 

[MountPoints2\{0b2ffa48-eaf1-11da-87f6-806d6172696f}] 
"BaseClass"="Drive" 

[MountPoints2\{0b2ffa49-eaf1-11da-87f6-806d6172696f}] 
"BaseClass"="Drive" 

[MountPoints2\{0b2ffa4a-eaf1-11da-87f6-806d6172696f}] 
"BaseClass"="Drive" 

[MountPoints2\{35dac936-86c4-11da-86e9-806d6172696f}] 
@SACL= 
"BaseClass"="Drive" 

[MountPoints2\{35dac937-86c4-11da-86e9-806d6172696f}] 
@SACL= 
"BaseClass"="Drive" 

[MountPoints2\{35dac938-86c4-11da-86e9-806d6172696f}] 
@SACL= 
"BaseClass"="Drive" 

[MountPoints2\{35dac939-86c4-11da-86e9-806d6172696f}] 
@SACL= 
"BaseClass"="Drive" 

[MountPoints2\{48d10788-41d3-11db-a13c-0090d098d6dd}] 
"BaseClass"="Drive" 
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\ 
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,01,00,01,01,ee,ff,ff,\ 
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\ 
ff,ff,00,00,10,00,00,08,03,00,00 

[MountPoints2\{48d10788-41d3-11db-a13c-0090d098d6dd}\shell] 
@="None" 

[MountPoints2\{48d10788-41d3-11db-a13c-0090d098d6dd}\shell\Autoplay] 
"MUIVerb"="@shell32.dll,-8504" 

[MountPoints2\{48d10788-41d3-11db-a13c-0090d098d6dd}\shell\Autoplay\DropTarget] 
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}" 
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll" 

[MountPoints2\{530564f6-8243-11db-a1b5-0090d098d6dd}] 
"BaseClass"="Drive" 
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\ 
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,5f,cf,\ 
cf,5f,5f,5f,5f,01,01,00,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\ 
ff,ff,00,00,10,00,00,08,01,00,00 

[MountPoints2\{530564f6-8243-11db-a1b5-0090d098d6dd}\shell] 
@="None" 

[MountPoints2\{530564f6-8243-11db-a1b5-0090d098d6dd}\shell\Autoplay] 
"MUIVerb"="@shell32.dll,-8504" 

[MountPoints2\{530564f6-8243-11db-a1b5-0090d098d6dd}\shell\Autoplay\DropTarget] 
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}" 
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll" 

[MountPoints2\{604df264-79bd-11db-a1a8-0090d098d6dd}] 
"BaseClass"="Drive" 
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\ 
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,01,00,01,01,ee,ff,ff,\ 
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\ 
ff,ff,00,00,10,00,00,08,03,00,00 

[MountPoints2\{604df264-79bd-11db-a1a8-0090d098d6dd}\shell] 
@="None" 

[MountPoints2\{604df264-79bd-11db-a1a8-0090d098d6dd}\shell\Autoplay] 
"MUIVerb"="@shell32.dll,-8504" 

[MountPoints2\{604df264-79bd-11db-a1a8-0090d098d6dd}\shell\Autoplay\DropTarget] 
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}" 
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll" 

[MountPoints2\{6a0671be-8273-11db-a1b6-0090d098d6dd}] 
"BaseClass"="Drive" 
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\ 
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,01,00,01,01,ee,ff,ff,\ 
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\ 
ff,ff,00,00,10,00,00,08,03,00,00 

[MountPoints2\{6a0671be-8273-11db-a1b6-0090d098d6dd}\shell] 
@="None" 

[MountPoints2\{6a0671be-8273-11db-a1b6-0090d098d6dd}\shell\Autoplay] 
"MUIVerb"="@shell32.dll,-8504" 

[MountPoints2\{6a0671be-8273-11db-a1b6-0090d098d6dd}\shell\Autoplay\DropTarget] 
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}" 
#### HKCR\CLSID\{f26a6
@+

Yuki · Answer

oui merci voici le rapport de Bitdefender :

BitDefender Online Scanner
	

 
	

 

Scan report generated at: Fri, Sep 21, 2007 - 11:53:05

 
	

 
	

 

Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;
	

 
	

 

 
	

 
	

 

Statistics

Time
	

00:52:08

Files
	

353233

Folders
	

6740

Boot Sectors
	

4

Archives
	

7372

Packed Files
	

26823
	

 
	

 

Results

Identified Viruses
	

7

Infected Files
	

14

Suspect Files
	

0

Warnings
	

0

Disinfected
	

0

Deleted Files
	

14
	

 
	

 

Engines Info

Virus Definitions
	

822793

Engine build
	

AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)

Scan plugins
	

14

Archive plugins
	

38

Unpack plugins
	

7

E-mail plugins
	

6

System plugins
	

1
	

 
	

 

Scan Settings

First Action
	

Disinfect

Second Action
	

Delete

Heuristics
	

Yes

Enable Warnings
	

Yes

Scanned Extensions
	

*;

Exclude Extensions
	

 

Scan Emails
	

Yes

Scan Archives
	

Yes

Scan Packed
	

Yes

Scan Files
	

Yes

Scan Boot
	

Yes
	

 
	

 
 

Scanned File
	

 Status

C:\Documents and Settings\Barros\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\java.class-1fbec264-26c6654f.class
	

Infected with: Trojan.Exploit.Java.Gimsh.A

C:\Documents and Settings\Barros\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\java.class-1fbec264-26c6654f.class
	

Disinfection failed

C:\Documents and Settings\Barros\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\java.class-1fbec264-26c6654f.class
	

Deleted

C:\Documents and Settings\Barros\Local Settings\Temp\324453.exe
	

Infected with: Rootkit.Agent.GV

C:\Documents and Settings\Barros\Local Settings\Temp\324453.exe
	

Disinfection failed

C:\Documents and Settings\Barros\Local Settings\Temp\324453.exe
	

Deleted

C:\Documents and Settings\Barros\Local Settings\Temporary Internet Files\Content.IE5\8N89GDCH\backup[1].zip
	

Infected with: Generic.Malware.SBdld!!.8B88A2BE

C:\Documents and Settings\Barros\Local Settings\Temporary Internet Files\Content.IE5\8N89GDCH\backup[1].zip
	

Disinfection failed

C:\Documents and Settings\Barros\Local Settings\Temporary Internet Files\Content.IE5\8N89GDCH\backup[1].zip
	

Deleted

C:\Documents and Settings\Barros\Local Settings\Temporary Internet Files\Content.IE5\AL89I7O5\backup[1].zip
	

Infected with: Generic.Malware.SBdld!!.8B88A2BE

C:\Documents and Settings\Barros\Local Settings\Temporary Internet Files\Content.IE5\AL89I7O5\backup[1].zip
	

Disinfection failed

C:\Documents and Settings\Barros\Local Settings\Temporary Internet Files\Content.IE5\AL89I7O5\backup[1].zip
	

Deleted

C:\Documents and Settings\Barros\Local Settings\Temporary Internet Files\Content.IE5\SHSVAJW5\backup[1].zip
	

Infected with: Generic.Malware.SBdld!!.8B88A2BE

C:\Documents and Settings\Barros\Local Settings\Temporary Internet Files\Content.IE5\SHSVAJW5\backup[1].zip
	

Disinfection failed

C:\Documents and Settings\Barros\Local Settings\Temporary Internet Files\Content.IE5\SHSVAJW5\backup[1].zip
	

Deleted

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP400\A0062778.exe
	

Infected with: Trojan.Kobcka.M

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP400\A0062778.exe
	

Disinfection failed

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP400\A0062778.exe
	

Deleted

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP400\A0064802.exe
	

Infected with: Trojan.Kobcka.M

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP400\A0064802.exe
	

Disinfection failed

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP400\A0064802.exe
	

Deleted

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP400\A0066847.exe
	

Infected with: Trojan.Kobcka.M

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP400\A0066847.exe
	

Disinfection failed

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP400\A0066847.exe
	

Deleted

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP400\A0077166.exe
	

Infected with: Trojan.Small.QH

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP400\A0077166.exe
	

Disinfection failed

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP400\A0077166.exe
	

Deleted

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP401\A0090396.sys
	

Infected with: Rootkit.Agent.DP

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP401\A0090396.sys
	

Disinfection failed

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP401\A0090396.sys
	

Deleted

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP401\A0090542.exe
	

Infected with: Trojan.Small.QH

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP401\A0090542.exe
	

Disinfection failed

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP401\A0090542.exe
	

Deleted

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP402\A0092573.sys
	

Infected with: Rootkit.Agent.DP

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP402\A0092573.sys
	

Disinfection failed

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP402\A0092573.sys
	

Deleted

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP402\A0093586.sys
	

Infected with: Rootkit.Agent.DP

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP402\A0093586.sys
	

Disinfection failed

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP402\A0093586.sys
	

Deleted

C:\WINDOWS	emp\startdrv.exe
	

Infected with: Trojan.Kobcka.L

C:\WINDOWS	emp\startdrv.exe
	

Disinfection failed

C:\WINDOWS	emp\startdrv.exe
	

Deleted

Yuki · Answer

Voici le rapport de MSNFIX qui à " nettoyé " les fichiers infectés !!

MSNFix 1.512  
 
C:\MSNFix 
Fix exécuté le 21/09/2007 - 22:48:08,06 By Barros 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\DOCUME~1\Barros\LOCALS~1\Temp\*.dmp 
... C:\WINDOWS\system32\microsoft\backup.tftp 

************************  MSNCHK ***** /!\ beta test /!\


 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\DOCUME~1\Barros\LOCALS~1\Temp\*.dmp  
.. OK ... C:\WINDOWS\system32\microsoft\backup.tftp  
 
 
 
************************ Nettoyage du registre 
 
 
 
************************ Fichiers suspects 
 
/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention 
 
[C:\WINDOWS\system32\ssgorgytim.scr] EE1A9D081CEF138D122FFEFE00CE8264 
[C:\MSNFix.zip] 116FE86952B4920A193E1276A4B841B8 

[color=#FF0000][b]==>[/b][/color] SVP merci d'envoyer le fichier  [b] C:\DOCUME~1\Barros\Bureau\Upload_Me.zip [/b] sur http://upload.changelog.fr

 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 21092007_22503675.zip
 
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------

Lyonnais92 · Answer

Bonsoir,

bon, pas mal de choses ont été nettoyées.

Ul faut que je fasse le bilan.

1) tu fais ce que !aur3n7 a demandé, upload le fichier C:\DOCUME~1\Barros\Bureau\Upload_Me.zip .

Tu ouvres son lien : http://upload.changelog.fr/ et tu suis les consignes.

2) tu remets un log Hijackthis.

3) tu envoies encore un fichier à tes contacts ?

@+

Yuki · Answer

voilà j'ai envoyer le rapport à !aur3n7.
pas compris la question 3

voici le dernier rapport Hijackthis. :


Logfile of HijackThis v1.99.1
Scan saved at 23:30:05, on 21/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Neuf\Media Center\MediaCenter.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\program files\fichiers communs\aol\1157577326\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
c:\program files\fichiers communs\aol\1157577326\ee\aolsoftware.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\MSN Messenger\usnsvc.exe
c:\program files\fichiers communs\aol\1157577326\ee\anotify.exe
C:\Program Files\AOL Compagnon\companion.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.fr/8SEFRFR030000TBR/InstallSuccess
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mono.exe] C:\WINDOWS\mono.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 2.0esources\fr-FR\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2ce861a41e324489ac465c2b9d28c6a7
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2ce861a41e324489ac465c2b9d28c6a7
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Userinit Logon Application - Unknown owner - C:\WINDOWS\userinit.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe



merci

Lyonnais92 · Answer

Re,

1) tu as 2 anti-virus, Fsecure et AVG. Il faut que tu choisisses.

2) Relance HijackThis.

Choisis Do a scan only

Coche la case devant les lignes suivantes 

O4 - HKLM\..\Run: [mono.exe] C:\WINDOWS\mono.exe

Ferme toutes les fenêtres (hormis HijackThis), y compris ton navigateur.

Clique sur fix checked.

Ferme Hijackthis.

3) télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

C:\WINDOWS\mono.exe
C:\WINDOWS\system32\5_exception.nls 
C:\WINDOWS\perfmon.exe
C:\WINDOWS\System32\drivers\ip6fw.sys

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 

4) Si OTMoveIt ne te l'a pas demandé, redémarre l'ordi.

Où en sont tes soucis ?

@+

Yuki · Answer

je ne peux pas supprimer " f-secure ( neuf sécurité ) mais celui -ci à été désinstallé malgré les clés dans le registre qui y sont encore.
avant de faire ce que tu me dit j'ai toujours un ou deux virus(C:\DOCUME~1\Barros\LOCALS. ) à chaque lancement en mode normal de mon pc.
donc je vais faire ce que tu m'as demandé

Yuki · Answer

ca y est j'ai fait la procédure avec OTMoveIt .mais au démarrage toujours cette lenteur et au bout d'un moment " Avg"est obliger de fermer.

Yuki · Answer

Cutwail est apparu plusieurs fois en mode sans échec ( mon anti spyware l'à détecté 3 fois puis supprimer ).
 ( Pour l'instant je poste ici toujours en mode sans échec )

Lyonnais92 · Answer

Bonjour,

poste le rapport de OTMoveIt.

Donne moi le nom exact du fichier infecté par "Cutwail" et le nom exact du malware.

remets un log Hijackthis.

@+

Yuki · Answer

Bonsoir, 

Voici le rapport de OTMoveIt. : 

File/Folder C:\WINDOWS\mono.exe not found.
C:\WINDOWS\system32\5_exception.nls moved successfully.
File/Folder C:\WINDOWS\perfmon.exe not found.
C:\WINDOWS\System32\drivers\ip6fw.sys moved successfully.
 
Created on 09/22/2007 10:30:07


je n'ai pas retrouvé le fichier qui était infecté par Cutwail ( c'est le logiciel aol Antispyware qui l'à trouvé en mode sans échec ).

dernier rapport Hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 23:12:54, on 22/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Fichiers communs\AOL\1157577326\ee\aolsoftware.exe
c:\program files\fichiers communs\aol\1157577326\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
c:\program files\fichiers communs\aol\1157577326\ee\aolsoftware.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.fr/8SEFRFR030000TBR/InstallSuccess
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 2.0esources\fr-FR\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2ce861a41e324489ac465c2b9d28c6a7
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2ce861a41e324489ac465c2b9d28c6a7
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Userinit Logon Application - Unknown owner - C:\WINDOWS\userinit.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Lyonnais92 · Answer

Bonsoir,

une infection coriace. O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe

1) Ne redémarre pas l'ordi si tu peux;

2) Relance HijackThis.

Choisis Do a scan only

Coche la case devant les lignes suivantes 

O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe

Ferme toutes les fenêtres (hormis HijackThis), y compris ton navigateur.

Clique sur fix checked.

Ferme Hijackthis.

3) relance Suspectfiles

clique sur Unselect all.

Coche ensuite devant :

Alternate data streams
EFS dumpind
Hidden objects
Suspicious files


Clique sur scan now et poste le rapport dans ta réponse.

@+

Yuki · Answer

Bonjour, 
C'est fait voici le rapport de  Suspectfiles  :


SystemScan - www.suspectfile.com - ver. 3.2.0

Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS

Date: 23/09/2007
Time: 11:39:40
  
Output limited to: 
 -Alternate Data Sreams
 -Encrypted Files
 -Hidden objects
 -Suspicious Files

===================== NTFS ADS =====================

Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
C:\Documents and Settings\All Users\Documents\Ma musique\Échantillons de musique\Thumbs.db:
:encryptable:$DATA	0
C:\Documents and Settings\All Users\Documents\Mes images\Échantillons d'images\Thumbs.db:
:encryptable:$DATA	0
.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Error opening C:\Documents and Settings\Barros\Application Data\Mozilla\Firefox\Profiles\8j6vigv8.default\parent.lock:
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
.
C:\Documents and Settings\Barros\Bureau\articles unif 93.doc:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Bureau	vsurpc.m3u:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Bureau\Raccourcis Bureau non utilisés\Contact-unif.htm:
   :Zone.Identifier:$DATA	26
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
.
.
C:\Documents and Settings\Barros\Mes documents\heroes.pdf:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\photo de thierry-trek.jpg:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\subadjust_156.zip:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Ma musique\Soundtrack\Thumbs.db:
:encryptable:$DATA	0
C:\Documents and Settings\Barros\Mes documents\Ma musique\Soundtrack\Last Exile 1\Thumbs.db:
:encryptable:$DATA	0
.
C:\Documents and Settings\Barros\Mes documents\Mes fichiers reçus\chat_music.rar:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\177.gif:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\Akte_X_Fan1.gif:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\angelbar.jpg:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\bar-xfiles.gif:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\heroes-bar.gif:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\Mj_usebar_3.jpg:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images
aruto.jpg:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\Pepsi.png:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\pepsilover.png:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\scifi-wallpaperwp_fatmomma_1280:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\SMACKDOWN_Viewer.png:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\Subway.png:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\Thumbs.db:
:encryptable:$DATA	0
C:\Documents and Settings\Barros\Mes documents\Mes images\wwelover.png:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\WWE_FAN2.jpg:
   :Zone.Identifier:$DATA	26
C:\Documents and Settings\Barros\Mes documents\Mes images\Photos sur AOL\Photos Reçues\Thumbs.db:
:encryptable:$DATA	0
C:\Documents and Settings\Barros\Mes documents\pic01117\Thumbs.db:
:encryptable:$DATA	0
.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
.
C:\Jeux video\Mario_Forever_PC_jeu_gratuit.exe:
   :Zone.Identifier:$DATA	26
C:\Mes téléchargements\antivir_workstation_win7u_en_h.exe:
   :Zone.Identifier:$DATA	26
C:\Mes téléchargements\aswclnr.exe:
   :Zone.Identifier:$DATA	26
C:\Mes téléchargements\setupfre.exe:
   :Zone.Identifier:$DATA	26
C:\Program Files\moustique.zip:
   :Zone.Identifier:$DATA	26
C:\Program Files\AOL 9.0\Thumbs.db:
:encryptable:$DATA	0
.
C:\Séries-files\-Shows-run-\Thumbs.db:
:encryptable:$DATA	0
C:\Séries-files\angel-heart\Angel_heart 1 [96a3be3cf2].rar:
   :Zone.Identifier:$DATA	26
C:\Séries-files\angel-heart\Thumbs.db:
:encryptable:$DATA	0
C:\Séries-files\Dexter\Thumbs.db:
:encryptable:$DATA	0
C:\Séries-files\Gto\GTO40 FullAnimes.free.fr.avi:
   :Zone.Identifier:$DATA	26
C:\Séries-files\Gto\Thumbs.db:
:encryptable:$DATA	0
C:\Séries-files\Naruto-Oavs-et-films\FILM1
arutonojutsu-team.com-film1.part1.rar:
   :Zone.Identifier:$DATA	26
C:\Séries-files\Naruto-Oavs-et-films\FILM1
arutonojutsu-team.com-film1.part2.rar:
   :Zone.Identifier:$DATA	26
C:\Séries-files\Naruto-Oavs-et-films\FILM1
arutonojutsu-team.com-film1.part3.rar:
   :Zone.Identifier:$DATA	26
C:\Séries-files\Naruto-Oavs-et-films\FILM1
arutonojutsu-team.com-film1.part4.rar:
   :Zone.Identifier:$DATA	26
C:\Séries-files\Naruto-tv-inédits--ep104à200\Naruto 157 FullAnimes.free.fr.avi:
   :Zone.Identifier:$DATA	26
C:\Séries-files\Naruto-tv-inédits--ep104à200\Naruto_200.avi:
   :Zone.Identifier:$DATA	26
C:\Séries-files\Naruto-tv-inédits--ep104à200\Thumbs.db:
:encryptable:$DATA	0
   :Zone.Identifier:$DATA	26
.
C:\Séries-files\One Piece-saison2\one piece ending 06.ram:
   :Zone.Identifier:$DATA	26
C:\Séries-files\One Piece-saison2\one piece ending 07.ram:
   :Zone.Identifier:$DATA	26
C:\Séries-files\One Piece-saison2\one piece opening 03.ram:
   :Zone.Identifier:$DATA	26
C:\Séries-files\One Piece-saison2\One Piece-77 FullAnimes.free.fr.avi:
   :Zone.Identifier:$DATA	26
C:\Séries-files\One Piece-saison2\Thumbs.db:
:encryptable:$DATA	0
C:\Séries-files\The.Big.Bang.Theory\Thumbs.db:
:encryptable:$DATA	0
C:\Séries-files\Yakitate japan\Thumbs.db:
:encryptable:$DATA	0
C:\Séries-files\Yakitate japan\Yakitate Japan 01 FullAnimes.free.fr.avi:
   :Zone.Identifier:$DATA	26
C:\Séries-files\Yakitate japan\Yakitate Japan 02 FullAnimes.free.fr.avi:
   :Zone.Identifier:$DATA	26
C:\Séries-files\Yakitate japan\Yakitate Japan 03 FullAnimes.free.fr.avi:
   :Zone.Identifier:$DATA	26
C:\Séries-files\Yakitate japan\Yakitate Japan 04 FullAnimes.free.fr.avi:
   :Zone.Identifier:$DATA	26
.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
.

===================== Encrypting File System dumping =====================

 
===================== Hidden Objects =====================


SCAN ABORTED: an unknown error has occurred. Please check Rootkit presence with another tool

===================== Checking Rustock rootkit =====================

 

===================== Checking Suspicious files =====================
EXE and DLL files packed with runtime packers, found in: C:\; C:\WINDOWS\; C:\WINDOWS\system32\

C:\WINDOWS\IFinst26.exe --> is compressed with UPX

==========================================
Scan completed in 3,2 minutes
End of report

Lyonnais92 · Answer

Bonjour,

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier : C:\WINDOWS\IFinst26.exe 

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse.

@+

Yuki · Answer

Voilà le rapport effectué en mode sans échec :


Fichier IFinst26.exe reçu le 2007.09.23 13:26:06 (CET)
Antivirus	Version	Dernière mise à jour	Résultat
AhnLab-V3	2007.9.22.0	2007.09.21	-
AntiVir	7.6.0.15	2007.09.21	-
Authentium	4.93.8	2007.09.23	-
Avast	4.7.1043.0	2007.09.22	-
AVG	7.5.0.485	2007.09.22	-
BitDefender	7.2	2007.09.23	-
CAT-QuickHeal	9.00	2007.09.21	-
ClamAV	0.91.2	2007.09.23	-
DrWeb	4.33	2007.09.23	-
eSafe	7.0.15.0	2007.09.19	suspicious Trojan/Worm
eTrust-Vet	31.2.5154	2007.09.21	-
Ewido	4.0	2007.09.20	-
FileAdvisor	1	2007.09.23	-
Fortinet	3.11.0.0	2007.09.23	-
F-Prot	4.3.2.48	2007.09.23	-
F-Secure	6.70.13030.0	2007.09.21	-
Ikarus	T3.1.1.12	2007.09.23	-
Kaspersky	4.0.2.24	2007.09.23	-
McAfee	5125	2007.09.21	-
Microsoft	1.2803	2007.09.23	-
NOD32v2	2545	2007.09.23	-
Norman	5.80.02	2007.09.21	-
Panda	9.0.0.4	2007.09.23	-
Prevx1	V2	2007.09.23	-
Rising	19.41.62.00	2007.09.23	-
Sophos	4.21.0	2007.09.23	-
Sunbelt	2.2.907.0	2007.09.22	-
Symantec	10	2007.09.23	-
TheHacker	6.2.5.066	2007.09.22	-
VBA32	3.12.2.4	2007.09.23	-
VirusBuster	4.3.26:9	2007.09.22	-
Webwasher-Gateway	6.0.1	2007.09.21	-
Information additionnelle
File size: 65024 bytes
MD5: fdc9d4de50a845137580698494b19f13
SHA1: 0982241e310fd7d79ce544d1c78ee4c6ce704091
packers: UPX
packers: UPX
packers: UPX

Yuki · Answer

salut, 
j'ai fait pareil ( virustotal ) avec ce fichier quii réapparait toujours malgré les mises en quarantaines :
C:\WINDOWS\Temp\startdrv.exe

 Fichier startdrv.exe reçu le 2007.09.23 17:49:16 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 20/31 (64.52%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 1.
L'heure estimée de démarrage est entre 39 et 56 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email: 	
	
Antivirus 	Version 	Dernière mise à jour 	Résultat
AhnLab-V3	2007.9.22.0	2007.09.21	Win-Trojan/Dropper.21504.B
AntiVir	7.6.0.15	2007.09.21	TR/Dropper.Gen
Authentium	4.93.8	2007.09.23	W32/Downldr2.AHGH
Avast	4.7.1043.0	2007.09.22	Win32:Agent-LPR
AVG	7.5.0.485	2007.09.23	-
BitDefender	7.2	2007.09.23	Trojan.Kobcka.L
CAT-QuickHeal	9.00	2007.09.21	TrojanDownloader.Agent.djt
ClamAV	0.91.2	2007.09.23	Trojan.Dropper-2556
DrWeb	4.33	2007.09.23	Trojan.MulDrop.8738
eSafe	7.0.15.0	2007.09.19	-
eTrust-Vet	31.2.5154	2007.09.21	-
Ewido	4.0	2007.09.20	-
FileAdvisor	1	2007.09.23	-
Fortinet	3.11.0.0	2007.09.23	-
F-Prot	4.3.2.48	2007.09.23	W32/Downldr2.AHGH
F-Secure	6.70.13030.0	2007.09.21	Trojan-Downloader.Win32.Agent.djt
Ikarus	T3.1.1.12	2007.09.23	Trojan-Downloader.Win32.Agent.djt
Kaspersky	4.0.2.24	2007.09.23	Trojan-Downloader.Win32.Agent.djt
McAfee	5125	2007.09.21	Spy-Agent.bv.dldr
Microsoft	1.2803	2007.09.23	TrojanDownloader:Win32/Agent.ACZ
NOD32v2	2545	2007.09.23	Win32/TrojanDownloader.Agent.DJT
Norman	5.80.02	2007.09.21	Pandex.gen
Panda	9.0.0.4	2007.09.23	Trj/BedeTres.B
Rising	19.41.62.00	2007.09.23	-
Sophos	4.21.0	2007.09.23	-
Sunbelt	2.2.907.0	2007.09.22	-
Symantec	10	2007.09.23	-
TheHacker	6.2.5.066	2007.09.22	-
VBA32	3.12.2.4	2007.09.23	Trojan-Downloader.Win32.Agent.djt
VirusBuster	4.3.26:9	2007.09.23	Trojan.DR.Agent.VWM
Webwasher-Gateway	6.0.1	2007.09.21	Trojan.Dropper.Gen
Information additionnelle
File size: 21504 bytes
MD5: 57dc8e742a312efc0a62310ecb3ec6be
SHA1: a1a503fb4833cd4b93e3dada46984f807b9cad3a

Lyonnais92 · Answer

Bonsoir,

Oui, celui-là, je n'avais pas de doute.

C'est l'autre qui me souciait. Finalement, il est propre.

Ouvre ce lien :
https://www.bleepingcomputer.com/download/linux/
pour télécharger regsearch.zip.

Choisis Enregistrer puis Bureau.

A la fin du déchargement fais un clic droit sur l'icône de regsearch.zip créée sur le bureau,choisis Extraire tout et suis les instructions.

Exécute Regsearch.exe qui se trouve dans le dossier qui vient d'être créé en double-cliquant et clique sur exécuter.

Dans la fenêtre qui s'ouvre vérifie que toutes les cases sont cochées.

Ensuite écris startdrv dans la première ligne de la fenêtre .

Clique sur OK pour rechercher dans le registre.

En fin de recherche, le bloc-note s'ouvre. Copie-colle le contenu du rapport dans ta réponse.

Le rapport se trouve dans le même dossier que Regsearch.exe sous le nom RegSearch.txt.

Relance aussi suspect files avec coché uniqument Scheduled jobs et Include host File et poste aussi le rappot.


Si tout cela ne donne rien, on sort le 450 de marine.

@+

yuki · Answer

Salut voici le rapport de regsearch :

Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.5.0

; Results at 23/09/2007 19:52:26 for strings:
;  'startdrv'
; Strings excluded from search:
;  (None)
; Search in: 
; Registry Keys  Registry Values  Registry Data  
; HKEY_LOCAL_MACHINE  HKEY_USERS  


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"startdrv"="C:\WINDOWS\Temp\startdrv.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"f"="C:\WINDOWS\temp\startdrv.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe]
"a"="C:\WINDOWS\temp\startdrv.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\WINDOWS\Temp\startdrv.exe"="startdrv"

; End Of The Log...


et celui de suspect files :

SystemScan - www.suspectfile.com - ver. 3.2.0

Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS

Date: 23/09/2007
Time: 19:56:10
  
Output limited to: 
 -Scheduled jobs
 -Include HOSTS file

===================== SCHEDULED JOBS =====================

jobs found in C:\WINDOWS:

05/08/2004 07:00:00             65 byte   1144 days old -- desktop.ini
23/09/2007 18:35:13              6 byte      0 days old -- SA.DAT
23/09/2007 18:39:00            256 byte      0 days old -- Vérifier les mises à jour de Windows Live Toolbar.job
~~~~~~~~~~~~~~~~~~~~~
Active jobs: 

~~~~~~~~~~~~~~~~~~~~~
Most recent (50) lines in jobs scheduled log:


===================== HOSTS FILE =====================


==========================================
Scan completed in 0 minutes
End of report


merci

Lyonnais92 · Answer

Re,

des informations utiles.

1) Ouvre le Bloc Notes.
Copie le texte ci-dessous (entre les * mais sans les *) avec le texte qui se trouve dans l'espace ci-dessous (copie/colle) : 

*****************************
REGEDIT4 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"startdrv"=- 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*] 
"f"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe] 
"a"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache] 
"C:\WINDOWS\Temp\startdrv.exe"=- 

*****************************
Clique sur "Fichier", "Enregistrer sous".
Clique sur Bureau (dans la colonne de gauche)
Dans Nom du fichier tu écris fix.reg 
Pour Type tu choisis "tous les fichiers" avec le menu déroulant.
Tu cliques sur Enregistrer.
Tu fermes le Bloc-notes

Sur ton bureau, tu double-clique sur l'icône de Fix.reg
Tu acceptes l'avertissement concernant la fusion
Le fix va travailler sans se manifester.
A la fin, tu vas voir un message disant que la fusion est terminée. Tu valides.

2) télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

C:\WINDOWS\Temp\startdrv.exe 

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.  Si ce n'est pas le cas, fais le toi-même;

Remets un log Hijackthis

@+

yuki · Answer

Bonsoir, j'ai fait ce que tu m'à demander , voici le rapport de  C:\_OTMoveIt\MovedFiles : 

C:\WINDOWS\Temp\startdrv.exe moved successfully.
 
Created on 09/23/2007 21:11:19




voici le rapport HijackThis :

Logfile of HijackThis v1.99.1
Scan saved at 21:35:05, on 23/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.fr/8SEFRFR030000TBR/InstallSuccess
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 2.0esources\fr-FR\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2ce861a41e324489ac465c2b9d28c6a7
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2ce861a41e324489ac465c2b9d28c6a7
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (file missing)
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Userinit Logon Application - Unknown owner - C:\WINDOWS\userinit.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Lyonnais92 · Answer

Re,

tu avais redémarré l'ordi avant de faire tourner hijackthis ?

On va prendre un point de restauration propre;

regarde ce tuto :
http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20020830101856924

dans un premier temps, tu coches la case pour désactiver la restauration.

dans un deuxième temps, tu décoches la case pour réactiver la restauration.


Que reste-t-il des soucis du début ?

@+

yuki · Answer

re, 


tu avais redémarré l'ordi avant de faire tourner hijackthis ? oui.

Lyonnais92 · Answer

Re,

alors je crois qu'on l'a eu.

Tu prends ton point de restauration et tu me dis ce qu'il te semble rester de tes soucis initiaux.

@+

yuki · Answer

re,
alors j'ai fait la phase 1 : ( tu coches la case pour désactiver la restauration. )
puis pour la phase 2 ( tu décoches la case pour réactiver la restauration. ) on m'a demander de redemarrer ( car le mode sans echec ne peut reprendre un point de restauration ).
donc en mode normal j'ai réactivé la restauration, et après un redémarrage, le pc se lance on ne peut mieux mais il y a toujours ce blocage et ce ralentissement.
d'autant plus que startdrv apparait encore( quand je scanne ce repertoire  C:\WINDOWS	emp\startdrv.exe,  avast retrouve le virus ) : 
scan HijackThis :

Logfile of HijackThis v1.99.1
Scan saved at 23:40:14, on 23/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.fr/8SEFRFR030000TBR/InstallSuccess
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 2.0esources\fr-FR\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2ce861a41e324489ac465c2b9d28c6a7
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2ce861a41e324489ac465c2b9d28c6a7
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (file missing)
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Userinit Logon Application - Unknown owner - C:\WINDOWS\userinit.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

merci bonne nuit et à demain.

Lyonnais92 · Answer

Re;

tu feras ça :

Scanne ensuite ton PC avec BitDefender en ligne (uniquement sous Internet Explorer).

ouvre ce lien :



www.bitdefender.com/scan8/ie.html 

Utilisation : 
Cliquer sur "J'accepte" puis accepter également l'ActiveX bloqué par la barre anti-popup du SP2 qui clignotera en haut et l'installer. 
Ensuite, cliquer sur "Cliquez ici pour scanner". 
Patienter jusqu'à la fin du scan qui peut durer assez longtemps... 

Copier/coller le rapport entier sur le forum. 

Tutoriel en images ici : http://pageperso.aol.fr/rginformatique/mapage/defender.htm (merci à Balltrap34 pour cette réalisation) 

@+

Yuki · Answer

salut , je viens d'allumer mon pc ( qui démarre bien mais se ralentit au bout d'un moment donc retour en sans échec ),
oui merci je connais Bitdefender, donc je lance l'analyse ( c'est long ).

sinon ne vaut -il pas reprendre les points 17, 22 et 24 ? en gros refaire la manip d'hier ???

Lyonnais92 · Answer

Bonjour,

le pb est que les mêmes causes produisent les mêmes effets. Le fichier revient.

Il y a un mécanisme de réinfection que je n'ai pas vu.

Une première amélioration est de "fixer" cette ligne

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll 

relance hijackthis, choisi do a scan only, coche la case devant la ligne et clique sur fix checked (-toutes les autres fenêtres, en particulier le navigateur fermé, donc après bit defender).

Ensuite, en mode sans échec, via l'explorateur Windows, tu supprimes C:\Program Files\eoRezo et tu vides ta corbeille.

Tu peux faire ça en même temps que bit defender :

1) Ouvre ce lien  (merci a S!RI pour ce programme). http://siri.urz.free.fr/Fix/SmitfraudFix.php 
et télécharge SmitfraudFix.exe.

Regarde le tuto
Exécute le en choisissant l’option 1, il va générer un rapport
Copie/colle le sur le poste stp. 

2) Tu relance Regsearch avec, dans la première ligne runtime et dans la sconde runtime2

tu postes les rapports.

@+

Yuki · Answer

Salut, 
voici le rapport de Bitdefender :

BitDefender Online Scanner
	
Scan report generated at: Mon, Sep 24, 2007 - 14:02:00

Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;

Statistics

Time
	

00:51:11

Files
	

348364

Folders
	

6586

Boot Sectors
	

4

Archives
	

7351

Packed Files
	

26667
	

 
	

 

Results

Identified Viruses
	

2

Infected Files
	

4

Suspect Files
	

0

Warnings
	

0

Disinfected
	

0

Deleted Files
	

4
	

 
	

 

Engines Info

Virus Definitions
	

823498

Engine build
	

AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)

Scan plugins
	

14

Archive plugins
	

38

Unpack plugins
	

7

E-mail plugins
	

6

System plugins
	

1
	

 
	

 

Scan Settings

First Action
	

Disinfect

Second Action
	

Delete

Heuristics
	

Yes

Enable Warnings
	

Yes

Scanned Extensions
	

*;

Exclude Extensions
	

 

Scan Emails
	

Yes

Scan Archives
	

Yes

Scan Packed
	

Yes

Scan Files
	

Yes

Scan Boot
	

Yes
	

 
	

 
 

Scanned File
	

 Status

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP1\A0001009.exe
	

Infected with: Trojan.Kobcka.L

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP1\A0001009.exe
	

Disinfection failed

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP1\A0001009.exe
	

Deleted

C:\WINDOWS	emp\startdrv.exe
	

Infected with: Trojan.Kobcka.L

C:\WINDOWS	emp\startdrv.exe
	

Disinfection failed

C:\WINDOWS	emp\startdrv.exe
	

Deleted

C:\_OTMoveIt\MovedFiles\WINDOWS\system32\drivers\ip6fw.sys
	

Infected with: Rootkit.Agent.DP

C:\_OTMoveIt\MovedFiles\WINDOWS\system32\drivers\ip6fw.sys
	

Disinfection failed

C:\_OTMoveIt\MovedFiles\WINDOWS\system32\drivers\ip6fw.sys
	

Deleted

C:\_OTMoveIt\MovedFiles\WINDOWS\Temp\startdrv.exe
	

Infected with: Trojan.Kobcka.L

C:\_OTMoveIt\MovedFiles\WINDOWS\Temp\startdrv.exe
	

Disinfection failed

C:\_OTMoveIt\MovedFiles\WINDOWS\Temp\startdrv.exe
	

Deleted
	

--la ligne à été fixé avec hijackthis ( eo rezo )

voici le rapport de SmitfraudFix : 

SmitFraudFix v2.227

Rapport fait à 16:08:08,09, 24/09/2007
Executé à partir de C:\Documents and Settings\Barros\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Barros


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Barros\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Barros\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: SiS 900 PCI Fast Ethernet Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3C7D350F-0EE3-4047-A4A0-FE12EB8A3C98}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3C7D350F-0EE3-4047-A4A0-FE12EB8A3C98}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3C7D350F-0EE3-4047-A4A0-FE12EB8A3C98}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3C7D350F-0EE3-4047-A4A0-FE12EB8A3C98}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


rapport de regsearch : 

Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.5.0

; Results at 24/09/2007 16:10:35 for strings:
;  ' runtime'
;  'runtime2'
; Strings excluded from search:
;  (None)
; Search in: 
; Registry Keys  Registry Values  Registry Data  
; HKEY_LOCAL_MACHINE  HKEY_USERS  


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLRMetaData.CLRRuntimeHost]
@="Microsoft Common Language Runtime Host V2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLRMetaData.CLRRuntimeHost.1]
@="Microsoft Common Language Runtime Host V2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLRMetaData.CLRRuntimeHost.2]
@="Microsoft Common Language Runtime Host V2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLRMetaData.CorMetaDataDispenser]
@="Microsoft Common Language Runtime Meta Data"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLRMetaData.CorMetaDataDispenser.2]
@="Microsoft Common Language Runtime Meta Data"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLRMetaData.CorMetaDataDispenserRuntime]
@="Microsoft Common Language Runtime Meta Data"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLRMetaData.CorMetaDataDispenserRuntime.2]
@="Microsoft Common Language Runtime Meta Data"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLRMetaData.CorRuntimeHost]
@="Microsoft Common Language Runtime Host"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLRMetaData.CorRuntimeHost.2]
@="Microsoft Common Language Runtime Host"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{047A9A40-657E-11D3-8D5B-00104B35E7EF}]
@="Microsoft Common Language Runtime Debugger Publisher"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{183C259A-0480-11d1-87EA-00C04FC29D46}]
@="LM Runtime Control"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1EC2DE53-75CC-11d2-9775-00A0C9B4D50C}]
@="Microsoft Common Language Runtime Meta Data"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6FEF44D0-39E7-4C77-BE8E-C9F8CF988630}]
@="Microsoft Common Language Runtime Debugger"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90F1A06E-7712-4762-86B5-7A5EBA6BDB01}]
@="Microsoft Common Language Runtime Meta Data V2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90F1A06E-7712-4762-86B5-7A5EBA6BDB02}]
@="Microsoft Common Language Runtime Meta Data V2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CB2F6723-AB3A-11d2-9C40-00C04FA30A3E}]
@="Microsoft Common Language Runtime Meta Data"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E5CB7A31-7512-11D2-89CE-0080C792E5D8}]
@="Microsoft Common Language Runtime Meta Data"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComPlusDebug.CorDebug]
@="Microsoft Common Language Runtime Debugger"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComPlusDebug.CorDebug.1]
@="Microsoft Common Language Runtime Debugger"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComPlusDebug.CorpubPublish]
@="Microsoft Common Language Runtime Debugger Publisher"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComPlusDebug.CorpubPublish.1]
@="Microsoft Common Language Runtime Debugger Publisher"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComPlusMetaData.MsCorHost.2]
@="Microsoft COM+ Runtime Meta Data"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510005]
"ProductName"="J2SE Runtime Environment 5.0 Update 5"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510005\SourceList]
"PackageName"="J2SE Runtime Environment 5.0 Update 5.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510006]
"ProductName"="J2SE Runtime Environment 5.0 Update 6"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510009]
"ProductName"="J2SE Runtime Environment 5.0 Update 9"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D511000]
"ProductName"="J2SE Runtime Environment 5.0 Update 10"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D511001]
"ProductName"="J2SE Runtime Environment 5.0 Update 11"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LM.LMReader]
@="LM Runtime Control"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LM.LMReader.1]
@="LM Runtime Control"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Multimedia\Components\Installed\playback_wmfsdk]
@="Windows Media Format Runtime"
"DESCRIPTION"="Windows Media Format Runtime provides efficient playback of Windows Media files.  This component must be installed for the software to function."

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{27D2CF3C-D5B0-11D2-8094-00104B1F9838}\1.0]
@="InstallShield Runtime 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0]
@="Microsoft Scripting Runtime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5477469E-83B1-11D2-8B49-00A0C9B7C9C4}\1.1]
@="Common Language Runtime Execution Engine 1.0 Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5477469E-83B1-11D2-8B49-00A0C9B7C9C4}\2.0]
@="Common Language Runtime Execution Engine 2.0 Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{97177EBC-0C54-11D0-B407-00AA00C14969}\5.0]
@="Visual Basic runtime objects and procedures"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BED7F4EA-1A96-11D2-8F08-00A0C9A6186D}\1.a]
@="Common Language Runtime Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}\6.0]
@="Visual Basic runtime objects and procedures"

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment]

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.5]

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_05]

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_06]

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_09]

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_10]

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_11]

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_11\MSI]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
@="Java Runtime Environment 1.5.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}]
@="Java Runtime Environment 1.5.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}]
@="Java Runtime Environment 1.5.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}]
@="Java Runtime Environment 1.5.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}]
@="Java Runtime Environment 1.5.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}]
@="Java Runtime Environment 1.5.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
@="Java Runtime Environment 1.5.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\0]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\10]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\11]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\12]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\13]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\14]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\15]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\16]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\17]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\18]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\19]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\2]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\20]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\21]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\22]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\23]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\24]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\25]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\26]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\27]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\28]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\29]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\3]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\30]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\31]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\32]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\33]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\34]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\35]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\36]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\37]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\38]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\39]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\4]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\40]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\41]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\42]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\44]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\45]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\46]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\47]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\48]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\49]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\5]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\50]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\51]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\52]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\53]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\54]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\55]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\57]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\58]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\59]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\6]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\60]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\61]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\62]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\63]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\64]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\65]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\66]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\67]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\68]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\69]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\7]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\70]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\71]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\72]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\73]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\74]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\75]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\76]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\77]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\78]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\79]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\8]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\80]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\81]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\82]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\83]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\84]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\85]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\86]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\87]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\88]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\89]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\9]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\90]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\91]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\92]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\93]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\SP0\WMFDist11\Filelist\94]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\WMFDist11]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows Media Format 11 runtime\WMFDist11]
"PackageName"="Windows Media Format 11 runtime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Windows Media Format Runtime]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510005\InstallProperties]
"DisplayName"="J2SE Runtime Environment 5.0 Update 5"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510006\InstallProperties]
"DisplayName"="J2SE Runtime Environment 5.0 Update 6"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510009\InstallProperties]
"DisplayName"="J2SE Runtime Environment 5.0 Update 9"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D511000\InstallProperties]
"DisplayName"="J2SE Runtime Environment 5.0 Update 10"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D511001\InstallProperties]
"DisplayName"="J2SE Runtime Environment 5.0 Update 11"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Media Format Runtime]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Media Format Runtime]
"DisplayName"="Windows Media Format 11 runtime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WMFDist11]
"DisplayName"="Windows Media Format 11 runtime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150050}]
"DisplayName"="J2SE Runtime Environment 5.0 Update 5"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150060}]
"DisplayName"="J2SE Runtime Environment 5.0 Update 6"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150090}]
"DisplayName"="J2SE Runtime Environment 5.0 Update 9"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150100}]
"DisplayName"="J2SE Runtime Environment 5.0 Update 10"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150110}]
"DisplayName"="J2SE Runtime Environment 5.0 Update 11"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CLR_OPTIMIZATION_V2.0.50727_32\0000]
"DeviceDesc"=".NET Runtime Optimization Service v2.0.50727_X86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_RUNTIME2]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_RUNTIME2\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_RUNTIME2\0000]
"Service"="runtime2"
"DeviceDesc"="runtime2"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\clr_optimization_v2.0.50727_32]
"DisplayName"=".NET Runtime Optimization Service v2.0.50727_X86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application]
; Contents of value:
;   WSH
;   WMIAdapter
;   WmdmPmSN
;   WinMgmt
;   Winlogon
;   Windows Product Activation
;   Windows 3.1 Migration
;   WebClient
;   VSS
;   VBRuntime
;   usnjsvc
;   Userinit
;   Userenv
;   SysmonLog
;   Starter
;   SpoolerCtrs
;   Software Restriction Policies
;   Software Installation
;   SNDSrvc
;   SecurityCenter
;   SclgNtfy
;   SceSrv
;   SceCli
;   safrslv
;   SAFrdms
;   Remote Assistance
;   PerfProc
;   PerfOS
;   PerfNet
;   Perfmon
;   Perflib
;   PerfDisk
;   Perfctrs
;   Offline Files
;   Oakley
;   ntbackup
;   NeroCheck
;   MSSQLSERVER/MSDE
;   MsiInstaller
;   MSDTC Client
;   MSDTC
;   mnmsrvc
;   Microsoft H.323 Telephony Service Provider
;   Microsoft Fax
;   Microsoft (R) Visual C# 2005 Compiler
;   LoadPerf
;   LiveUpdate
;   HelpSvc
;   Folder Redirection
;   File Deployment
;   EventSystem
;   ESENT
;   DrWatson
;   DiskQuota
;   crypt32
;   COM+
;   COM
;   Ci
;   Chkdsk
;   Automatic LiveUpdate Scheduler
;   AutoEnrollment
;   Autochk
;   ASP.NET 2.0.50727.0
;   ASP.NET 1.1.4322.0
;   Application Management
;   Application Hang
;   Application Error
;   .NET Runtime Optimization Service
;   .NET Runtime 2.0 Error Reporting
;   .NET Runtime
;   Application
;   
"Sources"=hex(7):57,00,53,00,48,00,00,00,57,00,4d,00,49,00,41,00,64,00,61,00,\
  70,00,74,00,65,00,72,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,4e,\
  00,00,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,00,00,00,57,00,69,00,6e,00,\
  6c,00,6f,00,67,00,6f,00,6e,00,00,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\
  00,20,00,50,00,72,00,6f,00,64,00,75,00,63,00,74,00,20,00,41,00,63,00,74,00,\
  69,00,76,00,61,00,74,00,69,00,6f,00,6e,00,00,00,57,00,69,00,6e,00,64,00,6f,\
  00,77,00,73,00,20,00,33,00,2e,00,31,00,20,00,4d,00,69,00,67,00,72,00,61,00,\
  74,00,69,00,6f,00,6e,00,00,00,57,00,65,00,62,00,43,00,6c,00,69,00,65,00,6e,\
  00,74,00,00,00,56,00,53,00,53,00,00,00,56,00,42,00,52,00,75,00,6e,00,74,00,\
  69,00,6d,00,65,00,00,00,75,00,73,00,6e,00,6a,00,73,00,76,00,63,00,00,00,55,\
  00,73,00,65,00,72,00,69,00,6e,00,69,00,74,00,00,00,55,00,73,00,65,00,72,00,\
  65,00,6e,00,76,00,00,00,53,00,79,00,73,00,6d,00,6f,00,6e,00,4c,00,6f,00,67,\
  00,00,00,53,00,74,00,61,00,72,00,74,00,65,00,72,00,00,00,53,00,70,00,6f,00,\
  6f,00,6c,00,65,00,72,00,43,00,74,00,72,00,73,00,00,00,53,00,6f,00,66,00,74,\
  00,77,00,61,00,72,00,65,00,20,00,52,00,65,00,73,00,74,00,72,00,69,00,63,00,\
  74,00,69,00,6f,00,6e,00,20,00,50,00,6f,00,6c,00,69,00,63,00,69,00,65,00,73,\
  00,00,00,53,00,6f,00,66,00,74,00,77,00,61,00,72,00,65,00,20,00,49,00,6e,00,\
  73,00,74,00,61,00,6c,00,6c,00,61,00,74,00,69,00,6f,00,6e,00,00,00,53,00,4e,\
  00,44,00,53,00,72,00,76,00,63,00,00,00,53,00,65,00,63,00,75,00,72,00,69,00,\
  74,00,79,00,43,00,65,00,6e,00,74,00,65,00,72,00,00,00,53,00,63,00,6c,00,67,\
  00,4e,00,74,00,66,00,79,00,00,00,53,00,63,00,65,00,53,00,72,00,76,00,00,00,\
  53,00,63,00,65,00,43,00,6c,00,69,00,00,00,73,00,61,00,66,00,72,00,73,00,6c,\
  00,76,00,00,00,53,00,41,00,46,00,72,00,64,00,6d,00,73,00,00,00,52,00,65,00,\
  6d,00,6f,00,74,00,65,00,20,00,41,00,73,00,73,00,69,00,73,00,74,00,61,00,6e,\
  00,63,00,65,00,00,00,50,00,65,00,72,00,66,00,50,00,72,00,6f,00,63,00,00,00,\
  50,00,65,00,72,00,66,00,4f,00,53,00,00,00,50,00,65,00,72,00,66,00,4e,00,65,\
  00,74,00,00,00,50,00,65,00,72,00,66,00,6d,00,6f,00,6e,00,00,00,50,00,65,00,\
  72,00,66,00,6c,00,69,00,62,00,00,00,50,00,65,00,72,00,66,00,44,00,69,00,73,\
  00,6b,00,00,00,50,00,65,00,72,00,66,00,63,00,74,00,72,00,73,00,00,00,4f,00,\
  66,00,66,00,6c,00,69,00,6e,00,65,00,20,00,46,00,69,00,6c,00,65,00,73,00,00,\
  00,4f,00,61,00,6b,00,6c,00,65,00,79,00,00,00,6e,00,74,00,62,00,61,00,63,00,\
  6b,00,75,00,70,00,00,00,4e,00,65,00,72,00,6f,00,43,00,68,00,65,00,63,00,6b,\
  00,00,00,4d,00,53,00,53,00,51,00,4c,00,53,00,45,00,52,00,56,00,45,00,52,00,\
  2f,00,4d,00,53,00,44,00,45,00,00,00,4d,00,73,00,69,00,49,00,6e,00,73,00,74,\
  00,61,00,6c,00,6c,00,65,00,72,00,00,00,4d,00,53,00,44,00,54,00,43,00,20,00,\
  43,00,6c,00,69,00,65,00,6e,00,74,00,00,00,4d,00,53,00,44,00,54,00,43,00,00,\
  00,6d,00,6e,00,6d,00,73,00,72,00,76,00,63,00,00,00,4d,00,69,00,63,00,72,00,\
  6f,00,73,00,6f,00,66,00,74,00,20,00,48,00,2e,00,33,00,32,00,33,00,20,00,54,\
  00,65,00,6c,00,65,00,70,00,68,00,6f,00,6e,00,79,00,20,00,53,00,65,00,72,00,\
  76,00,69,00,63,00,65,00,20,00,50,00,72,00,6f,00,76,00,69,00,64,00,65,00,72,\
  00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,46,00,\
  61,00,78,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,\
  00,28,00,52,00,29,00,20,00,56,00,69,00,73,00,75,00,61,00,6c,00,20,00,43,00,\
  23,00,20,00,32,00,30,00,30,00,35,00,20,00,43,00,6f,00,6d,00,70,00,69,00,6c,\
  00,65,00,72,00,00,00,4c,00,6f,00,61,00,64,00,50,00,65,00,72,00,66,00,00,00,\
  4c,00,69,00,76,00,65,00,55,00,70,00,64,00,61,00,74,00,65,00,00,00,48,00,65,\
  00,6c,00,70,00,53,00,76,00,63,00,00,00,46,00,6f,00,6c,00,64,00,65,00,72,00,\
  20,00,52,00,65,00,64,00,69,00,72,00,65,00,63,00,74,00,69,00,6f,00,6e,00,00,\
  00,46,00,69,00,6c,00,65,00,20,00,44,00,65,00,70,00,6c,00,6f,00,79,00,6d,00,\
  65,00,6e,00,74,00,00,00,45,00,76,00,65,00,6e,00,74,00,53,00,79,00,73,00,74,\
  00,65,00,6d,00,00,00,45,00,53,00,45,00,4e,00,54,00,00,00,44,00,72,00,57,00,\
  61,00,74,00,73,00,6f,00,6e,00,00,00,44,00,69,00,73,00,6b,00,51,00,75,00,6f,\
  00,74,00,61,00,00,00,63,00,72,00,79,00,70,00,74,00,33,00,32,00,00,00,43,00,\
  4f,00,4d,00,2b,00,00,00,43,00,4f,00,4d,00,00,00,43,00,69,00,00,00,43,00,68,\
  00,6b,00,64,00,73,00,6b,00,00,00,41,00,75,00,74,00,6f,00,6d,00,61,00,74,00,\
  69,00,63,00,20,00,4c,00,69,00,76,00,65,00,55,00,70,00,64,00,61,00,74,00,65,\
  00,20,00,53,00,63,00,68,00,65,00,64,00,75,00,6c,00,65,00,72,00,00,00,41,00,\
  75,00,74,00,6f,00,45,00,6e,00,72,00,6f,00,6c,00,6c,00,6d,00,65,00,6e,00,74,\
  00,00,00,41,00,75,00,74,00,6f,00,63,00,68,00,6b,00,00,00,41,00,53,00,50,00,\
  2e,00,4e,00,45,00,54,00,20,00,32,00,2e,00,30,00,2e,00,35,00,30,00,37,00,32,\
  00,37,00,2e,00,30,00,00,00,41,00,53,00,50,00,2e,00,4e,00,45,00,54,00,20,00,\
  31,00,2e,00,31,00,2e,00,34,00,33,00,32,00,32,00,2e,00,30,00,00,00,41,00,70,\
  00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,20,00,4d,00,61,00,\
  6e,00,61,00,67,00,65,00,6d,00,65,00,6e,00,74,00,00,00,41,00,70,00,70,00,6c,\
  00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,20,00,48,00,61,00,6e,00,67,00,\
  00,00,41,00,70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,20,\
  00,45,00,72,00,72,00,6f,00,72,00,00,00,2e,00,4e,00,45,00,54,00,20,00,52,00,\
  75,00,6e,00,74,00,69,00,6d,00,65,00,20,00,4f,00,70,00,74,00,69,00,6d,00,69,\
  00,7a,00,61,00,74,00,69,00,6f,00,6e,00,20,00,53,00,65,00,72,00,76,00,69,00,\
  63,00,65,00,00,00,2e,00,4e,00,45,00,54,00,20,00,52,00,75,00,6e,00,74,00,69,\
  00,6d,00,65,00,20,00,32,00,2e,00,30,00,20,00,45,00,72,00,72,00,6f,00,72,00,\
  20,00,52,00,65,00,70,00,6f,00,72,00,74,00,69,00,6e,00,67,00,00,00,2e,00,4e,\
  00,45,00,54,00,20,00,52,00,75,00,6e,00,74,00,69,00,6d,00,65,00,00,00,41,00,\
  70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\.NET Runtime]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\.NET Runtime 2.0 Error Reporting]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\.NET Runtime Optimization Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_CLR_OPTIMIZATION_V2.0.50727_32\0000]
"DeviceDesc"=".NET Runtime Optimization Service v2.0.50727_X86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_RUNTIME2]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_RUNTIME2\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_RUNTIME2\0000]
"Service"="runtime2"
"DeviceDesc"="runtime2"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\clr_optimization_v2.0.50727_32]
"DisplayName"=".NET Runtime Optimization Service v2.0.50727_X86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application]
; Contents of value:
;   WSH
;   WMIAdapter
;   WmdmPmSN
;   WinMgmt
;   Winlogon
;   Windows Product Activation
;   Windows 3.1 Migration
;   WebClient
;   VSS
;   VBRuntime
;   usnjsvc
;   Userinit
;   Userenv
;   SysmonLog
;   Starter
;   SpoolerCtrs
;   Software Restriction Policies
;   Software Installation
;   SNDSrvc
;   SecurityCenter
;   SclgNtfy
;   SceSrv
;   SceCli
;   safrslv
;   SAFrdms
;   Remote Assistance
;   PerfProc
;   PerfOS
;   PerfNet
;   Perfmon
;   Perflib
;   PerfDisk
;   Perfctrs
;   Offline Files
;   Oakley
;   ntbackup
;   NeroCheck
;   MSSQLSERVER/MSDE
;   MsiInstaller
;   MSDTC Client
;   MSDTC
;   mnmsrvc
;   Microsoft H.323 Telephony Service Provider
;   Microsoft Fax
;   Microsoft (R) Visual C# 2005 Compiler
;   LoadPerf
;   LiveUpdate
;   HelpSvc
;   Folder Redirection
;   File Deployment
;   F-Secure Management Agent
;   EventSystem
;   ESENT
;   DrWatson
;   DiskQuota
;   crypt32
;   COM+
;   COM
;   Ci
;   Chkdsk
;   Automatic LiveUpdate Scheduler
;   AutoEnrollment
;   Autochk
;   ASP.NET 2.0.50727.0
;   ASP.NET 1.1.4322.0
;   Application Management
;   Application Hang
;   Application Error
;   .NET Runtime Optimization Service
;   .NET Runtime 2.0 Error Reporting
;   .NET Runtime
;   Application
;   
"Sources"=hex(7):57,00,53,00,48,00,00,00,57,00,4d,00,49,00,41,00,64,00,61,00,\
  70,00,74,00,65,00,72,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,4e,\
  00,00,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,00,00,00,57,00,69,00,6e,00,\
  6c,00,6f,00,67,00,6f,00,6e,00,00,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\
  00,20,00,50,00,72,00,6f,00,64,00,75,00,63,00,74,00,20,00,41,00,63,00,74,00,\
  69,00,76,00,61,00,74,00,69,00,6f,00,6e,00,00,00,57,00,69,00,6e,00,64,00,6f,\
  00,77,00,73,00,20,00,33,00,2e,00,31,00,20,00,4d,00,69,00,67,00,72,00,61,00,\
  74,00,69,00,6f,00,6e,00,00,00,57,00,65,00,62,00,43,00,6c,00,69,00,65,00,6e,\
  00,74,00,00,00,56,00,53,00,53,00,00,00,56,00,42,00,52,00,75,00,6e,00,74,00,\
  69,00,6d,00,65,00,00,00,75,00,73,00,6e,00,6a,00,73,00,76,00,63,00,00,00,55,\
  00,73,00,65,00,72,00,69,00,6e,00,69,00,74,00,00,00,55,00,73,00,65,00,72,00,\
  65,00,6e,00,76,00,00,00,53,00,79,00,73,00,6d,00,6f,00,6e,00,4c,00,6f,00,67,\
  00,00,00,53,00,74,00,61,00,72,00,74,00,65,00,72,00,00,00,53,00,70,00,6f,00,\
  6f,00,6c,00,65,00,72,00,43,00,74,00,72,00,73,00,00,00,53,00,6f,00,66,00,74,\
  00,77,00,61,00,72,00,65,00,20,00,52,00,65,00,73,00,74,00,72,00,69,00,63,00,\
  74,00,69,00,6f,00,6e,00,20,00,50,00,6f,00,6c,00,69,00,63,00,69,00,65,00,73,\
  00,00,00,53,00,6f,00,66,00,74,00,77,00,61,00,72,00,65,00,20,00,49,00,6e,00,\
  73,00,74,00,61,00,6c,00,6c,00,61,00,74,00,69,00,6f,00,6e,00,00,00,53,00,4e,\
  00,44,00,53,00,72,00,76,00,63,00,00,00,53,00,65,00,63,00,75,00,72,00,69,00,\
  74,00,79,00,43,00,65,00,6e,00,74,00,65,00,72,00,00,00,53,00,63,00,6c,00,67,\
  00,4e,00,74,00,66,00,79,00,00,00,53,00,63,00,65,00,53,00,72,00,76,00,00,00,\
  53,00,63,00,65,00,43,00,6c,00,69,00,00,00,73,00,61,00,66,00,72,00,73,00,6c,\
  00,76,00,00,00,53,00,41,00,46,00,72,00,64,00,6d,00,73,00,00,00,52,00,65,00,\
  6d,00,6f,00,74,00,65,00,20,00,41,00,73,00,73,00,69,00,73,00,74,00,61,00,6e,\
  00,63,00,65,00,00,00,50,00,65,00,72,00,66,00,50,00,72,00,6f,00,63,00,00,00,\
  50,00,65,00,72,00,66,00,4f,00,53,00,00,00,50,00,65,00,72,00,66,00,4e,00,65,\
  00,74,00,00,00,50,00,65,00,72,00,66,00,6d,00,6f,00,6e,00,00,00,50,00,65,00,\
  72,00,66,00,6c,00,69,00,62,00,00,00,50,00,65,00,72,00,66,00,44,00,69,00,73,\
  00,6b,00,00,00,50,00,65,00,72,00,66,00,63,00,74,00,72,00,73,00,00,00,4f,00,\
  66,00,66,00,6c,00,69,00,6e,00,65,00,20,00,46,00,69,00,6c,00,65,00,73,00,00,\
  00,4f,00,61,00,6b,00,6c,00,65,00,79,00,00,00,6e,00,74,00,62,00,61,00,63,00,\
  6b,00,75,00,70,00,00,00,4e,00,65,00,72,00,6f,00,43,00,68,00,65,00,63,00,6b,\
  00,00,00,4d,00,53,00,53,00,51,00,4c,00,53,00,45,00,52,00,56,00,45,00,52,00,\
  2f,00,4d,00,53,00,44,00,45,00,00,00,4d,00,73,00,69,00,49,00,6e,00,73,00,74,\
  00,61,00,6c,00,6c,00,65,00,72,00,00,00,4d,00,53,00,44,00,54,00,43,00,20,00,\
  43,00,6c,00,69,00,65,00,6e,00,74,00,00,00,4d,00,53,00,44,00,54,00,43,00,00,\
  00,6d,00,6e,00,6d,00,73,00,72,00,76,00,63,00,00,00,4d,00,69,00,63,00,72,00,\
  6f,00,73,00,6f,00,66,00,74,00,20,00,48,00,2e,00,33,00,32,00,33,00,20,00,54,\
  00,65,00,6c,00,65,00,70,00,68,00,6f,00,6e,00,79,00,20,00,53,00,65,00,72,00,\
  76,00,69,00,63,00,65,00,20,00,50,00,72,00,6f,00,76,00,69,00,64,00,65,00,72,\
  00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,46,00,\
  61,00,78,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,\
  00,28,00,52,00,29,00,20,00,56,00,69,00,73,00,75,00,61,00,6c,00,20,00,43,00,\
  23,00,20,00,32,00,30,00,30,00,35,00,20,00,43,00,6f,00,6d,00,70,00,69,00,6c,\
  00,65,00,72,00,00,00,4c,00,6f,00,61,00,64,00,50,00,65,00,72,00,66,00,00,00,\
  4c,00,69,00,76,00,65,00,55,00,70,00,64,00,61,00,74,00,65,00,00,00,48,00,65,\
  00,6c,00,70,00,53,00,76,00,63,00,00,00,46,00,6f,00,6c,00,64,00,65,00,72,00,\
  20,00,52,00,65,00,64,00,69,00,72,00,65,00,63,00,74,00,69,00,6f,00,6e,00,00,\
  00,46,00,69,00,6c,00,65,00,20,00,44,00,65,00,70,00,6c,00,6f,00,79,00,6d,00,\
  65,00,6e,00,74,00,00,00,46,00,2d,00,53,00,65,00,63,00,75,00,72,00,65,00,20,\
  00,4d,00,61,00,6e,00,61,00,67,00,65,00,6d,00,65,00,6e,00,74,00,20,00,41,00,\
  67,00,65,00,6e,00,74,00,00,00,45,00,76,00,65,00,6e,00,74,00,53,00,79,00,73,\
  00,74,00,65,00,6d,00,00,00,45,00,53,00,45,00,4e,00,54,00,00,00,44,00,72,00,\
  57,00,61,00,74,00,73,00,6f,00,6e,00,00,00,44,00,69,00,73,00,6b,00,51,00,75,\
  00,6f,00,74,00,61,00,00,00,63,00,72,00,79,00,70,00,74,00,33,00,32,00,00,00,\
  43,00,4f,00,4d,00,2b,00,00,00,43,00,4f,00,4d,00,00,00,43,00,69,00,00,00,43,\
  00,68,00,6b,00,64,00,73,00,6b,00,00,00,41,00,75,00,74,00,6f,00,6d,00,61,00,\
  74,00,69,00,63,00,20,00,4c,00,69,00,76,00,65,00,55,00,70,00,64,00,61,00,74,\
  00,65,00,20,00,53,00,63,00,68,00,65,00,64,00,75,00,6c,00,65,00,72,00,00,00,\
  41,00,75,00,74,00,6f,00,45,00,6e,00,72,00,6f,00,6c,00,6c,00,6d,00,65,00,6e,\
  00,74,00,00,00,41,00,75,00,74,00,6f,00,63,00,68,00,6b,00,00,00,41,00,53,00,\
  50,00,2e,00,4e,00,45,00,54,00,20,00,32,00,2e,00,30,00,2e,00,35,00,30,00,37,\
  00,32,00,37,00,2e,00,30,00,00,00,41,00,53,00,50,00,2e,00,4e,00,45,00,54,00,\
  20,00,31,00,2e,00,31,00,2e,00,34,00,33,00,32,00,32,00,2e,00,30,00,00,00,41,\
  00,70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,20,00,4d,00,\
  61,00,6e,00,61,00,67,00,65,00,6d,00,65,00,6e,00,74,00,00,00,41,00,70,00,70,\
  00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,20,00,48,00,61,00,6e,00,\
  67,00,00,00,41,00,70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,\
  00,20,00,45,00,72,00,72,00,6f,00,72,00,00,00,2e,00,4e,00,45,00,54,00,20,00,\
  52,00,75,00,6e,00,74,00,69,00,6d,00,65,00,20,00,4f,00,70,00,74,00,69,00,6d,\
  00,69,00,7a,00,61,00,74,00,69,00,6f,00,6e,00,20,00,53,00,65,00,72,00,76,00,\
  69,00,63,00,65,00,00,00,2e,00,4e,00,45,00,54,00,20,00,52,00,75,00,6e,00,74,\
  00,69,00,6d,00,65,00,20,00,32,00,2e,00,30,00,20,00,45,00,72,00,72,00,6f,00,\
  72,00,20,00,52,00,65,00,70,00,6f,00,72,00,74,00,69,00,6e,00,67,00,00,00,2e,\
  00,4e,00,45,00,54,00,20,00,52,00,75,00,6e,00,74,00,69,00,6d,00,65,00,00,00,\
  41,00,70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,00,00,00,\
  00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\.NET Runtime]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\.NET Runtime 2.0 Error Reporting]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\.NET Runtime Optimization Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CLR_OPTIMIZATION_V2.0.50727_32\0000]
"DeviceDesc"=".NET Runtime Optimization Service v2.0.50727_X86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_RUNTIME2]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_RUNTIME2\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_RUNTIME2\0000]
"Service"="runtime2"
"DeviceDesc"="runtime2"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_RUNTIME2\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\clr_optimization_v2.0.50727_32]
"DisplayName"=".NET Runtime Optimization Service v2.0.50727_X86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application]
; Contents of value:
;   WSH
;   WMIAdapter
;   WmdmPmSN
;   WinMgmt
;   Winlogon
;   Windows Product Activation
;   Windows 3.1 Migration
;   WebClient
;   VSS
;   VBRuntime
;   Userinit
;   Userenv
;   SysmonLog
;   Starter
;   SpoolerCtrs
;   Software Restriction Policies
;   Software Installation
;   SNDSrvc
;   SecurityCenter
;   SclgNtfy
;   SceSrv
;   SceCli
;   safrslv
;   SAFrdms
;   Remote Assistance
;   PerfProc
;   PerfOS
;   PerfNet
;   Perfmon
;   Perflib
;   PerfDisk
;   Perfctrs
;   Offline Files
;   Oakley
;   ntbackup
;   NeroCheck
;   MSSQLSERVER/MSDE
;   MsiInstaller
;   MSDTC Client
;   MSDTC
;   mnmsrvc
;   Microsoft H.323 Telephony Service Provider
;   Microsoft Fax
;   Microsoft (R) Visual C# 2005 Compiler
;   LoadPerf
;   LiveUpdate
;   HelpSvc
;   Folder Redirection
;   File Deployment
;   F-Secure Management Agent
;   EventSystem
;   ESENT
;   DrWatson
;   DiskQuota
;   crypt32
;   COM+
;   COM
;   Ci
;   Chkdsk
;   AVG7
;   Automatic LiveUpdate Scheduler
;   AutoEnrollment
;   Autochk
;   ASP.NET 2.0.50727.0
;   ASP.NET 1.1.4322.0
;   Application Management
;   Application Hang
;   Application Error
;   .NET Runtime Optimization Service
;   .NET Runtime 2.0 Error Reporting
;   .NET Runtime
;   Application
;   
"Sources"=hex(7):57,00,53,00,48,00,00,00,57,00,4d,00,49,00,41,00,64,00,61,00,\
  70,00,74,00,65,00,72,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,4e,\
  00,00,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,00,00,00,57,00,69,00,6e,00,\
  6c,00,6f,00,67,00,6f,00,6e,00,00,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\
  00,20,00,50,00,72,00,6f,00,64,00,75,00,63,00,74,00,20,00,41,00,63,00,74,00,\
  69,00,76,00,61,00,74,00,69,00,6f,00,6e,00,00,00,57,00,69,00,6e,00,64,00,6f,\
  00,77,00,73,00,20,00,33,00,2e,00,31,00,20,00,4d,00,69,00,67,00,72,00,61,00,\
  74,00,69,00,6f,00,6e,00,00,00,57,00,65,00,62,00,43,00,6c,00,69,00,65,00,6e,\
  00,74,00,00,00,56,00,53,00,53,00,00,00,56,00,42,00,52,00,75,00,6e,00,74,00,\
  69,00,6d,00,65,00,00,00,55,00,73,00,65,00,72,00,69,00,6e,00,69,00,74,00,00,\
  00,55,00,73,00,65,00,72,00,65,00,6e,00,76,00,00,00,53,00,79,00,73,00,6d,00,\
  6f,00,6e,00,4c,00,6f,00,67,00,00,00,53,00,74,00,61,00,72,00,74,00,65,00,72,\
  00,00,00,53,00,70,00,6f,00,6f,00,6c,00,65,00,72,00,43,00,74,00,72,00,73,00,\
  00,00,53,00,6f,00,66,00,74,00,77,00,61,00,72,00,65,00,20,00,52,00,65,00,73,\
  00,74,00,72,00,69,00,63,00,74,00,69,00,6f,00,6e,00,20,00,50,00,6f,00,6c,00,\
  69,00,63,00,69,00,65,00,73,00,00,00,53,00,6f,00,66,00,74,00,77,00,61,00,72,\
  00,65,00,20,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,61,00,74,00,69,00,\
  6f,00,6e,00,00,00,53,00,4e,00,44,00,53,00,72,00,76,00,63,00,00,00,53,00,65,\
  00,63,00,75,00,72,00,69,00,74,00,79,00,43,00,65,00,6e,00,74,00,65,00,72,00,\
  00,00,53,00,63,00,6c,00,67,00,4e,00,74,00,66,00,79,00,00,00,53,00,63,00,65,\
  00,53,00,72,00,76,00,00,00,53,00,63,00,65,00,43,00,6c,00,69,00,00,00,73,00,\
  61,00,66,00,72,00,73,00,6c,00,76,00,00,00,53,00,41,00,46,00,72,00,64,00,6d,\
  00,73,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,20,00,41,00,73,00,73,00,\
  69,00,73,00,74,00,61,00,6e,00,63,00,65,00,00,00,50,00,65,00,72,00,66,00,50,\
  00,72,00,6f,00,63,00,00,00,50,00,65,00,72,00,66,00,4f,00,53,00,00,00,50,00,\
  65,00,72,00,66,00,4e,00,65,00,74,00,00,00,50,00,65,00,72,00,66,00,6d,00,6f,\
  00,6e,00,00,00,50,00,65,00,72,00,66,00,6c,00,69,00,62,00,00,00,50,00,65,00,\
  72,00,66,00,44,00,69,00,73,00,6b,00,00,00,50,00,65,00,72,00,66,00,63,00,74,\
  00,72,00,73,00,00,00,4f,00,66,00,66,00,6c,00,69,00,6e,00,65,00,20,00,46,00,\
  69,00,6c,00,65,00,73,00,00,00,4f,00,61,00,6b,00,6c,00,65,00,79,00,00,00,6e,\
  00,74,00,62,00,61,00,63,00,6b,00,75,00,70,00,00,00,4e,00,65,00,72,00,6f,00,\
  43,00,68,00,65,00,63,00,6b,00,00,00,4d,00,53,00,53,00,51,00,4c,00,53,00,45,\
  00,52,00,56,00,45,00,52,00,2f,00,4d,00,53,00,44,00,45,00,00,00,4d,00,73,00,\
  69,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,65,00,72,00,00,00,4d,00,53,\
  00,44,00,54,00,43,00,20,00,43,00,6c,00,69,00,65,00,6e,00,74,00,00,00,4d,00,\
  53,00,44,00,54,00,43,00,00,00,6d,00,6e,00,6d,00,73,00,72,00,76,00,63,00,00,\
  00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,48,00,2e,00,\
  33,00,32,00,33,00,20,00,54,00,65,00,6c,00,65,00,70,00,68,00,6f,00,6e,00,79,\
  00,20,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,20,00,50,00,72,00,6f,00,\
  76,00,69,00,64,00,65,00,72,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,\
  00,66,00,74,00,20,00,46,00,61,00,78,00,00,00,4d,00,69,00,63,00,72,00,6f,00,\
  73,00,6f,00,66,00,74,00,20,00,28,00,52,00,29,00,20,00,56,00,69,00,73,00,75,\
  00,61,00,6c,00,20,00,43,00,23,00,20,00,32,00,30,00,30,00,35,00,20,00,43,00,\
  6f,00,6d,00,70,00,69,00,6c,00,65,00,72,00,00,00,4c,00,6f,00,61,00,64,00,50,\
  00,65,00,72,00,66,00,00,00,4c,00,69,00,76,00,65,00,55,00,70,00,64,00,61,00,\
  74,00,65,00,00,00,48,00,65,00,6c,00,70,00,53,00,76,00,63,00,00,00,46,00,6f,\
  00,6c,00,64,00,65,00,72,00,20,00,52,00,65,00,64,00,69,00,72,00,65,00,63,00,\
  74,00,69,00,6f,00,6e,00,00,00,46,00,69,00,6c,00,65,00,20,00,44,00,65,00,70,\
  00,6c,00,6f,00,79,00,6d,00,65,00,6e,00,74,00,00,00,46,00,2d,00,53,00,65,00,\
  63,00,75,00,72,00,65,00,20,00,4d,00,61,00,6e,00,61,00,67,00,65,00,6d,00,65,\
  00,6e,00,74,00,20,00,41,00,67,00,65,00,6e,00,74,00,00,00,45,00,76,00,65,00,\
  6e,00,74,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,45,00,53,00,45,00,4e,\
  00,54,00,00,00,44,00,72,00,57,00,61,00,74,00,73,00,6f,00,6e,00,00,00,44,00,\
  69,00,73,00,6b,00,51,00,75,00,6f,00,74,00,61,00,00,00,63,00,72,00,79,00,70,\
  00,74,00,33,00,32,00,00,00,43,00,4f,00,4d,00,2b,00,00,00,43,00,4f,00,4d,00,\
  00,00,43,00,69,00,00,00,43,00,68,00,6b,00,64,00,73,00,6b,00,00,00,41,00,56,\
  00,47,00,37,00,00,00,41,00,75,00,74,00,6f,00,6d,00,61,00,74,00,69,00,63,00,\
  20,00,4c,00,69,00,76,00,65,00,55,00,70,00,64,00,61,00,74,00,65,00,20,00,53,\
  00,63,00,68,00,65,00,64,00,75,00,6c,00,65,00,72,00,00,00,41,00,75,00,74,00,\
  6f,00,45,00,6e,00,72,00,6f,00,6c,00,6c,00,6d,00,65,00,6e,00,74,00,00,00,41,\
  00,75,00,74,00,6f,00,63,00,68,00,6b,00,00,00,41,00,53,00,50,00,2e,00,4e,00,\
  45,00,54,00,20,00,32,00,2e,00,30,00,2e,00,35,00,30,00,37,00,32,00,37,00,2e,\
  00,30,00,00,00,41,00,53,00,50,00,2e,00,4e,00,45,00,54,00,20,00,31,00,2e,00,\
  31,00,2e,00,34,00,33,00,32,00,32,00,2e,00,30,00,00,00,41,00,70,00,70,00,6c,\
  00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,20,00,4d,00,61,00,6e,00,61,00,\
  67,00,65,00,6d,00,65,00,6e,00,74,00,00,00,41,00,70,00,70,00,6c,00,69,00,63,\
  00,61,00,74,00,69,00,6f,00,6e,00,20,00,48,00,61,00,6e,00,67,00,00,00,41,00,\
  70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,20,00,45,00,72,\
  00,72,00,6f,00,72,00,00,00,2e,00,4e,00,45,00,54,00,20,00,52,00,75,00,6e,00,\
  74,00,69,00,6d,00,65,00,20,00,4f,00,70,00,74,00,69,00,6d,00,69,00,7a,00,61,\
  00,74,00,69,00,6f,00,6e,00,20,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,\
  00,00,2e,00,4e,00,45,00,54,00,20,00,52,00,75,00,6e,00,74,00,69,00,6d,00,65,\
  00,20,00,32,00,2e,00,30,00,20,00,45,00,72,00,72,00,6f,00,72,00,20,00,52,00,\
  65,00,70,00,6f,00,72,00,74,00,69,00,6e,00,67,00,00,00,2e,00,4e,00,45,00,54,\
  00,20,00,52,00,75,00,6e,00,74,00,69,00,6d,00,65,00,00,00,41,00,70,00,70,00,\
  6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\.NET Runtime]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\.NET Runtime 2.0 Error Reporting]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\.NET Runtime Optimization Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_CLR_OPTIMIZATION_V2.0.50727_32\0000]
"DeviceDesc"=".NET Runtime Optimization Service v2.0.50727_X86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_RUNTIME2]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_RUNTIME2\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_RUNTIME2\0000]
"Service"="runtime2"
"DeviceDesc"="runtime2"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_RUNTIME2\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_RUNTIME2\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_RUNTIME2\0000\Control]
"ActiveService"="runtime2"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\clr_optimization_v2.0.50727_32]
"DisplayName"=".NET Runtime Optimization Service v2.0.50727_X86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application]
; Contents of value:
;   WSH
;   WMIAdapter
;   WmdmPmSN
;   WinMgmt
;   Winlogon
;   Windows Product Activation
;   Windows 3.1 Migration
;   WebClient
;   VSS
;   VBRuntime
;   Userinit
;   Userenv
;   SysmonLog
;   Starter
;   SpoolerCtrs
;   Software Restriction Policies
;   Software Installation
;   SNDSrvc
;   SecurityCenter
;   SclgNtfy
;   SceSrv
;   SceCli
;   safrslv
;   SAFrdms
;   Remote Assistance
;   PerfProc
;   PerfOS
;   PerfNet
;   Perfmon
;   Perflib
;   PerfDisk
;   Perfctrs
;   Offline Files
;   Oakley
;   ntbackup
;   NeroCheck
;   MSSQLSERVER/MSDE
;   MsiInstaller
;   MSDTC Client
;   MSDTC
;   mnmsrvc
;   Microsoft H.323 Telephony Service Provider
;   Microsoft Fax
;   Microsoft (R) Visual C# 2005 Compiler
;   LoadPerf
;   LiveUpdate
;   HelpSvc
;   Folder Redirection
;   File Deployment
;   F-Secure Management Agent
;   EventSystem
;   ESENT
;   DrWatson
;   DiskQuota
;   crypt32
;   COM+
;   COM
;   Ci
;   Chkdsk
;   AVG7
;   Automatic LiveUpdate Scheduler
;   AutoEnrollment
;   Autochk
;   ASP.NET 2.0.50727.0
;   ASP.NET 1.1.4322.0
;   Application Management
;   Application Hang
;   Application Error
;   .NET Runtime Optimization Service
;   .NET Runtime 2.0 Error Reporting
;   .NET Runtime
;   Application
;   
"Sources"=hex(7):57,00,53,00,48,00,00,00,57,00,4d,00,49,00,41,00,64,00,61,00,\
  70,00,74,00,65,00,72,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,4e,\
  00,00,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,00,00,00,57,00,69,00,6e,00,\
  6c,00,6f,00,67,00,6f,00,6e,00,00,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\
  00,20,00,50,00,72,00,6f,00,64,00,75,00,63,00,74,00,20,00,41,00,63,00,74,00,\
  69,00,76,00,61,00,74,00,69,00,6f,00,6e,00,00,00,57,00,69,00,6e,00,64,00,6f,\
  00,77,00,73,00,20,00,33,00,2e,00,31,00,20,00,4d,00,69,00,67,00,72,00,61,00,\
  74,00,69,00,6f,00,6e,00,00,00,57,00,65,00,62,00,43,00,6c,00,69,00,65,00,6e,\
  00,74,00,00,00,56,00,53,00,53,00,00,00,56,00,42,00,52,00,75,00,6e,00,74,00,\
  69,00,6d,00,65,00,00,00,55,00,73,00,65,00,72,00,69,00,6e,00,69,00,74,00,00,\
  00,55,00,73,00,65,00,72,00,65,00,6e,00,76,00,00,00,53,00,79,00,73,00,6d,00,\
  6f,00,6e,00,4c,00,6f,00,67,00,00,00,53,00,74,00,61,00,72,00,74,00,65,00,72,\
  00,00,00,53,00,70,00,6f,00,6f,00,6c,00,65,00,72,00,43,00,74,00,72,00,73,00,\
  00,00,53,00,6f,00,66,00,74,00,77,00,61,00,72,00,65,00,20,00,52,00,65,00,73,\
  00,74,00,72,00,69,00,63,00,74,00,69,00,6f,00,6e,00,20,00,50,00,6f,00,6c,00,\
  69,00,63,00,69,00,65,00,73,00,00,00,53,00,6f,00,66,00,74,00,77,00,61,00,72,\
  00,65,00,20,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,61,00,74,00,69,00,\
  6f,00,6e,00,00,00,53,00,4e,00,44,00,53,00,72,00,76,00,63,00,00,00,53,00,65,\
  00,63,00,75,00,72,00,69,00,74,00,79,00,43,00,65,00,6e,00,74,00,65,00,72,00,\
  00,00,53,00,63,00,6c,00,67,00,4e,00,74,00,66,00,79,00,00,00,53,00,63,00,65,\
  00,53,00,72,00,76,00,00,00,53,00,63,00,65,00,43,00,6c,00,69,00,00,00,73,00,\
  61,00,66,00,72,00,73,00,6c,00,76,00,00,00,53,00,41,00,46,00,72,00,64,00,6d,\
  00,73,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,20,00,41,00,73,00,73,00,\
  69,00,73,00,74,00,61,00,6e,00,63,00,65,00,00,00,50,00,65,00,72,00,66,00,50,\
  00,72,00,6f,00,63,00,00,00,50,00,65,00,72,00,66,00,4f,00,53,00,00,00,50,00,\
  65,00,72,00,66,00,4e,00,65,00,74,00,00,00,50,00,65,00,72,00,66,00,6d,00,6f,\
  00,6e,00,00,00,50,00,65,00,72,00,66,00,6c,00,69,00,62,00,00,00,50,00,65,00,\
  72,00,66,00,44,00,69,00,73,00,6b,00,00,00,50,00,65,00,72,00,66,00,63,00,74,\
  00,72,00,73,00,00,00,4f,00,66,00,66,00,6c,00,69,00,6e,00,65,00,20,00,46,00,\
  69,00,6c,00,65,00,73,00,00,00,4f,00,61,00,6b,00,6c,00,65,00,79,00,00,00,6e,\
  00,74,00,62,00,61,00,63,00,6b,00,75,00,70,00,00,00,4e,00,65,00,72,00,6f,00,\
  43,00,68,00,65,00,63,00,6b,00,00,00,4d,00,53,00,53,00,51,00,4c,00,53,00,45,\
  00,52,00,56,00,45,00,52,00,2f,00,4d,00,53,00,44,00,45,00,00,00,4d,00,73,00,\
  69,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,65,00,72,00,00,00,4d,00,53,\
  00,44,00,54,00,43,00,20,00,43,00,6c,00,69,00,65,00,6e,00,74,00,00,00,4d,00,\
  53,00,44,00,54,00,43,00,00,00,6d,00,6e,00,6d,00,73,00,72,00,76,00,63,00,00,\
  00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,48,00,2e,00,\
  33,00,32,00,33,00,20,00,54,00,65,00,6c,00,65,00,70,00,68,00,6f,00,6e,00,79,\
  00,20,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,20,00,50,00,72,00,6f,00,\
  76,00,69,00,64,00,65,00,72,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,\
  00,66,00,74,00,20,00,46,00,61,00,78,00,00,00,4d,00,69,00,63,00,72,00,6f,00,\
  73,00,6f,00,66,00,74,00,20,00,28,00,52,00,29,00,20,00,56,00,69,00,73,00,75,\
  00,61,00,6c,00,20,00,43,00,23,00,20,00,32,00,30,00,30,00,35,00,20,00,43,00,\
  6f,00,6d,00,70,00,69,00,6c,00,65,00,72,00,00,00,4c,00,6f,00,61,00,64,00,50,\
  00,65,00,72,00,66,00,00,00,4c,00,69,00,76,00,65,00,55,00,70,00,64,00,61,00,\
  74,00,65,00,00,00,48,00,65,00,6c,00,70,00,53,00,76,00,63,00,00,00,46,00,6f,\
  00,6c,00,64,00,65,00,72,00,20,00,52,00,65,00,64,00,69,00,72,00,65,00,63,00,\
  74,00,69,00,6f,00,6e,00,00,00,46,00,69,00,6c,00,65,00,20,00,44,00,65,00,70,\
  00,6c,00,6f,00,79,00,6d,00,65,00,6e,00,74,00,00,00,46,00,2d,00,53,00,65,00,\
  63,00,75,00,72,00,65,00,20,00,4d,00,61,00,6e,00,61,00,67,00,65,00,6d,00,65,\
  00,6e,00,74,00,20,00,41,00,67,00,65,00,6e,00,74,00,00,00,45,00,76,00,65,00,\
  6e,00,74,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,45,00,53,00,45,00,4e,\
  00,54,00,00,00,44,00,72,00,57,00,61,00,74,00,73,00,6f,00,6e,00,00,00,44,00,\
  69,00,73,00,6b,00,51,00,75,00,6f,00,74,00,61,00,00,00,63,00,72,00,79,00,70,\
  00,74,00,33,00,32,00,00,00,43,00,4f,00,4d,00,2b,00,00,00,43,00,4f,00,4d,00,\
  00,00,43,00,69,00,00,00,43,00,68,00,6b,00,64,00,73,00,6b,00,00,00,41,00,56,\
  00,47,00,37,00,00,00,41,00,75,00,74,00,6f,00,6d,00,61,00,74,00,69,00,63,00,\
  20,00,4c,00,69,00,76,00,65,00,55,00,70,00,64,00,61,00,74,00,65,00,20,00,53,\
  00,63,00,68,00,65,00,64,00,75,00,6c,00,65,00,72,00,00,00,41,00,75,00,74,00,\
  6f,00,45,00,6e,00,72,00,6f,00,6c,00,6c,00,6d,00,65,00,6e,00,74,00,00,00,41,\
  00,75,00,74,00,6f,00,63,00,68,00,6b,00,00,00,41,00,53,00,50,00,2e,00,4e,00,\
  45,00,54,00,20,00,32,00,2e,00,30,00,2e,00,35,00,30,00,37,00,32,00,37,00,2e,\
  00,30,00,00,00,41,00,53,00,50,00,2e,00,4e,00,45,00,54,00,20,00,31,00,2e,00,\
  31,00,2e,00,34,00,33,00,32,00,32,00,2e,00,30,00,00,00,41,00,70,00,70,00,6c,\
  00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,20,00,4d,00,61,00,6e,00,61,00,\
  67,00,6

Yuki · Answer

voici la suite : 

5,00,6d,00,65,00,6e,00,74,00,00,00,41,00,70,00,70,00,6c,00,69,00,63,\
  00,61,00,74,00,69,00,6f,00,6e,00,20,00,48,00,61,00,6e,00,67,00,00,00,41,00,\
  70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,20,00,45,00,72,\
  00,72,00,6f,00,72,00,00,00,2e,00,4e,00,45,00,54,00,20,00,52,00,75,00,6e,00,\
  74,00,69,00,6d,00,65,00,20,00,4f,00,70,00,74,00,69,00,6d,00,69,00,7a,00,61,\
  00,74,00,69,00,6f,00,6e,00,20,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,\
  00,00,2e,00,4e,00,45,00,54,00,20,00,52,00,75,00,6e,00,74,00,69,00,6d,00,65,\
  00,20,00,32,00,2e,00,30,00,20,00,45,00,72,00,72,00,6f,00,72,00,20,00,52,00,\
  65,00,70,00,6f,00,72,00,74,00,69,00,6e,00,67,00,00,00,2e,00,4e,00,45,00,54,\
  00,20,00,52,00,75,00,6e,00,74,00,69,00,6d,00,65,00,00,00,41,00,70,00,70,00,\
  6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application\.NET Runtime]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application\.NET Runtime 2.0 Error Reporting]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog\Application\.NET Runtime Optimization Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Enum\Root\LEGACY_CLR_OPTIMIZATION_V2.0.50727_32\0000]
"DeviceDesc"=".NET Runtime Optimization Service v2.0.50727_X86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Enum\Root\LEGACY_RUNTIME2]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Enum\Root\LEGACY_RUNTIME2\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Enum\Root\LEGACY_RUNTIME2\0000]
"Service"="runtime2"
"DeviceDesc"="runtime2"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Enum\Root\LEGACY_RUNTIME2\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\clr_optimization_v2.0.50727_32]
"DisplayName"=".NET Runtime Optimization Service v2.0.50727_X86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\Eventlog\Application]
; Contents of value:
;   WSH
;   WMIAdapter
;   WmdmPmSN
;   WinMgmt
;   Winlogon
;   Windows Product Activation
;   Windows 3.1 Migration
;   WebClient
;   VSS
;   VBRuntime
;   Userinit
;   Userenv
;   SysmonLog
;   Starter
;   SpoolerCtrs
;   Software Restriction Policies
;   Software Installation
;   SNDSrvc
;   SecurityCenter
;   SclgNtfy
;   SceSrv
;   SceCli
;   safrslv
;   SAFrdms
;   Remote Assistance
;   PerfProc
;   PerfOS
;   PerfNet
;   Perfmon
;   Perflib
;   PerfDisk
;   Perfctrs
;   Offline Files
;   Oakley
;   ntbackup
;   NeroCheck
;   MSSQLSERVER/MSDE
;   MsiInstaller
;   MSDTC Client
;   MSDTC
;   mnmsrvc
;   Microsoft H.323 Telephony Service Provider
;   Microsoft Fax
;   Microsoft (R) Visual C# 2005 Compiler
;   LoadPerf
;   LiveUpdate
;   HelpSvc
;   Folder Redirection
;   File Deployment
;   F-Secure Management Agent
;   EventSystem
;   ESENT
;   DrWatson
;   DiskQuota
;   crypt32
;   COM+
;   COM
;   Ci
;   Chkdsk
;   AVG7
;   Automatic LiveUpdate Scheduler
;   AutoEnrollment
;   Autochk
;   ASP.NET 2.0.50727.0
;   ASP.NET 1.1.4322.0
;   Application Management
;   Application Hang
;   Application Error
;   .NET Runtime Optimization Service
;   .NET Runtime 2.0 Error Reporting
;   .NET Runtime
;   Application
;   
"Sources"=hex(7):57,00,53,00,48,00,00,00,57,00,4d,00,49,00,41,00,64,00,61,00,\
  70,00,74,00,65,00,72,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,4e,\
  00,00,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,00,00,00,57,00,69,00,6e,00,\
  6c,00,6f,00,67,00,6f,00,6e,00,00,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\
  00,20,00,50,00,72,00,6f,00,64,00,75,00,63,00,74,00,20,00,41,00,63,00,74,00,\
  69,00,76,00,61,00,74,00,69,00,6f,00,6e,00,00,00,57,00,69,00,6e,00,64,00,6f,\
  00,77,00,73,00,20,00,33,00,2e,00,31,00,20,00,4d,00,69,00,67,00,72,00,61,00,\
  74,00,69,00,6f,00,6e,00,00,00,57,00,65,00,62,00,43,00,6c,00,69,00,65,00,6e,\
  00,74,00,00,00,56,00,53,00,53,00,00,00,56,00,42,00,52,00,75,00,6e,00,74,00,\
  69,00,6d,00,65,00,00,00,55,00,73,00,65,00,72,00,69,00,6e,00,69,00,74,00,00,\
  00,55,00,73,00,65,00,72,00,65,00,6e,00,76,00,00,00,53,00,79,00,73,00,6d,00,\
  6f,00,6e,00,4c,00,6f,00,67,00,00,00,53,00,74,00,61,00,72,00,74,00,65,00,72,\
  00,00,00,53,00,70,00,6f,00,6f,00,6c,00,65,00,72,00,43,00,74,00,72,00,73,00,\
  00,00,53,00,6f,00,66,00,74,00,77,00,61,00,72,00,65,00,20,00,52,00,65,00,73,\
  00,74,00,72,00,69,00,63,00,74,00,69,00,6f,00,6e,00,20,00,50,00,6f,00,6c,00,\
  69,00,63,00,69,00,65,00,73,00,00,00,53,00,6f,00,66,00,74,00,77,00,61,00,72,\
  00,65,00,20,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,61,00,74,00,69,00,\
  6f,00,6e,00,00,00,53,00,4e,00,44,00,53,00,72,00,76,00,63,00,00,00,53,00,65,\
  00,63,00,75,00,72,00,69,00,74,00,79,00,43,00,65,00,6e,00,74,00,65,00,72,00,\
  00,00,53,00,63,00,6c,00,67,00,4e,00,74,00,66,00,79,00,00,00,53,00,63,00,65,\
  00,53,00,72,00,76,00,00,00,53,00,63,00,65,00,43,00,6c,00,69,00,00,00,73,00,\
  61,00,66,00,72,00,73,00,6c,00,76,00,00,00,53,00,41,00,46,00,72,00,64,00,6d,\
  00,73,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,20,00,41,00,73,00,73,00,\
  69,00,73,00,74,00,61,00,6e,00,63,00,65,00,00,00,50,00,65,00,72,00,66,00,50,\
  00,72,00,6f,00,63,00,00,00,50,00,65,00,72,00,66,00,4f,00,53,00,00,00,50,00,\
  65,00,72,00,66,00,4e,00,65,00,74,00,00,00,50,00,65,00,72,00,66,00,6d,00,6f,\
  00,6e,00,00,00,50,00,65,00,72,00,66,00,6c,00,69,00,62,00,00,00,50,00,65,00,\
  72,00,66,00,44,00,69,00,73,00,6b,00,00,00,50,00,65,00,72,00,66,00,63,00,74,\
  00,72,00,73,00,00,00,4f,00,66,00,66,00,6c,00,69,00,6e,00,65,00,20,00,46,00,\
  69,00,6c,00,65,00,73,00,00,00,4f,00,61,00,6b,00,6c,00,65,00,79,00,00,00,6e,\
  00,74,00,62,00,61,00,63,00,6b,00,75,00,70,00,00,00,4e,00,65,00,72,00,6f,00,\
  43,00,68,00,65,00,63,00,6b,00,00,00,4d,00,53,00,53,00,51,00,4c,00,53,00,45,\
  00,52,00,56,00,45,00,52,00,2f,00,4d,00,53,00,44,00,45,00,00,00,4d,00,73,00,\
  69,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,65,00,72,00,00,00,4d,00,53,\
  00,44,00,54,00,43,00,20,00,43,00,6c,00,69,00,65,00,6e,00,74,00,00,00,4d,00,\
  53,00,44,00,54,00,43,00,00,00,6d,00,6e,00,6d,00,73,00,72,00,76,00,63,00,00,\
  00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,48,00,2e,00,\
  33,00,32,00,33,00,20,00,54,00,65,00,6c,00,65,00,70,00,68,00,6f,00,6e,00,79,\
  00,20,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,20,00,50,00,72,00,6f,00,\
  76,00,69,00,64,00,65,00,72,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,\
  00,66,00,74,00,20,00,46,00,61,00,78,00,00,00,4d,00,69,00,63,00,72,00,6f,00,\
  73,00,6f,00,66,00,74,00,20,00,28,00,52,00,29,00,20,00,56,00,69,00,73,00,75,\
  00,61,00,6c,00,20,00,43,00,23,00,20,00,32,00,30,00,30,00,35,00,20,00,43,00,\
  6f,00,6d,00,70,00,69,00,6c,00,65,00,72,00,00,00,4c,00,6f,00,61,00,64,00,50,\
  00,65,00,72,00,66,00,00,00,4c,00,69,00,76,00,65,00,55,00,70,00,64,00,61,00,\
  74,00,65,00,00,00,48,00,65,00,6c,00,70,00,53,00,76,00,63,00,00,00,46,00,6f,\
  00,6c,00,64,00,65,00,72,00,20,00,52,00,65,00,64,00,69,00,72,00,65,00,63,00,\
  74,00,69,00,6f,00,6e,00,00,00,46,00,69,00,6c,00,65,00,20,00,44,00,65,00,70,\
  00,6c,00,6f,00,79,00,6d,00,65,00,6e,00,74,00,00,00,46,00,2d,00,53,00,65,00,\
  63,00,75,00,72,00,65,00,20,00,4d,00,61,00,6e,00,61,00,67,00,65,00,6d,00,65,\
  00,6e,00,74,00,20,00,41,00,67,00,65,00,6e,00,74,00,00,00,45,00,76,00,65,00,\
  6e,00,74,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,45,00,53,00,45,00,4e,\
  00,54,00,00,00,44,00,72,00,57,00,61,00,74,00,73,00,6f,00,6e,00,00,00,44,00,\
  69,00,73,00,6b,00,51,00,75,00,6f,00,74,00,61,00,00,00,63,00,72,00,79,00,70,\
  00,74,00,33,00,32,00,00,00,43,00,4f,00,4d,00,2b,00,00,00,43,00,4f,00,4d,00,\
  00,00,43,00,69,00,00,00,43,00,68,00,6b,00,64,00,73,00,6b,00,00,00,41,00,56,\
  00,47,00,37,00,00,00,41,00,75,00,74,00,6f,00,6d,00,61,00,74,00,69,00,63,00,\
  20,00,4c,00,69,00,76,00,65,00,55,00,70,00,64,00,61,00,74,00,65,00,20,00,53,\
  00,63,00,68,00,65,00,64,00,75,00,6c,00,65,00,72,00,00,00,41,00,75,00,74,00,\
  6f,00,45,00,6e,00,72,00,6f,00,6c,00,6c,00,6d,00,65,00,6e,00,74,00,00,00,41,\
  00,75,00,74,00,6f,00,63,00,68,00,6b,00,00,00,41,00,53,00,50,00,2e,00,4e,00,\
  45,00,54,00,20,00,32,00,2e,00,30,00,2e,00,35,00,30,00,37,00,32,00,37,00,2e,\
  00,30,00,00,00,41,00,53,00,50,00,2e,00,4e,00,45,00,54,00,20,00,31,00,2e,00,\
  31,00,2e,00,34,00,33,00,32,00,32,00,2e,00,30,00,00,00,41,00,70,00,70,00,6c,\
  00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,20,00,4d,00,61,00,6e,00,61,00,\
  67,00,65,00,6d,00,65,00,6e,00,74,00,00,00,41,00,70,00,70,00,6c,00,69,00,63,\
  00,61,00,74,00,69,00,6f,00,6e,00,20,00,48,00,61,00,6e,00,67,00,00,00,41,00,\
  70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,20,00,45,00,72,\
  00,72,00,6f,00,72,00,00,00,2e,00,4e,00,45,00,54,00,20,00,52,00,75,00,6e,00,\
  74,00,69,00,6d,00,65,00,20,00,4f,00,70,00,74,00,69,00,6d,00,69,00,7a,00,61,\
  00,74,00,69,00,6f,00,6e,00,20,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,\
  00,00,2e,00,4e,00,45,00,54,00,20,00,52,00,75,00,6e,00,74,00,69,00,6d,00,65,\
  00,20,00,32,00,2e,00,30,00,20,00,45,00,72,00,72,00,6f,00,72,00,20,00,52,00,\
  65,00,70,00,6f,00,72,00,74,00,69,00,6e,00,67,00,00,00,2e,00,4e,00,45,00,54,\
  00,20,00,52,00,75,00,6e,00,74,00,69,00,6d,00,65,00,00,00,41,00,70,00,70,00,\
  6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\Eventlog\Application\.NET Runtime]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\Eventlog\Application\.NET Runtime 2.0 Error Reporting]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\Eventlog\Application\.NET Runtime Optimization Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLR_OPTIMIZATION_V2.0.50727_32\0000]
"DeviceDesc"=".NET Runtime Optimization Service v2.0.50727_X86"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RUNTIME2]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RUNTIME2\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RUNTIME2\0000]
"Service"="runtime2"
"DeviceDesc"="runtime2"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RUNTIME2\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RUNTIME2\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RUNTIME2\0000\Control]
"ActiveService"="runtime2"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clr_optimization_v2.0.50727_32]
"DisplayName"=".NET Runtime Optimization Service v2.0.50727_X86"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application]
; Contents of value:
;   WSH
;   WMIAdapter
;   WmdmPmSN
;   WinMgmt
;   Winlogon
;   Windows Product Activation
;   Windows 3.1 Migration
;   WebClient
;   VSS
;   VBRuntime
;   Userinit
;   Userenv
;   SysmonLog
;   Starter
;   SpoolerCtrs
;   Software Restriction Policies
;   Software Installation
;   SNDSrvc
;   SecurityCenter
;   SclgNtfy
;   SceSrv
;   SceCli
;   safrslv
;   SAFrdms
;   Remote Assistance
;   PerfProc
;   PerfOS
;   PerfNet
;   Perfmon
;   Perflib
;   PerfDisk
;   Perfctrs
;   Offline Files
;   Oakley
;   ntbackup
;   NeroCheck
;   MSSQLSERVER/MSDE
;   MsiInstaller
;   MSDTC Client
;   MSDTC
;   mnmsrvc
;   Microsoft H.323 Telephony Service Provider
;   Microsoft Fax
;   Microsoft (R) Visual C# 2005 Compiler
;   LoadPerf
;   LiveUpdate
;   HelpSvc
;   Folder Redirection
;   File Deployment
;   F-Secure Management Agent
;   EventSystem
;   ESENT
;   DrWatson
;   DiskQuota
;   crypt32
;   COM+
;   COM
;   Ci
;   Chkdsk
;   AVG7
;   Automatic LiveUpdate Scheduler
;   AutoEnrollment
;   Autochk
;   ASP.NET 2.0.50727.0
;   ASP.NET 1.1.4322.0
;   Application Management
;   Application Hang
;   Application Error
;   .NET Runtime Optimization Service
;   .NET Runtime 2.0 Error Reporting
;   .NET Runtime
;   Application
;   
"Sources"=hex(7):57,00,53,00,48,00,00,00,57,00,4d,00,49,00,41,00,64,00,61,00,\
  70,00,74,00,65,00,72,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,4e,\
  00,00,00,57,00,69,00,6e,00,4d,00,67,00,6d,00,74,00,00,00,57,00,69,00,6e,00,\
  6c,00,6f,00,67,00,6f,00,6e,00,00,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\
  00,20,00,50,00,72,00,6f,00,64,00,75,00,63,00,74,00,20,00,41,00,63,00,74,00,\
  69,00,76,00,61,00,74,00,69,00,6f,00,6e,00,00,00,57,00,69,00,6e,00,64,00,6f,\
  00,77,00,73,00,20,00,33,00,2e,00,31,00,20,00,4d,00,69,00,67,00,72,00,61,00,\
  74,00,69,00,6f,00,6e,00,00,00,57,00,65,00,62,00,43,00,6c,00,69,00,65,00,6e,\
  00,74,00,00,00,56,00,53,00,53,00,00,00,56,00,42,00,52,00,75,00,6e,00,74,00,\
  69,00,6d,00,65,00,00,00,55,00,73,00,65,00,72,00,69,00,6e,00,69,00,74,00,00,\
  00,55,00,73,00,65,00,72,00,65,00,6e,00,76,00,00,00,53,00,79,00,73,00,6d,00,\
  6f,00,6e,00,4c,00,6f,00,67,00,00,00,53,00,74,00,61,00,72,00,74,00,65,00,72,\
  00,00,00,53,00,70,00,6f,00,6f,00,6c,00,65,00,72,00,43,00,74,00,72,00,73,00,\
  00,00,53,00,6f,00,66,00,74,00,77,00,61,00,72,00,65,00,20,00,52,00,65,00,73,\
  00,74,00,72,00,69,00,63,00,74,00,69,00,6f,00,6e,00,20,00,50,00,6f,00,6c,00,\
  69,00,63,00,69,00,65,00,73,00,00,00,53,00,6f,00,66,00,74,00,77,00,61,00,72,\
  00,65,00,20,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,61,00,74,00,69,00,\
  6f,00,6e,00,00,00,53,00,4e,00,44,00,53,00,72,00,76,00,63,00,00,00,53,00,65,\
  00,63,00,75,00,72,00,69,00,74,00,79,00,43,00,65,00,6e,00,74,00,65,00,72,00,\
  00,00,53,00,63,00,6c,00,67,00,4e,00,74,00,66,00,79,00,00,00,53,00,63,00,65,\
  00,53,00,72,00,76,00,00,00,53,00,63,00,65,00,43,00,6c,00,69,00,00,00,73,00,\
  61,00,66,00,72,00,73,00,6c,00,76,00,00,00,53,00,41,00,46,00,72,00,64,00,6d,\
  00,73,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,20,00,41,00,73,00,73,00,\
  69,00,73,00,74,00,61,00,6e,00,63,00,65,00,00,00,50,00,65,00,72,00,66,00,50,\
  00,72,00,6f,00,63,00,00,00,50,00,65,00,72,00,66,00,4f,00,53,00,00,00,50,00,\
  65,00,72,00,66,00,4e,00,65,00,74,00,00,00,50,00,65,00,72,00,66,00,6d,00,6f,\
  00,6e,00,00,00,50,00,65,00,72,00,66,00,6c,00,69,00,62,00,00,00,50,00,65,00,\
  72,00,66,00,44,00,69,00,73,00,6b,00,00,00,50,00,65,00,72,00,66,00,63,00,74,\
  00,72,00,73,00,00,00,4f,00,66,00,66,00,6c,00,69,00,6e,00,65,00,20,00,46,00,\
  69,00,6c,00,65,00,73,00,00,00,4f,00,61,00,6b,00,6c,00,65,00,79,00,00,00,6e,\
  00,74,00,62,00,61,00,63,00,6b,00,75,00,70,00,00,00,4e,00,65,00,72,00,6f,00,\
  43,00,68,00,65,00,63,00,6b,00,00,00,4d,00,53,00,53,00,51,00,4c,00,53,00,45,\
  00,52,00,56,00,45,00,52,00,2f,00,4d,00,53,00,44,00,45,00,00,00,4d,00,73,00,\
  69,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,65,00,72,00,00,00,4d,00,53,\
  00,44,00,54,00,43,00,20,00,43,00,6c,00,69,00,65,00,6e,00,74,00,00,00,4d,00,\
  53,00,44,00,54,00,43,00,00,00,6d,00,6e,00,6d,00,73,00,72,00,76,00,63,00,00,\
  00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,48,00,2e,00,\
  33,00,32,00,33,00,20,00,54,00,65,00,6c,00,65,00,70,00,68,00,6f,00,6e,00,79,\
  00,20,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,20,00,50,00,72,00,6f,00,\
  76,00,69,00,64,00,65,00,72,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,\
  00,66,00,74,00,20,00,46,00,61,00,78,00,00,00,4d,00,69,00,63,00,72,00,6f,00,\
  73,00,6f,00,66,00,74,00,20,00,28,00,52,00,29,00,20,00,56,00,69,00,73,00,75,\
  00,61,00,6c,00,20,00,43,00,23,00,20,00,32,00,30,00,30,00,35,00,20,00,43,00,\
  6f,00,6d,00,70,00,69,00,6c,00,65,00,72,00,00,00,4c,00,6f,00,61,00,64,00,50,\
  00,65,00,72,00,66,00,00,00,4c,00,69,00,76,00,65,00,55,00,70,00,64,00,61,00,\
  74,00,65,00,00,00,48,00,65,00,6c,00,70,00,53,00,76,00,63,00,00,00,46,00,6f,\
  00,6c,00,64,00,65,00,72,00,20,00,52,00,65,00,64,00,69,00,72,00,65,00,63,00,\
  74,00,69,00,6f,00,6e,00,00,00,46,00,69,00,6c,00,65,00,20,00,44,00,65,00,70,\
  00,6c,00,6f,00,79,00,6d,00,65,00,6e,00,74,00,00,00,46,00,2d,00,53,00,65,00,\
  63,00,75,00,72,00,65,00,20,00,4d,00,61,00,6e,00,61,00,67,00,65,00,6d,00,65,\
  00,6e,00,74,00,20,00,41,00,67,00,65,00,6e,00,74,00,00,00,45,00,76,00,65,00,\
  6e,00,74,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,45,00,53,00,45,00,4e,\
  00,54,00,00,00,44,00,72,00,57,00,61,00,74,00,73,00,6f,00,6e,00,00,00,44,00,\
  69,00,73,00,6b,00,51,00,75,00,6f,00,74,00,61,00,00,00,63,00,72,00,79,00,70,\
  00,74,00,33,00,32,00,00,00,43,00,4f,00,4d,00,2b,00,00,00,43,00,4f,00,4d,00,\
  00,00,43,00,69,00,00,00,43,00,68,00,6b,00,64,00,73,00,6b,00,00,00,41,00,56,\
  00,47,00,37,00,00,00,41,00,75,00,74,00,6f,00,6d,00,61,00,74,00,69,00,63,00,\
  20,00,4c,00,69,00,76,00,65,00,55,00,70,00,64,00,61,00,74,00,65,00,20,00,53,\
  00,63,00,68,00,65,00,64,00,75,00,6c,00,65,00,72,00,00,00,41,00,75,00,74,00,\
  6f,00,45,00,6e,00,72,00,6f,00,6c,00,6c,00,6d,00,65,00,6e,00,74,00,00,00,41,\
  00,75,00,74,00,6f,00,63,00,68,00,6b,00,00,00,41,00,53,00,50,00,2e,00,4e,00,\
  45,00,54,00,20,00,32,00,2e,00,30,00,2e,00,35,00,30,00,37,00,32,00,37,00,2e,\
  00,30,00,00,00,41,00,53,00,50,00,2e,00,4e,00,45,00,54,00,20,00,31,00,2e,00,\
  31,00,2e,00,34,00,33,00,32,00,32,00,2e,00,30,00,00,00,41,00,70,00,70,00,6c,\
  00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,20,00,4d,00,61,00,6e,00,61,00,\
  67,00,65,00,6d,00,65,00,6e,00,74,00,00,00,41,00,70,00,70,00,6c,00,69,00,63,\
  00,61,00,74,00,69,00,6f,00,6e,00,20,00,48,00,61,00,6e,00,67,00,00,00,41,00,\
  70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,20,00,45,00,72,\
  00,72,00,6f,00,72,00,00,00,2e,00,4e,00,45,00,54,00,20,00,52,00,75,00,6e,00,\
  74,00,69,00,6d,00,65,00,20,00,4f,00,70,00,74,00,69,00,6d,00,69,00,7a,00,61,\
  00,74,00,69,00,6f,00,6e,00,20,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,\
  00,00,2e,00,4e,00,45,00,54,00,20,00,52,00,75,00,6e,00,74,00,69,00,6d,00,65,\
  00,20,00,32,00,2e,00,30,00,20,00,45,00,72,00,72,00,6f,00,72,00,20,00,52,00,\
  65,00,70,00,6f,00,72,00,74,00,69,00,6e,00,67,00,00,00,2e,00,4e,00,45,00,54,\
  00,20,00,52,00,75,00,6e,00,74,00,69,00,6d,00,65,00,00,00,41,00,70,00,70,00,\
  6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\.NET Runtime]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\.NET Runtime 2.0 Error Reporting]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\.NET Runtime Optimization Service]

[HKEY_CURRENT_USER\Software\JavaSoft\Java Runtime Environment]

[HKEY_CURRENT_USER\Software\JavaSoft\Java Runtime Environment\1.5.0_06]

[HKEY_CURRENT_USER\Software\JavaSoft\Java Runtime Environment\1.5.0_09]

[HKEY_CURRENT_USER\Software\JavaSoft\Java Runtime Environment\1.5.0_10]

[HKEY_CURRENT_USER\Software\JavaSoft\Java Runtime Environment\1.5.0_11]

; End Of The Log...

voilà pour le moment,merci pour tes consignes

Lyonnais92 · Answer

RE,

tu relances Regsearch sur ip6fw

@+

Yuki · Answer

Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.5.0

; Results at 24/09/2007 18:56:20 for strings:
;  'ip6fw '
; Strings excluded from search:
;  (None)
; Search in: 
; Registry Keys  Registry Values  Registry Data  
; HKEY_LOCAL_MACHINE  HKEY_USERS  


; End Of The Log...

Yuki · Answer

réponse à Helmuth, 
il faut payer 50 dollars pour tuer un trojan ?? TROJAN GUARDER !

Lyonnais92 · Answer

Re,

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier : C:\WINDOWS\userinit.exe

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse.

@+

Yuki · Answer

Bonsoir, 

C:\WINDOWS\system32\userinit.exe

Fichier userinit.exe reçu le 2007.09.24 22:33:41 (CET)
Antivirus	Version	Dernière mise à jour	Résultat
AhnLab-V3	2007.9.22.0	2007.09.24	-
AntiVir	7.6.0.15	2007.09.24	-
Authentium	4.93.8	2007.09.24	-
Avast	4.7.1043.0	2007.09.24	-
AVG	7.5.0.485	2007.09.24	-
BitDefender	7.2	2007.09.24	-
CAT-QuickHeal	9.00	2007.09.24	-
ClamAV	0.91.2	2007.09.24	-
DrWeb	4.33	2007.09.24	-
eSafe	7.0.15.0	2007.09.23	-
eTrust-Vet	31.2.5159	2007.09.24	-
Ewido	4.0	2007.09.24	-
FileAdvisor	1	2007.09.24	-
Fortinet	3.11.0.0	2007.09.24	-
F-Prot	4.3.2.48	2007.09.23	-
F-Secure	6.70.13030.0	2007.09.24	-
Ikarus	T3.1.1.12	2007.09.24	-
Kaspersky	4.0.2.24	2007.09.24	-
McAfee	5126	2007.09.24	-
Microsoft	1.2803	2007.09.24	-
NOD32v2	2547	2007.09.24	-
Norman	5.80.02	2007.09.24	-
Panda	9.0.0.4	2007.09.24	-
Prevx1	V2	2007.09.24	-
Rising	19.42.02.00	2007.09.24	-
Sophos	4.21.0	2007.09.24	-
Sunbelt	2.2.907.0	2007.09.24	-
Symantec	10	2007.09.24	-
TheHacker	6.2.5.067	2007.09.24	-
VBA32	3.12.2.4	2007.09.23	-
VirusBuster	4.3.26:9	2007.09.24	-
Webwasher-Gateway	6.0.1	2007.09.24	-
Information additionnelle
File size: 25088 bytes
MD5: d6d65ea32b190401b57edb6706f29669
SHA1: 273ea1a839056c60444238b248213ce6c94d1c3f

Lyonnais92 · Answer

Bonsoir,

on refait une tentative de suppression;

1) Ouvre le Bloc Notes. 
Copie le texte ci-dessous (entre les * mais sans les *) avec le texte qui se trouve dans l'espace ci-dessous (copie/colle) : (attention, ce n'est pas exactement le même).

***************************** 
REGEDIT4 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"startdrv"= "" 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*] 
"f"="" 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe] 
"a"=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache] 
"C:\WINDOWS\Temp\startdrv.exe"=""

***************************** 
Clique sur "Fichier", "Enregistrer sous". 
Clique sur Bureau (dans la colonne de gauche) 
Dans Nom du fichier tu écris fix.reg 
Pour Type tu choisis "tous les fichiers" avec le menu déroulant. 
Tu cliques sur Enregistrer. 
Tu fermes le Bloc-notes 

Sur ton bureau, tu double-clique sur l'icône de Fix.reg 
Tu acceptes l'avertissement concernant la fusion 
Le fix va travailler sans se manifester. 
A la fin, tu vas voir un message disant que la fusion est terminée. Tu valides. 

 2)

Télécharge The Avenger par Swandog46 sur ton Bureau: 

http://www.geekstogo.com/forum/files/file/393-the-avenger-by-swandog46/ 

Click sur Avenger.zip pour ouvrir le fichier 
Extraire avenger.exe sur votre bureau 

2. Copie tout le texte en gras ci-dessous : mettre en surbrillance et appuyer sur les touches(Ctrl+C): 

Files to delete: 
C:\WINDOWS\Temp\startdrv.exe 
 

3. Maintenant, lance The Avenger en cliquant sur son icône du bureau. 
Sous "scrïpt file to execute" choisir "Input scrïpt Manually". 
Puis clique sur l'icône en forme de loupe qui va ouvrir une nouvelle fenêtre "View/edit scrïpt" 
Dans cette fenêtre, colle le texte précedemment copié sur le bureau par les touches (Ctrl+V). 
Cliquer Done 
ensuite clique sur l'icône en forme de Feu Vert pour démarrer l'exécution du scrïpt 
Réponds "Yes" deux fois quand demandé. 

4. The Avenger va automatiquement faire ce qui suit: 
Il va Re-démarrer le système. 
Pendant le re-démarrage, il apparaitra brièvement une fenêtre de commande de windows noire sur ton bureau, ceci est NORMAL. 
Après le re-démarrage, il crée un fichier log qui s'ouvrira, faisant apparaitre les actions exécutées par The Avenger. Ce fichier log se trouve ici : C:\avenger.txt 

5. Pour finir copie/colle le contenu du ficher c:\avenger.txt dans ta réponse avec un nouveau rapport hijackthis.

Sauf mention (ou impossibilité), tu fais ça en mode normal, sur ta session habituelle.

@+

Yuki · Answer

re, 

4. The Avenger va automatiquement faire ce qui suit:
Il va Re-démarrer le système.
Pendant le re-démarrage, il apparaitra brièvement une fenêtre de commande de windows noire sur ton bureau, ceci est NORMAL.

il l'a fait après le redemarrage, c'est à dire au moment de l'ouverture de la barre des tâches.

Après le re-démarrage, il crée un fichier log qui s'ouvrira, faisant apparaitre les actions exécutées par The Avenger. Ce fichier log se trouve ici : C:\avenger.txt


//////////////////////////////////////////
  Avenger Pre-Processor log
//////////////////////////////////////////

Error:  could not create zip file.
Error code: 0


//////////////////////////////////////////


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\bjopupsy

*******************

Script file located at: \??\C:\Documents and Settings\uwfqciyb.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\Temp\startdrv.exe deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.

Yuki · Answer

Logfile of HijackThis v1.99.1
Scan saved at 00:26:03, on 25/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.fr/8SEFRFR030000TBR/InstallSuccess
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exe
O4 - Global Startup: Trojan Guarder Gold Version.lnk = C:\Program Files\Trojan Guarder Gold Version\Trojan Guarder.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 2.0esources\fr-FR\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2ce861a41e324489ac465c2b9d28c6a7
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2ce861a41e324489ac465c2b9d28c6a7
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (file missing)
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Userinit Logon Application - Unknown owner - C:\WINDOWS\userinit.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

voilà pour ce soir.

Lyonnais92 · Answer

Re,

tu fais ça :

Tu lance Resgsearch sur startdrv

 Ouvre le Bloc Notes. 
Copie le texte ci-dessous (entre les * mais sans les *) avec le texte qui se trouve dans l'espace ci-dessous (copie/colle) : (attention, ce n'est pas exactement le même). 

***************************** 
REGEDIT4 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"startdrv"= "" 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*] 
"f"="" 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe] 
"a"="" 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache] 
"C:\WINDOWS\Temp\startdrv.exe"="" 

***************************** 
Clique sur "Fichier", "Enregistrer sous". 
Clique sur Bureau (dans la colonne de gauche) 
Dans Nom du fichier tu écris fix.reg 
Pour Type tu choisis "tous les fichiers" avec le menu déroulant. 
Tu cliques sur Enregistrer. 
Tu fermes le Bloc-notes 

Sur ton bureau, tu double-clique sur l'icône de Fix.reg 
Tu acceptes l'avertissement concernant la fusion 
Le fix va travailler sans se manifester. 
A la fin, tu vas voir un message disant que la fusion est terminée. Tu valides. 

Tu relance Regsearch sur startdrv

Tu relances Regsearch sur HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

Tu postes les 3 rapport de Regsearch.

@+

Yuki · Answer

salut, 


regsearch rapport ( là le logiciel s'est bloqué ) : 

Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.5.0

; Results at 25/09/2007 13:11:56 for strings:
;  'startdrv'
; Strings excluded from search:
;  (None)
; Search in: 
; Registry Keys  Registry Values  Registry Data  
; HKEY_LOCAL_MACHINE  HKEY_USERS  


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"startdrv"="C:\WINDOWS\Temp\startdrv.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\WINDOWS\Temp\startdrv.exe"=""

; End Of The Log...

regsearch rapport 2 :
Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.5.0

; Results at 25/09/2007 13:17:04 for strings:
;  'startdrv'
; Strings excluded from search:
;  (None)
; Search in: 
; Registry Keys  Registry Values  Registry Data  
; HKEY_LOCAL_MACHINE  HKEY_USERS  


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"startdrv"=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\WINDOWS\Temp\startdrv.exe"=""

; End Of The Log...

Yuki · Answer

rapport regsearch 3 : 

Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.5.0

; Results at 25/09/2007 13:24:50 for strings:
;  'hkey_current_user\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru'
; Strings excluded from search:
;  (None)
; Search in: 
; Registry Keys  Registry Values  Registry Data  
; HKEY_LOCAL_MACHINE  HKEY_USERS  


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\6c-announce]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\abw]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\art]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\avi]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\bad]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\bin]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\bmp]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\bz2]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\cda]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\cdm]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\com]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\dat]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\doc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\EX_]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\gif]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\htm]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\html]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\jpeg]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\jpg]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\jpg=]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\lnk]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\m3u]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\met]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\mov]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\mp3]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\mpeg]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\mpg]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\msi]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU
ri]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\part]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\pdf]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\pfc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\php]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\png]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\pps]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRUam]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRUar]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRUeg]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRUlg]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRUm]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRUtf]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRUtx]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\srt]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU	h]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\Theme]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU	orrent]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU	xt]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\wma]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\wmv]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\xls]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\zip]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\_AA240_SCLZZZZZZZ_V38048725_]

; End Of The Log...

Lyonnais92 · Answer

Bonjour,

vu, retour demain soir (boulot)

@+

yuki · Answer

je me demande si un formatage ( propre ) du pc est enviseagable ???? sans perdre XP sur un Acer ?

Lyonnais92 · Answer

Bonsoir,

je vois Trojan Guarder.exe dans ton log Hijackthis.

Va dans panneau de configuration ajout suppression de programme et supprime le.

Si tu ne peux pas, fais ça :

Relance HijackThis.

Choisis Do a scan only

Coche la case devant cette ligne :

O4 - Global Startup: Trojan Guarder Gold Version.lnk = C:\Program Files\Trojan Guarder Gold Version\Trojan Guarder.exe

Ferme toutes les fenêtres (hormis HijackThis), y compris ton navigateur.

Clique sur fix checked.

Ferme Hijackthis. 


réouvre OTMoveIt, mets C:\Program Files\Trojan Guarder Gold Version\Trojan Guarder.exe dans la zone a supprimer et supprime.

@+

Lyonnais92 · Answer

Re,

fais aussi ça :

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le scrïpt.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du scrïpt et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis ! 

@+

yuki · Answer

Salut, 

C:\Program Files\Trojan Guarder Gold Version\Trojan Guarder.exe  

est un programme anti - trojan que j'ai installer il y à deux jours ( que j'ai supprimé ) :
https://download.cnet.com/archive/3000-2239_4-10727072.html

Trojan Guarder Gold will detect and eliminate viruses, Trojans and macro viruses, even new and unknown ones, on your computer. Trojan Guarder initates a system named Guard Ghost to supervise all running processes in memory system, Windows files and open ports to search worms and trojan horses at any time.

Trojan Guarder also provides assistance tool to protect and manage your computer: Windows Ghost and IE Doctor.
Windows Ghost can help you to config your computer from hacking. IE Doctor can recover any damage caused by java script viruses and activeX viruses. It can also prevent hackers from attacking the network browser of your computer.

yuki · Answer

mais je n'ai pas réussi donc j'éxécute ce que tu me dis dans le message 50....

yuki · Answer

ahh ca y est on dirai que mon PC se lance normalement en mode normal ( puisque j'utilisais le mode sans échec avec prise du réseau depuis de nombreux jours !! ) .

voici le rapport :


SDFix: Version 1.107

Run by Barros on 27/09/2007 at 03:11

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services: 

Name:
Userinit Logon Application

ImagePath:
C:\WINDOWS\userinit.exe 

Userinit Logon Application - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Service runtime2 - Deleted after Reboot

Normal Mode:
Checking Files: 

Trojan Files Found:

C:\WINDOWS\SYSTEM32\SYS_DLL.DLL - Deleted
C:\WINDOWS\system32\0_exception.nls  - Deleted
C:\WINDOWS\Temp\startdrv.exe  - Deleted
C:\WINDOWS\system32\driversuntime2.sys  - Deleted



Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found. 

C:\WINDOWS\system32
No streams found. 

C:\WINDOWS\system32\svchost.exe
No streams found.
 
C:\WINDOWS\system32
toskrnl.exe
No streams found.
 


                                 Final Check:

Remaining Services:
------------------




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Acer\Acer eConsole\MediaSync.exe"="C:\Program Files\Acer\Acer eConsole\MediaSync.exe:LocalSubNet:Enabled:Media Synchoronizer"
"C:\Program Files\Acer\Acer eConsole\eConsole.exe"="C:\Program Files\Acer\Acer eConsole\eConsole.exe:LocalSubNet:Enabled:eConsole"
"C:\Program Files\Acer\Acer eConsole\MediaServerService.exe"="C:\Program Files\Acer\Acer eConsole\MediaServerService.exe:LocalSubNet:Enabled:Acer Media Server"
"C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe:*:Enabled:AOL"
"C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe:*:Enabled:AOL"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\WINDOWS\system32\mshta.exe"="C:\WINDOWS\system32\mshta.exe:*:Enabled:Microsoft (R) HTML Application host"
"C:\Program Files\Fichiers communs\NewTech Infosystems\LiveUpdate\LiveUpdate.exe"="C:\Program Files\Fichiers communs\NewTech Infosystems\LiveUpdate\LiveUpdate.exe:*:Enabled:LiveUpdate"
"C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"="C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Fichiers communs\AOL\Loader\aolload.exe"="C:\Program Files\Fichiers communs\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\Fichiers communs\AOL\1157577326\ee\aolsoftware.exe"="C:\Program Files\Fichiers communs\AOL\1157577326\ee\aolsoftware.exe:*:Enabled:AOL Services"
"C:\Program Files\TVUPlayer\TVUPlayer.exe"="C:\Program Files\TVUPlayer\TVUPlayer.exe:*:Enabled:TVU Player Component"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\MaxTV\maxtv.exe"="C:\Program Files\MaxTV\maxtv.exe:*:Enabled:MaxTV Online"
"K:\Emule2\eMule\emule.exe"="K:\Emule2\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\adslTV\adslTV.exe"="C:\Program Files\adslTV\adslTV.exe:*:Enabled:adslTV"
"C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL"
"C:\Program Files\BitTorrent_DNA\dna.exe"="C:\Program Files\BitTorrent_DNA\dna.exe:*:Enabled:DNA"
"C:\Program Files\adslTV\vlc.exe"="C:\Program Files\adslTV\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Browser"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\WINDOWS\perfmon.exe"="C:\WINDOWS\perfmon.exe:*:Disabled:perfmon"
"C:\Program Files\Neuf\Media Center\httpd\httpd.exe"="C:\Program Files\Neuf\Media Center\httpd\httpd.exe:172.16.255.0/255.255.255.0:Enabled:Serveur de partage Media Center (Player Neuf Cegetel)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe:*:Enabled:AOL"
"C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe"="C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe:*:Enabled:AOL"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Mon 10 May 2004        54,384 A..H. --- "C:\Program Files\AOL 9.0\aolphx.exe"
Mon 10 May 2004       156,784 A..H. --- "C:\Program Files\AOL 9.0\aoltray.exe"
Mon 10 May 2004        31,344 A..H. --- "C:\Program Files\AOL 9.0\RBM.exe"
Mon 16 Jan 2006         1,024 ...HR --- "C:\WINDOWS\system32\NTIBUN4.dll"
Mon 16 Jan 2006         1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK7.dll"
Mon 16 Jan 2006         1,024 ...HR --- "C:\WINDOWS\system32\NTIFCD3.dll"
Mon 16 Jan 2006         1,024 ...HR --- "C:\WINDOWS\system32\NTIMP3.dll"
Mon 16 Jan 2006         1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll"
Sun 10 Sep 2006         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed  6 Dec 2006             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Wed 19 Sep 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8716c608174f1f63561ea4abedb6bf9b\BITD.tmp"

Finished! 


et maintenant le rapport Hick.. :
Logfile of HijackThis v1.99.1
Scan saved at 03:28:48, on 27/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Neuf\Media Center\MediaCenter.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\fichiers communs\aol\1157577326\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
c:\program files\fichiers communs\aol\1157577326\ee\aolsoftware.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\AOL Compagnon\companion.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.fr/8SEFRFR030000TBR/InstallSuccess
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 2.0esources\fr-FR\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2ce861a41e324489ac465c2b9d28c6a7
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2ce861a41e324489ac465c2b9d28c6a7
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Unknown owner - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (file missing)
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Lyonnais92 · Answer

Bonjour,

un bon coup de nettoyage général :

Lis bien et exécute cette manip dans l’ordre. 

#Télécharge et installe ces logiciels (si tu ne les as pas) pour les 3 premiers 
mets les à jour, comme indiqué dans les démos ou tutos. 

Ne les utilise pas tout de suite. 


Antispywares et autres : 

*Ad-Aware (gratuit) 
Téléchargement : 
http://telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/11643.html 
Le patch en Français pour Ad-Aware (gratuit) : 
http://telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/25543.html 
Tuto : 
http://perso.orange.fr/rginformatique/section%20virus/adawrevid.asf

*Spybot (gratuit) : 
Téléchargement : 
http://telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/26157.html 
voir demo d utilisation (merci Balltrap) 
http://perso.orange.fr/rginformatique/section%20virus/demo%20spybot.htm

* AVG AS 

AVG anti spyware 
https://www.01net.com/telecharger/
Mets le a jour avant de lancer le scan. 
Tuto : 
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html 


Nettoyeurs (de fichiers inutiles) et autres : 

*Ccleaner (gratuit) 
Téléchargement : 
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
Tuto : 
https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php 

Lors de l’installation, [décoche] l’option qui t’installerait la barre Yahoo ! 

======================================== 
->Affiche tous les fichiers et dossiers : 
clique sur démarrer/panneau de configuration (en affichage classique)/option des dossiers/affichage 

[Coche] « afficher les dossiers et fichiers cachés » 

[Décoche] la case « Masquer les fichiers protégés du système d'exploitation (recommandé) » 

[Décoche] « masquer les extensions dont le type est connu » 

Puis fais [appliquer] pour valider les changements. 

Et [Ok] 
======================================= 

->Démarre en mode sans échec : 
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec 
puis tape « entrée ». 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5). 
->Lance CCleaner. 

Suppression des fichiers temporaires 

Va dans la section "Options" situé dans la marge gauche.
Décoche "Avancé"
Retourne ensuite dans la section "Nettoyeur" 
Fais bien attention de cocher toutes ces cases dans la marge gauche (Internet Explorer/Windows Explorer/Système) 
• Clique sur [Analyse] 
• Patiente le temps du scan, qui peut prendre un peu de temps si c'est la première fois. 
• Une fois le scan terminé, clique sur [Lancer le Nettoyage] 



======================================== 
->Lance AVG pour un scan complet "Analyse" ->"Paramètres" 

Sous la question "Comment réagir ?" : 

-> clique sur "Actions recommandées" et choisis "Quarantaines" 
-> Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système" 

Si un fichier est infecté en fin d'analyse 

->Clique sur "Appliquer toutes les actions " 

->Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous". 

->Enregistre ce fichier texte sur ton bureau et [copie/colle le rapport en forum] 
======================================== 
->Passe Ad-Aware et supprime tout ce qu’il trouve + supprime les quarantaines… 
======================================== 
->Passe Spybot et corrige tout ce qu’il trouve + vaccine + supprime les quarantaines… 
======================================== 
->Relance CCleaner. 
Suppression des incohérences du registre 

• Clique sur l'icône [Erreurs] situés dans la marge à gauche 
• Puis clique sur [Analyser les erreurs] 
• Patiente pendant que CCleaner scan ton registre. 
• Une fois le scan terminé, coche toutes les entrèes qu'il t'aura trouvée. 
• Tu peux cliquer ensuite sur [Corriger les erreurs]. 

Si tu n'est pas sur de ce que tu fais, tu peux choisir de sauvegarder les entrées cochées pour les restaurer ultérieurement. 
======================================== 
->Vide ta Corbeille. 
======================================== 
->Redémarre en mode normal,


- > Ouvre ce lien pour scanner ton PC avec un BitDefender en ligne (uniquement sous Internet Explorer) : 

https://www.bitdefender.com/toolbox/

Utilisation : 
Cliquer sur "J'accepte" puis accepter également l'ActiveX bloqué par la barre anti-popup du SP2 qui clignotera en haut et l'installer. 
Ensuite, cliquer sur "Cliquez ici pour scanner". 
Patienter jusqu'à la fin du scan qui peut durer assez longtemps... 

Copier/coller le rapport entier sur le forum. 

Tutoriel en images ici : http://pageperso.aol.fr/rginformatique/mapage/defender.htm (merci à Balltrap34 pour cette réalisation) 
[Recoche] la case « Masquer les fichiers protégés du système d'exploitation (recommandé) » 

Relance Hijackthis et copie/colle un nouveau rapport sur le forum. 

Et dis moi ou en sont tes problèmes s’il t’en reste. 

@+

Yuki · Answer

Bonjour, 
j'ai fait tout ce que tu m'a demandé ( plusieurs virus moyen ont été effaçés sous Avg et Adaware ( j'ai effaçés la " mrulist " ) et tout les cookies et autres....avec cccleaner, cccleaner à corrigé 133 erreurs du registre !!! 

le rapport de Avg :

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	19:44:34 27/09/2007

 + Résultat de l'analyse:	



C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP1\A0002015.sys -> Downloader.Agent.acl : Nettoyé.
:mozilla.11:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\7ii8xbtp.default\cookies.txt -> TrackingCookie.Live : Nettoyé.
:mozilla.12:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\7ii8xbtp.default\cookies.txt -> TrackingCookie.Live : Nettoyé.
:mozilla.7:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\7ii8xbtp.default\cookies.txt -> TrackingCookie.Live : Nettoyé.
:mozilla.8:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\7ii8xbtp.default\cookies.txt -> TrackingCookie.Live : Nettoyé.
:mozilla.9:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\7ii8xbtp.default\cookies.txt -> TrackingCookie.Live : Nettoyé.
:mozilla.6:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\7ii8xbtp.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.


Fin du rapport


Voici le rapport Bitdefender : ( les virus trouvé sont ceux de Sdfix , le dossier mis en quarantaine que l'on ne peut supprimer ) :

BitDefender Online Scanner
	

 
	

 

Scan report generated at: Thu, Sep 27, 2007 - 21:19:00

 
	

 
	

 

Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;K:\;
	

 
	

 

 
	

 
	

 

Statistics

Time
	

00:48:12

Files
	

294726

Folders
	

5873

Boot Sectors
	

6

Archives
	

7547

Packed Files
	

17484
	

 
	

 

Results

Identified Viruses
	

1

Infected Files
	

4

Suspect Files
	

0

Warnings
	

0

Disinfected
	

0

Deleted Files
	

4
	

 
	

 

Engines Info

Virus Definitions
	

823990

Engine build
	

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins
	

14

Archive plugins
	

38

Unpack plugins
	

7

E-mail plugins
	

6

System plugins
	

1
	

 
	

 

Scan Settings

First Action
	

Disinfect

Second Action
	

Delete

Heuristics
	

Yes

Enable Warnings
	

Yes

Scanned Extensions
	

*;

Exclude Extensions
	

 

Scan Emails
	

Yes

Scan Archives
	

Yes

Scan Packed
	

Yes

Scan Files
	

Yes

Scan Boot
	

Yes
	

 
	

 
 

Scanned File
	

 Status

C:\SDFix\backups\backups.zip=>backups/startdrv.exe
	

Infected with: Trojan.Kobcka.L

C:\SDFix\backups\backups.zip=>backups/startdrv.exe
	

Disinfection failed

C:\SDFix\backups\backups.zip=>backups/startdrv.exe
	

Deleted

C:\SDFix\backups\backups.zip
	

Updated

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP1\A0002016.exe
	

Infected with: Trojan.Kobcka.L

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP1\A0002016.exe
	

Disinfection failed

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP1\A0002016.exe
	

Deleted

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP1\A0005094.exe
	

Infected with: Trojan.Kobcka.L

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP1\A0005094.exe
	

Disinfection failed

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP1\A0005094.exe
	

Deleted

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP1\A0007213.exe
	

Infected with: Trojan.Kobcka.L

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP1\A0007213.exe
	

Disinfection failed

C:\System Volume Information\_restore{6C8E7B52-D81C-4AFE-8CB4-40363E703700}\RP1\A0007213.exe
	

Deleted
	


Hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 21:24:06, on 27/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
c:\program files\fichiers communs\aol\1157577326\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
c:\program files\fichiers communs\aol\1157577326\ee\aolsoftware.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Neuf\Media Center\MediaCenter.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\AOL Compagnon\companion.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.fr/8SEFRFR030000TBR/InstallSuccess
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 2.0esources\fr-FR\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2ce861a41e324489ac465c2b9d28c6a7
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2ce861a41e324489ac465c2b9d28c6a7
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


voilà donc tout est revenu à la normal !

Et merci pour tes conseils avisés !!

Lyonnais92 · Answer

Re,

relance OTMoveIt, clique sur le bouton cleanup et redémarre l'ordi.

Il faut régler cette histoire de deux anti virus, sinon tu vas te réinfecter car moins bien protégée qu'avec un seul.

En plus, le parefeu de Norton Symantec, c'est pas terrible.

Dis moi ce que tu veux conserver.

@+

yuki · Answer

Bonsoir, 

le pare-feu de sYmantec à été désactivé et désintallé avant que j'ai ces virus.

Entre Avast et Avg, je garde Avast ( donc je désintalle avg sur le champ ! )
et Spybot ( sur la barre des taches ) je le garde ??
et Avg-anti-spyware ( sur la barre des taches ) je peux le garder ???

Lyonnais92 · Answer

Bonsoir,

tu gardes Spybot et AVG AS. Mais tu n'en garde qu'un en protection résidente. Soit le tea-timer de Spybot, soit le bouclier résident de AVG .Tu choisis. Actuellement les 2 sont activés.

En fait, seul Spybot offre une protection résidente gratuite.

Le parefeu de Symantec est activé.

fais les maneuvres et remets un log Hijackthis.

@+

yuki · Answer

Bonjour, 
j'ai supprimé liveupdate ( Symantec ).

yuki · Answer

Bonjour, 
Pour avg-as je désinstalle ou je fait ' arrêter la protection résidente " ?
apparemment au redemarrage la protection résidente que j'ai arrêter est maintenu. ( pour avg )

Lyonnais92 · Answer

Bonjour,

pour la protection résidente de AVG, tu l'actives et le désactives dans Bouclier résident.

Si tu as une version payante de AVG AS, tu gardes la protection résidente de AVG et tu arrêtes le tea-timer d Spybot.

Si tu as une version gratuite, la fonction Bouclier fonctionne durant la période d"'essai seulement. Donc pas la peine de l'activer (à mon avis), tu préfères le tea-timer de Spybot.

Pas 2 car cela (je criois), ralentit ton ordi sans rajouter grand chose à la protection.

Tu remets un log Hijackthis (la désinstallation de Norton peut être une vraie galère).

@+

Yuki · Answer

Bonsoir, voici le rapport :

Logfile of HijackThis v1.99.1
Scan saved at 00:28:26, on 30/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Neuf\Media Center\MediaCenter.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\fichiers communs\aol\1157577326\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
c:\program files\fichiers communs\aol\1157577326\ee\aolsoftware.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\AOL Compagnon\companion.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.fr/8SEFRFR030000TBR/InstallSuccess
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: jeanmarcmorandini Toolbar - {58b525f4-b7d7-4600-86f4-46d30a9cc183} - C:\Program Files\jeanmarcmorandini	bjean.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1157577326\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 2.0esources\fr-FR\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2ce861a41e324489ac465c2b9d28c6a7
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2ce861a41e324489ac465c2b9d28c6a7
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

@+

Lyonnais92 · Answer

Bonsoir,

désinstalle le pack sécurité de F-secure et reposte un log Hijackthis.

@+

HELMUTH · Answer

Salut vous me faites tourner la tete avec tous vos rapports. laisse tomber tout ca ,lis et procedes si tu desires ne plus etre embete avec touces trojan vers spyware virus etc....
desinstales ton antivirus et telecharge kaspersky en version d'evaluation ca reglera tous tes problemes  une fois netoyee tu peux remettre n'importe quel antivirus gratuit ( au fait j'ai entendu dire que depuis 3mois avast 4.7 laisse tous passer; version gratuite j'entends
pour simplement faire basculer ses utilisateurs sur sa vesion payante, la pro alors!!!!)
pour info j'ai essayer trojan guarder  VERSION D'EVALUATION  GRATUITE  qui m'as bien aider et maintenant je tourne avec kasper payant evidement  mais dans la vie rien ne se donne                https://www.cnetfrance.fr/telecharger/trojan-guarder-gold-39193501s.htm
                                                                                       https://www.kaspersky.fr/downloads?chapter=186498691
salut! et bon courage

Virus ( cheval de troi ) récurrant !

63 réponses

Votre réponse

Discussions similaires

Newsletters