Cheval de troie Résolu

Question

Bonjour a tous je retente ma chance car j'ai postéun message il y a quelque jour qui semble t il est passé a la trappe..
j'ai un cheval de troie sur mon ordi qui est en train de se repandre partout en gros l'ordi est ralenti et des pub intempestive apparaissent sans cesse  je viens de changer d'antivirus suite a  une recommandation sur un forum j'ai donc installé antivir ( avant j'avasi avast) je vous poste le rapport aprezs analyse d'antivir... j'espereque qqn pourra m'aider car je viens d'aller rue montgallet et on me demande 60 euro pour reformatter l'ordi d'apres eux c est la seule chose a faire contre un cheval de trois... merci de votre aide


AntiVir PersonalEdition Classic 
Report file date: 2007-11-03  13:15 
 
Scanning for 1036370 virus strains and unwanted programs. 
 
Licensed to:      Avira AntiVir PersonalEdition Classic 
Serial number:    0000149996-ADJIE-0001 
Platform:         Windows XP 
Windows version:  (Service Pack 2)  [5.1.2600] 
Username:         SYSTEM 
Computer name:    BEGNY-GA1A4CHG2 
 
Version information: 
BUILD.DAT    : 269           15604 Bytes  2007-09-10 14:31:00 
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  2007-08-23 13:16:29 
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  2007-08-16 12:23:51 
LUKE.DLL     : 7.0.5.3      147496 Bytes  2007-08-14 15:32:47 
LUKERES.DLL  : 7.0.6.1       10280 Bytes  2007-08-21 12:35:20 
ANTIVIR0.VDF : 6.35.0.1    7371264 Bytes  2006-05-31 12:32:40 
ANTIVIR1.VDF : 6.39.0.129  7251968 Bytes  2007-07-10 12:32:46 
ANTIVIR2.VDF : 6.39.1.43   1542656 Bytes  2007-08-25 17:21:02 
ANTIVIR3.VDF : 6.39.1.51     29696 Bytes  2007-08-28 07:22:36 
AVEWIN32.DLL : 7.6.0.5     2789888 Bytes  2007-08-29 17:09:10 
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  2007-02-26 10:36:26 
AVPREF.DLL   : 7.0.2.2       25640 Bytes  2007-07-18 07:39:17 
AVREP.DLL    : 7.0.0.1      155688 Bytes  2007-04-16 13:16:24 
AVPACK32.DLL : 7.3.0.15     360488 Bytes  2007-08-03 08:46:00 
AVREG.DLL    : 7.0.1.6       30760 Bytes  2007-07-18 07:17:06 
AVARKT.DLL   : 1.0.0.20     278568 Bytes  2007-08-28 12:26:33 
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  2007-07-18 07:10:18 
NETNT.DLL    : 7.0.0.0        7720 Bytes  2007-03-08 11:09:42 
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  2007-08-07 12:38:13 
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  2007-08-21 12:50:37 
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  2007-07-23 09:37:21 
 
Configuration settings for the scan: 
Jobname..........................: Complete system scan 
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp 
Logging..........................: low 
Primary action...................: interactive 
Secondary action.................: ignore 
Scan master boot sector..........: off 
Scan boot sector.................: on 
Boot sectors.....................: C:,  
Scan memory......................: on 
Process scan.....................: on 
Scan registry....................: on 
Search for rootkits..............: off 
Scan all files...................: Intelligent file selection 
Scan archives....................: on 
Recursion depth..................: 20 
Smart extensions.................: on 
Macro heuristic..................: on 
File heuristic...................: medium 
 
Start of the scan: 2007-11-03  13:15 
 
The scan of running processes will be started 
Scan process 'avscan.exe' - '1' Module(s) have been scanned 
Scan process 'avcenter.exe' - '1' Module(s) have been scanned 
Scan process 'avcenter.exe' - '1' Module(s) have been scanned 
Scan process 'guardgui.exe' - '1' Module(s) have been scanned 
Scan process 'guardgui.exe' - '1' Module(s) have been scanned 
Scan process 'guardgui.exe' - '1' Module(s) have been scanned 
Scan process 'guardgui.exe' - '1' Module(s) have been scanned 
Scan process 'guardgui.exe' - '1' Module(s) have been scanned 
Scan process 'guardgui.exe' - '1' Module(s) have been scanned 
Scan process 'guardgui.exe' - '1' Module(s) have been scanned 
Scan process 'guardgui.exe' - '1' Module(s) have been scanned 
Scan process 'guardgui.exe' - '1' Module(s) have been scanned 
Scan process 'guardgui.exe' - '1' Module(s) have been scanned 
Scan process 'guardgui.exe' - '1' Module(s) have been scanned 
Scan process 'avnotify.exe' - '1' Module(s) have been scanned 
Scan process 'guardgui.exe' - '1' Module(s) have been scanned 
Scan process 'avgnt.exe' - '1' Module(s) have been scanned 
Scan process 'avguard.exe' - '1' Module(s) have been scanned 
Scan process 'sched.exe' - '1' Module(s) have been scanned 
Scan process 'iexplore.exe' - '1' Module(s) have been scanned 
Scan process 'svchost.exe' - '1' Module(s) have been scanned 
Scan process 'ATKOSD.exe' - '1' Module(s) have been scanned 
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned 
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned 
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned 
Scan process 'svchost.exe' - '1' Module(s) have been scanned 
Scan process 'jusched.exe' - '1' Module(s) have been scanned 
Scan process 'sm56hlpr.exe' - '1' Module(s) have been scanned 
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned 
Scan process 'HControl.exe' - '1' Module(s) have been scanned 
Scan process 'alg.exe' - '1' Module(s) have been scanned 
Scan process 'Tablet.exe' - '1' Module(s) have been scanned 
Scan process 'TabUserW.exe' - '1' Module(s) have been scanned 
Scan process 'explorer.exe' - '1' Module(s) have been scanned 
Scan process 'Tablet.exe' - '1' Module(s) have been scanned 
Scan process 'StkCSrv.exe' - '1' Module(s) have been scanned 
Scan process 'svchost.exe' - '1' Module(s) have been scanned 
Scan process 'NMSAccessU.exe' - '1' Module(s) have been scanned 
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned 
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned 
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned 
Scan process 'svchost.exe' - '1' Module(s) have been scanned 
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned 
Scan process 'svchost.exe' - '1' Module(s) have been scanned 
Scan process 'svchost.exe' - '1' Module(s) have been scanned 
Scan process 'svchost.exe' - '1' Module(s) have been scanned 
Scan process 'svchost.exe' - '1' Module(s) have been scanned 
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned 
Scan process 'lsass.exe' - '1' Module(s) have been scanned 
Scan process 'services.exe' - '1' Module(s) have been scanned 
Scan process 'winlogon.exe' - '1' Module(s) have been scanned 
Scan process 'csrss.exe' - '1' Module(s) have been scanned 
Scan process 'smss.exe' - '1' Module(s) have been scanned 
53 processes with 53 modules were scanned 
 
Start scanning boot sectors: 
Boot sector 'C:\' 
      [NOTE]      No virus was found! 
 
Starting to scan the registry. 
The registry was scanned ( '24' files ). 
 
 
Starting the file scan: 
 
Begin scan in 'C:\' 
C:\pagefile.sys 
      [WARNING]   The file could not be opened! 
C:\Documents and Settings\BEGNY\Local Settings\Temporary Internet Files\Content.IE5\2EDF7FFG\17PHolmes[1].cmt 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '477c6725.qua'! 
C:\Documents and Settings\BEGNY\Local Settings\Temporary Internet Files\Content.IE5\5TVFVLU4\mosx1024[1] 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '479f6776.qua'! 
C:\Documents and Settings\BEGNY\Local Settings\Temporary Internet Files\Content.IE5\Y2E0NSE5\isearch[1].htm 
      [DETECTION] Contains suspicious code HEUR/Exploit.HTML 
      [INFO]      The file was moved to '4791678c.qua'! 
C:\qoobox\Quarantine\C\Program Files\Fichiers communs\Yazzle1560OinAdmin.exe.vir 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '47a66e4f.qua'! 
C:\qoobox\Quarantine\C\WINDOWS\system32\cucpfbcc.dll.vir 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '478f6e63.qua'! 
C:\qoobox\Quarantine\C\WINDOWS\system32slxxpph.dll.vir 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '47986e62.qua'! 
C:\qoobox\Quarantine\C\WINDOWS\system32\uaqifxbv.dll.vir 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '479d6e50.qua'! 
C:\qoobox\Quarantine\C\WINDOWS\system32\__c00198CA.dat.vir 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '478f6e4e.qua'! 
C:\qoobox\Quarantine\C\WINDOWS\system32\u4\c124wvr.exe.vir 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '475e6e21.qua'! 
C:\qoobox\Quarantine\C\WINDOWS\system32\u4\wr31drs.exe.vir 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '475f6e62.qua'! 
C:\RECYCLER\S-1-5-21-484763869-884357618-725345543-1003\Dc78.zip 
  [0] Archive type: ZIP 
  --> __c001EC51.dat 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '47636e63.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP19\A0006877.exe 
      [DETECTION] Is the Trojan horse TR/Agent.RIR.135 
      [INFO]      The file was moved to '475c6e48.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP29\A0008577.dll 
      [DETECTION] Contains detection pattern of the dropper DR/Agent.141853.A 
      [INFO]      The file was moved to '475c6e89.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP60\A0013533.exe 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '475c6f0a.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP61\A0014704.exe 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '475c6f0e.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP61\A0014707.exe 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '46c12e57.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP62\A0014854.exe 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '475c6f11.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP62\A0014861.dll 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '475c6f12.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP62\A0014863.dll 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '46c12e4b.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP62\A0014865.dll 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '475c6f14.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP62\A0014871.exe 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '475c6f13.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP62\A0014872.exe 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '46c12e4c.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP62\A0014930.exe 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '46c12e4d.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP62\A0014931.exe 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '475c6f15.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP63\A0014989.exe 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '475c6f18.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP64\A0015109.dll 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '475c6f1b.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP64\A0015220.dll 
      [DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738 
      [INFO]      The file was moved to '475c6f1e.qua'! 
C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP65\A0015446.dll 
      [DETECTION] Is the Trojan horse TR/Trash.Gen 
      [INFO]      The file was moved to '475c6f23.qua'! 
C:\WINDOWS\mrofinu1000106.exe 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '479b6f77.qua'! 
C:\WINDOWS\mrofinu1000106.exe.tmp 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '46005930.qua'! 
C:\WINDOWS\mrofinu1188.exe 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '479b6f79.qua'! 
C:\WINDOWS\mrofinu1188.exe.tmp 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '479b6f78.qua'! 
C:\WINDOWS\system32\lejygeds.dll 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '479671b9.qua'! 
C:\WINDOWS\system32
kiupqwt.dll 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [INFO]      The file was moved to '479571ca.qua'! 
C:\WINDOWS\system32\spudscv.exe 
      [DETECTION] Is the Trojan horse TR/Spy.Banker.Gen 
      [INFO]      The file was moved to '47a171d9.qua'! 
C:\WINDOWS\system32\__c009ADE2.dat 
      [DETECTION] Contains suspicious code HEUR/Malware 
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003 
      [WARNING]   The file could not be deleted! 
C:\WINDOWS\system32\b3arndrll2.exe 
      [DETECTION] Is the Trojan horse TR/Dldr.Small.buy.1 
      [INFO]      The file was moved to '479e72ab.qua'! 
C:\WINDOWS\system32\u4\wr31drs.exe 
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen 
      [INFO]      The file was moved to '475f7308.qua'! 
 
 
End of the scan: 2007-11-03  14:07 
Used time: 52:21 min 
 
The scan has been done completely. 
 
   6463 Scanning directories 
 397755 Files were scanned 
     22 viruses and/or unwanted programs were found 
     16 Files were classified as suspicious: 
      0 files were deleted 
      0 files were repaired 
     37 files were moved to quarantine 
      0 files were renamed 
      1 Files cannot be scanned 
 397733 Files not concerned 
   6422 Archives were scanned 
      2 Warnings 
     50 Notes

FillPCA · Answer

Bonjour,

On va te faire ça pour 0 €.
As-tu le rapport Combofix, vu qu'il a déjà été utilisé ? Il me faut aussi un rapport Hijackthis.

Quel genre de pubs subis-tu ?

FillPCA

Kevindu36 · Answer

bonjour

Fait un scan avec Bitdefender Online
https://www.bitdefender.com/toolbox/
Désactive ton antivirus pendant le scan
Puis poste le rapport génerré

++

Yoan · Answer

Ici a été posté un log hijackthis concernant le problème de dede4240.

dede4240 · Answer

ca c'est le rapport combofix... le log hijackthis date de deux jours je crois (peut etre trois) j'ai pas ma l bidouillé d'apres ce que j'ai lu su rles forum depuis .. donc les info ne sont peut etre plus valable ... j'en reposte un de suite ... merci a tous ... ComboFix 07-11-01.1 - BEGNY 2007-11-03 14:47:36.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1373 [GMT 1:00] Running from: C:\Downloads\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\BEGNY\Favoris\Online Security Guide.lnk C:\Program Files\Temporary C:\Program Files\Temporary\wininstall.exe C:\Program Files\WinAble C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\WINDOWS\b122.exe C:\WINDOWS\system32\b3 C:\WINDOWS\system32\bccdd.bak2 C:\WINDOWS\system32\bccdd.ini C:\WINDOWS\system32\bccdd.ini2 C:\WINDOWS\system32\bccdd.tmp C:\WINDOWS\system32\ddccb.dll C:\WINDOWS\system32\e1 C:\WINDOWS\system32\e1\caws83122.exe C:\WINDOWS\system32\giysaxlm.dllbox C:\WINDOWS\system32\jkkll.dll C:\WINDOWS\system32\llkkj.bak1 C:\WINDOWS\system32\llkkj.ini C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\u4 . ((((((((((((((((((((((((((((( Fichiers créés 2007-10-03 to 2007-11-03 )))))))))))))))))))))))))))))))))))) . 2007-11-03 13:06 d-------- C:\Program Files\Avira 2007-11-03 13:06 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-11-03 10:50 87,616 --a------ C:\WINDOWS\system32\xsphsxvb.dll 2007-11-03 10:50 81,472 --a------ C:\WINDOWS\system32\xvfjpwqx.dll 2007-11-03 10:32 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-03 10:13 d-------- C:\Program Files\Panda Security 2007-11-03 10:08 d---s---- C:\WINDOWS\Downloaded Program Files 2007-11-03 01:07 35,328 --a------ C:\WINDOWS\system32 qrollm.dll 2007-11-02 19:10 d-------- C:\Documents and Settings\BEGNY\Application Data\WTablet 2007-11-02 19:03 82,496 --a------ C:\WINDOWS\system32\ehotopxw.dll 2007-11-02 19:02 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-02 18:57 d-------- C:\Program Files\Navilog1 2007-11-02 18:39 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2007-11-02 18:39 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll 2007-11-02 18:39 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2007-11-02 18:39 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys 2007-11-02 18:39 11,440 --a------ C:\WINDOWS\system32\drivers\WacomVKHid.sys 2007-11-02 18:27 d-------- C:\WINDOWS\system32\WTablet 2007-11-02 18:27 d-------- C:\Program Files\Tablet 2007-11-02 18:27 1,197,616 --a------ C:\WINDOWS\system32\Tablet.exe 2007-11-02 18:27 124,464 --------- C:\WINDOWS\system32\Wintab32.dll 2007-11-02 18:27 12,848 --a------ C:\WINDOWS\system32\drivers\wacomvhid.sys 2007-11-02 18:27 11,312 --a------ C:\WINDOWS\system32\drivers\wacommousefilter.sys 2007-11-02 09:46 d-------- C:\Temp\mZOr 2007-11-02 09:46 32,256 --a------ C:\WINDOWS\system32\yayyyax.dll 2007-11-01 18:17 d-------- C:\Program Files\Trend Micro 2007-11-01 11:52 28,672 --a------ C:\Documents and Settings\BEGNY\iexplorer.exe 2007-11-01 11:47 d-------- C:\WINDOWS\system32\bfubackups 2007-11-01 10:35 32,256 --a------ C:\WINDOWS\system32\urqqppp.dll 2007-10-31 18:44 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-10-31 17:21 569,344 --a------ C:\WINDOWS\system32\spudsc.exe 2007-10-31 17:21 153,600 --a------ C:\WINDOWS\system32\svchost1.exe 2007-10-31 17:21 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll 2007-10-31 17:18 32,256 --a------ C:\WINDOWS\system32\ssqqonn.dll 2007-10-31 17:17 d-------- C:\WINDOWS\system32\Mz18r 2007-10-31 17:17 d-------- C:\Temp 2007-10-31 16:01 d-------- C:\Program Files\TimeAdjuster 2007-10-29 16:21 1,156 --a------ C:\WINDOWS\mozver.dat 2007-10-29 16:18 0 --a------ C:\WINDOWS sreg.dat 2007-10-25 14:24 d-------- C:\WINDOWS\Sun 2007-10-12 23:35 d-------- C:\Program Files\Ripp-it_AM 2007-10-12 22:34 d-------- C:\Program Files\AviSynth 2.5 2007-10-10 13:59 584,192 -----c--- C:\WINDOWS\system32\dllcache pcrt4.dll 2007-10-04 14:55 163,840 --a------ C:\WINDOWS\BJPSUNST.EXE 2007-10-04 14:53 d-------- C:\WINDOWS\StartHtmico 2007-10-04 14:52 d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ 2007-10-04 14:52 140,288 --a------ C:\WINDOWS\system32\CNMLM78.DLL 2007-10-04 14:52 90,112 -ra------ C:\WINDOWS\system32\CNMCP78.exe 2007-10-04 14:52 8,704 --a------ C:\WINDOWS\system32\CNMVS78.DLL 2007-10-04 14:50 d-------- C:\Program Files\Canon 2007-10-04 14:43 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-10-04 14:43 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-10-04 14:06 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2007-10-04 14:04 d-------- C:\WINDOWS\SHELLNEW 2007-10-04 14:02 d-------- C:\Program Files\Microsoft.NET 2007-10-04 14:00 dr-h----- C:\MSOCache 2007-10-04 12:40 d-------- C:\Downloads 2007-10-04 12:40 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-10-04 12:37 d-------- C:\Program Files\BitComet 2007-10-03 19:40 d-------- C:\Program Files\Azureus 2007-10-03 19:40 d-------- C:\Documents and Settings\BEGNY\Application Data\Azureus . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-03 13:21 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\LimeWire 2007-11-02 16:25 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\Skype 2007-10-31 16:21 278,542 ----a-w C:\WINDOWS\Fonts\Setup.exe 2007-10-31 16:16 278,541 --sha-w C:\WINDOWS\Fonts\svchost.exe 2007-10-24 13:12 --------- d-----w C:\Program Files\Java 2007-10-17 16:39 --------- d-----w C:\Program Files\Winamp 2007-10-04 16:28 359,808 ----a-w C:\WINDOWS\system32\drivers cpip.sys 2007-10-01 09:32 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2007-09-28 17:55 --------- d-----w C:\Program Files\CDBurnerXP 2007-09-25 22:06 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\vlc 2007-09-25 10:38 --------- d-----w C:\Program Files\Audacity 2007-09-24 12:47 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\Apple Computer 2007-09-24 02:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier 2007-09-24 02:36 --------- d-----w C:\Program Files\Microsoft SQL Server 2007-09-24 01:36 --------- d-----w C:\Program Files\Adssite Advanced Toolbar 2007-09-23 19:41 --------- d-----w C:\Program Files\Google 2007-09-22 11:27 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-09-22 10:17 --------- d-----w C:\Program Files\Eltima Software 2007-09-21 21:12 --------- d-----w C:\Program Files\Fichiers communs\Macromedia 2007-09-21 21:11 --------- d-----w C:\Program Files\Macromedia 2007-09-21 21:10 --------- d-----w C:\Program Files\Fichiers communs\InstallShield 2007-09-21 10:00 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\Adssite Advanced Toolbar 2007-09-21 09:25 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-09-21 01:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems 2007-09-21 01:13 --------- d-----w C:\Program Files\Fichiers communs\Adobe Systems Shared 2007-09-20 23:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\IsolatedStorage 2007-09-20 21:28 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\MSN6 2007-09-20 21:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6 2007-09-20 21:21 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2007-09-20 21:21 --------- d-----w C:\Program Files\Fichiers communs\Teleca Shared 2007-09-20 21:21 --------- d-----w C:\Program Files\FairUse Wizard 2007-09-20 21:21 --------- d-----w C:\Program Files\Error Safe Free 2007-09-20 21:21 --------- d-----w C:\Program Files\eRightSoft 2007-09-20 21:21 --------- d-----w C:\Program Files\EPSON 2007-09-20 21:20 --------- d-----w C:\Program Files\eMule 2007-09-20 21:18 --------- d-----w C:\Program Files\CyberLink 2007-09-20 21:18 --------- d-----w C:\Program Files\Creative 2007-09-20 21:18 --------- d-----w C:\Program Files\Common~1 2007-09-20 21:18 --------- d-----w C:\Program Files\CoffeeCup Software 2007-09-20 21:18 --------- d-----w C:\Program Files\BSplayer_WhenUSave_Installer 2007-09-20 21:17 --------- d-----w C:\Program Files\Apple Software Update 2007-09-20 21:17 --------- d-----w C:\Program Files\Alwil Software 2007-09-20 21:17 --------- d-----w C:\Program Files\Ahead 2007-09-20 21:07 --------- d-----w C:\Program Files\1&1 2007-09-20 21:06 --------- d-----w C:\Program Files\XviD codec (Neodivx Version) 2007-09-20 21:06 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-09-20 21:06 --------- d-----w C:\Program Files\Windows Live 2007-09-20 21:05 --------- d-----w C:\Program Files\WinASPI 2007-09-20 21:04 --------- d-----w C:\Program Files\Webteh 2007-09-20 21:04 --------- d-----w C:\Program Files\VSO 2007-09-20 21:04 --------- d-----w C:\Program Files\VOB 2007-09-20 21:04 --------- d-----w C:\Program Files\VISoftware 2007-09-20 21:04 --------- d-----w C:\Program Files\Visicom Media 2007-09-20 21:04 --------- d-----w C:\Program Files\VideoLAN 2007-09-20 21:04 --------- d-----w C:\Program Files\URUSoft 2007-09-20 21:04 --------- d-----w C:\Program Files\Uniblue 2007-09-20 21:04 --------- d-----w C:\Program Files\Ubisoft 2007-09-20 21:04 --------- d-----w C:\Program Files\Thugs at Bay 2007-09-20 21:04 --------- d-----w C:\Program Files\Symantec 2007-09-20 21:04 --------- d-----w C:\Program Files\STK014 2007-09-20 21:04 --------- d-----w C:\Program Files\StarV9 2007-09-20 21:03 --------- d-----w C:\Program Files\Sony Ericsson 2007-09-20 21:03 --------- d-----w C:\Program Files\Skype 2007-09-20 21:03 --------- d-----w C:\Program Files\RADVideo 2007-09-20 21:03 --------- d-----w C:\Program Files\QuickTime Alternative 2007-09-20 21:03 --------- d-----w C:\Program Files\plugins 2007-09-20 21:03 --------- d-----w C:\Program Files\NETGEAR 2007-09-20 20:21 --------- d-----w C:\Program Files\Fichiers communs\LightScribe 2007-09-20 20:21 --------- d-----w C:\Program Files\Fichiers communs\Ahead 2007-09-20 20:20 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\Ahead 2007-09-20 20:18 --------- d-----w C:\Program Files\Nero 2007-09-20 20:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero 2007-09-20 20:16 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines 2007-09-20 20:16 --------- d-----w C:\Program Files\Fichiers communs\ODBC 2007-09-20 20:12 --------- d-----w C:\Program Files\Motorola 2007-09-20 20:09 --------- d-----w C:\Program Files\Realtek 2007-09-20 19:51 315,392 ----a-w C:\WINDOWS\HideWin.exe 2007-09-20 19:23 --------- d-----w C:\Program Files\microsoft frontpage 2007-09-20 19:21 --------- d-----w C:\Program Files\Fichiers communs\MSSoap 2007-09-20 19:20 --------- d-----w C:\Program Files\Services en ligne 2007-09-20 18:37 --------- d-----w C:\Program Files\MSN Messenger 2007-09-20 18:21 --------- d-----w C:\Program Files\Fichiers communs\Java 2007-09-20 18:03 --------- d-----w C:\Program Files\QuickTime 2007-09-20 18:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-09-20 18:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2007-09-20 16:28 --------- d-----w C:\Program Files\MyXOFT 2007-09-20 16:28 --------- d-----w C:\Program Files\Multimedia Mouse Driver 2007-09-20 16:28 --------- d-----w C:\Program Files\MSXML 4.0 2007-09-20 16:27 --------- d-----w C:\Program Files\MSI 2007-09-20 16:27 --------- d-----w C:\Program Files\Microsoft Games 2007-09-20 16:26 --------- d-----w C:\Program Files\Maïdo Production 2007-09-20 16:25 --------- d-----w C:\Program Files\Lauyan 2007-09-20 16:25 --------- d-----w C:\Program Files\key 2007-09-20 16:25 --------- d-----w C:\Program Files\Jasc Software Inc 2007-09-20 16:24 --------- d-----w C:\Program Files\InterVideo 2007-09-20 16:24 --------- d-----w C:\Program Files\InterActual 2007-09-20 16:24 --------- d-----w C:\Program Files\Infogrames 2007-09-19 20:01 9,715,200 ----a-w C:\WINDOWS\RTLCPL.exe 2007-09-19 20:01 86,016 ----a-w C:\WINDOWS\SoundMan.exe 2007-09-19 20:01 69,632 ----a-w C:\WINDOWS\Alcmtr.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{67A0AFC4-E872-4DB3-8770-FA65BD4F61D6}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AC619BCA-2BF3-4D49-B815-91BC5ACEB12A}] C:\Program Files\Lauyan ipysavC:\WINDOWS\system32\e1\caws83122.exe.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C6ED5DA7-9ECD-4808-8947-B0E81FFE4941}] C:\WINDOWS\system32\jkhhi.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DAB04895-840B-40C8-A787-CF56360009E9}] C:\Program Files\key ipysavC:\WINDOWS\system32\e1\caws83122.exe.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E6980035-9529-4F1F-BC04-1B846166C7A9}] C:\Program Files\key ipysavC:\WINDOWS\system32\e1\caws83122.exe.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-10-14 16:37] "RTHDCPL"="RTHDCPL.EXE" [2007-09-19 21:01 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2007-09-19 21:01 C:\WINDOWS\SkyTel.exe] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-10-09 20:43] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-26 11:12] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06] "Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10] "Host Process"="C:\WINDOWS\Fonts\svchost.exe" [2007-10-31 17:16] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-03 14:21] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-16 22:09] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-05-17 12:11] "BitComet"="C:\Program Files\BitComet\BitComet.exe" [2007-09-10 13:33] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\giysaxlm] giysaxlm.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\ddccb.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;C:\WINDOWS\System32\StkCSrv.exe R3 ASNDIS5;ASNDIS5 Protocol Driver;\??\C:\WINDOWS\ATK0100\ASNDIS5.SYS R3 RTSTOR;USB Mass Stroage Device;C:\WINDOWS\system32\drivers\RTSTOR.SYS R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;C:\WINDOWS\system32\Drivers\StkCMini.sys R3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys R3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys R3 WacomVKHid;Virtual Keyboard Driver;C:\WINDOWS\system32\DRIVERS\WacomVKHid.sys S3 AtcL002;NDIS Miniport Driver for Attansic L2 Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\atl02_xp.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57df1a99-77eb-11dc-b9f3-0015af38a7f9}] \Shell\Auto\command - bittorrent.exe e \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bittorrent.exe e . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-03 14:52:24 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-03 14:53:49 - machine was rebooted . --- E O F ---

FillPCA · Answer

Re,

OK. On continue tout ici alors. Rapports :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:18:36, on 02/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\Fonts\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\mrofinu1000106.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Insider\Insider.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\StkCSrv.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [Windows32] C:\Arquivos de programas\services.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [787e34f4] rundll32.exe "C:\WINDOWS\system32\spfnrmss.dll",b
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1000106.exe 61A847B5BBF72813329B385772FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B8B7581F-45BC-462C-8D2B-15CB7C159F03}: NameServer = 213.36.80.1
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00198CA.dat
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkCSrv.exe
End of file - 7742 bytes

RAPPORT D AVG:
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 15:41:12 01/11/2007

+ Résultat de l'analyse:



HKLM\SOFTWARE\Classes\WR -> Adware.Generic : Nettoyé.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runner1 -> Adware.Generic : Nettoyé.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo -> Adware.Generic : Nettoyé.
C:\Documents and Settings\BEGNY\Local Settings\Temporary Internet Files\Content.IE5\IENCLOHL\8154ff2675af1b6e0677560871425153[1].zip/b138.exe -> Downloader.Agent.cbx : Nettoyé.
:mozilla.22:C:\Documents and Settings\BEGNY\Application Data\Mozilla\Firefox\Profiles\yqp3on1h.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.24:C:\Documents and Settings\BEGNY\Application Data\Mozilla\Firefox\Profiles\yqp3on1h.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\BEGNY\Cookies\begny@advertising[2].txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.26:C:\Documents and Settings\BEGNY\Application Data\Mozilla\Firefox\Profiles\yqp3on1h.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\BEGNY\Cookies\begny@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\BEGNY\Cookies\begny@overture[1].txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.10:C:\Documents and Settings\BEGNY\Application Data\Mozilla\Firefox\Profiles\yqp3on1h.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.12:C:\Documents and Settings\BEGNY\Application Data\Mozilla\Firefox\Profiles\yqp3on1h.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.13:C:\Documents and Settings\BEGNY\Application Data\Mozilla\Firefox\Profiles\yqp3on1h.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.14:C:\Documents and Settings\BEGNY\Application Data\Mozilla\Firefox\Profiles\yqp3on1h.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.7:C:\Documents and Settings\BEGNY\Application Data\Mozilla\Firefox\Profiles\yqp3on1h.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.8:C:\Documents and Settings\BEGNY\Application Data\Mozilla\Firefox\Profiles\yqp3on1h.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\BEGNY\Cookies\begny@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyé. 

FillPCA

Kevindu36 · Answer

bonjour

Fait un scan avec Bitdefender Online
https://www.bitdefender.com/toolbox/
Désactive ton antivirus pendant le scan
Puis poste le rapport génerré

++

FillPCA · Answer

Re,

1/     *  Télécharge Vundofix  (par Atribune) sur ton Bureau : http://www.atribune.org/ccount/click.php?id=4
    * Double-clique VundoFix.exe afin de le lancer.
    * Clique sur le bouton Scan for Vundo.
    * Lorsque le scan est complété, clique sur le bouton Remove Vundo (uniquement si des fichiers infectieux sont trouvés).
    * Une invite te demandera si tu veux supprimer les fichiers, clique YES.
    * Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
    * Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK.
    * Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

2/     *  Télécharger smitfraudfix (de S!Ri) sur le bureau : http://siri.urz.free.fr/Fix/SmitfraudFix.exe
    * Clique sur smitfraudfix.exe
    * Choisis l'option 1 et colle dans ta réponse le rapport généré par smitfraudfix. Ce rapport se trouve dans la fenêtre du bloc-note qui s’ouvre.
    * Ferme l'application en tapant sur la touche Q.

3/ Edite les deux rapports précédents et un nouveau rapport Hijackthis.

FillPCA

dede4240 · Answer

le nouveau rapport hijackthis....


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:00:34, on 03/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\StkCSrv.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Fonts\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\system32undll32.exe
C:\Documents and Settings\BEGNY\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B8B7581F-45BC-462C-8D2B-15CB7C159F03}: NameServer = 213.36.80.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkCSrv.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

FillPCA · Answer

Hello Kevindu36,

Un scan en ligne sera inefficace ici.

FillPCA

FillPCA · Answer

Re,

Ok. Peux-tu faire ceci ? http://www.commentcamarche.net/forum/affich 3942183 cheval de troie#7

FillPCA

Kevindu36 · Answer

Salut

je sais mais c'était pour voir si il y avait d'autre infection !!!

++

FillPCA · Answer

Re,

Il y en a d'autres. Vundo, d'après le rapports combofix et ceci :
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe 

FillPCA

dede4240 · Answer

rapport vundo
le hijackthis plante maintenant... j'ai peut etre telechargé trop de truc de protection ??
VundoFix V6.5.11

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 15:07:19 03/11/2007

Listing files found while scanning....

No infected files were found.

dede4240 · Answer

LE RAPPORT SmitFraudFix v2.246 MERCI ;)

Rapport fait à 15:15:10,65, 03/11/2007
Executé à partir de C:\Downloads\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\StkCSrv.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Fonts\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\BEGNY


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\BEGNY\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\BEGNY\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="sockspy.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Atheros AR5006EG Wireless Network Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 213.36.80.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B8B7581F-45BC-462C-8D2B-15CB7C159F03}: NameServer=213.36.80.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B8B7581F-45BC-462C-8D2B-15CB7C159F03}: NameServer=213.36.80.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B8B7581F-45BC-462C-8D2B-15CB7C159F03}: NameServer=213.36.80.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

FillPCA · Answer

Re,


1/ # Double clique combofix.exe et suis les invites.
# Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

2/     *  Télécharge PCA (d'Evosla) : http://ww25.evosla.com/pca_cpt.php?agr=pca_securite
    * Dézippe-le dans un répertoire dédié comme c:\PCA au moyen d'un clic droit (Extraire...),
    * Clique sur l'onglet  "diagnostic du PC" puis "analyser".
    * Laisse l'analyse se dérouler. Cela ne prend que quelques secondes.
    * Clique sur "enregistrer le rapport" en bas à droite et sauvegarde-le sur le bureau.
    * Edite le contenu de ce rapport dans ta prochaine réponse. Il se nomme PCA_LOG.txt

Edite les rapports demandés.

FillPCA

dede4240 · Answer

nouveau rapport hijackthis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:21:09, on 03/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\StkCSrv.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\BEGNY\Bureau\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B8B7581F-45BC-462C-8D2B-15CB7C159F03}: NameServer = 213.36.80.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkCSrv.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

dede4240 · Answer

ComboFix 07-11-01.1 - BEGNY 2007-11-03 15:27:01.3 - NTFSx86 Running from: C:\Downloads\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\cdeeg.bak1 C:\WINDOWS\system32\cdeeg.ini C:\WINDOWS\system32\geedc.dll C:\z.exe . ((((((((((((((((((((((((((((( Fichiers créés 2007-10-03 to 2007-11-03 )))))))))))))))))))))))))))))))))))) . 2007-11-03 15:15 2,742 --a------ C:\WINDOWS\system32 mp.reg 2007-11-03 15:14 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-11-03 15:14 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-11-03 15:14 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-11-03 15:14 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-11-03 15:14 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-03 15:08 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2007-11-03 15:07 d-------- C:\VundoFix Backups 2007-11-03 14:55 82 --a------ C: .bat 2007-11-03 14:55 0 --a------ C:\z.dat 2007-11-03 14:54 35,328 --a------ C:\WINDOWS\system32\gebxvww.dll 2007-11-03 13:06 d-------- C:\Program Files\Avira 2007-11-03 13:06 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-11-03 10:50 87,616 --a------ C:\WINDOWS\system32\xsphsxvb.dll 2007-11-03 10:50 81,472 --a------ C:\WINDOWS\system32\xvfjpwqx.dll 2007-11-03 10:32 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-03 10:13 d-------- C:\Program Files\Panda Security 2007-11-03 10:08 d---s---- C:\WINDOWS\Downloaded Program Files 2007-11-03 01:07 35,328 --a------ C:\WINDOWS\system32 qrollm.dll 2007-11-02 19:10 d-------- C:\Documents and Settings\BEGNY\Application Data\WTablet 2007-11-02 19:03 82,496 --a------ C:\WINDOWS\system32\ehotopxw.dll 2007-11-02 19:02 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-02 18:57 d-------- C:\Program Files\Navilog1 2007-11-02 18:39 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2007-11-02 18:39 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll 2007-11-02 18:39 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2007-11-02 18:39 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys 2007-11-02 18:39 11,440 --a------ C:\WINDOWS\system32\drivers\WacomVKHid.sys 2007-11-02 18:27 d-------- C:\WINDOWS\system32\WTablet 2007-11-02 18:27 d-------- C:\Program Files\Tablet 2007-11-02 18:27 1,197,616 --a------ C:\WINDOWS\system32\Tablet.exe 2007-11-02 18:27 124,464 --------- C:\WINDOWS\system32\Wintab32.dll 2007-11-02 18:27 12,848 --a------ C:\WINDOWS\system32\drivers\wacomvhid.sys 2007-11-02 18:27 11,312 --a------ C:\WINDOWS\system32\drivers\wacommousefilter.sys 2007-11-02 09:46 d-------- C:\Temp\mZOr 2007-11-02 09:46 32,256 --a------ C:\WINDOWS\system32\yayyyax.dll 2007-11-01 18:17 d-------- C:\Program Files\Trend Micro 2007-11-01 11:52 28,672 --a------ C:\Documents and Settings\BEGNY\iexplorer.exe 2007-11-01 11:47 d-------- C:\WINDOWS\system32\bfubackups 2007-10-31 18:44 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-10-31 17:21 569,344 --a------ C:\WINDOWS\system32\spudsc.exe 2007-10-31 17:21 153,600 --a------ C:\WINDOWS\system32\svchost1.exe 2007-10-31 17:21 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll 2007-10-31 17:17 d-------- C:\WINDOWS\system32\Mz18r 2007-10-31 17:17 d-------- C:\Temp 2007-10-31 16:01 d-------- C:\Program Files\TimeAdjuster 2007-10-29 16:21 1,156 --a------ C:\WINDOWS\mozver.dat 2007-10-29 16:18 0 --a------ C:\WINDOWS sreg.dat 2007-10-25 14:24 d-------- C:\WINDOWS\Sun 2007-10-12 23:35 d-------- C:\Program Files\Ripp-it_AM 2007-10-12 22:34 d-------- C:\Program Files\AviSynth 2.5 2007-10-10 13:59 584,192 -----c--- C:\WINDOWS\system32\dllcache pcrt4.dll 2007-10-04 14:55 163,840 --a------ C:\WINDOWS\BJPSUNST.EXE 2007-10-04 14:53 d-------- C:\WINDOWS\StartHtmico 2007-10-04 14:52 d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ 2007-10-04 14:52 140,288 --a------ C:\WINDOWS\system32\CNMLM78.DLL 2007-10-04 14:52 90,112 -ra------ C:\WINDOWS\system32\CNMCP78.exe 2007-10-04 14:52 8,704 --a------ C:\WINDOWS\system32\CNMVS78.DLL 2007-10-04 14:50 d-------- C:\Program Files\Canon 2007-10-04 14:43 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-10-04 14:43 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-10-04 14:06 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2007-10-04 14:04 d-------- C:\WINDOWS\SHELLNEW 2007-10-04 14:02 d-------- C:\Program Files\Microsoft.NET 2007-10-04 14:00 dr-h----- C:\MSOCache 2007-10-04 12:40 d-------- C:\Downloads 2007-10-04 12:40 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-10-04 12:37 d-------- C:\Program Files\BitComet 2007-10-03 19:40 d-------- C:\Program Files\Azureus 2007-10-03 19:40 d-------- C:\Documents and Settings\BEGNY\Application Data\Azureus . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-03 13:58 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\LimeWire 2007-11-02 16:25 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\Skype 2007-10-24 13:12 --------- d-----w C:\Program Files\Java 2007-10-17 16:39 --------- d-----w C:\Program Files\Winamp 2007-10-04 16:28 359,808 ----a-w C:\WINDOWS\system32\drivers cpip.sys 2007-10-01 09:32 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2007-09-28 17:55 --------- d-----w C:\Program Files\CDBurnerXP 2007-09-25 22:06 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\vlc 2007-09-25 10:38 --------- d-----w C:\Program Files\Audacity 2007-09-24 12:47 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\Apple Computer 2007-09-24 02:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier 2007-09-24 02:36 --------- d-----w C:\Program Files\Microsoft SQL Server 2007-09-24 01:36 --------- d-----w C:\Program Files\Adssite Advanced Toolbar 2007-09-23 19:41 --------- d-----w C:\Program Files\Google 2007-09-22 11:27 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-09-22 10:17 --------- d-----w C:\Program Files\Eltima Software 2007-09-21 21:12 --------- d-----w C:\Program Files\Fichiers communs\Macromedia 2007-09-21 21:11 --------- d-----w C:\Program Files\Macromedia 2007-09-21 21:10 --------- d-----w C:\Program Files\Fichiers communs\InstallShield 2007-09-21 10:00 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\Adssite Advanced Toolbar 2007-09-21 09:25 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-09-21 01:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems 2007-09-21 01:13 --------- d-----w C:\Program Files\Fichiers communs\Adobe Systems Shared 2007-09-20 23:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\IsolatedStorage 2007-09-20 21:28 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\MSN6 2007-09-20 21:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6 2007-09-20 21:21 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2007-09-20 21:21 --------- d-----w C:\Program Files\Fichiers communs\Teleca Shared 2007-09-20 21:21 --------- d-----w C:\Program Files\FairUse Wizard 2007-09-20 21:21 --------- d-----w C:\Program Files\Error Safe Free 2007-09-20 21:21 --------- d-----w C:\Program Files\eRightSoft 2007-09-20 21:21 --------- d-----w C:\Program Files\EPSON 2007-09-20 21:20 --------- d-----w C:\Program Files\eMule 2007-09-20 21:18 --------- d-----w C:\Program Files\CyberLink 2007-09-20 21:18 --------- d-----w C:\Program Files\Creative 2007-09-20 21:18 --------- d-----w C:\Program Files\Common~1 2007-09-20 21:18 --------- d-----w C:\Program Files\CoffeeCup Software 2007-09-20 21:18 --------- d-----w C:\Program Files\BSplayer_WhenUSave_Installer 2007-09-20 21:17 --------- d-----w C:\Program Files\Apple Software Update 2007-09-20 21:17 --------- d-----w C:\Program Files\Alwil Software 2007-09-20 21:17 --------- d-----w C:\Program Files\Ahead 2007-09-20 21:07 --------- d-----w C:\Program Files\1&1 2007-09-20 21:06 --------- d-----w C:\Program Files\XviD codec (Neodivx Version) 2007-09-20 21:06 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-09-20 21:06 --------- d-----w C:\Program Files\Windows Live 2007-09-20 21:05 --------- d-----w C:\Program Files\WinASPI 2007-09-20 21:04 --------- d-----w C:\Program Files\Webteh 2007-09-20 21:04 --------- d-----w C:\Program Files\VSO 2007-09-20 21:04 --------- d-----w C:\Program Files\VOB 2007-09-20 21:04 --------- d-----w C:\Program Files\VISoftware 2007-09-20 21:04 --------- d-----w C:\Program Files\Visicom Media 2007-09-20 21:04 --------- d-----w C:\Program Files\VideoLAN 2007-09-20 21:04 --------- d-----w C:\Program Files\URUSoft 2007-09-20 21:04 --------- d-----w C:\Program Files\Uniblue 2007-09-20 21:04 --------- d-----w C:\Program Files\Ubisoft 2007-09-20 21:04 --------- d-----w C:\Program Files\Thugs at Bay 2007-09-20 21:04 --------- d-----w C:\Program Files\Symantec 2007-09-20 21:04 --------- d-----w C:\Program Files\STK014 2007-09-20 21:04 --------- d-----w C:\Program Files\StarV9 2007-09-20 21:03 --------- d-----w C:\Program Files\Sony Ericsson 2007-09-20 21:03 --------- d-----w C:\Program Files\Skype 2007-09-20 21:03 --------- d-----w C:\Program Files\RADVideo 2007-09-20 21:03 --------- d-----w C:\Program Files\QuickTime Alternative 2007-09-20 21:03 --------- d-----w C:\Program Files\plugins 2007-09-20 21:03 --------- d-----w C:\Program Files\NETGEAR 2007-09-20 20:21 --------- d-----w C:\Program Files\Fichiers communs\LightScribe 2007-09-20 20:21 --------- d-----w C:\Program Files\Fichiers communs\Ahead 2007-09-20 20:20 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\Ahead 2007-09-20 20:18 --------- d-----w C:\Program Files\Nero 2007-09-20 20:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero 2007-09-20 20:16 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines 2007-09-20 20:16 --------- d-----w C:\Program Files\Fichiers communs\ODBC 2007-09-20 20:12 --------- d-----w C:\Program Files\Motorola 2007-09-20 20:09 --------- d-----w C:\Program Files\Realtek 2007-09-20 19:51 315,392 ----a-w C:\WINDOWS\HideWin.exe 2007-09-20 19:23 --------- d-----w C:\Program Files\microsoft frontpage 2007-09-20 19:21 --------- d-----w C:\Program Files\Fichiers communs\MSSoap 2007-09-20 19:20 --------- d-----w C:\Program Files\Services en ligne 2007-09-20 18:37 --------- d-----w C:\Program Files\MSN Messenger 2007-09-20 18:21 --------- d-----w C:\Program Files\Fichiers communs\Java 2007-09-20 18:03 --------- d-----w C:\Program Files\QuickTime 2007-09-20 18:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-09-20 18:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2007-09-20 16:28 --------- d-----w C:\Program Files\MyXOFT 2007-09-20 16:28 --------- d-----w C:\Program Files\Multimedia Mouse Driver 2007-09-20 16:28 --------- d-----w C:\Program Files\MSXML 4.0 2007-09-20 16:27 --------- d-----w C:\Program Files\MSI 2007-09-20 16:27 --------- d-----w C:\Program Files\Microsoft Games 2007-09-20 16:26 --------- d-----w C:\Program Files\Maïdo Production 2007-09-20 16:25 --------- d-----w C:\Program Files\Lauyan 2007-09-20 16:25 --------- d-----w C:\Program Files\key 2007-09-20 16:25 --------- d-----w C:\Program Files\Jasc Software Inc 2007-09-20 16:24 --------- d-----w C:\Program Files\InterVideo 2007-09-20 16:24 --------- d-----w C:\Program Files\InterActual 2007-09-20 16:24 --------- d-----w C:\Program Files\Infogrames 2007-09-19 20:01 9,715,200 ----a-w C:\WINDOWS\RTLCPL.exe 2007-09-19 20:01 86,016 ----a-w C:\WINDOWS\SoundMan.exe 2007-09-19 20:01 69,632 ----a-w C:\WINDOWS\Alcmtr.exe 2007-09-19 20:01 520,192 ----a-w C:\WINDOWS\RtlExUpd.dll 2007-09-19 20:01 49,152 ----a-w C:\WINDOWS\system32\ChCfg.exe . ((((((((((((((((((((((((((((( snapshot@2007-11-03_14.53.14.28 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-03 14:03:42 22,486 ----a-r C:\WINDOWS\Installer\{BDF62CC9-FE60-4F9D-8194-8EB7E6E1412D} egister_icon.exe - 2001-09-28 12:00:00 112,128 ----a-w C:\WINDOWS\system32\mapi32.dll + 2004-03-31 12:28:00 131,072 ----a-w C:\WINDOWS\system32\mapi32.dll + 2002-01-05 02:48:16 974,848 ----a-w C:\WINDOWS\system32\mfc70.dll + 2002-01-05 02:36:38 964,608 ----a-w C:\WINDOWS\system32\mfc70u.dll + 2003-03-18 20:12:12 1,047,552 ----a-w C:\WINDOWS\system32\mfc71u.dll + 2002-01-05 02:38:38 54,784 ----a-w C:\WINDOWS\system32\msvci70.dll + 2002-01-05 02:40:20 487,424 ----a-w C:\WINDOWS\system32\msvcp70.dll + 2002-01-05 01:37:28 344,064 ----a-w C:\WINDOWS\system32\msvcr70.dll . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{67A0AFC4-E872-4DB3-8770-FA65BD4F61D6}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AC619BCA-2BF3-4D49-B815-91BC5ACEB12A}] C:\Program Files\Lauyan ipysavC:\WINDOWS\system32\e1\caws83122.exe.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}] 2007-11-03 14:54 35328 --a------ C:\WINDOWS\system32\gebxvww.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C6ED5DA7-9ECD-4808-8947-B0E81FFE4941}] C:\WINDOWS\system32\jkhhi.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DAB04895-840B-40C8-A787-CF56360009E9}] C:\Program Files\key ipysavC:\WINDOWS\system32\e1\caws83122.exe.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E6980035-9529-4F1F-BC04-1B846166C7A9}] C:\Program Files\key ipysavC:\WINDOWS\system32\e1\caws83122.exe.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-10-14 16:37] "RTHDCPL"="RTHDCPL.EXE" [2007-09-19 21:01 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2007-09-19 21:01 C:\WINDOWS\SkyTel.exe] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-10-09 20:43] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-26 11:12] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06] "Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10] "Host Process"="C:\WINDOWS\Fonts\svchost.exe" [] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-03 14:21] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-16 22:09] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-05-17 12:11] "BitComet"="C:\Program Files\BitComet\BitComet.exe" [2007-09-10 13:33] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{BCC73622-F72D-4277-803C-D65565A0947F}"= C:\WINDOWS\system32\gebxvww.dll [2007-11-03 14:54 35328] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\gebxvww] gebxvww.dll 2007-11-03 14:54 35328 C:\WINDOWS\system32\gebxvww.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\giysaxlm] giysaxlm.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\geedc.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;C:\WINDOWS\System32\StkCSrv.exe R3 ASNDIS5;ASNDIS5 Protocol Driver;\??\C:\WINDOWS\ATK0100\ASNDIS5.SYS R3 RTSTOR;USB Mass Stroage Device;C:\WINDOWS\system32\drivers\RTSTOR.SYS R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;C:\WINDOWS\system32\Drivers\StkCMini.sys R3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys R3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys R3 WacomVKHid;Virtual Keyboard Driver;C:\WINDOWS\system32\DRIVERS\WacomVKHid.sys S3 AtcL002;NDIS Miniport Driver for Attansic L2 Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\atl02_xp.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57df1a99-77eb-11dc-b9f3-0015af38a7f9}] \Shell\Auto\command - bittorrent.exe e \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bittorrent.exe e . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-03 15:32:33 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-03 15:34:26 - machine was rebooted C:\ComboFix2.txt ... 2007-11-03 14:53 . --- E O F --- rapport PCA # PCA Sécurité V 1.0.2, (fichier LOG). # Rapport du :03/11/2007 15:37:38 Microsoft Windows XP Service Pack 2 ==>> Processus <== \SystemRoot\System32\smss.exe \??\C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\StkCSrv.exe C:\WINDOWS\system32\Tablet.exe C:\WINDOWS\system32\Tablet.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\internet explorer\iexplore.exe C:\pca\pca.exe //pages de démarrage et de recherche d'Internet Explorer RO - HKLM\Software\Microsoft\Internet Explorer\Main\Start Page = https://www.msn.com/fr-fr/?ocid=iehp RO - HKLM\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp RO - HKCU\Software\Microsoft\Internet Explorer\Main\Start Page = https://www.google.fr/?gws_rd=ssl RO - HKCU\Software\Microsoft\Internet Explorer\Toolbar\LinksFolderName = Liens R1 - HKLM\Software\Microsoft\Internet Explorer\Main\Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKCU\Software\Microsoft\Internet Explorer\Main\Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch R1 - HKLM\Software\Microsoft\Internet Explorer\Search\CustomizeSearch = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Search\SearchAssistant = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Search\SearchAssistant = http://www.google.com/toolbar/ie8/sidebar.html //applications lancées depuis system.ini,win.ini //03 - Browser Helper Objects (BHOs) 02 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet ools\BitCometBHO_1.1.8.30.dll 02 - BHO: - {67A0AFC4-E872-4DB3-8770-FA65BD4F61D6} - 02 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll 02 - BHO: - {7E853D72-626A-48EC-A868-BA8D5E23E045} - 02 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll 02 - BHO: - {AC619BCA-2BF3-4D49-B815-91BC5ACEB12A} - C:\Program Files\Lauyan ipysavC:\WINDOWS\system32\e1\caws83122.exe.dll 02 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll 02 - BHO: - {BCC73622-F72D-4277-803C-D65565A0947F} - C:\WINDOWS\system32\gebxvww.dll 02 - BHO: - {C6ED5DA7-9ECD-4808-8947-B0E81FFE4941} - C:\WINDOWS\system32\jkhhi.dll 02 - BHO: - {DAB04895-840B-40C8-A787-CF56360009E9} - C:\Program Files\key ipysavC:\WINDOWS\system32\e1\caws83122.exe.dll 02 - BHO: - {E6980035-9529-4F1F-BC04-1B846166C7A9} - C:\Program Files\key ipysavC:\WINDOWS\system32\e1\caws83122.exe.dll O3 - Toolbar : &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll //04 - applications chargées automatiquement 04 - HKLM\..\RUN: [HControl] - C:\WINDOWS\ATK0100\HControl.exe 04 - HKLM\..\RUN: [RTHDCPL] - RTHDCPL.EXE 04 - HKLM\..\RUN: [SkyTel] - SkyTel.EXE 04 - HKLM\..\RUN: [SMSERIAL] - C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe 04 - HKLM\..\RUN: [NeroFilterCheck] - C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe 04 - HKLM\..\RUN: [SunJavaUpdateSched] - "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" 04 - HKLM\..\RUN: [Adobe Reader Speed Launcher] - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" 04 - HKLM\..\RUN: [Easy-PrintToolBox] - C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon 04 - HKLM\..\RUN: [Host Process] - C:\WINDOWS\Fonts\svchost.exe 04 - HKLM\..\RUN: [avgnt] - "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min 04 - HKLU\..\RUN: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 04 - HKLU\..\RUN: [ctfmon.exe] - C:\WINDOWS\system32\ctfmon.exe 04 - HKLU\..\RUN: [msnmsgr] - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background 04 - HKLU\..\RUN: [BitComet] - "C:\Program Files\BitComet\BitComet.exe" /tray 04 - HKUS\S-1-5-18\..\RUN: [CTFMON.EXE] - C:\WINDOWS\ATK0100\HControl.exe 04 - HKUS\S-1-5-19\..\RUN: [CTFMON.EXE] - C:\WINDOWS\ATK0100\HControl.exe 04 - HKUS\S-1-5-20\..\RUN: [CTFMON.EXE] - C:\WINDOWS\ATK0100\HControl.exe 04 - HKUS\S-1-5-21-484763869-884357618-725345543-1003\..\RUN: [swg] - C:\WINDOWS\ATK0100\HControl.exe 04 - HKUS\S-1-5-21-484763869-884357618-725345543-1003\..\RUN: [ctfmon.exe] - RTHDCPL.EXE 04 - HKUS\S-1-5-21-484763869-884357618-725345543-1003\..\RUN: [msnmsgr] - SkyTel.EXE 04 - HKUS\S-1-5-21-484763869-884357618-725345543-1003\..\RUN: [BitComet] - C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe 04 - Global Startup: Adobe Gamma Loader.lnk= C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk //05 - Accès au panneau de contrôle d'Internet Explorer (control.ini) //06- interdiction à l' accès au options (Internet Explorer) //07 - blocage de l'exécution de Regedit //08 - lignes supplémentaires dans le menu contextuel d'Internet Explorer 08 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm 08 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm 08 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm 08 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 //09 - boutons situés sur la barre d'outils principale d'Internet Explorer 09 - Extra button: - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll 09 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll 09 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - 09 - Extra 'Tools' menuitem: - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - 09 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - 09 - Extra 'Tools' menuitem: - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - 09 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 09 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe //O10 - Pirates de Winsock //O11 - Onglet supplémentaire dans les options avancées d'Internet Explorer) O11 - Options group: [INTERNATIONAL] - International* //O12 - IE plugins O12 - IE plugins : C:\Program Files\Internet Explorer\PLUGINS pqtplugin.dll O12 - IE plugins : C:\Program Files\Internet Explorer\PLUGINS pqtplugin2.dll O12 - IE plugins : C:\Program Files\Internet Explorer\PLUGINS pqtplugin3.dll O12 - IE plugins : C:\Program Files\Internet Explorer\PLUGINS pqtplugin4.dll O12 - IE plugins : C:\Program Files\Internet Explorer\PLUGINS pqtplugin5.dll O12 - IE plugins : C:\Program Files\Internet Explorer\PLUGINS pqtplugin6.dll O12 - IE plugins : C:\Program Files\Internet Explorer\PLUGINS pqtplugin7.dll //013 : DefaultPrefix //014 - Option : (Rétablir les paramètres Web) //015 - Zone de confiance d'Internet Explorer 15 - trusted zone: http . localhost //O16 - Objets ActiveX O16 - DPF : Windows Genuine Advantage Validation Tool - {17492023-C23A-453E-A040-C7C580BBF700} - C:\WINDOWS\system32\LegitCheckControl.DLL O16 - DPF : Shockwave Flash Object - {D27CDB6E-AE6D-11CF-96B8-444553540000} - C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx //O17 - piratage de domaine Lop.com //O18 - protocoles additionnels O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\System32\msvidctl.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\FICHIE~1\MICROS~1\WEBCOM~1\11\OWC11.DLL //O19 - feuille de style de l'utilisateur //O20 - valeur de Registre AppInit_DLLs et les sous-clés Winlogon Notify //O21 - ShellServiceObjectDelayLoad //O22 - SharedTaskScheduler O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - %SystemRoot%\System32\browseui.dll O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - %SystemRoot%\System32\browseui.dll //O23 - services de XP,NT, 2000, et 2003 O23 - Service: [Adobe LM Service] - "C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe" O23 - Service: [Service de la passerelle de la couche Application] - %SystemRoot%\System32\alg.exe O23 - Service: [AntiVir PersonalEdition Classic Scheduler] - "C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe" O23 - Service: [AntiVir PersonalEdition Classic Guard] - "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe" O23 - Service: [ASP.NET State Service] - %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe O23 - Service: [] - %SystemRoot%\System32\Ati2evxx.exe O23 - Service: [Gestionnaire de l'Album] - %SystemRoot%\system32\clipsrv.exe O23 - Service: [.NET Runtime Optimization Service v2.0.50727_X86] - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe O23 - Service: [Application système COM+] - C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} O23 - Service: [Google Updater Service] - "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" O23 - Service: [Service COM de gravage de CD IMAPI] - O23 - Service: [LightScribeService Direct Disc Labeling Service] - "C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe" O23 - Service: [Partage de Bureau à distance NetMeeting] - C:\WINDOWS\System32\mnmsrvc.exe O23 - Service: [Distributed Transaction Coordinator] - C:\WINDOWS\System32\msdtc.exe O23 - Service: [NBService] - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: [NMIndexingService] - "C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe" O23 - Service: [NMSAccessU] - C:\Program Files\CDBurnerXP\NMSAccessU.exe O23 - Service: [Office Source Engine] - "C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE" O23 - Service: [Gestionnaire de session d'aide sur le Bureau à distance] - C:\WINDOWS\system32\sessmgr.exe O23 - Service: [Localisateur d'appels de procédure distante (RPC)] - %SystemRoot%\System32\locator.exe O23 - Service: [QoS RSVP] - %SystemRoot%\System32 svp.exe O23 - Service: [Spouleur d'impression] - %SystemRoot%\system32\spoolsv.exe O23 - Service: [Syntek AVStream USB2.0 WebCam Service] - %SystemRoot%\System32\StkCSrv.exe O23 - Service: [MS Software Shadow Copy Provider] - C:\WINDOWS\System32\dllhost.exe /Processid:{BD8A66A2-59AB-492B-96B9-05428D9412ED} O23 - Service: [Journaux et alertes de performance] - %SystemRoot%\system32\smlogsvc.exe O23 - Service: [TabletService] - C:\WINDOWS\system32\Tablet.exe O23 - Service: [Telnet] - C:\WINDOWS\System32 lntsvr.exe O23 - Service: [Uninterruptible Power Supply] - %SystemRoot%\System32\ups.exe O23 - Service: [Service Messenger Sharing Folders USN Journal Reader] - "C:\Program Files\MSN Messenger\usnsvc.exe" O23 - Service: [Cliché instantané de volume] - %SystemRoot%\System32\vssvc.exe O23 - Service: [Carte de performance WMI] - C:\WINDOWS\System32\wbem\wmiapsrv.exe O23 - Service: [Service Partage réseau du Lecteur Windows Media] - "C:\Program Files\Windows Media Player\WMPNetwk.exe"

FillPCA · Answer

Re,

1/     *  Sélectionne le texte suivant :

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DAB04895-840B-40C8-A787-CF56360009E9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E6980035-9529-4F1F-BC04-1B846166C7A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C6ED5DA7-9ECD-4808-8947-B0E81FFE4941}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AC619BCA-2BF3-4D49-B815-91BC5ACEB12A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67A0AFC4-E872-4DB3-8770-FA65BD4F61D6}] 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BCC73622-F72D-4277-803C-D65565A0947F}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\gebxvww]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\giysaxlm]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Host Process"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BCC73622-F72D-4277-803C-D65565A0947F}"=-

File::
C:\WINDOWS\system32\jkhhi.dll
C:
.bat
C:\z.dat
C:\WINDOWS\system32\gebxvww.dll
C:\WINDOWS\system32\xsphsxvb.dll
C:\WINDOWS\system32\xvfjpwqx.dll
C:\WINDOWS\system32qrollm.dll
C:\WINDOWS\system32\ehotopxw.dll
C:\WINDOWS\system32\yayyyax.dll 
C:\WINDOWS\system32\spudsc.exe
C:\WINDOWS\system32\svchost1.exe
C:\WINDOWS\Fonts\svchost.exe
C:\WINDOWS\system32\e1\caws83122.exe.dll

Folder::
C:\Temp\mZOr
C:\WINDOWS\system32\e1

    * Copie le texte sélectionné (CTRL+C).
    * Ouvre le bloc-note (programme>Accessoire>bloc-note).
    * Colle le texte copié dans ce bloc-note (CTRL+V).
    * Sauvegarde ce fichier sous le nom de CFScript.txt
    * Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe

    * Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
    * Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal!
      Ne touche à rien tant que le scan n'est pas terminé.
    * Une fois le scan achevé, un rapport va s'afficher: Poste son contenu.
    * Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

2/     *  Télécharge DiagHelp.zip sur ton bureau(Merci Malekal)  : http://www.malekal.com/download/DiagHelp.zip
Tuto : http://www.malekal.com/DiagHelp/DiagHelp.php
    * Ne double-clique pas dessus !! Fais un clic droit sur le fichier et extraire tout.
    * Un nouveau dossier chercher va être créé.
    * Ouvre le et double-clic sur go.cmd (le .cmd peut ne pas apparaître)
    * Une fenêtre va s'ouvrir, choisis l'option 1
    * L'analyse va commencer, ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand on te le demande.
    * Pendant l'analyse après le rapport CATCHME sur l'écran rouge, tu dois appuyer sue entrée pour que l'outil continue ses recherches. Suis les consignes écrites.
    * Une fenêtre avec le rapport s'ouvre alors. Copie/colle son contenu. (Il se trouve aussi ici : c:esultat.txt)
    * Double-clique sur ce fichier, Fais CTRL+A puis CTRL+C.
    * Dans ta prochaine réponse, colle le rapport en faisant CTRL+V.

3/     *  Télécharge SREng (de Smallfrogs) : http://www.kztechs.com/eng/download.html
    * Dézippe tout son contenu sur ton bureau (clic droit >Extraire ici).
    * Ouvre le dossier SReng2 et double-clique sur SREng.exe.
    * Clique sur "smart scan".
    * Clique sur le bouton "scan".
    * Quand l'analyse est terminée, clique sur le bouton "save reports".
    * Sauvegarde alors le rapport sur ton bureau.
    * Copie/colle le contenu du rapport  SREnglLOG.log dans ta prochaine réponse.

4/ Edite le rapport Combofix, Diaghelp, SREng et un nouveau rapport Hijackthis.

FillPCA

dede4240 · Answer

ComboFix 07-11-01.1 - BEGNY 2007-11-03 16:09:38.4 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1432 [GMT 1:00] Running from: C:\Downloads\ComboFix.exe Command switches used :: C:\Downloads\CFScript.txt * Created a new restore point FILE:: C: .bat C:\WINDOWS\Fonts\svchost.exe C:\WINDOWS\system32\e1\caws83122.exe.dll C:\WINDOWS\system32\ehotopxw.dll C:\WINDOWS\system32\gebxvww.dll C:\WINDOWS\system32\jkhhi.dll C:\WINDOWS\system32 qrollm.dll C:\WINDOWS\system32\spudsc.exe C:\WINDOWS\system32\svchost1.exe C:\WINDOWS\system32\xsphsxvb.dll C:\WINDOWS\system32\xvfjpwqx.dll C:\WINDOWS\system32\yayyyax.dll C:\z.dat . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C: .bat C:\Temp\mZOr C:\Temp\mZOr OasF.log C:\WINDOWS\system32\ehotopxw.dll C:\WINDOWS\system32\gebxvww.dll C:\WINDOWS\system32 qrollm.dll C:\WINDOWS\system32\spudsc.exe C:\WINDOWS\system32\svchost1.exe C:\WINDOWS\system32\xsphsxvb.dll C:\WINDOWS\system32\xvfjpwqx.dll C:\z.dat . ((((((((((((((((((((((((((((( Fichiers créés 2007-10-03 to 2007-11-03 )))))))))))))))))))))))))))))))))))) . 2007-11-03 15:36 d-------- C:\pca 2007-11-03 15:15 2,742 --a------ C:\WINDOWS\system32 mp.reg 2007-11-03 15:14 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-11-03 15:14 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-11-03 15:14 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-11-03 15:14 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-11-03 15:14 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-03 15:08 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2007-11-03 15:07 d-------- C:\VundoFix Backups 2007-11-03 13:06 d-------- C:\Program Files\Avira 2007-11-03 13:06 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-11-03 10:32 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-03 10:13 d-------- C:\Program Files\Panda Security 2007-11-03 10:08 d---s---- C:\WINDOWS\Downloaded Program Files 2007-11-02 19:10 d-------- C:\Documents and Settings\BEGNY\Application Data\WTablet 2007-11-02 19:02 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-02 18:57 d-------- C:\Program Files\Navilog1 2007-11-02 18:39 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2007-11-02 18:39 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll 2007-11-02 18:39 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2007-11-02 18:39 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys 2007-11-02 18:39 11,440 --a------ C:\WINDOWS\system32\drivers\WacomVKHid.sys 2007-11-02 18:27 d-------- C:\WINDOWS\system32\WTablet 2007-11-02 18:27 d-------- C:\Program Files\Tablet 2007-11-02 18:27 1,197,616 --a------ C:\WINDOWS\system32\Tablet.exe 2007-11-02 18:27 124,464 --------- C:\WINDOWS\system32\Wintab32.dll 2007-11-02 18:27 12,848 --a------ C:\WINDOWS\system32\drivers\wacomvhid.sys 2007-11-02 18:27 11,312 --a------ C:\WINDOWS\system32\drivers\wacommousefilter.sys 2007-11-01 18:17 d-------- C:\Program Files\Trend Micro 2007-11-01 11:52 28,672 --a------ C:\Documents and Settings\BEGNY\iexplorer.exe 2007-11-01 11:47 d-------- C:\WINDOWS\system32\bfubackups 2007-10-31 18:44 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-10-31 17:21 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll 2007-10-31 17:17 d-------- C:\WINDOWS\system32\Mz18r 2007-10-31 17:17 d-------- C:\Temp 2007-10-31 16:01 d-------- C:\Program Files\TimeAdjuster 2007-10-29 16:21 1,156 --a------ C:\WINDOWS\mozver.dat 2007-10-29 16:18 0 --a------ C:\WINDOWS sreg.dat 2007-10-25 14:24 d-------- C:\WINDOWS\Sun 2007-10-12 23:35 d-------- C:\Program Files\Ripp-it_AM 2007-10-12 22:34 d-------- C:\Program Files\AviSynth 2.5 2007-10-10 13:59 584,192 -----c--- C:\WINDOWS\system32\dllcache pcrt4.dll 2007-10-04 14:55 163,840 --a------ C:\WINDOWS\BJPSUNST.EXE 2007-10-04 14:53 d-------- C:\WINDOWS\StartHtmico 2007-10-04 14:52 d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ 2007-10-04 14:52 140,288 --a------ C:\WINDOWS\system32\CNMLM78.DLL 2007-10-04 14:52 90,112 -ra------ C:\WINDOWS\system32\CNMCP78.exe 2007-10-04 14:52 8,704 --a------ C:\WINDOWS\system32\CNMVS78.DLL 2007-10-04 14:50 d-------- C:\Program Files\Canon 2007-10-04 14:43 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-10-04 14:43 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-10-04 14:06 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2007-10-04 14:04 d-------- C:\WINDOWS\SHELLNEW 2007-10-04 14:02 d-------- C:\Program Files\Microsoft.NET 2007-10-04 14:00 dr-h----- C:\MSOCache 2007-10-04 12:40 d-------- C:\Downloads 2007-10-04 12:40 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-10-04 12:37 d-------- C:\Program Files\BitComet 2007-10-03 19:40 d-------- C:\Program Files\Azureus 2007-10-03 19:40 d-------- C:\Documents and Settings\BEGNY\Application Data\Azureus . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-03 13:58 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\LimeWire 2007-11-02 16:25 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\Skype 2007-10-24 13:12 --------- d-----w C:\Program Files\Java 2007-10-17 16:39 --------- d-----w C:\Program Files\Winamp 2007-10-04 16:28 359,808 ----a-w C:\WINDOWS\system32\drivers cpip.sys 2007-10-01 09:32 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2007-09-28 17:55 --------- d-----w C:\Program Files\CDBurnerXP 2007-09-25 22:06 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\vlc 2007-09-25 10:38 --------- d-----w C:\Program Files\Audacity 2007-09-24 12:47 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\Apple Computer 2007-09-24 02:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier 2007-09-24 02:36 --------- d-----w C:\Program Files\Microsoft SQL Server 2007-09-24 01:36 --------- d-----w C:\Program Files\Adssite Advanced Toolbar 2007-09-23 19:41 --------- d-----w C:\Program Files\Google 2007-09-22 11:27 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-09-22 10:17 --------- d-----w C:\Program Files\Eltima Software 2007-09-21 21:12 --------- d-----w C:\Program Files\Fichiers communs\Macromedia 2007-09-21 21:11 --------- d-----w C:\Program Files\Macromedia 2007-09-21 21:10 --------- d-----w C:\Program Files\Fichiers communs\InstallShield 2007-09-21 10:00 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\Adssite Advanced Toolbar 2007-09-21 09:25 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-09-21 01:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems 2007-09-21 01:13 --------- d-----w C:\Program Files\Fichiers communs\Adobe Systems Shared 2007-09-20 23:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\IsolatedStorage 2007-09-20 21:28 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\MSN6 2007-09-20 21:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6 2007-09-20 21:21 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2007-09-20 21:21 --------- d-----w C:\Program Files\Fichiers communs\Teleca Shared 2007-09-20 21:21 --------- d-----w C:\Program Files\FairUse Wizard 2007-09-20 21:21 --------- d-----w C:\Program Files\Error Safe Free 2007-09-20 21:21 --------- d-----w C:\Program Files\eRightSoft 2007-09-20 21:21 --------- d-----w C:\Program Files\EPSON 2007-09-20 21:20 --------- d-----w C:\Program Files\eMule 2007-09-20 21:18 --------- d-----w C:\Program Files\CyberLink 2007-09-20 21:18 --------- d-----w C:\Program Files\Creative 2007-09-20 21:18 --------- d-----w C:\Program Files\Common~1 2007-09-20 21:18 --------- d-----w C:\Program Files\CoffeeCup Software 2007-09-20 21:18 --------- d-----w C:\Program Files\BSplayer_WhenUSave_Installer 2007-09-20 21:17 --------- d-----w C:\Program Files\Apple Software Update 2007-09-20 21:17 --------- d-----w C:\Program Files\Alwil Software 2007-09-20 21:17 --------- d-----w C:\Program Files\Ahead 2007-09-20 21:07 --------- d-----w C:\Program Files\1&1 2007-09-20 21:06 --------- d-----w C:\Program Files\XviD codec (Neodivx Version) 2007-09-20 21:06 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-09-20 21:06 --------- d-----w C:\Program Files\Windows Live 2007-09-20 21:05 --------- d-----w C:\Program Files\WinASPI 2007-09-20 21:04 --------- d-----w C:\Program Files\Webteh 2007-09-20 21:04 --------- d-----w C:\Program Files\VSO 2007-09-20 21:04 --------- d-----w C:\Program Files\VOB 2007-09-20 21:04 --------- d-----w C:\Program Files\VISoftware 2007-09-20 21:04 --------- d-----w C:\Program Files\Visicom Media 2007-09-20 21:04 --------- d-----w C:\Program Files\VideoLAN 2007-09-20 21:04 --------- d-----w C:\Program Files\URUSoft 2007-09-20 21:04 --------- d-----w C:\Program Files\Uniblue 2007-09-20 21:04 --------- d-----w C:\Program Files\Ubisoft 2007-09-20 21:04 --------- d-----w C:\Program Files\Thugs at Bay 2007-09-20 21:04 --------- d-----w C:\Program Files\Symantec 2007-09-20 21:04 --------- d-----w C:\Program Files\STK014 2007-09-20 21:04 --------- d-----w C:\Program Files\StarV9 2007-09-20 21:03 --------- d-----w C:\Program Files\Sony Ericsson 2007-09-20 21:03 --------- d-----w C:\Program Files\Skype 2007-09-20 21:03 --------- d-----w C:\Program Files\RADVideo 2007-09-20 21:03 --------- d-----w C:\Program Files\QuickTime Alternative 2007-09-20 21:03 --------- d-----w C:\Program Files\plugins 2007-09-20 21:03 --------- d-----w C:\Program Files\NETGEAR 2007-09-20 20:21 --------- d-----w C:\Program Files\Fichiers communs\LightScribe 2007-09-20 20:21 --------- d-----w C:\Program Files\Fichiers communs\Ahead 2007-09-20 20:20 --------- d-----w C:\Documents and Settings\BEGNY\Application Data\Ahead 2007-09-20 20:18 --------- d-----w C:\Program Files\Nero 2007-09-20 20:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero 2007-09-20 20:16 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines 2007-09-20 20:16 --------- d-----w C:\Program Files\Fichiers communs\ODBC 2007-09-20 20:12 --------- d-----w C:\Program Files\Motorola 2007-09-20 20:09 --------- d-----w C:\Program Files\Realtek 2007-09-20 19:51 315,392 ----a-w C:\WINDOWS\HideWin.exe 2007-09-20 19:23 --------- d-----w C:\Program Files\microsoft frontpage 2007-09-20 19:21 --------- d-----w C:\Program Files\Fichiers communs\MSSoap 2007-09-20 19:20 --------- d-----w C:\Program Files\Services en ligne 2007-09-20 18:37 --------- d-----w C:\Program Files\MSN Messenger 2007-09-20 18:21 --------- d-----w C:\Program Files\Fichiers communs\Java 2007-09-20 18:03 --------- d-----w C:\Program Files\QuickTime 2007-09-20 18:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-09-20 18:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2007-09-20 16:28 --------- d-----w C:\Program Files\MyXOFT 2007-09-20 16:28 --------- d-----w C:\Program Files\Multimedia Mouse Driver 2007-09-20 16:28 --------- d-----w C:\Program Files\MSXML 4.0 2007-09-20 16:27 --------- d-----w C:\Program Files\MSI 2007-09-20 16:27 --------- d-----w C:\Program Files\Microsoft Games 2007-09-20 16:26 --------- d-----w C:\Program Files\Maïdo Production 2007-09-20 16:25 --------- d-----w C:\Program Files\Lauyan 2007-09-20 16:25 --------- d-----w C:\Program Files\key 2007-09-20 16:25 --------- d-----w C:\Program Files\Jasc Software Inc 2007-09-20 16:24 --------- d-----w C:\Program Files\InterVideo 2007-09-20 16:24 --------- d-----w C:\Program Files\InterActual 2007-09-20 16:24 --------- d-----w C:\Program Files\Infogrames 2007-09-19 20:01 9,715,200 ----a-w C:\WINDOWS\RTLCPL.exe 2007-09-19 20:01 86,016 ----a-w C:\WINDOWS\SoundMan.exe 2007-09-19 20:01 69,632 ----a-w C:\WINDOWS\Alcmtr.exe 2007-09-19 20:01 520,192 ----a-w C:\WINDOWS\RtlExUpd.dll 2007-09-19 20:01 4,614,656 ----a-w C:\WINDOWS\system32\drivers\RtkHDAud.sys . ((((((((((((((((((((((((((((( snapshot@2007-11-03_14.53.14.28 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-03 14:03:42 22,486 ----a-r C:\WINDOWS\Installer\{BDF62CC9-FE60-4F9D-8194-8EB7E6E1412D} egister_icon.exe - 2001-09-28 12:00:00 112,128 ----a-w C:\WINDOWS\system32\mapi32.dll + 2004-03-31 12:28:00 131,072 ----a-w C:\WINDOWS\system32\mapi32.dll + 2002-01-05 02:48:16 974,848 ----a-w C:\WINDOWS\system32\mfc70.dll + 2002-01-05 02:36:38 964,608 ----a-w C:\WINDOWS\system32\mfc70u.dll + 2003-03-18 20:12:12 1,047,552 ----a-w C:\WINDOWS\system32\mfc71u.dll + 2002-01-05 02:38:38 54,784 ----a-w C:\WINDOWS\system32\msvci70.dll + 2002-01-05 02:40:20 487,424 ----a-w C:\WINDOWS\system32\msvcp70.dll + 2002-01-05 01:37:28 344,064 ----a-w C:\WINDOWS\system32\msvcr70.dll . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-10-14 16:37] "RTHDCPL"="RTHDCPL.EXE" [2007-09-19 21:01 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2007-09-19 21:01 C:\WINDOWS\SkyTel.exe] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-10-09 20:43] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-26 11:12] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06] "Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-03 14:21] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-16 22:09] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-05-17 12:11] "BitComet"="C:\Program Files\BitComet\BitComet.exe" [2007-09-10 13:33] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;C:\WINDOWS\System32\StkCSrv.exe R3 ASNDIS5;ASNDIS5 Protocol Driver;\??\C:\WINDOWS\ATK0100\ASNDIS5.SYS R3 RTSTOR;USB Mass Stroage Device;C:\WINDOWS\system32\drivers\RTSTOR.SYS R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;C:\WINDOWS\system32\Drivers\StkCMini.sys R3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys R3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys R3 WacomVKHid;Virtual Keyboard Driver;C:\WINDOWS\system32\DRIVERS\WacomVKHid.sys S3 AtcL002;NDIS Miniport Driver for Attansic L2 Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\atl02_xp.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57df1a99-77eb-11dc-b9f3-0015af38a7f9}] \Shell\Auto\command - bittorrent.exe e \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bittorrent.exe e . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-03 16:13:50 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-03 16:15:00 - machine was rebooted C:\ComboFix2.txt ... 2007-11-03 15:34 C:\ComboFix3.txt ... 2007-11-03 14:53 . --- E O F ---

dede4240 · Answer

j ai un soucis sur le site de malekal car il me demande d'uploader un fichier mais ca ne fonctionne ca charge pendant  longtemps sans succes
http://upload.malekal.com/ j'ai l'impression que tant que l'upload n'est pas faite, ca bloque les reste du programme ...

FillPCA · Answer

Re,

Si l'upload est impossible, ferme l'onglet ou la fenêtre de l'explorateur relative à l'upload. Le programme devrait poursuivre son travail.

FillPCA

dede4240 · Answer

bon j'ai quand meme le log dans c: malgré que l'upload ne soit pas chargé ... j ene sais pas du coup si il y a toutesl es infos que tu souhaites DiagHelp version v1.3 - http://www.malekal.com excute le 03/11/2007 à 16:45:40,92 Liste des derniers fichies modifies/crees dans windir\system32 et prefetch C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->03/11/2007 16:45:38 C:\WINDOWS\prefetch\CHCP.COM-18156052.pf -->03/11/2007 16:45:35 C:\WINDOWS\prefetch\IEXPLORE.EXE-27122324.pf -->03/11/2007 16:21:40 C:\WINDOWS\prefetch\GUARDGUI.EXE-2C20A958.pf -->03/11/2007 16:20:19 C:\WINDOWS\prefetch\FIND.EXE-0EC32F1E.pf -->03/11/2007 16:19:57 C:\WINDOWS\prefetch\WINRAR.EXE-39C6DAD9.pf -->03/11/2007 16:18:29 C:\WINDOWS\prefetch\VERCLSID.EXE-3667BD89.pf -->03/11/2007 16:18:03 C:\WINDOWS\prefetch\NOTEPAD.EXE-336351A9.pf -->03/11/2007 16:15:10 C:\WINDOWS\prefetch\MTEE.CFEXE-1E067BC7.pf -->03/11/2007 16:15:00 C:\WINDOWS\prefetch\CATCHME.CFEXE-0F2A0789.pf -->03/11/2007 16:14:52 C:\WINDOWS\System32\drivers\avipbb.sys -->03/11/2007 14:21:58 C:\WINDOWS\System32\drivers cpip.sys -->04/10/2007 17:28:48 C:\WINDOWS\System32\drivers\RtkHDAud.sys -->19/09/2007 21:01:14 C:\WINDOWS\System32\drivers\avgntdd.sys -->09/08/2007 13:04:11 C:\WINDOWS\System32\drivers\avgntmgr.sys -->18/07/2007 14:22:19 C:\WINDOWS\System32\drivers\update.sys -->23/04/2007 11:32:54 C:\WINDOWS\System32\drivers\imagesrv.sys -->26/03/2007 10:52:48 C:\WINDOWS\System32\bdod.bin -->03/11/2007 15:17:50 C:\WINDOWS\System32 mp.txt -->03/11/2007 15:15:16 C:\WINDOWS\System32 mp.reg -->03/11/2007 15:15:16 C:\WINDOWS\System32\bdss.log -->03/11/2007 15:08:41 C:\WINDOWS\System32\CONFIG.NT -->03/11/2007 12:45:13 C:\WINDOWS\System32\bvxshpsx.ini -->03/11/2007 10:50:44 C:\WINDOWS\System32\mcrh.tmp -->02/11/2007 17:10:33 C:\WINDOWS\System32\jlxhesna.ini -->02/11/2007 10:42:51 C:\WINDOWS\System32 eg_0001.txt -->31/10/2007 17:23:07 C:\WINDOWS\System32\wpa.dbl -->31/10/2007 17:22:21 C:\WINDOWS\System32\vbzip10.dll -->31/10/2007 17:21:28 C:\WINDOWS\System32\perfh00C.dat -->28/10/2007 11:06:49 C:\WINDOWS\System32\perfh009.dat -->28/10/2007 11:06:49 C:\WINDOWS\System32\perfc00C.dat -->28/10/2007 11:06:49 C:\WINDOWS\System32\PerfStringBackup.INI -->28/10/2007 11:06:48 C:\WINDOWS\System32\perfc009.dat -->28/10/2007 11:06:48 C:\WINDOWS\System32\jupdate-1.6.0_03-b05.log -->24/10/2007 14:12:40 C:\WINDOWS\System32\FNTCACHE.DAT -->05/10/2007 10:56:41 C:\WINDOWS\System32\bitcometres.dll -->04/10/2007 12:40:09 C:\WINDOWS\System32\WS2Fix.exe -->03/10/2007 23:36:46 C:\WINDOWS\System32 scompat.tlb -->02/10/2007 19:26:11 C:\WINDOWS\System32\amcompat.tlb -->02/10/2007 19:26:11 C:\WINDOWS\System32\MRT.exe -->28/09/2007 06:19:39 C:\WINDOWS\System32\javaws.exe -->24/09/2007 22:31:42 C:\WINDOWS\System32\javacpl.cpl -->24/09/2007 22:31:42 C:\WINDOWS\0.log -->03/11/2007 16:13:42 C:\WINDOWS\wiadebug.log -->03/11/2007 16:13:40 C:\WINDOWS\WindowsUpdate.log -->03/11/2007 16:13:38 C:\WINDOWS\wiaservc.log -->03/11/2007 16:13:38 C:\WINDOWS\bootstat.dat -->03/11/2007 16:13:31 C:\WINDOWS\SchedLgU.Txt -->03/11/2007 16:12:36 C:\WINDOWS\setupapi.log -->03/11/2007 13:20:48 C:\WINDOWS\setupact.log -->03/11/2007 13:20:43 C:\WINDOWS tbtlog.txt -->03/11/2007 01:26:55 C:\WINDOWS\NeroDigital.ini -->02/11/2007 17:16:32 C:\WINDOWS\win.ini -->01/11/2007 18:55:55 C:\WINDOWS\system.ini -->01/11/2007 18:55:55 C:\WINDOWS\catchme.exe -->29/10/2007 18:56:19 C:\WINDOWS\mozver.dat -->29/10/2007 16:21:09 C:\WINDOWS sreg.dat -->29/10/2007 16:18:08 MD5 des fichiers sensibles tcpip.sys de891ad282e856acfd40990094a63b6f ndis.sys 558635d3af1c7546d26067d5d9b6959e null.sys 73c1e1f395918bc2c6dd67af7591a3ad svchost.exe 2979b03d5382a602623c0535b16ab9c0 ListDLLs v2.25 - DLL lister for Win9x/NT Copyright (C) 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ explorer.exe pid: 1664 Command line: C:\WINDOWS\Explorer.EXE Base Size Version Path 0x44080000 0xcf000 7.00.6000.16544 C:\WINDOWS\system32\WININET.dll 0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll 0x43e00000 0x45000 7.00.6000.16544 C:\WINDOWS\system32\iertutil.dll 0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll 0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll 0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL 0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll 0x44360000 0x5cb000 7.00.6000.16544 C:\WINDOWS\system32\ieframe.dll 0x44160000 0x124000 7.00.6000.16544 C:\WINDOWS\system32\urlmon.dll 0x442b0000 0x3c000 7.00.6000.16544 C:\WINDOWS\system32\webcheck.dll 0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\WPDShServiceObj.dll 0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceTypes.dll 0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll 0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll 0x02fc0000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll 0x10000000 0x5b000 8.01.0000.0000 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll 0x78130000 0x9b000 8.00.50727.0163 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\MSVCR80.dll 0x03460000 0x4c000 8.00.0000.0000 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA 0x031c0000 0x2e000 C:\Program Files\WinRAR arext.dll 0x03330000 0x14000 2.07.0003.0000 C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll 0x7c250000 0x102000 7.10.3077.0000 C:\Program Files\Nero\Nero 7\Nero BackItUp\MFC71U.DLL 0x03350000 0x56000 7.10.3052.0004 C:\Program Files\Nero\Nero 7\Nero BackItUp\MSVCR71.dll 0x7c3a0000 0x7b000 7.10.3077.0000 C:\Program Files\Nero\Nero 7\Nero BackItUp\MSVCP71.dll 0x030a0000 0x11000 7.00.0000.0010 C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll 0x1c400000 0x11000 1.00.0000.0002 C:\WINDOWS\System32\StkCWIA.dll 0x325c0000 0x12000 11.00.5510.0000 C:\Program Files\Microsoft Office\OFFICE11\msohev.dll 0x60980000 0x7000 3.01.4000.1823 C:\WINDOWS\system32\MSISIP.DLL 0x74e10000 0x10000 5.06.0000.8820 C:\WINDOWS\System32\wshext.dll 0x73d20000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL 0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL 0x59000000 0xe000 5.06.0000.6626 C:\WINDOWS\System32\wshFR.DLL 0x36d30000 0x19000 11.00.5510.0000 C:\PROGRA~1\MICROS~3\OFFICE11\MCPS.DLL ListDLLs v2.25 - DLL lister for Win9x/NT Copyright (C) 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ winlogon.exe pid: 600 Command line: winlogon.exe Base Size Version Path 0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe 0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll 0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll 0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll 0x10000000 0x1d000 6.14.0010.4158 C:\WINDOWS\system32\Ati2evxx.dll 0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll 0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 787E-345B Répertoire de C:\WINDOWS\system32 19/08/2004 15:09 6 144 csrss.exe 1 fichier(s) 6 144 octets 0 Rép(s) 64 940 441 600 octets libres Contenu de Downloaded Program Files Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 787E-345B Répertoire de C:\WINDOWS\Downloaded Program Files 03/11/2007 10:12 . 03/11/2007 10:12 .. 03/11/2007 10:08 65 desktop.ini 1 fichier(s) 65 octets Total des fichiers listés : 1 fichier(s) 65 octets 2 Rép(s) 64 940 437 504 octets libres Recherche de rootkit! (Merci S!Ri) Recherche d'infections connues Export des clefs sensibles.. Liste des fichiers en exception sur le pare-feu XP SP2 Export de la clef SharedTaskScheduler [SharedTaskScheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant" exports des policies REGEDIT4 [system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 Export des clefs sensibles.. Rechercher adresses sensibles dans le fichier HOSTS... KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Process list by traversal of KiWaitListHead 4 - System 164 - Tablet.exe 404 - sched.exe 436 - GoogleUpdaterSe 568 - csrss.exe 600 - winlogon.exe 644 - services.exe 660 - lsass.exe 812 - ati2evxx.exe 828 - svchost.exe 892 - svchost.exe 932 - svchost.exe 1032 - svchost.exe 1080 - svchost.exe 1220 - ati2evxx.exe 1516 - TabUserW.exe 1524 - avguard.exe 1568 - alg.exe 1664 - explorer.exe 2580 - iexplore.exe 2856 - HControl.exe 2888 - RTHDCPL.exe 2964 - sm56hlpr.exe 3036 - svchost.exe 3084 - avgnt.exe 3100 - GoogleToolbarNo 3128 - ctfmon.exe 3156 - msnmsgr.exe 3200 - BitComet.exe 3404 - ATKOSD.exe 5696 - cmd.exe Total number of processes = 31 NOTE: Under WinXP, this will not show all processes. KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Driver/Module list by traversal of PsLoadedModuleList 804D7000 - \WINDOWS\system32 tkrnlpa.exe 806E2000 - \WINDOWS\system32\hal.dll BADA8000 - \WINDOWS\system32\KDCOM.DLL BACB8000 - \WINDOWS\system32\BOOTVID.dll BA778000 - ACPI.sys BADAA000 - \WINDOWS\System32\DRIVERS\WMILIB.SYS BA767000 - pci.sys BA8A8000 - isapnp.sys BACBC000 - compbatt.sys BACC0000 - \WINDOWS\System32\DRIVERS\BATTC.SYS BAE70000 - pciide.sys BAB28000 - \WINDOWS\System32\DRIVERS\PCIIDEX.SYS BA8B8000 - MountMgr.sys BA748000 - ftdisk.sys BADAC000 - dmload.sys BA722000 - dmio.sys BACC4000 - ACPIEC.sys BAE71000 - \WINDOWS\System32\DRIVERS\OPRGHDLR.SYS BAB30000 - PartMgr.sys BA8C8000 - VolSnap.sys BA70A000 - atapi.sys BA8D8000 - disk.sys BA8E8000 - \WINDOWS\System32\DRIVERS\CLASSPNP.SYS BA6EA000 - fltmgr.sys BA6D8000 - sr.sys BA8F8000 - PxHelp20.sys BA6C1000 - KSecDD.sys BA634000 - Ntfs.sys BA607000 - NDIS.sys BA908000 - ComboFix.sys BA5EC000 - Mup.sys BADDA000 - \SystemRoot\System32\DRIVERS\ATKACPI.sys BAAC8000 - \SystemRoot\System32\DRIVERS\intelppm.sys B8022000 - \SystemRoot\System32\DRIVERS\ati2mtag.sys B800E000 - \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS B7F8C000 - \SystemRoot\System32\DRIVERS\ar5211.sys BAC30000 - \SystemRoot\System32\DRIVERS\usbohci.sys B7F69000 - \SystemRoot\System32\DRIVERS\USBPORT.SYS BAC38000 - \SystemRoot\system32\DRIVERS\usbehci.sys BAAD8000 - \SystemRoot\System32\Drivers\Imapi.SYS BAAE8000 - \SystemRoot\System32\DRIVERS\cdrom.sys BAAF8000 - \SystemRoot\System32\DRIVERS edbook.sys B7F46000 - \SystemRoot\System32\DRIVERS\ks.sys B7F21000 - \SystemRoot\system32\DRIVERS\HDAudBus.sys BAB08000 - \SystemRoot\System32\DRIVERS\i8042prt.sys BAC40000 - \SystemRoot\System32\DRIVERS\kbdclass.sys BAC48000 - \SystemRoot\System32\DRIVERS\mouclass.sys BA5C8000 - \SystemRoot\System32\DRIVERS\CmBatt.sys BADDC000 - \SystemRoot\system32\DRIVERS\wacomvhid.sys BAB18000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS BAC50000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS BADDE000 - \SystemRoot\system32\DRIVERS\WacomVKHid.sys BAF34000 - \SystemRoot\System32\DRIVERS\audstub.sys BA938000 - \SystemRoot\System32\DRIVERS asl2tp.sys BA5C4000 - \SystemRoot\System32\DRIVERS distapi.sys B7F0A000 - \SystemRoot\System32\DRIVERS diswan.sys BA978000 - \SystemRoot\System32\DRIVERS aspppoe.sys BA948000 - \SystemRoot\System32\DRIVERS aspptp.sys BAC58000 - \SystemRoot\System32\DRIVERS\TDI.SYS B7EF9000 - \SystemRoot\System32\DRIVERS\psched.sys BA958000 - \SystemRoot\System32\DRIVERS\msgpc.sys BAC60000 - \SystemRoot\System32\DRIVERS\ptilink.sys BAC68000 - \SystemRoot\System32\DRIVERS aspti.sys B7EC8000 - \SystemRoot\System32\DRIVERS dpdr.sys BA968000 - \SystemRoot\System32\DRIVERS ermdd.sys BADE0000 - \SystemRoot\System32\DRIVERS\swenum.sys B7E6F000 - \SystemRoot\System32\DRIVERS\update.sys BA5A8000 - \SystemRoot\System32\DRIVERS\mssmbios.sys BA5A4000 - \SystemRoot\System32\DRIVERS\mouhid.sys BAC70000 - \SystemRoot\system32\DRIVERS\wacommousefilter.sys B825A000 - \SystemRoot\system32\DRIVERS\kbdhid.sys BA988000 - \SystemRoot\System32\Drivers\NDProxy.SYS BA9C8000 - \SystemRoot\System32\DRIVERS\usbhub.sys BADE2000 - \SystemRoot\System32\DRIVERS\USBD.SYS AF8A5000 - \SystemRoot\system32\drivers\RtkHDAud.sys AF883000 - \SystemRoot\system32\drivers\portcls.sys BA9D8000 - \SystemRoot\system32\drivers\drmk.sys AF793000 - \SystemRoot\system32\DRIVERS\smserial.sys BAC78000 - \SystemRoot\System32\Drivers\Modem.SYS BAD70000 - \SystemRoot\system32\drivers\MODEMCSA.sys BADEC000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS BAFD3000 - \SystemRoot\System32\Drivers\Null.SYS BADEE000 - \SystemRoot\System32\Drivers\Beep.SYS BAC98000 - \SystemRoot\System32\drivers\vga.sys BADF0000 - \SystemRoot\System32\Drivers\mnmdd.SYS BADF2000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys BACA0000 - \SystemRoot\System32\Drivers\Msfs.SYS BACA8000 - \SystemRoot\System32\Drivers\Npfs.SYS BAD84000 - \SystemRoot\System32\DRIVERS asacd.sys AF710000 - \SystemRoot\System32\DRIVERS\ipsec.sys AF6B8000 - \SystemRoot\System32\DRIVERS cpip.sys AF690000 - \SystemRoot\System32\DRIVERS etbt.sys AF66F000 - \SystemRoot\System32\DRIVERS\ipnat.sys BA9E8000 - \SystemRoot\System32\DRIVERS\wanarp.sys AF64D000 - \SystemRoot\System32\drivers\afd.sys BA9F8000 - \SystemRoot\System32\DRIVERS etbios.sys BACB0000 - \SystemRoot\system32\DRIVERS\ssmdrv.sys AF622000 - \SystemRoot\System32\DRIVERS dbss.sys AF5B3000 - \SystemRoot\System32\DRIVERS\mrxsmb.sys BAA18000 - \SystemRoot\System32\Drivers\Fips.SYS BAA28000 - \SystemRoot\system32\DRIVERS\avipbb.sys BADF4000 - \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys AF483000 - \SystemRoot\System32\Drivers\StkCMini.sys AE8B7000 - \SystemRoot\System32\Drivers\StkCPipe.sys BAA78000 - \SystemRoot\System32\Drivers\Cdfs.SYS AE7D7000 - \SystemRoot\System32\Drivers\dump_atapi.sys BAE0C000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS BF800000 - \SystemRoot\System32\win32k.sys BAD6C000 - \SystemRoot\System32\drivers\Dxapi.sys BABC0000 - \SystemRoot\System32\watchdog.sys BF9C3000 - \SystemRoot\System32\drivers\dxg.sys BAFFC000 - \SystemRoot\System32\drivers\dxgthk.sys BABD8000 - \SystemRoot\system32\drivers\RTSTOR.SYS BF9D5000 - \SystemRoot\System32\ati2dvag.dll BFA19000 - \SystemRoot\System32\ati2cqag.dll BFA6E000 - \SystemRoot\System32\atikvmag.dll BFABA000 - \SystemRoot\System32\atiok3x2.dll BFACA000 - \SystemRoot\System32\ati3duag.dll BFD7D000 - \SystemRoot\System32\ativvaxx.dll BFFA0000 - \SystemRoot\System32\ATMFD.DLL AC3DF000 - \SystemRoot\System32\DRIVERS disuio.sys AC072000 - \SystemRoot\System32\DRIVERS\mrxdav.sys ABF97000 - \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys ABF82000 - \SystemRoot\system32\drivers\wdmaud.sys AC467000 - \SystemRoot\system32\drivers\sysaudio.sys ABCB0000 - \SystemRoot\System32\DRIVERS\srv.sys AB80F000 - \SystemRoot\System32\Drivers\HTTP.sys AB513000 - \??\C:\WINDOWS\ATK0100\ASNDIS5.SYS AB7D3000 - \??\C:\DOCUME~1\BEGNY\LOCALS~1\Temp\catchme.sys BAEFC000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys AB3D4000 - \SystemRoot\system32\drivers\kmixer.sys Total number of drivers = 131 Liste des programmes installes Adobe Flash Player 9 ActiveX Adobe Illustrator 10 Adobe Illustrator CS Adobe Illustrator CS2 Adobe Illustrator CS2 Adobe Photoshop 7.0 Adobe Reader 8.1.0 - Français Adobe SVG Viewer 3.0 Archiveur WinRAR ATI Display Driver ATK0100 ACPI UTILITY Attansic L2 Fast Ethernet Driver Audacity 1.2.6 Avira AntiVir PersonalEdition Classic AviSynth 2.5 BitComet 0.93 Canon iP4200 Canon Setup Utility 2.0 Canon Utilities Easy-PhotoPrint Canon Utilities Easy-PrintToolBox CD-LabelPrint CDBurnerXP Correctif pour Lecteur Windows Media 11 (KB939683) Correctif pour Windows XP (KB935448) Correctif Windows XP - KB873339 Correctif Windows XP - KB885835 Correctif Windows XP - KB885836 Correctif Windows XP - KB886185 Correctif Windows XP - KB887472 Correctif Windows XP - KB888302 Correctif Windows XP - KB890859 Correctif Windows XP - KB891781 Google Toolbar for Internet Explorer Google Toolbar for Internet Explorer High Definition Audio Driver Package - KB888111 HijackThis 2.0.2 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB926239) IziSpot 4.8 Java(TM) 6 Update 2 Java(TM) 6 Update 3 Lame ACM MP3 Codec Lecteur Windows Media 11 LightScribe 1.4.142.1 Macromedia Extension Manager Macromedia Flash 8 Macromedia Flash 8 Video Encoder Macromedia Flash Player 8 Macromedia Flash Player 8 Plugin Microsoft .NET Framework 2.0 Microsoft .NET Framework 2.0 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft Internet Explorer Administration Kit 5 Microsoft National Language Support Downlevel APIs Microsoft Office Small Business Edition 2003 Microsoft User-Mode Driver Framework Feature Pack 1.0 Mise à jour de sécurité pour Lecteur Windows Media (KB911564) Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782) Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398) Mise à jour de sécurité pour Lecteur Windows Media 9 (KB936782) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653) Mise à jour de sécurité pour Windows XP (KB890046) Mise à jour de sécurité pour Windows XP (KB893756) Mise à jour de sécurité pour Windows XP (KB896358) Mise à jour de sécurité pour Windows XP (KB896423) Mise à jour de sécurité pour Windows XP (KB896428) Mise à jour de sécurité pour Windows XP (KB899587) Mise à jour de sécurité pour Windows XP (KB899591) Mise à jour de sécurité pour Windows XP (KB900725) Mise à jour de sécurité pour Windows XP (KB901017) Mise à jour de sécurité pour Windows XP (KB901190) Mise à jour de sécurité pour Windows XP (KB901214) Mise à jour de sécurité pour Windows XP (KB902400) Mise à jour de sécurité pour Windows XP (KB904706) Mise à jour de sécurité pour Windows XP (KB905414) Mise à jour de sécurité pour Windows XP (KB905749) Mise à jour de sécurité pour Windows XP (KB908519) Mise à jour de sécurité pour Windows XP (KB911562) Mise à jour de sécurité pour Windows XP (KB911927) Mise à jour de sécurité pour Windows XP (KB913580) Mise à jour de sécurité pour Windows XP (KB914388) Mise à jour de sécurité pour Windows XP (KB914389) Mise à jour de sécurité pour Windows XP (KB917953) Mise à jour de sécurité pour Windows XP (KB918118) Mise à jour de sécurité pour Windows XP (KB918439) Mise à jour de sécurité pour Windows XP (KB919007) Mise à jour de sécurité pour Windows XP (KB920213) Mise à jour de sécurité pour Windows XP (KB920670) Mise à jour de sécurité pour Windows XP (KB920683) Mise à jour de sécurité pour Windows XP (KB920685) Mise à jour de sécurité pour Windows XP (KB921503) Mise à jour de sécurité pour Windows XP (KB922819) Mise à jour de sécurité pour Windows XP (KB923191) Mise à jour de sécurité pour Windows XP (KB923414) Mise à jour de sécurité pour Windows XP (KB923689) Mise à jour de sécurité pour Windows XP (KB923980) Mise à jour de sécurité pour Windows XP (KB924270) Mise à jour de sécurité pour Windows XP (KB924667) Mise à jour de sécurité pour Windows XP (KB925902) Mise à jour de sécurité pour Windows XP (KB926255) Mise à jour de sécurité pour Windows XP (KB926436) Mise à jour de sécurité pour Windows XP (KB927779) Mise à jour de sécurité pour Windows XP (KB927802) Mise à jour de sécurité pour Windows XP (KB928255) Mise à jour de sécurité pour Windows XP (KB928843) Mise à jour de sécurité pour Windows XP (KB929123) Mise à jour de sécurité pour Windows XP (KB930178) Mise à jour de sécurité pour Windows XP (KB931261) Mise à jour de sécurité pour Windows XP (KB931784) Mise à jour de sécurité pour Windows XP (KB932168) Mise à jour de sécurité pour Windows XP (KB933729) Mise à jour de sécurité pour Windows XP (KB935839) Mise à jour de sécurité pour Windows XP (KB935840) Mise à jour de sécurité pour Windows XP (KB936021) Mise à jour de sécurité pour Windows XP (KB938829) Mise à jour de sécurité pour Windows XP (KB941202) Mise à jour pour Windows XP (KB894391) Mise à jour pour Windows XP (KB898461) Mise à jour pour Windows XP (KB900485) Mise à jour pour Windows XP (KB908531) Mise à jour pour Windows XP (KB910437) Mise à jour pour Windows XP (KB911280) Mise à jour pour Windows XP (KB916595) Mise à jour pour Windows XP (KB920872) Mise à jour pour Windows XP (KB922582) Mise à jour pour Windows XP (KB927891) Mise à jour pour Windows XP (KB930916) Mise à jour pour Windows XP (KB933360) Mise à jour pour Windows XP (KB936357) Mise à jour pour Windows XP (KB938828) Motorola SM56 Speakerphone Modem Mozilla Firefox (2.0.0.8) Navilog1 3.3.4 Nero 7 Essentials QuickTime Realtek High Definition Audio Driver Realtek USB 2.0 Card Reader Ri4m v5.0.1d Security Update for Microsoft .NET Framework 2.0 (KB928365) Tablette Time Adjuster v2.9 (STANDARD) USB2.0 1.3M WebCam VideoLAN VLC media player 0.8.5 WebFldrs XP Winamp Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Live Messenger Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows XP Service Pack 2 Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 787E-345B Répertoire de C:\Program Files 03/11/2007 15:18 . 03/11/2007 15:18 .. 20/09/2007 22:07 1&1 21/09/2007 10:25 Adobe 24/09/2007 02:36 Adssite Advanced Toolbar 20/09/2007 22:17 Ahead 20/09/2007 22:17 Alwil Software 20/09/2007 22:17 Apple Software Update 25/09/2007 11:38 Audacity 03/11/2007 13:06 Avira 12/10/2007 23:36 AviSynth 2.5 04/10/2007 12:36 Azureus 04/10/2007 13:49 BitComet 20/09/2007 22:18 BSplayer_WhenUSave_Installer 04/10/2007 14:55 Canon 28/09/2007 18:55 CDBurnerXP 20/09/2007 22:18 CoffeeCup Software 20/09/2007 22:18 Common~1 20/09/2007 20:20 ComPlus Applications 20/09/2007 22:18 Creative 20/09/2007 22:18 CyberLink 22/09/2007 11:17 Eltima Software 20/09/2007 22:20 eMule 20/09/2007 22:21 EPSON 20/09/2007 22:21 eRightSoft 20/09/2007 22:21 Error Safe Free 20/09/2007 22:21 FairUse Wizard 03/11/2007 15:02 Fichiers communs 23/09/2007 20:41 Google 31/10/2007 18:44 Grisoft 24/09/2007 03:26 IEAK 20/09/2007 17:24 Infogrames 12/02/2005 14:29 812 INSTALL.LOG 20/09/2007 17:24 InterActual 11/10/2007 00:00 Internet Explorer 20/09/2007 17:24 InterVideo 20/09/2007 17:25 Jasc Software Inc 24/10/2007 14:12 Java 20/09/2007 17:25 key 20/09/2007 17:25 Lauyan 21/09/2007 22:11 Macromedia 20/09/2007 17:26 Maïdo Production 24/09/2007 02:29 Messenger 20/09/2007 20:23 microsoft frontpage 20/09/2007 17:27 Microsoft Games 04/10/2007 14:05 Microsoft Office 24/09/2007 03:36 Microsoft SQL Server 04/10/2007 14:02 Microsoft.NET 20/09/2007 21:12 Motorola 20/09/2007 20:59 Movie Maker 03/11/2007 14:17 Mozilla Firefox 20/09/2007 17:27 MSI 20/09/2007 20:20 MSN Gaming Zone 20/09/2007 19:37 MSN Messenger 20/09/2007 17:28 MSXML 4.0 20/09/2007 17:28 Multimedia Mouse Driver 20/09/2007 17:28 MyXOFT 02/11/2007 18:57 Navilog1 20/09/2007 21:18 Nero 20/09/2007 22:03 NETGEAR 20/09/2007 22:56 NetMeeting 24/09/2007 03:26 ORKTools 24/09/2007 02:27 Outlook Express 03/11/2007 12:23 Panda Security 20/09/2007 22:03 plugins 20/09/2007 19:03 QuickTime 20/09/2007 22:03 QuickTime Alternative 20/09/2007 22:03 RADVideo 20/09/2007 21:09 Realtek 12/10/2007 23:42 Ripp-it_AM 20/09/2007 20:20 Services en ligne 20/09/2007 22:03 Skype 20/09/2007 22:03 Sony Ericsson 03/11/2007 12:25 Spybot - Search & Destroy 20/09/2007 22:04 StarV9 20/09/2007 22:04 STK014 20/09/2007 22:04 Symantec 02/11/2007 19:09 Tablet 20/09/2007 22:04 Thugs at Bay 31/10/2007 16:02 TimeAdjuster 01/11/2007 18:17 Trend Micro 20/09/2007 22:04 Ubisoft 20/09/2007 22:04 Uniblue 20/09/2007 22:04 URUSoft 20/09/2007 22:04 VideoLAN 05/11/2006 13:25 859 136 VirtualDub.exe 27/05/2007 22:05 144 VirtualDub.jobs 05/11/2006 13:25 186 624 VirtualDub.vdi 20/09/2007 22:04 Visicom Media 20/09/2007 22:04 VISoftware 19/05/2006 14:45 8 282 187 vlc-0.8.5-win32.exe 20/09/2007 22:04 VOB 20/09/2007 22:04 VSO 20/09/2007 22:04 Webteh 17/10/2007 17:39 Winamp 20/09/2007 22:05 WinASPI 20/09/2007 22:06 Windows Live 20/09/2007 22:06 Windows Media Connect 2 02/10/2007 19:25 Windows Media Player 20/09/2007 22:56 Windows NT 13/10/2007 23:32 WinRAR 20/09/2007 20:23 xerox 20/09/2007 22:06 XviD codec (Neodivx Version) 5 fichier(s) 9 328 903 octets 98 Rép(s) 64 918 704 128 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 787E-345B Répertoire de C:\Program Files\fichiers communs 03/11/2007 15:02 . 03/11/2007 15:02 .. 01/10/2007 10:32 Adobe 21/09/2007 02:13 Adobe Systems Shared 20/09/2007 21:21 Ahead 04/10/2007 14:05 DESIGNER 10/02/2006 10:16 278 528 FDEUnInstaller.exe 21/09/2007 22:10 InstallShield 20/09/2007 19:21 Java 20/09/2007 21:21 LightScribe 21/09/2007 22:12 Macromedia 04/10/2007 14:05 Microsoft Shared 20/09/2007 20:21 MSSoap 20/09/2007 21:16 ODBC 20/09/2007 20:21 Services 03/11/2007 15:03 Softwin 20/09/2007 21:16 SpeechEngines 04/10/2007 14:04 System 20/09/2007 22:21 Teleca Shared 20/09/2007 22:21 Wise Installation Wizard 1 fichier(s) 278 528 octets 19 Rép(s) 64 918 700 032 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 787E-345B Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders 04/10/2007 14:05 . 04/10/2007 14:05 .. 04/10/2007 14:04 1033 04/10/2007 14:04 1036 11/07/2003 09:15 1 292 872 MSONSEXT.DLL 15/07/2003 05:52 35 896 MSOSV.DLL 03/06/1999 13:09 122 937 MSOWS409.DLL 07/03/2001 08:00 127 033 MSOWS40c.DLL 11/07/2003 01:25 80 448 PKMWS.DLL 5 fichier(s) 1 659 186 octets 4 Rép(s) 64 918 700 032 octets libres c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Inst2\Cnmvsa.exe c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Inst2\helpkicker.exe c:\Documents and Settings\BEGNY\iexplorer.exe c:\Documents and Settings\BEGNY\Application Data\Microsoft\Installer\{885A63EA-382B-4DD4-A755-14809B8557D6}\ARPPRODUCTICON.exe c:\Documents and Settings\BEGNY\Application Data\Microsoft\Installer\{91057632-CA70-413C-B628-2D3CDBBB906B}\ARPPRODUCTICON.exe c:\Documents and Settings\BEGNY\Bureau\HijackThis.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\catchme.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\diff.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\dumphive.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\FilesInfoCmd.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\find2.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\Fport.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\grep.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\gzip.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\KProcCheck.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\LFiles.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\LISTDLLS.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\md5sums.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\pslist.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\streams.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp\swreg.exe c:\Documents and Settings\BEGNY\Bureau\DiagHelp ar.exe c:\Documents and Settings\BEGNY\Bureau\PACK OFFICE\SETUP.EXE c:\Documents and Settings\BEGNY\Bureau\PACK OFFICE\FILES\OWC10\SETUP.EXE c:\Documents and Settings\BEGNY\Bureau\PACK OFFICE\FILES\OWC11\SETUP.EXE c:\Documents and Settings\BEGNY\Bureau\PACK OFFICE\FILES\PFILES\COMMON\MSSHARED\DW\DW20.EXE c:\Documents and Settings\BEGNY\Bureau\PACK OFFICE\FILES\PFILES\COMMON\MSSHARED\DW\DWTRIG20.EXE c:\Documents and Settings\BEGNY\Bureau\PACK OFFICE\FILES\PFILES\MSOFFICE\OFFICE11\OFFCLN.EXE c:\Documents and Settings\BEGNY\Bureau\PACK OFFICE\FILES\SETUP\OSE.EXE c:\Documents and Settings\BEGNY\Bureau ip\setup.exe c:\Documents and Settings\BEGNY\Local Settings\Application Data\CDBurnerXP_Soft\cdbxpp.exe_Url_nfryvllqiqb1hla4nzefaejvhwflc2o0 c:\Documents and Settings\BEGNY\Mes documents\Mes documents\dossier melanie\Bt848RegTool.exe c:\Documents and Settings\BEGNY\Mes documents\Mes documents\dossier melanie\MoreTV32French2.exe c:\Documents and Settings\BEGNY\Mes documents\Mes documents\dossier melanie\Perfect Audio.exe c:\Documents and Settings\BEGNY\Mes documents\Mes documents\dossier melanie\Wilma.exe c:\Documents and Settings\BEGNY\Mes documents\Mes documents\dossier melanie\MeuhMeuhTV\MeuhMeuhTV.exe c:\Documents and Settings\BEGNY\Mes documents\Mes documents\dossier melanie\MeuhMeuhTV\Recorder.exe c:\Documents and Settings\BEGNY\Shared\Adobe Illustrator CS + serial\Adobe Illustrator CS\setup.exe c:\Documents and Settings\BEGNY\Shared\Adobe Illustrator CS2 + ssg keygen\_keygen\keygen.exe c:\Documents and Settings\BEGNY\Shared\Macromedia Studio 8 - Flash - Dreamweaver - Fireworks - Full Working - Tested with serial\Dreamweaver8-en.exe c:\Documents and Settings\BEGNY\Shared\Macromedia Studio 8 - Flash - Dreamweaver - Fireworks - Full Working - Tested with serial\Fireworks8-en.exe c:\Documents and Settings\BEGNY\Shared\Macromedia Studio 8 - Flash - Dreamweaver - Fireworks - Full Working - Tested with serial\Flash8-en.exe c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0404\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0404\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0404\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0405\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0405\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0405\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0406\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0406\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0406\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0407\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0407\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0407\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0408\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0408\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0408\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0409\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0409\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0409\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\040b\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\040b\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\040b\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\040c\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\040c\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\040c\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\040e\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\040e\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\040e\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0410\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0410\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0410\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0411\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0411\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0411\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0412\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0412\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0412\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0413\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0413\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0413\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0414\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0414\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0414\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0415\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0415\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0415\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0419\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0419\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0419\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\041D\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\041D\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\041D\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\041E\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\041E\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\041E\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\041F\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\041F\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\041F\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0804\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0804\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0804\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0816\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0816\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0816\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0c0a\CNMlr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0c0a\CNMsr78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200\LanguageModules\0c0a\CNMur78.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNM_0260.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMBR260.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMDRV.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMDUMP5.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMFUS.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMINST.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLMON2.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRCN.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRCZ.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRDE.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRDK.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRES.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRFI.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRFR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRGR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRHU.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRIT.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRJ.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRKR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRNL.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRNO.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRPL.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRPT.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRRU.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRSE.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRTH.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRTR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMLRTW.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMOP78.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMP_260.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMPCOMM.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMPD.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMPP.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMPV.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMQUEUE.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSMSD.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRCN.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRCZ.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRDE.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRDK.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRES.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRFI.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRFR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRGR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRHU.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRIT.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRJ.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRKR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRNL.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRNO.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRPL.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRPT.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRRU.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRSE.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRTH.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRTR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSRTW.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMSTMN.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMUI.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMUR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURCN.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURCZ.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURDE.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURDK.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURES.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURFI.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURFR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURGR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURHU.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURIT.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURJ.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURKR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURNL.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURNO.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURPL.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURPT.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURRU.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURSE.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURTH.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURTR.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMURTW.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMVS.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Driver2\CNMW3.DLL c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Inst2\cnmi040c.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Inst2\cnminst2.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Inst2\cnmis.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Inst2\cnmis4.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Inst2\cnmis5.dll c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP4200 Installer\Inst2\devid.dll c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll c:\Documents and Settings\All Users\Application Data\Nero\DrWeb\Drweb32.dll c:\Documents and Settings\BEGNY\Local Settings\Application Data\Macromedia\Flash 8\en\Configuration\External Libraries\FLfile.dll c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll ****** Fin du rapport DiagHelp Veuillez svp envoyer le fichier C:\upload_moi_BEGNY-GA1A4CHG2.tar.gz a l'adresse http://upload.malekal.com

dede4240 · Answer

[CODE] 2007-11-03,17:01:40 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed Follow item(s) have been choosed: All Boot Items (Including Registry, Startup Folders, Services and so on) Browser Add-ons Runing Processes (Including process model information) File Associations Winsock Provider Autorun.Inf HOSTS File Process Privileges Scan Boot Items Registry [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Google Inc] [(Verified)Microsoft Windows Publisher] <"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background> [(Verified)Microsoft Corporation] <"C:\Program Files\BitComet\BitComet.exe" /tray> [(Verified)Comet Network Technology Co Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Microsoft Windows Hardware Compatibility Publisher] [(Verified)Microsoft Windows Hardware Compatibility Publisher] [(Verified)Microsoft Windows Hardware Compatibility Publisher] [(Verified)Microsoft Windows Hardware Compatibility Publisher] [(Verified)Nero AG] <"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"> [(Verified)"Sun Microsystems, Inc."] <"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"> [(Verified)"Adobe Systems, Incorporated"] [CANON INC.] <"C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min> [Avira GmbH] <"C:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Publisher] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [Microsoft Corporation] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\Program Files\BitComet\BitComet.exe" /tray> [(Verified)Comet Network Technology Co Ltd.] <; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized> [(Verified)Skype Technologies SA] ================================== Startup Folders [Adobe Gamma Loader] C:\PROGRA~1\FICHIE~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]> ================================== Services [Adobe LM Service / Adobe LM Service][Stopped/Manual Start] <"C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe"> [AntiVir PersonalEdition Classic Scheduler / AntiVirScheduler][Running/Auto Start] <"C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe"> [AntiVir PersonalEdition Classic Guard / AntiVirService][Running/Auto Start] <"C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe"> [Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start] [Google Updater Service / gusvc][Running/Auto Start] <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"> [LightScribeService Direct Disc Labeling Service / LightScribeService][Running/Auto Start] <"C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe"> [NBService / NBService][Stopped/Manual Start] [NMIndexingService / NMIndexingService][Stopped/Manual Start] <"C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe"> [NMSAccessU / NMSAccessU][Running/Auto Start] [Syntek AVStream USB2.0 WebCam Service / StkSSrv][Running/Auto Start] [TabletService / TabletService][Running/Auto Start] ================================== Drivers [Atheros Wireless Network Adapter Service / AR5211][Running/Manual Start] [ASNDIS5 Protocol Driver / ASNDIS5][Running/Manual Start] <\??\C:\WINDOWS\ATK0100\ASNDIS5.SYS> [NDIS Miniport Driver for Attansic L2 Fast Ethernet Adapter / AtcL002][Stopped/Manual Start] [ati2mtag / ati2mtag][Running/Manual Start] [avgio / avgio][Running/System Start] <\??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys> [avgntflt / avgntflt][Running/Manual Start] <\??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys> [avipbb / avipbb][Running/System Start] [BDFsDrv / BDFsDrv][Stopped/Manual Start] <\??\C:\Program Files\Softwin\BitDefender10\bdfsdrv.sys> [BDRsDrv / BDRsDrv][Stopped/Manual Start] <\??\C:\Program Files\Softwin\BitDefender10\bdrsdrv.sys> [catchme / catchme][Running/Manual Start] <\??\C:\DOCUME~1\BEGNY\LOCALS~1\Temp\catchme.sys> [Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start] [Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start] [ATK0100 ACPI UTILITY / MTsensor][Running/Manual Start] <> [Pilote de liaison parallèle directe / Ptilink][Running/Manual Start] [PxHelp20 / PxHelp20][Running/Boot Start] <\SystemRoot\System32\Drivers\PxHelp20.sys> [USB Mass Stroage Device / RTSTOR][Running/Manual Start] [Secdrv / Secdrv][Stopped/Manual Start] [smserial / smserial][Running/Manual Start] [ssmdrv / ssmdrv][Running/System Start] [Syntek AVStream USB2.0 1.3M WebCam / StkCMini][Running/Manual Start] [Wacom Mouse Filter Driver / wacommousefilter][Running/Manual Start] [Wacom Virtual Hid Driver / wacomvhid][Running/Manual Start] [Virtual Keyboard Driver / WacomVKHid][Running/Manual Start] [Codec Teletext standard / WSTCODEC][Stopped/Manual Start] ================================== Browser Add-ons [BitComet Helper] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} [SSVHelper Class] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [Google Toolbar Helper] {AA58ED58-01DD-4d91-8333-CF10577473F7} [Google Toolbar Notifier BHO] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} [Java Plug-in 1.6.0_03] {08B0E5C0-4FCB-11CF-AAA5-00401C608501} [BitComet Button] {461CC20B-FB6E-4f16-8FE8-C29359DB100E} [&Rechercher] {92780B25-18CC-41C8-B9BE-3C9C571A8263} [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} [&Google] {2318C2B1-4965-11d4-9B18-009027A5CD4F} [Windows Genuine Advantage Validation Tool] {17492023-C23A-453E-A040-C7C580BBF700} [Java Plug-in 1.6.0_03] {8AD9C840-044E-11D1-B3E9-00805F499D93} [Java Plug-in 1.6.0_02] {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} [Java Plug-in 1.6.0_03] {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [Java Plug-in 1.6.0_03] {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [Google Script Object] {00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} [QuickTime Object] {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [Aide pour le lien d'Adobe PDF Reader] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [Windows Genuine Advantage Validation Tool] {17492023-C23A-453E-A040-C7C580BBF700} [InformationCardSigninHelper Class] {19916E01-B44E-4E31-94A4-4696DF46157B} [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} [&Google] {2318C2B1-4965-11D4-9B18-009027A5CD4F} [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} [] {28AEAED5-E434-468F-85BD-3D1A1BCCF761} [XML DOM Document] {2933BF90-7B36-11D2-B20E-00C04F983E60} [XSL Template] {2933BF94-7B36-11D2-B20E-00C04F983E60} [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} [HtmlDlgSafeHelper Class] {3050F819-98B5-11CF-BB82-00AA00BDCE0B} [Tabular Data Control] {333C7BC4-460F-11D0-BC04-0080C7055A83} [BitComet Helper] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} [QuickTime Object] {4063BE15-3B08-470D-A0D5-B37161CFFD69} [Microsoft Office Control] {4453D895-F2A1-4A38-A285-1EF9BD3F6D5D} [XML Document] {48123BC4-99D9-11D1-A6B3-00C04FD91555} [] {4F07F79F-087F-42CF-8B36-7A88D06088E9} [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} [isInstalled Class] {5852F5ED-8BF4-11D4-A245-0080C6F74284} [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} [Active Desktop Mover] {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A> [SSVHelper Class] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [Microsoft Web Browser] {8856F961-340A-11D0-A96B-00C04FD705A2} [Java Plug-in 1.6.0_03] {8AD9C840-044E-11D1-B3E9-00805F499D93} [Google Toolbar Helper] {AA58ED58-01DD-4D91-8333-CF10577473F7} [Google Toolbar Notifier BHO] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\System32\shdocvw.dll, N/A> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} [Java Plug-in 1.6.0_02] {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} [Java Plug-in 1.6.0_02] {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB} [Java Plug-in 1.6.0_02] {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} [Java Plug-in 1.6.0_03] {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [AUDIO__MID Moniker Class] {CD3AFA74-B84F-48F0-9393-7EDC34128127} [AUDIO__MP3 Moniker Class] {CD3AFA76-B84F-48F0-9393-7EDC34128127} [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [QuickTimeCheck Class] {DE4AF3B0-F4D4-11D3-B41A-0050DA2E6C21} [] {E1771B7F-98BE-407F-BA67-AA16ADA5D0C5} [XML HTTP Request] {ED8C108E-4349-11D2-91A4-00C04F7969E8} [] {F06608C7-1874-4EEA-B3B2-DF99EBB144B8} [XML DOM Document 3.0] {F5078F32-C551-11D3-89B9-0000F81FE221} [Free Threaded XML DOM Document 3.0] {F5078F33-C551-11D3-89B9-0000F81FE221} [XML Schema Cache 3.0] {F5078F34-C551-11D3-89B9-0000F81FE221} [XML HTTP 3.0] {F5078F35-C551-11D3-89B9-0000F81FE221} [XSL Template 3.0] {F5078F36-C551-11D3-89B9-0000F81FE221} [XML Data Source Object 3.0] {F5078F39-C551-11D3-89B9-0000F81FE221} [Free Threaded XML DOM Document] {F6D90F12-9C73-11D3-B32E-00C04F990BB4} [XML Data Source Object] {F6D90F14-9C73-11D3-B32E-00C04F990BB4} [XML HTTP] {F6D90F16-9C73-11D3-B32E-00C04F990BB4} [&D&ownload &with BitComet] [&D&ownload all video with BitComet] [&D&ownload all with BitComet] [E&xporter vers Microsoft Excel] ================================== Running Processes [PID: 516 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 568 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 600 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4158] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 644 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)] [PID: 660 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 812 / SYSTEM][C:\WINDOWS\System32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4158] [C:\WINDOWS\System32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2510] [C:\WINDOWS\System32\atipdlxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2515] [PID: 828 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 892 / SERVICE RÉSEAU][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 932 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [PID: 1000 / SERVICE RÉSEAU][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1032 / SERVICE LOCAL][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [PID: 1220 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4158] [C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2510] [C:\WINDOWS\system32\atipdlxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2515] [C:\WINDOWS\system32\ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4158] [PID: 1400 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\WINDOWS\system32\CNMLM78.DLL] [CANON INC., 1.90.2.61] [C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.1897.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD78.DLL] [CANON INC., 1.90.2.61] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0] [PID: 1524 / SYSTEM][C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe] [Avira GmbH, 7.00.00.82] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.dll] [Avira GmbH, 7.00.00.01] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\avevtlog.dll] [Avira GmbH, 7.00.00.20] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\guardmsg.dll] [Avira GmbH, 7.00.11.00] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\sqlite3.dll] [, 3, 3, 17, 1] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\AVPREF.DLL] [Avira GmbH, 7.00.02.02] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\SMTPLIB.DLL] [Avira GmbH, 1.02.00.17] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\AVPACK32.DLL] [Avira GmbH, 7.03.00.15] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\unacev2.dll] [N/A, ] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\AVEWIN32.DLL] [Avira GmbH, 7.6.0.30] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\avipc.dll] [Avira GmbH, 1.00.00.04] [PID: 1664 / BEGNY][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\WINDOWS\system32\WPDShServiceObj.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\PortableDeviceTypes.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 8.1.0.0] [C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA] [Adobe Systems, Inc., 8.0.0.0] [C:\Program Files\WinRAR arext.dll] [N/A, ] [C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll] [Nero AG, 2, 7, 3, 0] [C:\Program Files\Nero\Nero 7\Nero BackItUp\MFC71U.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Nero\Nero 7\Nero BackItUp\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Nero\Nero 7\Nero BackItUp\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll] [Avira GmbH, 7.00.00.10] [C:\WINDOWS\System32\StkCWIA.dll] [Syntek America Inc., 1.0.0.2] [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510] [PID: 404 / SYSTEM][C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe] [Avira GmbH, 7.00.00.62] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\schedr.dll] [Avira GmbH, 7.00.24.00] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\avevtlog.dll] [Avira GmbH, 7.00.00.20] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\sqlite3.dll] [, 3, 3, 17, 1] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\avipc.dll] [Avira GmbH, 1.00.00.04] [PID: 436 / SYSTEM][C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe] [Google, 2.2.824.5515.beta] [PID: 356 / SYSTEM][C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe] [Hewlett-Packard Company, 1.4.142.1] [C:\Program Files\Fichiers communs\LightScribe\LSSProxy.dll] [Hewlett-Packard Company, 1.4.142.1] [C:\Program Files\Fichiers communs\LightScribe\LSLog.dll] [Hewlett-Packard Company, 1.4.142.1] [PID: 772 / SYSTEM][C:\Program Files\CDBurnerXP\NMSAccessU.exe] [N/A, ] [PID: 1080 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1152 / SYSTEM][C:\WINDOWS\System32\StkCSrv.exe] [Syntek America Inc., 1.0.0.2] [PID: 1164 / SYSTEM][C:\WINDOWS\system32\Tablet.exe] [Wacom Technology, Corp., 6.0.4-4] [PID: 1516 / BEGNY][C:\WINDOWS\system32\WTablet\TabUserW.exe] [Wacom Technology, Corp., 6.0.4-4] [PID: 164 / SYSTEM][C:\WINDOWS\system32\Tablet.exe] [Wacom Technology, Corp., 6.0.4-4] [PID: 1568 / SERVICE LOCAL][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 2856 / BEGNY][C:\WINDOWS\ATK0100\HControl.exe] [, 1043, 2, 15, 65] [C:\WINDOWS\ATK0100\CMSSC.dll] [N/A, ] [C:\WINDOWS\ATK0100\inter_f2.dll] [ATK, 1043, 2, 15, 52] [C:\WINDOWS\ATK0100\ATKWLIOC.DLL] [ACTIONTEC Electronics,Inc, 2.01.02] [C:\WINDOWS\ATK0100\SiSPkt.dll] [Silicon Integrated Systems Corp., 1, 0, 0, 45] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\ATK0100\ASUSNET.dll] [, 1, 9, 9, 2] [C:\WINDOWS\ATK0100\ASW32N50.dll] [Printing Communications Assoc., Inc. (PCAUSA), 5.00.13.50] [PID: 2888 / BEGNY][C:\WINDOWS\RTHDCPL.EXE] [Realtek Semiconductor Corp., 2.1.5.7] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 2964 / BEGNY][C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe] [Motorola Inc., 6.12.04] [C:\Program Files\Motorola\SMSERIAL\sm56eng.dll] [Motorola Inc., 6.12.04] [C:\Program Files\Motorola\SMSERIAL\sm56fra.dll] [, ] [C:\Program Files\Motorola\SMSERIAL\sm56brz.dll] [, ] [C:\Program Files\Motorola\SMSERIAL\sm56chs.dll] [, ] [C:\Program Files\Motorola\SMSERIAL\sm56cht.dll] [, ] [C:\Program Files\Motorola\SMSERIAL\sm56ger.dll] [, ] [C:\Program Files\Motorola\SMSERIAL\sm56ita.dll] [, ] [C:\Program Files\Motorola\SMSERIAL\sm56jpn.dll] [, ] [C:\Program Files\Motorola\SMSERIAL\sm56esp.dll] [, ] [C:\Program Files\Motorola\SMSERIAL\sm56kor.dll] [, ] [C:\Program Files\Motorola\SMSERIAL\sm56dnk.dll] [, ] [PID: 2992 / BEGNY][C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe] [Sun Microsystems, Inc., 6.0.30.5] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [PID: 3036 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 3084 / BEGNY][C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe] [Avira GmbH, 7.02.00.16] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MFC71U.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\cclib.dll] [Avira GmbH, 7.02.00.03] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [c:\program files\avira\antivir personaledition classic\ccgen.dll] [Avira GmbH, 7.02.00.10] [c:\program files\avira\antivir personaledition classic\ccgenrc.dll] [Avira GmbH, 7.02.04.02] [c:\program files\avira\antivir personaledition classic\ccguard.dll] [Avira GmbH, 7.00.01.35] [c:\program files\avira\antivir personaledition classic\ccgrdrc.dll] [Avira GmbH, 7.00.06.00] [C:\Program Files\Avira\AntiVir PersonalEdition Classic\avipc.dll] [Avira GmbH, 1.00.00.04] [c:\program files\avira\antivir personaledition classic\ccupdate.dll] [Avira GmbH, 7.02.00.04] [c:\program files\avira\antivir personaledition classic\ccupdrc.dll] [Avira GmbH, 7.02.01.00] [c:\program files\avira\antivir personaledition classic\cclic.dll] [Avira GmbH, 7.02.00.04] [c:\program files\avira\antivir personaledition classic\cclicrc.dll] [Avira GmbH, 7.02.01.00] [c:\program files\avira\antivir personaledition classic\ccmsg.dll] [Avira GmbH, 7.00.00.00] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [PID: 3100 / BEGNY][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] [Google Inc., 2, 0, 301, 1654] [C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\gtn.dll] [Google Inc., 2, 1, 615, 5858] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll] [Google Inc., 2, 1, 615, 5858] [PID: 3128 / BEGNY][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 3156 / BEGNY][C:\Program Files\Windows Live\Messenger\msnmsgr.exe] [Microsoft Corporation, 8.5.1235.0517] [C:\Program Files\Windows Live\Messenger\MSNCore.dll] [Microsoft Corporation, 8.5.1235.0517] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\Program Files\Windows Live\Messenger\msidcrl40.dll] [Microsoft Corporation, 4.100.313.1] [C:\Program Files\Windows Live\Messenger\ContactsUX.dll] [Microsoft Corporation, 8.5.1235.0517] [C:\Program Files\Windows Live\Messenger\msgslang.8.5.1235.0517.dll] [Microsoft Corporation, 8.5.1235.0517] [C:\Program Files\Windows Live\Messenger\msgsres.dll] [Microsoft Corporation, 8.5.1235.0517] [C:\Program Files\Windows Live\Messenger\lcapi.dll] [Microsoft Corporation, 1.7.256.0 (RTC Version 4.3.5371.0) built by: msn8.0(rtbldlab)] [C:\WINDOWS\system32\msdmo.dll] [, ] [C:\Program Files\Windows Live\Messenger\lcres.dll] [Microsoft Corp., 1.7.109.0 (RTC Version 4.3.5371.0) built by: msn8.0(rtbldlab)] [C:\Program Files\Windows Live\Messenger\RTMPLTFM.dll] [Microsoft Corporation, 3.0.5774.0 built by: media_msn80] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Windows Live\Messenger\MSGSWCAM.dll] [Microsoft Corporation, 8.5.1235.0517] [C:\WINDOWS\system32\sirenacm.dll] [Microsoft Corp., 8.1.0178.00] [C:\WINDOWS\system32\StkCProp.ax] [Syntek America Inc., 1.0.0.2] [PID: 3200 / BEGNY][C:\Program Files\BitComet\BitComet.exe] [www.BitComet.com, 0.93] [C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 3404 / BEGNY][C:\WINDOWS\ATK0100\ATKOSD.exe] [, 1043, 2, 15, 63] [PID: 2580 / BEGNY][C:\Program Files\internet explorer\iexplore.exe] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\WINDOWS\system32\IEFRAME.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\WINDOWS\system32\IEUI.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)] [C:\WINDOWS\system32\xmllite.dll] [Microsoft Corporation, 1.00.1018.0] [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510] [C:\Program Files\Internet Explorer\ieproxy.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [c:\program files\google\googletoolbar1.dll] [Google Inc., 4, 0, 1601, 4978] [C:\Program Files\BitComet ools\BitCometBHO_1.1.8.30.dll] [BitComet, 20070830] [C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll] [Sun Microsystems, Inc., 6.0.30.5] [C:\Program Files\Java\jre1.6.0_03\bin\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll] [Google Inc., 2, 1, 615, 5858] [C:\WINDOWS\system32\ieapfltr.dll] [Microsoft Corporation, 7.0.6000.16461] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx] [Adobe Systems, Inc., 9,0,47,0] [PID: 7224 / BEGNY][C:\Documents and Settings\BEGNY\Bureau\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Documents and Settings\BEGNY\Bureau\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] ================================== File Associations .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock Provider N/A ================================== Autorun.Inf N/A ================================== HOSTS File 127.0.0.1 localhost ================================== Process Privileges Scan Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1524, C:\PROGRAM FILES\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\AVGUARD.EXE] Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3084, C:\PROGRAM FILES\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\AVGNT.EXE] ================================== API HOOK N/A ================================== Hidden Process N/A ================================== [/CODE]

dede4240 · Answer

le dernier hijackthis... pas trop ras le bol j'espère ;-) mille merci en tout cas ...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:02:56, on 03/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\StkCSrv.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\BEGNY\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.8.30.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] ; "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] ; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitComet] ; "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [Skype] ; "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B8B7581F-45BC-462C-8D2B-15CB7C159F03}: NameServer = 213.36.80.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkCSrv.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

FillPCA · Answer

Re,

Ca me semble pas mal. Comment le pc se porte-t-il ?

Fais ensuite ceci :

1/     *  Télécharge OTMoveIt  (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe
    * Double-clique sur OTMoveIt.exe pour lancer le programme,
    * Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste List Of Files/Folders to be moved" :

C:\WINDOWS\System32\bvxshpsx.ini
C:\WINDOWS\System32\jlxhesna.ini

    * Clique sur MoveIt! pour lancer la suppression,
    * Le résultat appraraîtra dans le cadre Results.
    * Clique sur Exit pour fermer le programme.
    * Poste le rapport qui est situé ici : C:\\_OTMoveIt\MovedFiles
    * Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

2/ Télécharge Ccleaner Basic https://www.ccleaner.com/ccleaner/download

Ouvre Ccleaner, clique sur "lancer le nettoyage".

3/ Télécharge AVGantispyware : https://www.avg.com/en-ww/free-antivirus-download
Tu l'installes.
Lance AVG Anti-Spyware et clique sur le bouton Mise à jour. Patiente.

Clique sur le bouton Analyse (de la barre d'outils)
Puis sur l'onglets Comment réagir, clique sur Actions recommandées. Sélectionne Quarantaine.
Reviens à l'onglet Analyse. Clique sur Analyse complète du système.
A la fin du scan, choisis l'option " Appliquer toutes les actions " en bas. Ensuite.
Clique sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware. 

4/     *  Fais un scan en ligne en cliquant ici : https://www.bitdefender.com/toolbox/
    * Tu dois réaliser le scan en utilisant Internet explorer. Une information apparait en haut, près de la barre d'état. Tu dois accepter et installer l'activeX proposé. La mise à jour de l'antivirus se lance.
    * Réalise un scan complet du système.
    * Sauvegarde le rapport en mode texte à l'issue du scan.

5/ Edite ces rapports : AVGantispyware, Bit defender et un nouveau rapport Hijackthis.

FillPCA

dede4240 · Answer

merde j'ai ait une erreur ... j'ai appuye sur clean up apres avoir collé les dossier:
C:\WINDOWS\System32\bvxshpsx.ini 
C:\WINDOWS\System32\jlxhesna.ini 
dsl :(

dede4240 · Answer

C:\WINDOWS\System32\bvxshpsx.ini moved successfully.
C:\WINDOWS\System32\jlxhesna.ini moved successfully.
File/Folder  not found.
 
Created on 11/03/2007 17:23:55

FillPCA · Answer

OK. Comment le pc se porte ?

FillPCA

dede4240 · Answer

bcp mieux j'ai l'impression... je n'ai pas compris un foutu mot de ce que vous avez pu faire mais je pense que ca lui afait plus que du bien .... ;) si ca peut m'eviter de perdre toute mes donnees ca serait fantastique...avec mon boulot, j'utilise enormement de dossier flash ...

FillPCA · Answer

Re,

Ne t'inquiète pas, on va sauver ton pc. Peux-tu passer à la suite (Ccleaner + AVGantispyware +bit defender) ?

FillPCA

dede4240 · Answer

c'est en cours mais c'est assez long pour ccleaner ( pas de soucis je patiente )
juste une question technique en attendant...
- dans la panique j'ai écouté les conseils du vendeur rue montgallet ce matin et j'ai sauvegardé par copier coller tous mes fichiers important sur mon disque dur externe... le pbm maintenant c'est  que si je rebranche ce disque dur externe sur mon ordi ( juste pour supprimer ces fichiers sauvegardés qui du coup ne me servent plus a rien) il y a un risque que les virus reviennent en courant le temps de la supppression non?
- pour le moment j'ai antivir ( que je viens d'installer avant j'avais avast) et le pare feu windows... est ce que ca vous semble convenable comme config pour parer aux eventuels prochaines attaques de virus ou me conseillez vous d'installer autre chose??
mille merci...

FillPCA · Answer

Re,

Les dernières étapes seront assez longues (notamment AVGantispyware et surtout le scan en ligne bit defender qui peut durer plusieurs heures, selon la taille du disque dur).

Je pense qu'il serait intéressant que tu réalises les scan d'AVGantispyware et de bit defender avec le disque dur externe branché.

On ne fait jamais de sauvegarde en cas d'infection. Il faut les faire avant...

Pour les conseils, je t'en donnerai quand tout sera propre. Le firewall de XP est minimaliste.

FillPCA

dede4240 · Answer

j'ai plein de message d'antivir qui apparaissent tou a coup : cest du au scan d'avg a votre avis ???

dede4240 · Answer

je coupe l'ntivurus les temps des scan ??? merci bcp

FillPCA · Answer

Re,
Inutile. Normalement, bit defender et Antivir sont compatibles.

Je reviens plus tard.

FillPCA

dede4240 · Answer

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	19:33:34 03/11/2007

 + Résultat de l'analyse:	



C:\Documents and Settings\BEGNY\Cookies\begny@atdmt[1].txt -> TrackingCookie.Atdmt : Nettoyé.


Fin du rapport

dede4240 · Answer

et voila le rapport bitdefender... merci et bonne soiree ;)


BitDefender Online Scanner
	

 
	

 

Scan report generated at: Sat, Nov 03, 2007 - 22:00:47

 
	

 
	

 

Scan path: C:\;D:\;E:\;F:\;
	

 
	

 

 
	

 
	

 

Statistics

Time
	

00:53:24

Files
	

304202

Folders
	

6467

Boot Sectors
	

2

Archives
	

2296

Packed Files
	

15899
	

 
	

 

Results

Identified Viruses
	

1

Infected Files
	

4

Suspect Files
	

0

Warnings
	

0

Disinfected
	

0

Deleted Files
	

4
	

 
	

 

Engines Info

Virus Definitions
	

860168

Engine build
	

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins
	

14

Archive plugins
	

38

Unpack plugins
	

7

E-mail plugins
	

6

System plugins
	

1
	

 
	

 

Scan Settings

First Action
	

Disinfect

Second Action
	

Delete

Heuristics
	

Yes

Enable Warnings
	

Yes

Scanned Extensions
	

*;

Exclude Extensions
	

 

Scan Emails
	

Yes

Scan Archives
	

Yes

Scan Packed
	

Yes

Scan Files
	

Yes

Scan Boot
	

Yes
	

 
	

 
 

Scanned File
	

 Status

C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP61\A0014706.exe=>(NSIS o)=>zlib_nsis0003
	

Detected with: Adware.TTC.B

C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP61\A0014706.exe=>(NSIS o)=>zlib_nsis0003
	

Disinfection failed

C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP61\A0014706.exe=>(NSIS o)=>zlib_nsis0003
	

Deleted

C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP61\A0014706.exe=>(NSIS o)
	

Update failed

C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP62\A0014870.exe=>(NSIS o)=>zlib_nsis0003
	

Detected with: Adware.TTC.B

C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP62\A0014870.exe=>(NSIS o)=>zlib_nsis0003
	

Disinfection failed

C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP62\A0014870.exe=>(NSIS o)=>zlib_nsis0003
	

Deleted

C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP62\A0014870.exe=>(NSIS o)
	

Update failed

C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP65\A0015553.exe=>(NSIS o)=>zlib_nsis0003
	

Detected with: Adware.TTC.B

C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP65\A0015553.exe=>(NSIS o)=>zlib_nsis0003
	

Disinfection failed

C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP65\A0015553.exe=>(NSIS o)=>zlib_nsis0003
	

Deleted

C:\System Volume Information\_restore{1A8E027C-D601-467A-ABBC-00C5EF01FCC8}\RP65\A0015553.exe=>(NSIS o)
	

Update failed

C:\upload_moi_BEGNY-GA1A4CHG2.tar.gz=>upload_moi.tar=>qoobox/Quarantine/C/WINDOWS/system32/e1/caws83122.exe.vir=>(NSIS o)=>zlib_nsis0003
	

Detected with: Adware.TTC.B

C:\upload_moi_BEGNY-GA1A4CHG2.tar.gz=>upload_moi.tar=>qoobox/Quarantine/C/WINDOWS/system32/e1/caws83122.exe.vir=>(NSIS o)=>zlib_nsis0003
	

Disinfection failed

C:\upload_moi_BEGNY-GA1A4CHG2.tar.gz=>upload_moi.tar=>qoobox/Quarantine/C/WINDOWS/system32/e1/caws83122.exe.vir=>(NSIS o)=>zlib_nsis0003
	

Deleted

C:\upload_moi_BEGNY-GA1A4CHG2.tar.gz=>upload_moi.tar=>qoobox/Quarantine/C/WINDOWS/system32/e1/caws83122.exe.vir=>(NSIS o)
	

Update failed

dede4240 · Answer

j oubliais le hijack this...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:11:02, on 03/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\StkCSrv.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\internet explorer\iexplore.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\BEGNY\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.8.30.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] ; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [Skype] ; "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B8B7581F-45BC-462C-8D2B-15CB7C159F03}: NameServer = 213.36.80.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkCSrv.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

FillPCA · Answer

Re,

1/ Supprime ceci : C:\upload_moi_BEGNY-GA1A4CHG2.tar.gz
Puis vide ta corbeille.

2/ Tu dois désactiver puis réactiver la restauration système. Pour cela, fais un clic droit sur « poste de travail ». Dans l’onglet « restauration du système », coche la case « désactiver la restauration système ». Clique sur appliquer.
Décoche cette case, clique sur appliquer>OK et redémarre le PC.

As-tu toujours des soucis ? Sinon, je te donne les derniers conseils.

FillPCA

FillPCA · Answer

Re,

Si tu n'as plus de problème, je te conseille d'installer au minimum un firewall. Je te conseille Comodo, mais il y en a d'autres qui sont aussi très bien.

Tu trouveras des liens intéressants ici : http://perso.orange.fr/Le-site-de-Fill/S%E9curit%E9/Logiciels%20de%20protection.html

N'oublie pas d'indiquer ton sujet comme "résolu" si tu n'as plus de problème, et avec les 60 € économisés, tu t'achèteras quelques bonnes bouteilles !

Boone nuit !

FillPCA

dede4240 · Answer

bonsoir,
 j'ai suivis toutes vos indication, et j'ai installé le nouveau parefeu...le pc ronronne a nouveau et je n'ai , semble il, plus de pbm... j'ai une derniere question cependant: quand dois-je reactiver la restauration systeme? je pense que je peux le faire maintenant car j'ai redemarré le pc en mode "restauration systeme desactivé"
   je souhaite vous remercier tout spécialement d'avoir pris autant de votre  temps pour m'aider, les gens comme vous se font rare de nos jours... vous n'imaginez pas de quelle situation vous m'avez sorti... je bosse depuis deux mois sur un projet flash a raison de 12 a 15 H par jour et je n'ai , bêtement pas pensé a sauvegarder mes donnés ailleurs... imaginez l'angoisse ce matin quand j'ai appris que je devais tout effacer... ce que vous m'avez fait faire relève a mes yeux plus du tour de passe passe qu'autre chose et j'admire la facilité avec laquelle vous êtes parvenu a me faire effectuer toutes ces manips complexes... 
encore un immense merci pour votre bienveillance...

FillPCA · Answer

Bonjour,

Content d'avoir pu t'aider. Il faut en effet réactiver la restauration système et redémarrer le pc.
La protection d'un pc est nécessaire mais il faut surtout être prudent dans son surf : ne pas ouvrir de mails d'expéditeurs inconnus, pas de p2p, pas de cracks , ne pas installer n'importe quel programme et toujours le télécharger sur le site de l'éditeur s'il est fiable => 95 % des problèmes sont éliminés.

Pense à faire des sauvegardes régulières de tes documents. Enfin, un logiciels de restauration d'image système peut être utile en cas de gros pépin ou de plantage.

Bon surf !

FillPCA

Cheval de troie

42 réponses

Votre réponse

Discussions similaires

Newsletters