Virus ISTbar +Inconnu

Question

Bonjour,

En lancant le yahoo anti spy de mozilla jai toujour le meme probleme qui revient, l'highacker "ISTbar".Je l'ai supprimé maintes et maintes fois et il reviens toujour :-( .Je me suis dejà renseigné et essayé les différentes solutions comme rescanner en mode sans echec ou utiliser le "fxISTbar" de symantec mais rien n'y fait.
De plus il m'est impossible d'aller sur IE et faire de scan en ligne car le navigateur minforme que je possede un espion ou un malware menpêchant d'y acceder.De plus on ma recommandé de réinstaller kaspersky 7.0 mais impossible cela me met "le programme d'instalation va fermer, cause: erreur fatale".
il m'est impossible d'aller sur windows update pour les mises à jour...
Et impossible de faire des recherches sur l'utilitaire du menu démarrer...ya juste le petit chien
Donc est-ce ce ISTbar qui bloque tout ou un autre virus plus important....
Je ne suis pas tres fort en informatique donc voila...
en attente dune reponse ...salutaion a vous
Je possede spybot shearch&destroy 1.5
Avast édition familiale v4.7
cc cleaner
tune up utilities
a-squarred 3.0

lolo · Answer

hak

Lyonnais92 · Answer

Bonjour, 

1) Clique sur ce lien 
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe 
pour télécharger le fichier d'installation d'HijackThis.

Enregistre HJTInstall.exe sur ton bureau.  

Double-clique sur HJTInstall.exe pour lancer le programme

Par défaut, il s'installera là : 
C:\Program Files\Trend Micro\HijackThis

Accepte la license en cliquant sur le bouton "I Accept"

Choisis l'option "Do a system scan and save a log file"

Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note

Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport

Colle le rapport que tu viens de copier sur ce forum

Ne fixe encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement


Tutoriaux : http://pageperso.aol.fr/balltrap34/demohijack.htm (ne fixe rien pour le moment !!)
             http://cybersecurite.xooit.com/t138-HijackThis-2-0-2.htm 

2) Clique sur ce lien : 
http://www.alt-shift-return.org/Info/GenProc-HowTo.html 

ensuite, clique sur celui-ci et exécute le tuto du lien ci-dessus 
http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip 

Poste le rapport dans ta réponse. 

Ne commence pas à mettre en oeuvre les recommandations.
@+

AlexX · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:10:59, on 30/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\DOCUME~1\alexX\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=;gopher=;http=196.202.252.244:80;https=;socks=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - (no file)
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: OFFICE One Startup v7.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O21 - SSODL: printers - {856A5D3B-2576-4253-B42A-DBC6FAC47FBD} - libcintles3.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\swdsvc.exe (file missing)

AlexX · Answer

merci pour ta reponse lyonnais92

AlexX · Answer

Et voici apres tous ce que tu ma recommandé de faire : le  nouveau rapport HijackThis puis , suivant le rapport NaviPromo.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:52:12, on 30/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\DOCUME~1\alexX\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=;gopher=;http=196.202.252.244:80;https=;socks=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - (no file)
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: OFFICE One Startup v7.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O21 - SSODL: printers - {856A5D3B-2576-4253-B42A-DBC6FAC47FBD} - libcintles3.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\swdsvc.exe (file missing)

AlexX · Answer

Rapport Navipromo.bat 0.73 effectué le 30/11/2007 à 18:37:49,95
C:\Documents and Settings\alexX\Bureau
L'opération se déroule en mode sans échec sous le compte "alexX" 

** Recherche...

1/ iyrupte trouvé, recherche de iyrupte* 
C:\WINDOWS\system32\iyrupte.exe
C:\WINDOWS\system32\iyrupte.dat
C:\WINDOWS\system32\iyrupte_nav.dat
C:\WINDOWS\system32\iyrupte_navps.dat


------------------
Fin du rapport de recherche
Adware Navipromo trouvé 1 fois avec cette méthode 

################################################

** Nettoyage...

1/ Déplacement de iyrupte* vers C:\Navipromo\Backups...
C:\WINDOWS\System32\iyrupte* déplacé avec succès !

 ------------------
Aucune entrée de registre n'a été trouvée 
 

* Backups :

C:\Navipromo\Backups\HKLMRun.reg
C:\Navipromo\Backups\HKCURun.reg
C:\Navipromo\Backups\Uninstall.reg
C:\Navipromo\Backups\ARPCache.reg
C:\Navipromo\Backups\iyrupte.exe
C:\Navipromo\Backups\iyrupte.dat
C:\Navipromo\Backups\iyrupte_nav.dat
C:\Navipromo\Backups\iyrupte_navps.dat
C:\Navipromo\Backups\pack.epk

Ajout d'extension .off aux backups

## Fin du rapport de Suppression
 
-------------

Rapport Navipromo.bat 0.73 effectué le 30/11/2007 à 18:39:29,14
L'opération se déroule en mode sans échec sous le compte "alexX" 

## Suppression Heuristique 

* Backups :


Aucun résultat par la recherche heuristique  
 

## Fin du rapport Heuristique

AlexX · Answer

Et voici apres tous ce que tu ma recommandé de faire : le  nouveau rapport HijackThis puis , suivant le rapport NaviPromo.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:52:12, on 30/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\DOCUME~1\alexX\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=;gopher=;http=196.202.252.244:80;https=;socks=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - (no file)
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: OFFICE One Startup v7.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O21 - SSODL: printers - {856A5D3B-2576-4253-B42A-DBC6FAC47FBD} - libcintles3.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\swdsvc.exe (file missing)

AlexX · Answer

Et voici apres tous ce que tu ma recommandé de faire : le  nouveau rapport HijackThis puis , suivant le rapport NaviPromo.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:52:12, on 30/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\DOCUME~1\alexX\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=;gopher=;http=196.202.252.244:80;https=;socks=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - (no file)
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: OFFICE One Startup v7.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O21 - SSODL: printers - {856A5D3B-2576-4253-B42A-DBC6FAC47FBD} - libcintles3.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\swdsvc.exe (file missing)

Lyonnais92 · Answer

re,

j'avais demandé le rapport de GenProc.


Télécharge MSNFix.zip (de !aur3n7) sur ton bureau:
http://sosvirus.changelog.fr/MSNFix.zip

Décompresse-le (clic droit >> Extraire ici) et place les fichiers dans C:\MSNFix (très important).

Double cliquer sur le fichier MSNFix.bat.
- Exécutez l'option R.
-- Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage

Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal

- Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.txt

exXelior · Answer

escuse moi j'ai bêtement suivie les recommendation de GenProc.enfin...
tu voulais le rapport de MSNFix? le voici.
MSNFix 1.596  
 
C:\MSNFix 
Fix exécuté le 30/11/2007 - 19:42:28,75 By alexX 
mode normal    
    
************************ Recherche les fichiers présents      
    
Aucun Fichier trouvé 
 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
 
 
************************ Suppression des fichiers       
    
 
 
 
************************ Nettoyage du registre 
 
 
 
************************ Fichiers suspects 
 
Aucun Fichier trouvé 
 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 30112007_19433660.zip
 
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------

exXelior · Answer

Merci  pour tout cela mais je ne peux toujour pas aller sur windows update via internet explorer.Il me dit cela "Désolés...
... nous ne pouvons pas traiter votre requête pour le moment. Un virus informatique ou un spyware (logiciel espion) nous envoie des requêtes automatiques, et il semble que votre ordinateur ou votre réseau soit infecté. 


L’accès sera rétabli dès que possible ; essayez de nouveau ultérieurement. En attendant, nous vous conseillons d’utiliser un antivirus ou un anti-spyware afin de vous assurer que votre ordinateur n’est pas infecté par un virus ou un logiciel espion. 

Nous vous prions de nous excuser pour ce désagrément et espérons vous revoir bientôt sur Google. "

donc voila si tu pourrais me donner dautre recommendation je ten remercie par avance.

exXelior · Answer

pour information lorsque je demarre un scan minutieux avec avast il maffiche un rapport a la fin du scan stipulant quil na pu scanner tel ou tel repertoire...

Lyonnais92 · Answer

Re

désactive le tea timer de Spybot.

esaye de faire les MAj de Windows.

Fais un scan en ligne Kaspersky avec Internet Explorer :
- Clique sur Démarrer Online-Scanner

- Clique maintenant sur J'accepte.
- Valide l'installation d'un ou de plusieurs ActiveX si c'est nécessaire.
- Patiente pendant l'installation des Mises à jour.
- Choisis par la suite l'analyse du Poste de travail.
- Sauvegarde puis colle le rapport généré en fin d'analyse.

AIDE : Configurer le contrôle des ActiveX

NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte toi sur le site de Kaspersky pour retenter le scan en ligne.

exXelior · Answer

impossible de faire les mise a jours sur windows update ni de se conecter au site kaspersky avec IE

Lyonnais92 · Answer

Re,

fais le scan avec Avast et poste le rapport.

exXelior · Answer

bon et bien a mon grand etonnement il n'y a plus de probleme de repertoire avec avast...Mais en attendant le scan jai regardé un peu le forum et il est plusieurs fois mentionné qu'avast est un mauvais utilitaire et quil fallait mieux prendre antivir ce que je vais faire...
En attendant jai toujour ce probleme de windows update etc...

Lyonnais92 · Answer

Re,

ouvre ce lien, télécharge zeb restore et exécute les items qui correspondent à tes problèmes.

http://telechargement.zebulon.fr/zeb-restore.html

Des améliorations ?

Qu'en est il de Istbar ?

exXelior · Answer

je fais un scan avec  antivir et il me trouve deja un trojan horse appelé TR/Dropper.Gen.
Plus de IST bar dans le yahoo anti spy...
Cependant toujour ce probleme de connexion a windows update... puis pas possible dutiliser lutilitaire de recherche sur le menu démarrer ya que le petit chien ,le reste ,la ou est normalement marqué "taper le nom du fichier rechercher",est vide!!!

exXelior · Answer

rien a faire meme avec Zeb restore sa marche pas...Toujour ce probleme de virus detecté par google.
De plus quand je clic direct sur le lien Windows update du menu demarrer la page IE souvre et reste blanche avec marqué terminé en bas a droite...
Que faire!!!!?

exXelior · Answer

voici le rapport du scan antivir si jamais

AntiVir PersonalEdition Classic
Report file date: vendredi 30 novembre 2007 22:45

Scanning for 955520 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: ACER-C1A4DB9544

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 30/11/2007 21:41:16
AVSCAN.DLL : 7.0.6.0 49192 Bytes 30/11/2007 21:41:16
LUKE.DLL : 7.0.5.3 147496 Bytes 30/11/2007 21:41:16
LUKERES.DLL : 7.0.6.1 10280 Bytes 30/11/2007 21:41:16
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 21:41:16
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 21:41:16
ANTIVIR2.VDF : 7.0.1.30 1575424 Bytes 30/11/2007 21:41:16
ANTIVIR3.VDF : 7.0.1.31 2048 Bytes 30/11/2007 21:41:16
AVEWIN32.DLL : 7.6.0.34 3125760 Bytes 30/11/2007 21:41:16
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:28
AVPREF.DLL : 7.0.2.2 25640 Bytes 30/11/2007 21:41:16
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 30/11/2007 21:41:16
AVREG.DLL : 7.0.1.6 30760 Bytes 30/11/2007 21:41:16
AVARKT.DLL : 1.0.0.20 278568 Bytes 30/11/2007 21:41:14
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 30/11/2007 21:41:14
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:44
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 30/11/2007 21:41:08
RCTEXT.DLL : 7.0.62.0 86056 Bytes 30/11/2007 21:41:08
SQLITE3.DLL : 3.3.17.1 339968 Bytes 30/11/2007 21:41:16

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: E:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: vendredi 30 novembre 2007 22:45

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'WUAUCLT.EXE' - '1' Module(s) have been scanned
Scan process 'WkCalRem.exe' - '1' Module(s) have been scanned
Scan process 'Acer.Empowering.Framework.Launcher.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'CTDetect.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'igfxext.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'HKCMD.EXE' - '1' Module(s) have been scanned
Scan process 'RtkBtMnt.exe' - '1' Module(s) have been scanned
Scan process 'OpWareSE4.exe' - '1' Module(s) have been scanned
Scan process 'ElkCtrl.exe' - '1' Module(s) have been scanned
Scan process 'CameraAssistant.exe' - '1' Module(s) have been scanned
Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned
Scan process 'QtZgAcer.EXE' - '1' Module(s) have been scanned
Scan process 'unsecapp.exe' - '1' Module(s) have been scanned
Scan process 'ePower_DMC.exe' - '1' Module(s) have been scanned
Scan process 'ePresentation.exe' - '1' Module(s) have been scanned
Scan process 'eDSloader.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'eRAgent.exe' - '1' Module(s) have been scanned
Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned
Scan process 'AGRSMMSG.EXE' - '1' Module(s) have been scanned
Scan process 'RUNDLL32.EXE' - '1' Module(s) have been scanned
Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned
Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned
Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned
Scan process 'ALG.EXE' - '1' Module(s) have been scanned
Scan process 'WMIAPSRV.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned
Scan process 'AluSchedulerSvc.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'CTSVCCDA.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'MemCheck.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned
Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned
Scan process 'EvtEng.exe' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'MsMpEng.exe' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'LSASS.EXE' - '1' Module(s) have been scanned
Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned
Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned
Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned
Scan process 'SMSS.EXE' - '1' Module(s) have been scanned
62 processes with 62 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'E:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '57' files ).

Starting the file scan:

Begin scan in 'C:\' <ACER>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\pijvfuyo.exe
[DETECTION] Is the Trojan horse TR/Dropper.Gen
[INFO] The file was deleted!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
C:\system volume information\_restore{5086CBA9-07CE-4129-B9F1-C36818E60F61}\RP2\A0000382.exe
[DETECTION] Is the Trojan horse TR/Dropper.Gen
[INFO] The file was moved to '478089da.qua'!
Begin scan in 'E:\' <ACERDATA>

End of the scan: vendredi 30 novembre 2007 23:13
Used time: 28:09 min

The scan has been done completely.

4873 Scanning directories
289487 Files were scanned
2 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
1 files were deleted
0 files were repaired
1 files were moved to quarantine
0 files were renamed
3 Files cannot be scanned
289485 Files not concerned
8210 Archives were scanned
3 Warnings
3 Notes

Lyonnais92 · Answer

Re,

Tu sembles ne pas avoir de parefeu contrôlant les connexions sortantes, ce qui est un risque de sécurité.

Si c'est le cas tu as le choix entre ces deux possibilités :

Zone Alarm Tuto et lien de téléchargement ici :
https://www.malekal.com/tutoriel-zonealarm-firewall/

Kerio Tuto et lien de téléchargement ici :
http://www.malekal.com/kerio_firewall.php

Il y en a d'autres que tu peux trouver en ouvrant ce lien :
http://www.malekal.com/menu_tutorials_logiciels.php 

Il faut que tu désactives le parefeu de Windows (panneau de configuration, parefeu de Windows) après le téléchargement et avant l'installation (déconnecte toi du Net à ce moment là).

Par contre, tu as des restes de Norton.

utilise le désinstallateur :

http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924

Poste le rapport de Antivir quand il est terminé.

Lyonnais92 · Answer

Re,

on s'est croisé.

Ensuite, tu fais ça :

Clique sur ce lien :
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
pour télécharger navilog1.exe.

Choisis Enregistrer

et enregistre-le sur ton bureau.

Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

Laisse-toi guider. Au menu principal, choisis 1 et valides.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité du rapport dans ta réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)

exXelior · Answer

et voila navilog.Par contre je nai pas téléchargé de firewall ayant deja spybot et a-squarred! n'est-ce pas suffisant?

Search Navipromo version 3.3.6 commencé le 30/11/2007 à 23:49:10,89

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 14.11.2007 à 18h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.13 


*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\alexX\Application Data ***


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDÉ~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun fichier trouvé dans :

- C:\WINDOWS\system32
- C:\DOCUME~1\ALEXX\LOCALS~1\APPLIC~1



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans C:\DOCUME~1\ALEXX\LOCALS~1\APPLIC~1 *



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé ! 

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

2)Recherche Heuristique :



3)Recherche Certificats :

Certificat Egroup trouvé !


*** Analyse terminée le 30/11/2007 à 23:49:36,03 ***

Lyonnais92 · Answer

Re,

un firewall te permet de controller les programmes qui veulent accéder à internet. Pour certains, c'est normal. Pour d'autres non.

cela n'a rien à voir avec des antispywares qui ont pour charge de supprimer des fichiers nocifs.

Supprime navilog;

Télécharge Superantispyware (SAS) en cliquant sur ce lien :

https://www.superantispyware.com/superantispywarefreevspro.html

Choisis "enregistrer" et enregistre-le sur ton bureau.

Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions.

Créé une icône sur le bureau.

Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer.

- Si l'outil te demande de mettre à jour le programme ("update the program definitions", clique sur yes.
- Sous Configuration and Preferences, clique sur le bouton "Preferences"
- Clique sur l'onglet "Scanning Control "
- Dans "Scanner Options ", assure toi que la case devant lles lignes suivantes est cochée :

Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
- Laisse les autres lignes décochées.

- Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle.

- Dans la fenêtre principale, clique, dans "Scan for Harmful Software", sur "Scan your computer".

Dans la colonne de gauche, coche   C:\Fixed Drive.

Dans la colonne de droite, sous "Complete scan", clique sur "Perform Complete Scan"

Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan.

A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK.

Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next".

Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes.

Pour recopier les informations sur le forum, fais ceci :

- après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS.
- Clique sur "Preferences" puis sur l'onglet "Statistics/Logs ".
- Dans "scanners logs", double-clique sur SUPERAntiSpyware Scan Log.

- Le rapport va s'ouvrir dans ton éditeur de texte par défaut.

- Copie son contenu dans ta réponse

exXelior · Answer

et voila ;

SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 12/01/2007 at 00:47 AM

Application Version : 3.9.1008

Core Rules Database Version : 3259
Trace Rules Database Version: 1270

Scan type       : Complete Scan
Total Scan Time : 00:29:29

Memory items scanned      : 688
Memory threats detected   : 0
Registry items scanned    : 5851
Registry threats detected : 0
File items scanned        : 29604
File threats detected     : 0

Lyonnais92 · Answer

Re,

télécharge combofix (par sUBs)ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe


et enregistre le sur le bureau.

2 double-clique sur combofix.exe et suis les instructions

3 à la fin, il va produire un rapport C:\ComboFix.txt

4 copie/colle ce rapport dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

exXelior · Answer

et voila le rapport comboFix , ComboFix 07-11-19.4C - alexX 2007-12-01 1:00:13.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.349 [GMT 1:00] Running from: C:\Documents and Settings\alexX\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers pf.sys C:\WINDOWS\system32\packet.dll C:\WINDOWS\system32\pthreadVC.dll C:\WINDOWS\system32\WanPacket.dll C:\WINDOWS\system32\wpcap.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_NPF -------\NPF ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-01 to 2007-12-01 )))))))))))))))))))))))))))))))))))) . 2007-12-01 00:14 d-------- C:\Program Files\SUPERAntiSpyware 2007-12-01 00:14 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2007-12-01 00:14 d-------- C:\Documents and Settings\alexX\Application Data\SUPERAntiSpyware.com 2007-11-30 23:47 d-------- C:\Program Files\Navilog1 2007-11-30 23:24 d-------- C:\Program Files\Zone alarm 2007-11-30 22:38 d-------- C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic 2007-11-30 19:41 d-------- C:\MSNFix 2007-11-30 18:43 d-------- C:\WINDOWS\system32\bfubackups 2007-11-30 18:38 d-------- C:\Navipromo 2007-11-30 18:22 d-------- C:\Program Files\BFU 2007-11-30 18:10 d-------- C:\Program Files\Trend Micro 2007-11-30 17:33 d-------- C:\Program Files\Alwil Software 2007-11-30 17:33 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-11-30 17:33 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-11-30 16:52 d-------- C:\kav 2007-11-30 14:42 d-------- C:\Documents and Settings\alexX\Application Data\PC Tools 2007-11-30 14:42 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-30 14:42 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-30 14:42 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-30 14:42 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-30 14:42 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-30 14:36 d-------- C:\Program Files\a-squared Free 2007-11-26 16:02 d-------- C:\WINDOWS\Sun 2007-11-16 19:33 d-------- C:\Documents and Settings\alexX\Application Data\OpenOffice.org2 2007-11-16 19:28 d-------- C:\Program Files\OpenOffice.org 2.3 2007-11-16 19:27 d-------- C:\Program Files\Java 2007-11-16 19:27 d-------- C:\Program Files\Fichiers communs\Java 2007-11-14 11:54 45,568 --a------ C:\WINDOWS\UniFish3.exe 2007-11-07 14:11 d-------- C:\Documents and Settings\All Users\Application Data\Creative 2007-11-07 14:08 d-------- C:\Documents and Settings\alexX\Application Data\Creative 2007-11-07 14:03 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx 2007-11-07 14:03 41,984 --------- C:\WINDOWS\Ctregrun.exe 2007-11-07 14:01 71,596 --------- C:\WINDOWS\system32\drivers\PfModNT.sys 2007-11-07 13:58 d-------- C:\Program Files\Creative 2007-11-07 13:58 229,376 --a------ C:\WINDOWS\system32\CTPmsMan.dll 2007-11-07 13:58 200,704 --a------ C:\WINDOWS\system32\CTPdeSrv.exe 2007-11-07 13:58 149,504 --a------ C:\WINDOWS\UNWISE.EXE 2007-11-07 13:58 143,360 --a------ C:\WINDOWS\system32\CTPmsWma.dll 2007-11-07 13:58 45,056 --a------ C:\WINDOWS\system32\Jb4Inst.crl 2007-11-07 13:58 32,768 --a------ C:\WINDOWS\system32\PdePgHlp.dll 2007-11-07 13:58 28,672 --a------ C:\WINDOWS\system32\PdeSrvps.dll 2007-11-07 13:58 28,672 --a------ C:\WINDOWS\system32\Jb4Inst.dll 2007-11-07 13:58 16,880 --a------ C:\WINDOWS\system32\drivers\ctpdusb.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-28 13:53 --------- d-----w C:\Documents and Settings\acer\Application Data\TuneUp Software 2007-10-25 16:43 8,516,608 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-25 13:46 --------- d-----w C:\Documents and Settings\alexX\Application Data\RegistrySmart 2007-10-22 11:58 --------- d-----w C:\Program Files\DAEMON Tools 2007-10-22 11:55 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-21 14:13 --------- d-----w C:\Program Files\splus 2007-10-09 17:01 --------- d-----w C:\Program Files\TuneUp Utilities 2007 2007-10-09 17:00 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2007-10-09 16:23 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-10-09 16:23 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2007-10-09 16:23 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-10-09 16:23 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-10-07 20:26 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-10-07 18:39 --------- d-----w C:\Program Files\Ubisoft 2007-09-26 14:44 69,689 ----a-w C:\WINDOWS\UNZIP.DLL 2007-09-26 14:44 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL 2007-09-26 14:44 286,720 ----a-w C:\WINDOWS\PATCH.EXE 2007-09-10 08:15 920,088 ----a-w C:\WINDOWS\system32\igxpun.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 05:00] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 13:24] "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:55 C:\WINDOWS\system32\bthprops.cpl] "LaunchApp"="Alaunch" [] "AGRSMMSG"="AGRSMMSG.exe" [2005-12-13 21:50 C:\WINDOWS\AGRSMMSG.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-07-19 09:42 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-07-19 09:42 C:\WINDOWS\SkyTel.exe] "AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-07-19 09:41] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-29 06:13] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "ntiMUI"="C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7 tiMUI.exe" [2006-05-15 11:15] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 05:00] "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 05:00] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00] "eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 15:00] "Acer ePresentation HPD"="C:\Acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-06-07 20:18] "ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-07-12 15:48] "Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 22:12] "LManager"="C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE" [2006-07-14 12:13] "eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 14:40] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2006-06-23 10:39] "LogitechCameraAssistant"="C:\Program Files\Acer\OrbiCam\CameraAssistant.exe" [2006-06-26 15:47] "LogitechVideo[inspector]"="C:\Program Files\Acer\OrbiCam\InstallHelper.exe" [2006-06-26 15:55] "LogitechCameraService(E)"="C:\WINDOWS\system32\ElkCtrl.exe" [2004-11-01 18:22] "SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 13:16] "OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 12:45] "WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2000-07-12 12:59] "Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2000-07-12 14:14] "Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [2000-08-04 03:01] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-08-24 11:01] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-08-24 11:01] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-08-24 11:00] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-06-14 18:32] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-30 22:41] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 05:00] "DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38] [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll C:\WINDOWS\system32\klogon.dll 2007-06-26 16:53 206088 C:\WINDOWS\system32\klogon.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys R2 EpmPsd;Acer EPM Power Scheme Driver;\??\C:\WINDOWS\system32\drivers\epm-psd.sys R2 EpmShd;Acer EPM System Hardware Driver;\??\C:\WINDOWS\system32\drivers\epm-shd.sys R2 int15;int15;\??\C:\WINDOWS\system32\drivers\int15.sys R2 procguard;procguard;\??\C:\WINDOWS\system32\drivers\procguard.sys R2 tvicport;tvicport;\??\C:\WINDOWS\system32\drivers vicport.sys R2 UxTuneUp;Extension de conception TuneUp;C:\WINDOWS\System32\svchost.exe -k netsvcs R3 DKbFltr;Dritek Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DKbFltr.sys R3 lv321av;Logitech USB PC Camera (VC0321);C:\WINDOWS\system32\DRIVERS\lv321av.sys R3 LVPrcMon;Logitech LVPrcMon Driver;\??\C:\WINDOWS\system32\drivers\LVPrcMon.sys R3 psdfilter;psdfilter;\??\C:\WINDOWS\system32\Drivers\psdfilter.sys R3 psdvdisk;psdvdisk;\??\C:\WINDOWS\system32\Drivers\psdvdisk.sys S2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-11-16 16:15:58 C:\WINDOWS\Tasks\Maintenance en 1 clic.job" - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe "2007-11-30 22:47:32 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-01 01:03:26 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-01 1:04:50 - machine was rebooted . --- E O F ---

Lyonnais92 · Answer

Re,

remets un rapport Hijackthis stp.

je verrai ça au jour.

exXelior · Answer

ok merci pour ton aide.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:30:19, on 01/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\hkcmd.exe
C:\DOCUME~1\alexX\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=;gopher=;http=196.202.252.244:80;https=;socks=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: OFFICE One Startup v7.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\swdsvc.exe (file missing)

Lyonnais92 · Answer

Bonjour,

tu as désactivé le tea-timer comme demandé post 13 ?
(O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe)

Tu as exécuté le désinstallateur de Norton-Symantec (post 21) ?
(O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing))

Tu as installé un parefeu (post 21) ?
(je ne le vois pas)

exXelior · Answer

bonjour.

Oui j'ai desactivé le tea timer (dans processus), éxécuté le désinstaleur de symantec mais pas installé un parefeu.

Lyonnais92 · Answer

Re,

pour le tea-timer,

ouvre Spybot, clique sur mode. Advanced mode doit être coché;

Clique sur tools puis resident.

la case du tea-timer doit être décochée.

Tu le recocheras en fiin de désinfection.

Double clique sur le raccourci Navilog1 présent sur le bureau et laisse-toi guider. 
Au menu principal, choisis 3 et valide. 

Le fix va t'informer qu'il va alors redémarrer ton PC 
Ferme toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts
Appuie sur une touche comme demandé.
(si ton Pc ne redémarre pas automatiquement, fais le toi même)
Au redémarrage de ton PC, choisis ta session habituelle.

Patiente jusqu'au message : 
*** Nettoyage Termine le ..... *** 
Le blocnote va s'ouvrir. 
Sauvegarde le rapport de manière à le retrouver 
Referme le blocnote. Ton bureau va réapparaitre 

PS:Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches. 
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter" 
Tape explorer et valide. Celà te fera apparaitre ton bureau.

Reéxécute zeb restore 

Des améliorations ?

exXelior · Answer

bon jai télécharger sunbelt kerio personal firewall4 qui me dit deja cela:

Détails techniques sur l'intrusion :

Application injectrice : c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe(new line)
Description : Logitech LVPrcSrv Module.(new line)
Version du fichier : 9.4.4.1082(new line)
Produit : Logitech(new line)
Version du produit : 9.4.4.1082(new line)
Créé le : 2006/6/23, 09:40:58(new line)
Modifié le : 2006/6/23, 09:40:58(new line)
Dernier accès le : 2007/11/30, 23:00:00

Application cible : C:\Program Files\Synaptics\SynTP\SynTPEnh.exe(new line)
Description : Synaptics TouchPad Enhancements(new line)
Version du fichier : 8.3.0 28Apr06(new line)
Produit : Synaptics Pointing Device Driver(new line)
Version du produit : 8.3.0 28Apr06(new line)
Créé le : 2006/4/29, 05:13:46(new line)
Modifié le : 2006/4/29, 05:13:46(new line)
Dernier accès le : 2007/11/30, 23:00:00

Adresse de l'injection : 0x00260000

il me la répété un quinzine de fois!

Lyonnais92 · Answer

Re,

attention à ne pas rater un post,

on se croise.

Je crois que tu autorises Logitech à mettre à jour ses produits automatiquement.

exXelior · Answer

oui on se croise! :)

Ben non jpeux toujours pas aller sur le site de win update et loutil de recherche de windows ne reapparait pas...On mannonce toujour un virus.Maintenant le firewall me dit toute les dix seconde que le processus tente de sintegrer a un autre processu et quil bloque laction!
Jpeux pas faire fermer le rapport? pacque la chui harcelé lol

Lyonnais92 · Answer

Re,

si, tu dois pouvoir bloquer les messages.

Pour Kerio, un site assez complet :

http://kerio.probb.fr/Systemesd-exploitation-c1/Logiciels-et-tutoriels-gratuits-tries-par-categorie-f6/Tutoriel-pour-Kerio-4-version-gratuite-t201.htm

exXelior · Answer

Bon sinon il est toujours assez embetant de ne pouvoir faire de mise a jours windows surtout que cela fait plus dun moi.
Y a t il une solution?

exXelior · Answer

en relancant le yahoo anti spy il ma detecté ceci "backdoor"  key  hkey_current_user\software\wget!!!
ahhh ya plein dprobleme c'est la cata!!!!

exXelior · Answer

ISTbar est revenu!!!!!!!!!!!!!!!!

Lyonnais92 · Answer

Re,

dans l'ordre :

Hijackthis

navilog choix 1

combofix

superantispyware (avec le réglage que je t'ai donné)

antivir (scan complet : all files)

Les rapports dans le même ordre

exXelior · Answer

voici dans lordre

-Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:22:22, on 01/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\igfxext.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\DOCUME~1\alexX\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=;gopher=;http=196.202.252.244:80;https=;socks=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: OFFICE One Startup v7.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\swdsvc.exe (file missing)
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Lyonnais92 · Answer

Re,

Ouvre ce lien https://www.majorgeeks.com/files/details/gmer.html
Clique sur uner des lignes MajorGeeks TX à droite du drapeau américain.
Si une nouvelle fenêtre s'ouvre indiquant 'Your download of GMER will automatically start in a few seconds...' clique 'Click here if it does not. ' pour télécharge gmer et choisis 'Enregistrer' dans la fenêtre de téléchargement. Enregistre le sur le bureau.

Dezippe le sur le bureau.

Déconnecte toi d'Internet et fermer tous les autres programmes.

Double-clique sur gmer.exe pour lancer le programme.

Si on te pose la question, réponds oui au lancement de gmer.sys.
Si tu as un message t'avertissant du démarrage d'un programme sur l'activité des rootkits et si tu veux lancer un scan, réponds NON.

Ouvre l'onglet Rootkit.

Vérifies que toutes les cases de la colonne de droite sont cochées, à l'exception de "Show all".

Clique sur le bouton "Scan". Patiente le temps du scan.

A la fin, clique sur le bouton "Copy".

Le rapport a été copié dans le presse-papier. Ouvre le bloc-notes et appuie en même temps sur les touches Ctrl et V. Le rapport est copié dans le bloc-notes. Sauve le (enregistrer sous)sur le bureau.

Copie le dans ta réponse.

Mentionne moi les lignes en rouge s'il y en a.

NB. Si tu as un problème pour lancer gmer.exe, essaye en mode sans échec. Contrairement à d'autres scanners de rootkits, gmer s'xécute en mode sans échec.

exXelior · Answer

pas de ligne en rouge
voici le rapport ,

GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-12-01 18:26:54
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.13 ----

SSDT            sptd.sys                                                                 ZwEnumerateKey
SSDT            sptd.sys                                                                 ZwEnumerateValueKey

Code            73A0DDEB                                                                 KeSetProfileIrql

---- Devices - GMER 1.0.13 ----

Device          \FileSystem\Fastfat \Fat IRP_MJ_CREATE                                   865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_CLOSE                                    865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_READ                                     865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_WRITE                                    865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION                        865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION                          865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA                                 865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_SET_EA                                   865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS                            865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION                 865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION                   865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL                        865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL                      865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL                           865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN                                 865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL                             865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP                                  865281E8
Device          \FileSystem\Fastfat \Fat IRP_MJ_PNP                                      865281E8

AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_CREATE                                   [F72D11DE] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_CREATE_NAMED_PIPE                        [F72D11DE] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_CLOSE                                    [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_READ                                     [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_WRITE                                    [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION                        [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION                          [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA                                 [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SET_EA                                   [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS                            [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION                 [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION                   [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL                        [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL                      [F72D1454] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL                           [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_INTERNAL_DEVICE_CONTROL                  [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN                                 [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL                             [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP                                  [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_CREATE_MAILSLOT                          [F72D11DE] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_QUERY_SECURITY                           [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SET_SECURITY                             [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_POWER                                    [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SYSTEM_CONTROL                           [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CHANGE                            [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_QUERY_QUOTA                              [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SET_QUOTA                                [F72C4F4C] fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_CREATE                                   [F7959000] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_CREATE_NAMED_PIPE                        [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_CLOSE                                    [F79590C0] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_READ                                     [F79590DE] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_WRITE                                    [F7959190] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION                        [F79590C0] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION                          [F7959254] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA                                 [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SET_EA                                   [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS                            [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION                 [F79590C0] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION                   [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL                        [F7959A3C] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL                      [F795A414] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL                           [F7959BBC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_INTERNAL_DEVICE_CONTROL                  [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN                                 [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL                             [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP                                  [F79590C0] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_CREATE_MAILSLOT                          [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_QUERY_SECURITY                           [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SET_SECURITY                             [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_POWER                                    [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SYSTEM_CONTROL                           [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CHANGE                            [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_QUERY_QUOTA                              [F79570BC] psdfilter.sys
AttachedDevice  \FileSystem\Fastfat \Fat IRP_MJ_SET_QUOTA                                [F79570BC] psdfilter.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_CREATE                                   [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_NAMED_PIPE                        [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE                                    [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_READ                                     [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_WRITE                                    [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_INFORMATION                        [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_SET_INFORMATION                          [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_EA                                 [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_SET_EA                                   [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_FLUSH_BUFFERS                            [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_VOLUME_INFORMATION                 [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_SET_VOLUME_INFORMATION                   [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_DIRECTORY_CONTROL                        [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_FILE_SYSTEM_CONTROL                      [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL                           [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL                  [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN                                 [AA0F0B30] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_LOCK_CONTROL                             [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP                                  [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT                          [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_SECURITY                           [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_SET_SECURITY                             [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_POWER                                    [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_SYSTEM_CONTROL                           [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CHANGE                            [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_QUOTA                              [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Ip IRP_MJ_SET_QUOTA                                [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE                                  [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE                       [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE                                   [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_READ                                    [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_WRITE                                   [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_INFORMATION                       [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION                         [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_EA                                [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_SET_EA                                  [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_FLUSH_BUFFERS                           [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION                [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION                  [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_DIRECTORY_CONTROL                       [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL                     [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL                          [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL                 [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN                                [AA0F0B30] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_LOCK_CONTROL                            [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP                                 [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT                         [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_SECURITY                          [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_SET_SECURITY                            [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_POWER                                   [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_SYSTEM_CONTROL                          [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CHANGE                           [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_QUOTA                             [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp IRP_MJ_SET_QUOTA                               [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_CREATE                                  [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_NAMED_PIPE                       [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE                                   [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_READ                                    [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_WRITE                                   [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_INFORMATION                       [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_SET_INFORMATION                         [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_EA                                [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_SET_EA                                  [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_FLUSH_BUFFERS                           [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_VOLUME_INFORMATION                [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_SET_VOLUME_INFORMATION                  [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_DIRECTORY_CONTROL                       [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_FILE_SYSTEM_CONTROL                     [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL                          [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL                 [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_SHUTDOWN                                [AA0F0B30] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_LOCK_CONTROL                            [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP                                 [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_MAILSLOT                         [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_SECURITY                          [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_SET_SECURITY                            [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_POWER                                   [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_SYSTEM_CONTROL                          [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CHANGE                           [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_QUOTA                             [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\Udp IRP_MJ_SET_QUOTA                               [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE                                [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_NAMED_PIPE                     [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE                                 [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_READ                                  [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_WRITE                                 [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_INFORMATION                     [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_SET_INFORMATION                       [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_EA                              [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_SET_EA                                [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_FLUSH_BUFFERS                         [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_VOLUME_INFORMATION              [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_SET_VOLUME_INFORMATION                [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_DIRECTORY_CONTROL                     [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_FILE_SYSTEM_CONTROL                   [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL                        [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL               [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_SHUTDOWN                              [AA0F0B30] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_LOCK_CONTROL                          [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP                               [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_MAILSLOT                       [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_SECURITY                        [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_SET_SECURITY                          [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_POWER                                 [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_SYSTEM_CONTROL                        [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CHANGE                         [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_QUOTA                           [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp IRP_MJ_SET_QUOTA                             [AA0F0974] fwdrv.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE                    [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_NAMED_PIPE         [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLOSE                     [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_READ                      [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_WRITE                     [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_INFORMATION         [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_INFORMATION           [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_EA                  [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_EA                    [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FLUSH_BUFFERS             [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_VOLUME_INFORMATION  [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_VOLUME_INFORMATION    [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DIRECTORY_CONTROL         [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FILE_SYSTEM_CONTROL       [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CONTROL            [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_INTERNAL_DEVICE_CONTROL   [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SHUTDOWN                  [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_LOCK_CONTROL              [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLEANUP                   [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_MAILSLOT           [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_SECURITY            [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_SECURITY              [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_POWER                     [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SYSTEM_CONTROL            [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CHANGE             [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_QUOTA               [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_QUOTA                 [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE                    [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE_NAMED_PIPE         [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CLOSE                     [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_READ                      [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_WRITE                     [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_INFORMATION         [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_INFORMATION           [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_EA                  [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_EA                    [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_FLUSH_BUFFERS             [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_VOLUME_INFORMATION  [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_VOLUME_INFORMATION    [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DIRECTORY_CONTROL         [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_FILE_SYSTEM_CONTROL       [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DEVICE_CONTROL            [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_INTERNAL_DEVICE_CONTROL   [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SHUTDOWN                  [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_LOCK_CONTROL              [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CLEANUP                   [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE_MAILSLOT           [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_SECURITY            [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_SECURITY              [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_POWER                     [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SYSTEM_CONTROL            [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DEVICE_CHANGE             [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_QUOTA               [F691DA30] SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_QUOTA                 [F691DA30] SynTP.sys

---- EOF - GMER 1.0.13 ----
NTI Backup NOW! for Windows 98/ME/NT/2000/XP
With Burner Database File Version 465

Table of Contents
-----------------
A. List of Supported CD-R/RW and DVD+/-R/RW/RAM Drives
B. Emergency Recovery


A. List of Supported CD-R/RW and DVD+/-R/RW/RAM Drives
----------------------------------------------------------------------
001. 1394 (Acer): CD-R/RW 12X8X32.
002. 2.4X2.4X8 (LITE-ON): 121032.
003. 48X24 (AccessTek): COMBO.
004. 52X24 (MSI): CDRW.
005. 52X32 (MSI): CDRW.
006. AccessTek: CD-RW CW0801, CW1601, CW1601A, CW3201, CW4001, CW4002, CW4801, CW4802, CW5201, CW5202, CW5205, CW5207, TCW5201, COMBO DC4801.
007. ACER: CB5224-QA0, CD-RW 52X32-B0, 52X32-L0, 52X32-M0, COMBO 48X24-B0, 48X24-H0, 48X24-L0, 48X24-M0, DVD Du 4X/24X-A0, 4X/24X-B0, 4X/24X-H0, 4X/24X-L0, 4X/24X-M0, 4X/24X-P0, 8X/48X-A0, 8X/48X-B0, 8X/48X-H0, 8X/48X-L0, 8X/48X-M0, 8X/48X-P0, DVD DUAL 4XMax, DVD RW 16XMax, 4XMax, 8XMax, DVD+RW 4X/40X-A0, 4X/40X-B0, 4X/40X-H0, 4X/40X-L0, 4X/40X-M0, 4X/40X-P0, 4XMax, 4XMaxA, 8X/48X-A0, 8X/48X-B0, 8X/48X-H0, 8X/48X-L0, 8X/48X-M0, 8X/48X-P0, 8XMax, DVD-RW 4XMax, 8XMax.
008. ACTIMA: ARW4420, ARW4420S, ARW4424P, ARW4432P, G44A24, G44P24, G44A32, G44P32, DVD+RW ADRW-H00P.
009. AOPEN: 16X48X24X48, 16X52X24X52COMBO, 16X52X32X52COMBO, 16X8 DVD DUAL, 20X10X40 CD-RW, 24X10X40 CD-RW, 24X10X48 CD-RW, 32X12X48 CD-RW, 40X12X48 CD-RW, 40X12X50 CD-RW, 48X12X48 CD-RW, 48X12X50 CD-RW, 48X16X48 CD-RW, 48X24X52 CD-RW, 4X IDE CD-RW, 52X24X52 CD-RW, 52X32CD-RW, 52X32COMBO, 52X32X52 CD-RW, 8X4X32 IDE CD-RW, CDRW5232, COM4824, COM4824/AAH, COM5224, COM5224/AAH, COMBO48X, CQ2440, CQ3248, CQ4048, CQ4848, CQ4852, CQ5252, CQ5252PRO, CRS446U, CRS9420, CRS9624, CRW5232/AAO, CRW5232/BKS, CRW620, CRW622, CRW8432, CRW8832, CRW9420, CRW9420S, CRW9624, CRW9624S, CRW9632, CRW9832, CRW1232, DRW4410, DRW4416, DRW4624, DRW8120, DUW1608/ARR, DUW1616/ARR, DVRW2412PRO, IDE4016CO, IDE4816CO, 12X10X32 CD-RW, A, P, 16X10X32 CD-RW, A, 4X4X20 IDE CD-RW, SCSI CDRW, SLIM CDRW, 4X4X8 241040, 241640, 6X4X24 IDE CD-RW, SCSI CDRW, SLIM CDRW, 8X DVD Dual ABB, ABG, ACC, ACG, 8X8 DVD Dual AAG, AAN, ACC, ACG, APG, APP, CD-RW CRW1232 A, CRW1232PRO, CRW1632, CRW1632 A, CRW2040, CRW2440, CRW2448, CRW3248, CRW4048, CRW4050, CRW4850, CRW4852, CRW5224, CRW5232, CDRW/DVD SB2410E, COM5232/AAH, PRO, COMBO SDW-824, CRW5232/AAO PRO, DVD Du 4X/24X-A0, 8X/48X-A0, DVD DUAL SU4216E, DVD RW Drive, ISU8424E, DVD+RW 4X/40X-A0, 8X/48X-A0, DVD/RW 4X6X4X24.
010. APACHI (AOPEN): CD_1632 DRIVE, CD_2440 DRIVE, CD_4048 DRIVE.
011. ARCHOS: MiniCDRW 161024, XS4424, XS4432, XS8432.
012. ARTEC: 52Z16, BKM-48W16, BKM-52X16, BKM-52Z16, BPN-KM48W16, BPN-KM52X16, BPN-KM52Z16, VOM-12E48X, VRR-4B24R, VRR-8F32W, VRR-12J52Z, WPN-KM52X16, WPN-RR52X, PLUS, WPN-RR52Z, PLUS, II, III, IV, WPN-SM52X, WPN-SM52Z, WPN-SM52ZA, WRA-GA32, WRA-KA40, WRA-OA40, WRA-WA40, WRA-WA48, WRR-4048, WRR-4848, WRR-48W, WRR-52X, PLUS, II, III, IV, V, WRR-52Z, PLUS, II, III, IV, V, WSM-4848, WSM-52X, WSM-52Z, WSM-52ZA, WSM-YG48, WSM-YG52, WSN-52X, RW-161032, RW-201040, RW-241040,     RW-241040, RW-321040, RW-321048, RW-321248, RW-401248, RW-481248, RW-481648, RW-481648M, RW-481650M, RW-481650W, RW-482448, RW-5224, RW-522452, PLUS, II, III, IV, V, RW-522452M, RW-522452W, RW-523252, PLUS, II, III, IV, V, RW-523252M, RW-523252W, COMBO-48W16, COMBO-52X, COMBO-52XP, COMBO-52X16, COMBO-52Z16, COMBO-M48W16, COMBO-M52X16, COMBO-M52Z16, DVD+RW 448, 8812, 121216.
013. ASUS: CRW-1210R, CRW-1610A, CRW-2410A, CRW-2410S, CRW-3212A, CRW-3212U, CRW-4012A, CRW-4816A, CRW-4824A, CRW-4824AH, CRW-4832A, CRW-4832AX, CRW-5224A, CRW-5232A, CRW-5232AS, DRW-0208P, DRW-0402P, DRW-0402P/D, DRW-1604P, DRW-1608P2, DRW-1608P2S-D, SCB-1608, SCB-2408, SCB-2424.
014. ATAPI (AccessTek): CD-RW52XMAX, CRD-BPDV2, CRD-BPDV3, CD-RW 16/12/40X, 12/8/32X, 16/8/40X, 32/12/40X, 40/12/40X, 40/12/48X, 48/12/48X, 48/16/48X, 48/24/48X, 48XMax, 52XMax, 52XMaxx, CW4801, CW5201, CW5202, CW5205, CW5207, TCW5201, CDRW 482448A, 522452A, 523252A, COMBO 48XMax, DC4801, DVD DUAL 4XMax, DVD RW 12XMax, 16XMax, 4XMax, 8XMax, DD0201, DD0203, DD0401, DD0405, DD1203, DD1205, DD1603, TDD0201, DVD+/-R/RW8XMAX, DVD+RW 4XMax, 4XMaxA, 8XMax, DD0202, DD0205, DD0402, DVD-RW 4XMax, 8XMax, DD0204, DD0403, DD0404, DVD/CDRW 48Max.
015. ATAPI (BENQ): CD-R/RW CRW6206A, 2X2X6, CRW6232A, 2X2X32, CRW4232A, 4X2X32, CRW4432A, 4X4X32, 4X2X30, 4X4X30, 2X2X24, 4X4X24, 6X4X30, 6X4X32, 8X4X24, 8X4X30, 8X4X32, CRW8432A, 10X8X32, 12X8X32, 10X4X32, 4X4X6, 4X4X8, 16X10, 20X10, 24X10, 16X10X40, 20X10X40, 24X10X40, 32X10, 32X12, 32X12X40, 40X12, CRW4812A, 48X12, 48X16, 48X20, 50X16, 50X20, CRW5224P, CD-RW 16X10X40, 32X10X40, 32X12X40, 40X12, 48X12, 48X16, 48X20, 48X24, 50X16, 50X20, 52X20, 52X24, 52X32, 52X32X, 56X32, CDRW 48X16, 48X24, 52X24, 52X32, 56X32, CDRW DRIVE 48X16, 48X24, 52X24, 52X32, 56X32, COMBO 16X48X24X, 16X48X32X, 16X52X24X, 16X52X32X, 32X12, 48X24, 48X32, 52X24, 52X32, DVD DD 2X16X4X16, 2X8X4X12, 2X8X4X16, 4X16X4X16, DVD DL 16X4X16, 2X8X4X12, DVD DUAL 16X4X12, 8X4X12, DVD+RW 4X2X12, 4X4X12, 6X4X12, 8X4X12, 8X4X16, WRITER, DVD-RW 4X Max.
016. ATAPI (BTC): 2W24R, CD-Writer.
017. ATARI (LG): DVD-RW-GCA-4020B.
018. ATK (AccessTek): DVD RW DD0201, DD0203, DD0401, DD0405, DD1603, TDD0201, DVD+RW DD0202, DD0205, DD0402, DVD-RW DD0204, DD0403, DD0404.
019. AXTRATEC (BTC): CRD-RW1S, RW5120, AXT 8000.
020. BACKPACK: CD-REWRITER-2A, CD-REWRITER-4A, CD-REWRITER-4B, CD-REWRITER-4D, CD-REWRITER-4E, CD-REWRITER-4F, CD-REWRITER-4G, CD-REWRITER-4H, CD-REWRITER-8A, CD-REWRITER-8B, CD-REWRITER-8C.
021. BENQ: SC248T, CDRW 5232X, DVD DD DW1620, DW1630, DW1640, DW1650, DW880A, DW890A, EW161I, EW161U, EW162I, EW162U, EW163U, EW165U, DVD DL DW1600, DW830A, DVD DUAL DW1610, DW820A, DW822A, DW825A, DW826A, EW161I, EW161U, EW822U, SDVD TW100G, TW200G, TW200Q, TW200T.
022. BTC: BCE242IE, BCE324IE, BCE424IE, BCE5232IB, BCE832IE, BCE840IE, BCE833IE, BCE1032IE, BCE128IE, BCE1610IM, BCE1610IR, BCE2010IR, BCE2408IM, BCE2410IM, BCE2410IR, BCE3212IM, BCE3212IR, BCE4010IM, BCE4012IM, BCE4016IM, BCE4812IM, BCE4816IM, BCE4824IM, BCE4832IM, BCE5216IM, BCE5224IM, BCE5224SO, BCE5224UI, BCE5232IA, BCE5232IM, BCE5232SO, BCO1212IM, BCO1612IM, BCO2408SM, BCO2408SM+, BCO2408SU, BCO4008UI, BCO4012IM, BCO4016IM, BCO4816IM, BCP8000U, BDE5224UI, BDW0810SE, BDW0810SI, CBD620E, DRW1004IM, DRW1008IM, DRW1012IM, DRW1016IM, DRW1104IM, DRW1108IM, DRW1112IM, DRW1116IM, ED5220, RW5120, AXT 8200, 8300, BCE 62IE, BCP 8000, 8000+, 8200, 8300, CD-RW 52X24-B0, 52X32-B0, COMBO 48X24-B0, DRW 1004IB, 1008IB, DVD Du 4X/24X-B0, 8X/48X-B0, DVD+RW 4X/40X-B0, 8X/48X-B0, GEN 8200, 8300.
023. BurnMAX (BTC): PDRW-4D-IN.
024. CalOptic: W1210F, W1210FB.
025. CARAVELL (SANYO): CD-R CDR-N820S.
026. CD-R/RW (CyberDrv): CW078D CD-R/RW, CW079D CD-R/RW, CW088D CD-R/RW, CW089D CD-R/RW, CW098D CD-R/RW, CW099D CD-R/RW, EW058U CD-R/RW, EW068U CD-R/RW, EW078U CD-R/RW, EW088U CD-R/RW.
027. CD-R/RW (PROVIEW): 52X24X52X.
028. CD-RW (BTC): 5232IA, 5232IB, GO-R5232B.
029. CD-RW (LITE-ON): 52X32-L0, CDR-1232DD, CDR-1232M, CDR-1232MC, CDR-1232S, CDR-1640MB, CDR-1640MC, CDR-1640MM, CDR-1640SB, CDR-2040MC, CDR-2040MM, CDR-2040SC, CDR-2440DH, CDR-2440DS, CDR-2440MB, CDR-2440MM, CDR-2440SB, CDR-2440SD, CDR-2840DH, CDR-2840DS, CDR-3240MH, CDR-3240MS, CDR-3240S, CDR-3240WD, CDR-3248MS, CDR-4048S, CDR-4048SD, CDR-4048W, CDR-4848S, CDR-5G48, CDR-5K32, CDR-5K40, CDR-5S32, CDR-5S40, CDR-5S48, CDR-5W32, CDR-5W40, CDR-5W48, CDR-6K40, CDR-6S32, CDR-6S40, CDR-6S48, CDR-6S52, CDR-7K48, CDR-8S48, CDR-8S52, CDR-9S48, CDR-9S52, CDR-9S52S, CDR-9V48, CDR-9V52, CDR-S148S, CDR-S152S, CRX-2440B, CRX-2440S, CXR-1X24, CXR-2X24, CXR-2X32, CXR-2X40, CXR-2440B, CXR-2440S, CXR-3X24, CXR-3X32, CXR-3X40, CXR-3X40B, CXR-3240, CXR-3240A, CXR-3240B, CXR-3240C, CXR-3240S, CXR-4040, CXR-4040A, CXR-4040B, CXR-4040C, JLR-3240H, LTR-24101B, LTR-24101C, LTR-24102B, LTR-24102C, MAR-241040SD, MAR-321040S, MAR-321040SD, MAR-321240WD, MAR-401248S, MAR-401248SD, MAR-401248W, MXR-241040S, MXR-2440B, MXR-321240S, SMART CLONE48, CLONE52.
030. CDRW (BTC): 5232UI.
031. CDRW (LITE-ON): 52X32X, CDR-8S52A.
032. CDWRITER (BTC): 2W24R, BCE5232IM, CD-RW5232IA, CD-RW5232IB, IDE2x2x24, IDE4x4x24, IDE4x4x32, IDE8x4x40, IDE8432, IDE8x4x32, IDE1032, IDE128, IDE1610, IDE1610IR, IDE2410, IDE2010IR, IDE2410IR, IDE3212, IDE4012, IDE 4012, IDE4812, IDE4816, IDE4824, IDE4832, IDE5224, IDE5224 V0012, IDE5224SO, IDE5232, IDE5232SO.
033. CENDYNE: 241040AA, 241040AB, 241040AL, 241040AT, 321240AA, 321240AB, 321240AL, 321240AT, 401248AA, 401248AB, 401248AL, 401248AT, 401248AX, 481248AA, 481248AB, 481248AL, 481248AT, 481648AA, 481648AB, 481648AX, 48244816AX, 482448AL, 482448AX, 522452AA, 522452AL, 522452AU, 522452AX, 523252AL, 523252AU, 523252AX, DVDR1AB, DVDR1AP, DVRW1AA, DVRW1AB, DVRW1AP, DVRW1AR, DVRW1AX.
034. CNBridge (LITE-ON): CBCO1H-48X, CBCO1K-48X, CBRW2B-24X, CBRW3S-32X, CBRW5S-32X, CBRW5S-40X, CBRW6K-40X, CBRW6K-52X, CBRW6S-32X, CBRW6S-40X, CBRW6S-48X, CBRW6S-52X, CBRW7K-48X, CBRW7K-52X, CBRW7S-48X, CBRW7S-52X, CBXRW-24X, CBXRW-40X, CBXRW-40XB.
035. COMBI (LITE-ON): COB-1K4816.
036. COMBI (PHILIPS): RW16x8/DVD, RW16x10/DVD, RW16x12/DVD, RW32/DVD.
037. COMBO (BTC): 2408SU, 4816IA, 4816UI, BCO1612IM, BCO3216IM, BCO4008UI, BCO4016IM, COMBO4816IA, IDE1612CO, IDE2408CO, IDE3216CO, IDE4008UI, IDE4016CO, IDE5216CO, IDE5224CO.
038. COMBO (CyberDrv): CB501D Combo, CB511D Combo, CB521D Combo, CB531D Combo.
039. COMBO (LITE-ON): 52X32X52X, COB-1H4816, COB-1K4012, COB-1K4816, COB-1T4816, COB-1T5216, COB-2H4816, COB-2H5216, COB-2K4816, COB-2K5216, COB-5H4816, COB-5H5216, COB-5K4816, COB-5K5216, COB-6K4816, COB-6K48S, COB-6K5216, COB-6V4816, COB-6V5216, COB-7K4816P, COB-7K4816S, COB-7K5216P, COB-7K5216S, COB-AH4816, COB-AH5216.
040. COMBO (PHILIPS): CDD5351, RW24x8/DVD, RW48/DVD, RW48/DVD16a, RW48/DVDa, RW52/DVD16a.
041. COMPAL (AccessTek): TSD80Y1 DVD RW.
042. COMPAL (TOSHIBA): TSB24H1 DVD/CDRW, TSB24H2 DVD/CDRW.
043. CoWriter (BTC): IDE12x10x40x12, IDE16x10x40x12.
044. CREATIVE: CD-RW ED5220, ED5220-A, ED5221, RW121032E, RW1210E, RW1220E, RW1260E, RW1610E, RW1611E, RW1620E, RW1650E, RW1680S, RW2024E, RW2410E, RW2410E-B, RW2450E, RW3210E, RW3260E, RW4010E, RW4020E, RW4060E, RW4224E, RW4424E, RW4810E, RW4811E, RW4820E, RW4860E, RW5220E, RW5221E, RW5260E, RW52G0E, RW6424E, RW8432E, RW8433E, RW8435E, RW8436E, RW8438E, RW8439E, COMBO CB1210328E, CB7820E, CBA020E, CBA820E, CBD620E, CBF220E, DVDRW DR8420E, DR8820E, MINICDRW RW4426U, STORAGE MC4820E.
045. Cyam (LITE-ON): CLW-224A, CLW-232A, CLW-240A.
046. CyberDrv: CB501D Combo, CB511D Combo, CB521D Combo, CB531D Combo, CW018D CD-R/RW, CW028D CD-R/RW, CW038D CD-R/RW, CW048D CD-R/RW, CW058D CD-R/RW, CW059D CD-R/RW, CW068D CD-R/RW, CW069D CD-R/RW, CW078D CD-R/RW, CW079D CD-R/RW, CW088D CD-R/RW, CW089D CD-R/RW, CW098D CD-R/RW, CW099D CD-R/RW, DX042D DVD+RW, DX081D DVD+RW, DX082D DVD+RW, EW058U CD-R/RW, EW068U CD-R/RW, EW078U CD-R/RW, EW088U CD-R/RW, EX042U DVD+RW, EX081U DVD+RW, EX082U DVD+RW, SX042D DVD+RW, SX082D DVD+RW.
047. DAEWOO (AOPEN): CD-RW RW5224.
048. DELTA: CDE6121, CRW-ES4420, ODE-6121, ODR-6121, OME-W141, OIP-PW2004A, OIP-RW2004/B, OIP-RW2004A.
049. DGMaster (LITE-ON): DGM-241040,DGM-321240, DGM-401248, DGM-481248, DGM-482448.
050. DIAMOND: DATA 40X16X10, 40X20X10, 40X24X10.
051. DIXALL (BTC): IDE5224.
052. DPL: R130, R210, R310, R320, R350, R810.
053. DRW (BTC): IDE1004, IDE1108.
054. DVD (PHILIPS): DVDRW6002.
055. DVD Dual (BTC): GO-W0404A.
056. DVD+RW (CyberDrv): DX042D DVD+RW, DX081D DVD+RW, DX082D DVD+RW, EX042U DVD+RW, EX081U DVD+RW, EX082U DVD+RW, SX042D DVD+RW, SX082D DVD+RW.
057. DVDR/RW (AccessTek): DD1601.
058. DVDRW (BTC): 1004IB, 1004IM, 1008IB, 1008IM, 1012IM, 1016IM, DUALS801E, DUALS801I, IDE1004, IDE1008, IDE1012, IDE1016, IDE1104, IDE1108, IDE1112, IDE1116, IDE H16X, 16X, USB 16X.
059. DVDRW (LITE-ON): 16X16X, DRW-1S40, DRW-1S41, DRW-1S61, DRW-1S65, DRW-1S66, DRW-1S81, DRW-1S85, DRW-2S80, DRW-2S81, DRW-2S83, DRW-2S85, DRW-3S120, DRW-3S121, DRW-3S125, DRW-3S161, DRW-3S163, DRW-3S165, DRW-3S167, DRW-3S169, DRW-3S189, DRW-3S83, DRW-3Y161, DRW-5S161, DRW-5S163, DRW-5S165, DRW-5S16H, DRW-5S16HS, DRW-5S185, DRW-6S160H, DRW-6S160P, DRW-6S160P6S, DRW-6S160S, DXW-5X89, DXW-6X169, S200DX, SOHW-1653S.
060. DYSAN: CRW-1622, CRW-426, CRW-1426, CRW-2216e, CRW-2216, CDRW-2216, CRW-4216, CRW-4216e, CDRW-4216, CDRW-4416, CDRW-2224, CDRW-4424, CDRW-4432, CDRW 4424, CDRW 4432.
061. EMC (PROVIEW): 52X24X52X.
062. EMPREX (BTC): EDW4020, IDE1108.
063. FEDELIA (ARTEC): 9RA-OA40, 9RA-OA48, 9RR-4048, 9RR-4848, 9RR-48W, 9RR-YO48, 9SM-4848, 9SM-52X, 9SM-52Z, 9SM-52ZA, 9SM-YG48, 9SM-YG52.
064. FREECOM (BTC): CDRW52K, DVD+/-RW8K1.
065. FREECOM_ (BTC): Combo48K, DVD+/-RW16B9, DVD+/-RW4K, DVD+/-RW8B.
066. FREECOM_ (NEC): DVD+/-RW16B8.
067. GENERIC (AccessTek): CRD-BPDV2, CRD-BPDV3, CD-RW 48/24/48X, 52/24/52X, 52/24/52X2, 52/32/52X, DVD DUAL 4XMax, DVD RW 12XMax, 16XMax, 4XMax, 8XMax, DVD+RW 4XMax, 4XMaxA, 8XMax, DVD-RW 4XMax, 8XMax, DVD/CDRW 48Max.
068. GENERIC (BTC): GEN 8000.
069. GENERIC (MATSUSHITA): CDRCB03, CDRCB04, CDRCB05, DVD-RAM MLT01, MLT02, MLT03.
070. GENERIC (PHILIPS): FREECOM24B, FREECOM24B USB, FREECOM24D, FREECOM24E, FREECOM32A, FREECOM52I.
071. GENERIC (SANYO): CD-R CRD-R800S (firmware version 1.23 or later), CRD-RW1 (firmware version 1.09 or later), CRD-RW2, CRD-RW800P, CDRCB01, CDRRW03, CDRRW06, CDRRW08, CRD-BP2, CRD-BP3, CRD-BP4, CRD-BP5, CRD-BP6, CRD-BP900P, CRD-BP1300P, CRD-BP1400P, CRD-BP1500P, CRD-BP1600P, CRD-BP1700P.
072. GENERICP (MATSUSHITA): UJ-820P, UJ-820P DVD/CDRW, UJ-822P, UJ-822P DVD/CDRW, UJ-830P, UJ-830P DVD/CDRW, UJ-831P, UJ-831P DVD/CDRW.
073. GIGABYTE (LITE-ON): GO-B5232A, GO-B5232C, GO-R5232A, GO-R5232E, GO-W0804A, GO-W0808A, GO-W1608A, GO-W160A, GO-W160B, GO-W1616A, GO-W161A, GO-W161B, GO-W1623A.
074. Goldstar (LG): CD-RW CED-8041B, CED-8042B, CED-8043B, CED-8045B, CED-8060B, CED-8080B, CED-8081B, CED-8082B, CED-8083B, CED-8120B, CED-8121B, CED-8122B, CED-8123B, CED-8124B, CED-8125B, CED-8160B, CED-8161B, CED-8162B, CED-8163B, CED-8164B, CED-8165B, CEN-8080B, CEN-8081B, CEN-8082B, CEN-8083B, CEN-8084B, CEN-8085B, CCD-8080B, CCD-8081B, CCD-8082B, CCD-8083B, CCD-8120B, CCD-8121B, CCD-8122B, CCD-8123B, CCN-8080B, CCN-8081B, CCN-8082B, CCN-8083B.
075. HI-VAL: H2242, H161040A.
076. HL-DT-ST (LG): CD-RW_GCE-8487B, DVD-RW_GSA-H11N, DVDRAM_GSA-2164D, DVDRAM_GSA-2166D, DVDRAM_GSA-4165B, DVDRAM_GSA-H10N, DVDRAM_GSA-H30L, DVDRAM_GSA-T10N, CD-RW GCE-8121B, GCE-8122B, GCE-8123B, GCE-8124B, GCE-8125B, GCE-8160B, GCE-8161B, GCE-8162B, GCE-8163B, GCE-8164B, GCE-8165B, GCE-8080N, GCE-8081N, GCE-8082N, GCE-8083N, GCE-8084N, GCE-8085N, GCE-8240B, GCE-8320B, GCE-8321B, GCE-8322B, GCE-8400B, GCE-8401B, GCE-8402B, GCE-8403B, GCE-8404B, GCE-8405B, GCE-8480B, GCE-8481B, GCE-8482B, GCE-8483B, GCE-8484B, GCE-8485B, GCE-8487B, GCE-8520B, GCE-8521B, GCE-8522B, GCE-8523B, GCE-8524B, GCE-8525B, GCE-8526B, GCE-8527B, GCC-8123B, CDRW/DVD GCC4482, Combo 48X24-H0, GCC-4080B, GCC-4080N, GCC-4081B, GCC-4081N, GCC-4082B, GCC-4082N, GCC-4083B, GCC-4120B, GCC-4121B, GCC-4122B, GCC-4123B, GCC-5240P, GCC-5241P, GCC-8080B, GCC-8080N, GCC-8081B, GCC-8081N, GCC-8082B, GCC-8082N, GCC-8083B, GCC-8083N, GCC-8120B, GCC-8121B, GCC-8122B, DVD Du 4X/24X-H0, 8X/48X-H0, DVD+-RW GWA4040N, DVD+RW 4X/40X-H0, 8X/48X-H0, GCA-4040N, DVD-RAM GSA-H30L, GSA-T10N, DVD-ROM GDR8083N, DVD-RW GCA-4020B, GCA-4080N, GRA-4083B, GRA-4120B, GSA-4080N, GSA-4081B, GSA-4082B, GWA-4040B, GWA-4040N, GWA-4080N, GWA-4082B, GWA-4082N, GWA-4083B, GWA-4084B, GWA-4161B, GWA-4162B, DVDRAM GAS-4040B, GMA-4020B, GMA-4040B, GMA-4080N, GMA-4082N, GSA-2164D, GSA-2166D, GSA-4040A, GSA-4040B, GSA-4080N, GSA-4081B, GSA-4082B, GSA-4082N, GSA-4083N, GSA-4084N, GSA-4120B, GSA-4160B, GSA-4163B, GSA-4165B, GSA-4167B, GSA-5120D, GSA-H30L, GSA-T10N, DVDRRW GWA-4164B, GWA-4166B, RW/DVD GCC-2240P, GCC-4080N, GCC-4120B, GCC-4121B, GCC-4160N, GCC-4240N, GCC-4241N, GCC-4242N, GCC-4243N, GCC-4244N, GCC-4247N, GCC-4320B, GCC-4321B, GCC-4322B, GCC-4480B, GCC-4481B, GCC-4482B, GCC-4483B, GCC-4484B, GCC-4520B, GCC-4521B, GCC-4522B, GCC-4523B, GCC-4524B, GCC-5240P, GCC-5241P, GCC-8240N, GCC-8241N, GCC-8242N, GCC-8243N, GCC-8244N.
077. HP: dvd-writer, CD Writer 52r, CD-Writer cd12d, cd12n, cd12ri, cd14f, cd16b, cd16c, cd16Ci, cd16e, cd16f, cd16mi, cd16n, cd16r, cd16ri, cd16v, cd24p, cd52e, cd52i, 1610e, CD-Writer+ 7100, 7200, 7500, 8100, 8200, 8200a, 8200F, 8290, M820, 9100, 9100b, 9100c, 9100e, 9100ei, 9200, 9300, 9310, 9400, 9410, 9500, 9500b, 9600, 9700, 9700k, 9900j,     DVD Writer, DVD Writer 100i, 100j, 200e, 200i, 200j, 300c, 300e, 300i, 300n, 400c, 400e, 400i, 420c, 420e, 420i, 420n, 500c, 530i, 530r, 550s, 550Sl, 630C, 630i, 640b, 640c, 740B, 740c, 740e, 740i, 740r.
078. IDE (PHILIPS): R/RW 24x12A, 40x12A, 40x16A, JR/RW24.
079. IDE-CD (PHILIPS): CDRW7352, JR/RW24, ReWritable-2x2x6, R/RW 2x2x24, 4x4x24, 4x4x32, 8x4x32, 12x8x32, 12x8, 12x10, 16x10A, 16x12A, 20x10, 24x10A, 24x12A, 40x12A, 40x16A, 48xA, 48xB, 48xC.
080. IDE-CMB (PHILIPS): CMB6248.
081. IDE-DVD (PHILIPS): DVDRW6001, DVDRW6002, DVDRW6003, DVDRW8301, DVDRW8401, DVDRW8412, DVDRW8421, DVDRW8431, DVDRW8601, DVDRW8631, DVDRW8651, DVDRW8701, DVDRW8801, DVDRW8851, SDVD8431, SDVDRW8041, SDVDRW8042, SDVDRW8311, SDVDRW8422.
082. IMATION: IMW121032IAB, IMW161032IA, IMW241040IAB, IMW241224DV8EA, IMW242424DV8E, IMW321248IA, IMW401248IA, IMW402440EA, IMW4222DV8E, IMW482448DV16IA, IMW482448DV81AC, IMW522452IA, IMW523252DV161, IMW523252E, IMW523252IA, IMW523252IC, IMW8844DL8E, IMWDLRW16DL84E, IMWDVRW16DL84I, IMWDVRW16DLE, IMWDVRW16DLI, IMWDVRW16LI, IMWDVDRW8DE, IMWDVRW8DI, IMWDVRW8I, CD-R IMR080020, CD-RW IMW040420, IMW080220.
083. IOMEGA: CDDVD24128E24-B, CDDVD482416E23-B, CDDVD482416E23-C, CDDVD482416INT-B, CDDVD482416INT-C, CDDVD522416E23-C, CDDVD522416INT-C, CDDVD523216E23-B, CDDVD523216INT-B, CDRW15360INT-B, CDRW15362EXT3-B, CDRW19200INT-A, CDRW19202EXT2-B, CDRW23040INT-B, CDRW23040INT-C, CDRW23042EXT-B, CDRW23042EXT2-B, CDRW23042EXT3-B, CDRW23042EXT3-C, CDRW23042FEXT-B, CDRW27648INT-B, CDRW38402EXT2-B, CDRW55292EXT, CDRW55292EXT3, CDRW55292EXT3-B, CDRW55292EXT3-C, CDRW55292INT-B, CDRW55296EXT3, CDRW55296INT-B, CDRW55296INT-C, CDRW5529DEXT1-B, CDRW5529FEXT1-B, CDRW6400INT, CDRW6400INT-B, CDRW6402EXT-B, CDRW6402EXT-C, CDRW64892EXT3-B, CDRW64892EXT3-C, CDRW64896INT-B, CDRW64896INT-C, CDRW86522EXT3-B, CDRW86522EXT3-C, CDRW86528INT-B, CDRW86528INT-C, CDRW86592EXT3-B, CDRW9600INT-B, CDRW9602EXT-B, CDRW9602EXT3-B, DVDRW12448E2D-B, DVDRW12448IND-B, DVDRW4216IND-A, DVDRW4216INP-A, DVDRW4224E2Q-D, DVDRW4224INQ-D, DVDRW8424E2Q-D, DVDRW8424INQ-D, DVDRW8440E2D-B, DVDRW8440E2X-B, DVDRW8440IND-B, DVDRW8824E2Q-D, DVDRW8824INQ-D, ZIP CD, ZIPCD 4x650, ZIPCD 650, ZIPCD 650 USB, ZIPCD1024EXT, ZIPCD1024INT-A, ZIPCDINT1536, ZIPCDINT 1536, ZIPCD3840INT, ZIPCD3840INT-A, ZIPCD3840INT-E, ZIPCD-DVDROM.
084. JASS (BTC): JAS 5224, 8200, 8300.
085. JCCOM: JCD-62RW, CDRW-622, JCD-64RW, JCD-1622RW, JCD-1642RW.
086. JLMS (LITE-ON): LTC-48161K, XJ-HC401K, XJ-HC481K, XJ-SC241M, XJ-SC242K, XJ-SC242M, XJ-SC242S, COMBO LSC-24081, LSC-24081M, LSC-24081S, LSC-24082M, LSC-24082S.
087. JUMBO (QSI): CDRW/DVD DBW-481, DBW521A, SBW242U, DVDRW DDW-081, DDW-082.
088. JVC: XR-W2080 (firmware version 2.21 or later), XR-W2082, XR-W4080 (firmware version 1.20 or later), XR-W4082, XR-W4424B, XR-W4424.
089. KHYPER (LITE-ON): KDVRWDUA.
090. LACIE: CDBP-12432A, CDBP-12432S, CDBP-121032A, CDBP-121032S, CDBP-161040A, CDBP-161040S, CDBP-241040A, CDBP-241040S, CDBP-321040A, CDBP-321240A, CDBP-401240A, CDBP-401248A, CDRW-8432A, CDRW-12432S, CDRW-BOOSTER, LTR-1240B, CD-RW BOOSTER.
091. LACIE GR: Lacie 1394-CDROM.
092. LEMEL (LITE-ON): LRW-48D16L, LRW-5224L, LRW-5232L.
093. LG: CD-RW CED-8041B, CED-8042B, CED-8043B, CED-8045B, CED-8060B, CED-8080B, CED-8081B, CED-8082B, CED-8083B, CED-8120B, CED-8121B, CED-8122B, CED-8123B, CED-8124B, CED-8125B, CED-8160B, CED-8161B, CED-8162B, CED-8163B, CED-8164B, CED-8165B, CEN-8080B, CEN-8081B, CEN-8082B, CEN-8083B, CEN-8084B, CEN-8085B, CCD-8080B, CCD-8081B, CCD-8082B, CCD-8083B, CCD-8120B, CCD-8121B, CCD-8122B, CCD-8123B, CCN-8080B, CCN-8081B, CCN-8082B, CCN-8083B, GCE-8160B, GCE-8240B, GCE-8320B.
094. Linkage (AOPEN): CDRW2440E, CDRW4048E.
095. LITE-ON: CDR-6S48, CDR-6S52, CXR-3X40B, LTC-40161, LTC-48161H, LTC-48161K, LTC-48161T, LTR-511, LTR-0841, LTR-1240, LTR-1241, LTR-12101B, LTR-12101C, LTR-12102B, LTR-12102C, LTR-16101B, LTR-16101C, LTR-16102, LTR-16102B, LTR-16102C, LTR-24101B, LTR-24101C, LTR-24102B, LTR-24102C, LTR-24102M, LTR-24102S, LTR-24102U, LTR-24103S, LTR-32102H, LTR-32102S, LTR-3248MH, LTR-32103S, LTR-32105S, LTR-32123H, LTR-32123S, LTR-32125K, LTR-32125S, LTR-32125W, LTR-40125K, LTR-40125S, LTR-40125W, LTR-40126H, LTR-40126K, LTR-40126S, LTR-40246S, LTR-48125G, LTR-48125S, LTR-48125W, LTR-48126S, LTR-48166K, LTR-48166S, LTR-48246K, LTR-48246S, LTR-48247S, LTR-48248S, LTR-48327K, LTR-48327S, LTR-48328S, LTR-52246K, LTR-52246S, LTR-52247S, LTR-52248S, LTR-52328S, LTR-52326K, LTR-52326S, LTR-52327K, LTR-52327S, LTR-52328S, LXR-322, LXR-323, LXR-402, LXR-403, LXR-24101A, LXR-24101B, LXR-24102, LXR-24102S, LXR-24102U, LXR-24103, LXR-24163, LXR-32122, LXR-32122A, LXR-32122B, LXR-32122C, LXR-32122S, LXR-32123, LXR-40122, LXR-40122A, LXR-40122B, LXR-40122C, LXR-40123, LXR-40243, WLL-52Z, CD-RW 52X32-L0, SHR-48S1S, SHR-52S1S, SHR-52S9S, SOHR-4828S, SOHR-4838S, SOHR-4839S, SOHR-4839V, SOHR-48A8S, SOHR-48S9S, SOHR-5228S, SOHR-5238S, SOHR-5239S, SOHR-5239V, SOHR-52A8S, COMBO 48X24-L0, LTC-48161H, LTC-48161K, LTC-48162H, LTC-48162K, LTC-52161T, LTC-52162H, LTC-52162K, SHC-48P7K, SHC-48S6K, SHC-48S7K, SHC-52P7K, SHC-52S7K, SHOW-4839S, SOHC-4822K, SOHC-4832K, SOHC-4835H, SOHC-4835K, SOHC-4836K, SOHC-4836V, SOHC-5222K, SOHC-5232K, SOHC-5235H, SOHC-5235K, SOHC-5236K, SOHC-5236V, SOHC-52S6K, SOHW-4839S, SOUC-2481, USC-2481, DVD Du 4X/24X-L0, 8X/40X-L0, 8X/48X-L0, DVD+RW 4X/40X-L0, 8X/48X-L0, LDW-401S, LDW-402S, LDW-461S, LDW-661S, LDW-802S, SOHW-1203, SOHW1603S, SOHW16A3S, SOHW-802S, SOHW-822S, DVDRW DRW-2S81, LDW-1213S, LDW-400D, LDW-401D, LDW-401S, LDW-411S, LDW-412S, LDW-421S, LDW-440D, LDW-451S, LDW-611S, LDW-651S, LDW-802S, LDW-811S, LDW-812S, LDW-812SX, LDW-851S, LDW-851SX, LDW-853S, LXW-1696A, LXW-1696X, LXW-895X, SH-16AH7S, SH-16AL7S, SH-16AP7S, SH-16AS7S, SH-16WP7S, SH-16WS7S, SHM-160H6S, SHM-160P6S, SHM-160S6S, SHM-165H6S, SHM-165L6S, SHM-165P6S, SHM-165PEH, SHM-165S6S, SHM-166H6S, SHM-166P7S, SHM-166PFH, SHM-166S6S SHM-166S7S, SHM-16H5S, SHOW-1635S, SHOW-1673S, SHOW-1693S, SHOW-1893S, SHOW-812S, SHW-160H6S, SHW-160P6S, SHW-160S6S, SHW-1635S, SHW-1635SX, SHW-1655S, SHW-16H5S, SHW-16H5SX, SHW-16S5S, SHW-1855S, SOHW-0833S, SOHW-1210S, SOHW-1213S, SOHW-1253S, SOHW-1613S, SOHW-1613Y, SOHW-1614S, SOHW-1615S, SOHW-1633S, SOHW-1635S, SOHW-1653S, SOHW-1673S, SOHW-1693S, SOHW-16B3S, SOHW-16S5S, SOHW-1893S, SOHW-812S, SOHW-813S, SOHW-832S, SOHW-833S, SOHW-852S, SOHW-853S, SOLW-891, SOXW-1696X, SOHW-822S VPPE.
096. LOGITEC: LCW-T1210BSU, CD-RW DRIVE.
097. M52X1 (ARTEC): VPN-RR4B24R, DVD+RW R448.
098. M52X16 (ARTEC): VPN-RR8F32W, VPN-R12J52Z, DVD+RW R8812, R121216.
099. MAD DOG (NEC): MD-16X2DVD9-8X, MD-16X3DVD9-8X, MD-16XDVD9, MD-16XDVD9A2, MD-8XDVDRW-PM.
100. MAG (PROVIEW): 52X24X52X.
101. MATSUSHITA (PANASONIC): CDRCB01, CDRRW01, CDRRW02, CDRRW03, CDRRW06, SW-9573, SW-9573D, SW-9583, SW-9583D, SW-9584D, UJ-810, UJ-811, UJ-812, DVD/CDRW, UJ-813, UJ-815A, UJ-816A, UJ-820, DVD/CDRW, UJ-820D, DVD/CDRW, UJ-822, DVD/CDRW, UJ-822D, DVD/CDRW, UJ-825, UJ-825D, UJ-830, DVD/CDRW, UJ-830CEA, UJ-830D, DVD/CDRW, UJ-831D, DVD/CDRW, UJ-835, UJ-835D, UJ-840D, DVD/CDRW, UJ-841D, DVD/CDRW, UJ-845D, DVD/CDRW, UJ-850D, DVD/CDRW, UJDA-750-II, UJDA-750-Il, UJDA-750-ll, UJDA310, UJDA320, UJDA330, UJDA330A, UJDA340, UJDA360, CDRW, UJDD420, UJDA710, UJDA710A, UJDA720, UJDB3100, UJDD410, UJDA750cDVD/CDRW, UJDA750FDVD/CDRW, UJDA750QT-A, UJDA755cDVD/CDRW, UJDA755yDVD/CDRW, UJDA755zDVD/CDRW, UJDA760cDVD/CDRW, UJDA760eDVD/CDRW, UJDA765cDVD/CDRW, BD-MLT SW-5582, UJ-210S, CD-R CW-7503, CW-7582, CD-RW CW-7585, CW-7586, CW-7122, CW-7122-B, CW-8121, CW-8122, CW-8123, CW-8124, CW-8221, CW-8571, CW-8572, CW-8572-C, CDRW/DVD UJDA740, DVD-R UJ-815, UJ-815A, UJ-816, UJ-816A, UJ-820, UJ-825, UJ-835, UJ-840, UJ-841, UJ-845, UJ-846, UJ-85J, DVD-RAM LF-D521, LF-D621, LF-M721, LF-M760, LF-M821, LF-M860, LF-P567, LF-P667, LF-P767, MLT01, SW-9571, SW-9571A, SW-9572, SW-9573, SW-9573C, SW-9573S, SW-9574, SW-9574A, SW-9574S, SW-9581, SW-9581A, SW-9581N, SW-9582, SW-9582N, SW-9583, SW-9583A, SW-9583C, SW-9583S, SW-9584, SW-9584A, SW-9585, SW-9585A, SW-9585S, SW-9586, SW-9586S, SW-9587, SW-9587A, SW-9587S, SW-9588, SW-9588A, UJ-810, UJ-811, UJ-811B, UJ-812, UJ-812B, UJ-813, UJ-815, UJ-815A, UJ-816, UJ-816A, UJ-820, UJ-820A, UJ-820B, UJ-820c, UJ-820S, UJ-822, UJ-822B, UJ-822c, UJ-822S, UJ-825, UJ-825A, UJ-825B, UJ-825S, UJ-830, UJ-830B, UJ-830c, UJ-830cc, UJ-830S, UJ-831S, UJ-832S, UJ-835, UJ-835A, UJ-835S, UJ-840A, UJ-840S, UJ-841A, UJ-841S, UJ-842B, UJ-842S, UJ-845A, UJ-845S, UJ-846, UJ-846A, UJ-846S, UJ-850S, UJ-85JA, UJ-85JS, UJDA730 DVD/CDRW, UJDA740 DVD/CDRW, UJDA740AC-A, UJDA745 DVD/CDRW, UJDA747 DVD/CDRW, UJDA750 DVD/CDRW, UJDA755 DVD/CDRW, UJDA757 DVD/CDRW, UJDA760 DVD/CDRW, UJDA765 DVD/CDRW, UJDA767 DVD/CDRW, UJDA770 DVD/CDRW.
102. MAXELL: MCDRW8X4X32, MCD-RW44-20, MCD-RW64-24, MCD-RW84-32, MCD-RW12-1032, MCD-RW16-1040, MCD-RW16-1040-L, MCD-RW24-1040-L, MCD-RW40-1248-L, MCD-RW4012-48, MCD-RW4812-48, MCD-RW4824-48, MCD-RW5224-52, MCD-RW5232-52.
103. MELCO: CRWS-SB1210.
104. MEMOREX: 16X-DDL-IN, 16X-DDL-SM-ILO, 16X-DDL-SM-IN, 24MAXX1040B1, 48MAXX1648AK, CD-RW2224, CD-RW4224, CD-RW4424, CDRW-2216, CDRW-2224, CDRW-4216, CDRW-4416, CDRW-4416S, CDRW-4420, CDRW-4420s, CDRW-4424, CDRW-4432, CDRW4420, CDRW4420S, CRW-1622, CRW-2216, CRW-2216e, CRW-2642, CRW-4216, CRW-4216e, DVD16+/-DL4RWID2, DVD16+/-DL4RWLD2, DVD16+/-DL4RWn16, DVD16+/-DL4RWnD, DVDUR/RWD16816AJ, 24MAXX 1040, 32Maxx 1240AK, 40EMAX 1240AJ, 2440AJ, 40MAXX 1240AJ, 1248AJ, 48MAX 244816AJ, 48MAXX 1248AJ, 2448AJ, 52MAX 245216AJ, 325216AJ, 325216AJ1, 52MAXX 2452AJ, 2452AK, 325216AJ, 3252AJ, 3252AJ1, 3252AJ1v2, 3252AT, CD-R 820S, CD-RW 8220S, 8432, 12432S, CDRW 4424, 4432, CDRW6424, CDRW6424S, CDRW/DVD 6424-4, DVD 16X-DDL-ILO, DVD+/-DLRWL1 F16, DVD+/-DLRWN16 D2, DVD+/-RW Dual-X1, True-8X, True8Xn, DVD+R/-R True8XI, True8Xl, DVD+R/RW 2.4x8AA, 4412AJ, 8412AJ, DVDUR/RW 12812AJ, 8412AJ, 8812AJ, DVDUR/RWD 8812AJ, SixteenMAXX 1040, TwelveMAXX 1032, 1032A, 1032P, Twelve MAXX 1032.
105. MEMUP (BTC): 1004IB, 1008IB, 4816IA, 5232IA, 5232IB, DRW1004IM, IDE1008, IDE4816, IDE5224.
106. Micro Advantage: DVDRW IDE1008.
107. MiniCDRW (ARCHOS): XS4424, XS4432, XS8432.
108. MiniRW (ACER): CD-R/RW 6X4X24, 8X8x24, 16X10, 24X10.
109. MITSUBISHI: CDRW226, CDRW226A, CDRW4420a, CDRW4420.
110. MITSUMI: CR-2600TE, CR-2801TE, CR-4801TE, CR-4802TE, CR-4804TE, CR-485FTE, CR-485GTE, CR-486ETE, CR-487ETE, CR-488ETE, CR-48X5TE, CR-48X8TE, CR-4809TE, CR-48X9TE, CR-48XATE, CR-48XCTE, CR-48XETE, CR-48XFTE, CR-48XGTE, CR-52XETE, CRS5224TE, DR-6800TE, DW-7801TE, DW-7802TE, DW-7872TE, DW-7873TE.
111. MOTOROLA (QSI): OA-X36, OA-X37, SLIM DVD/CD-RW, DVDRW.
112. MSI (AccessTek): CD-R/RW CR-48, CR-52, CD-RW 48XMAX, 52XMAX, 52X32-M0, CR-52, CR52, MS-8332, MS-8340, MS-8340S, MS-8348, MS-8348S, MS-8352M, MS-8416N, COMBO 48X24-M0, DVD Du 4X/24X-M0, 8X/48X-M0, DVD+RW 4X/40X-M0, 8X/48X-M0.
113. MTI: PLAYWRITE 8200.
114. NEC: NR-7900A, CD-RW NR-7500A, NR-7700A, NR-8500A, NR-8400A, NR-7800A, NR-7800B, NR-7900A, NR-9100A, NR-9200A, NR-9300A, DVD_RW ND-1100A, ND-1200A, ND-1300A, ND-1500A, ND-2300A, ND-2500A, ND-2500A2, ND-2510A, ND-3500A, ND-3500AD, ND-3500AG, ND-3520A, ND-3520AW, ND-3530A, ND-3540A, ND-3540B, ND-3550A, ND-3551A, ND-3650A, ND-4550A, ND-4551A, ND-5200A, ND-5300A, ND-5500A, ND-6500A, ND-6550A, ND-6750A, ND-6751A, ND-7550A, ND-7551A, DVD+-RW ND-3450A, ND-3530A, ND-6450A, ND-6500A, DVD+RW ND-1000A, ND-1100A, ND-1500A, ND-2100A, ND-2100AD, ND-3100A, ND-3100AD, ND-5000A, ND-5100A, ND-6050A, ND-6100A, DVD-RW ND-1300M, ND-1500M.
115. Norcent (LITE-ON): RWJ-321S, RWJ-401S, RWJ-481S, RWJ-482S, RWJ-483S.
116. NU (QSI): CDRW/DVD DBW-481, DBW-521, DBW-522, SBW242G, SBW242U, SBW243, UBW-241, CDRWDVD UBW-242, DVD+-RW SDW-082, SDW-082K, SDW-083, SDW-085, UDVD8042, UDW-042, DVD+RW SDW-081, SDW-081G, SDW-081L, UDW-041, DVD-RAM SDW-086, DVDRW DDW-041, DDW-061, DDW-081, DDW-082, DDW-121, DDW-122, DDW-161, DDW-162, SDW-041, SDW-042.
117. OLYMPUS (NEC): S-DVD-100.
118. OPDC (AccessTek): IDE4824CO.
119. OPTI (AccessTek): OPCRW4824, OPCRW5224, OPCRW5232, OPDC4816, DVD DUAL 4XMax, DVD RW 16XMax, 4XMax, 8XMax, DVD+RW 4XMax, 4XMaxA, 8XMax, DVD-RW 4XMax, 8XMax.
120. OPTI (BTC): IDE1612CO, IDE4016CO, IDE5216CO.
121. OPTIMUM (LITE-ON): DVDRWDUA.
122. OPTORITE (AccessTek): CRD-BPDV2, CRD-BPDV3, DD0202, CD-RW CW1601, CW3201, CW4001, CW4002, CW4801, CW4802, CW5201, CW5202, CW5205, CW5207, TCW5201, COMBO DC4801, DVD RW DD0201, DD0203, DD0401, DD0405, DD1203, DD1205, DD1601, DD1603, TDD0201, DVD+RW DD0202, DD0205, DD0402, DVD-RW DD0204, DD0403, DD0404.
123. OTI-975 (BTC): SOCRATES, SOCRATES    1.00.
124. PATRIOT: LTR-12101B, LTR-16101B, LTR-16102B, LTR-16102C.
125. PHILIPS: 241040 CDRW, 241240 CDRW, 321240 CDRW, 401240 CDRW, 401248 CDRW, 482448 CDRW, 4424 CDRW, BDD1001, CDD3610, CDD3801, CDD4201 CD-R/RW, CDD4401 CD-R/RW, CDD4801 CD-R/RW, CDD4851 CD-R/RW, CDD4911, CDD5101, CDD5251S, CDD5301, CDD5351, CDD5411, CDD5451, CDD6611, CDD6811, CDD6911, CDD6941, CDD7048, CDD7248, CDD7052, CDD7251, CDD7252, CDD7352, CDD7448, CDRW1610A, CDRW1612A, CDRW2010, CDRW2410A, CDRW2412A, CDRW3210S, CDRW4012A, CDRW4012P, CDRW4016A, CDRW4824, CDRW4832, CDRW48A, CDRW48P, CDRW5224, CDRW5232, CDRW5232L, CDRW5232P1, CDRW52P, CDRWDVD1610, CDRWDVD1612, CDRWDVD2010, CDRWDVD3210, CDRWDVD3210S, CDRWDVD3212, CDRWDVD4816, CDRWDVD4816a, CDRWDVD4816L, CDRWDVD4832, CDRWDVD52, CMB6148, CMB6248, COMB6048, COMB6248, DVD6001, DVD6002, DVD6003, DVD8301, DVD8351, DVD8401, DVD8412, DVD8421, DVD8431, DVD8601, DVD8631, DVD8651, DVD8701, DVD8731, DVD8801, DVD8900, DVD+RW-D01, DVD+RW-D28, DVD+RW-D38, DVD+RW-D48, DVD+RW-S44, DVD8851, DVDR1628P1, DVDR1640P, DVDR1648P, DVDR1648P1, DVDR1660P1, DVDR1668P1, DVDR16LS, DVDR824DP, DVDR824P, DVDR885P, DVDRW1208, DVDRW228, DVDRW248, DVDRW416, DVDRW416N, DVDRW424, DVDRW424R, DVDRW428, DVDRW448, DVDRW8301, DVDRW832, DVDRW8900, ED16DVDS, ED8DVDRW, ES8DVDRW, ES8DVDRX, JR24CDRW, JR32RWDV, JR48RWDV, JR4DVDRW, JR52CDRW, JR52RWDV, JR/RW24, PBCO4824L, PBDV1601P, PBDV1628P1, PBDV1640P, PBDV1648P, PBDV1660P1, PBDV416P, PBDV824DP, PBDV824P, PBDV885P, PBRW4824, PBRW5224, PBRW5232, PBRW5232L, PBRW5232P, PBRWDVD4816L, PCA382RW IDE, PCRW1208, PCRW1208JR, PCRW1208MR, PCRW1208UE, PCRW404, PCRW406, PCRW5232, PCRW5232P, PCRW804, RW48/DVD16a, RW52/DVD16a, RWDV4824L, RWDV5216P1, RWDV5216P2, SDVD6004, SDVD8041, SDVD8042, SDVD8311, SDVD8312, SDVD8421, SPD1400P1, SPD2300L1, SPD2400L1, SPD3000L1, SPD3200L1, SPD4000L1, SPD6000L1, SPD8003L1, SPD8004P1, BD-RE BDD1001, CD-R/RW RW7200A, CDRW/DVD CDD5211, CDD5260, CDD5262, CDD5263, COM6248, SCB5264, SCB5265, UCB5211, UCB5221, CDRWDVD SCB5266, SCB5268, UCB5231, DVD Du 4X/24X-P0, 8X/48X-P0, DVD+-RW DVD8701, SDVD8042, SDVD8431, SDVD8441, SDVD8811, SDVD8820, DVD+/-RW DVD8701, DVD8801, DVD+RW 4X/40X-P0, 8X/48X-P0, DVD8601, SDVD8041, SDVD8411, SDVD8421, SDVD8422, SDVD8423, UDVD8041, DVD-RAM SDVD8821, SDVD8822, SDVD8831, DVDRAM SDVD8821H, R/RW 48xA.
126. PIKA ONE (BTC): RIP4000P-C, RIP 8000, 8200, 8300.
127. PINE (AOPEN): 32X12X48 CDR-RW, 40X12X48 CD-RW, 40X12X48 CDR-RW.
128. PIONEER: BD-RW BDR-101, BDR-101A, DVD RW DVR-107D, DVR-A07D, DVD-RW DVR-103, DVR-104, DVR-105, DVR-106D, DVR-106RD, DVR-107D, DVR-107RD, DVR-108, DVR-108D, DVR-108RD, DVR-109, DVR-109D, DVR-109RD, DVR-110, DVR-110D, DVR-110RD, DVR-111, DVR-111D, DVR-111RD, DVR-111RF, DVR-A03, DVR-A04, DVR-A05, DVR-A06D, DVR-A06RD, DVR-A07D, DVR-A07RD, DVR-A08, DVR-A08D, DVR-A08RD, DVR-A09, DVR-A09D, DVR-A09RD, DVR-A10, DVR-A10D, DVR-A10RD, DVR-A11, DVR-A11D, DVR-A11RD, DVR-K04L, DVR-K04RA, DVR-K05, DVR-K05RA, DVR-K06RS, DVR-K11, DVR-K12D, DVR-K12RA, DVR-K13, DVR-K13D, DVR-K13RA, DVR-K14, DVR-K14D, DVR-K14L, DVR-K14RA, DVR-K15, DVR-K15RA, DVR-K16, DVR-K16RA, DVR-K16RF, DVR-K16RS, DVR-SK12D, DVR-SK13D, DVR-SK14D, DVD/CDRW DCR-111.
129. PLEXTOR: PX-504A DVD+R/RW, PX-S2410TU, CD-R PREMIUM, PX-320A, PX-R412C, PX-R820T, PX-S2410TU, PX-S88T, PX-W1210A, PX-W1210S, PX-W124TS, PX-W1610A, PX-W1610S, PX-W2410A, PX-W4012A, PX-W4012S, PX-W4220T, PX-W4824A, PX-W5224A, PX-W8220T, PX-W8432T, DVDR PX-504A, PX-708A, PX-708A2, PX-708UF, PX-708UF2, PX-712A, PX-712SA, PX-716A, PX-716AL, PX-740A, PX-760A.
130. POLAROID: 24X CD-RW DRIVE, 32X CD-RW DRIVE, 40X CD-RW DRIVE, 48X CD-RW DRIVE, BurnMax16, BURNMAX16 CB, BurnMax16EX, BURNMAX16EX CB, BURNMAX32 COMBO, BURNMAX32EX COMBO, BurnMax40, BURNMAX40 CB, BurnMax40EX, BURNMAX40EX CB, BurnMax40PX, BURNMAX48, BURNMAX48 CB, BurnMAX48CO, BURNMAX48EX, BURNMAX48EX CB, BurnMAX52, BurnMAX52CB, BurnMAX52SO, BurnMAX52EX, BurnMAX52EX SO, PROBT 5224.
131. Portable (ACER): CD-R/RW 4X4X24, CD-R/RW 6X4X24, CD-R/RW 4X4X6.
132. PROVIEW: CD-R/RW 52X24X52.
133. Q-lity (QSI): CD-R/RW ECW-043.
134. QPS: CD-W54E, CD-W58E, CD-W512EB, CD-W516EB, CD-W524E, CR-48XATE, CRD-BP1400P, CRD-BP1500P, CRD-BP1500U, CRD-BP1600P, CRD-BP1700P, CRD-BP4, LTR-16101B, LTR-20101B, LTR-24101B, RW-241040, CD-R PX-W1610A, PX-W1210A, PX-W8432T, PX-W1610S, PX-W1210S, PX-W124TS, PX-W2410A, CD-R/RW SW-408B, SW-208B, 16X10, 20X10, 24X10.
135. QSI: 12X DVDRW DRIVE, 16X DVDRW DRIVE, 24X CDRW/DVD S, US, 4X DVDRW DRIVE S, 52X CDRW/DVD, A, 8X DVDRW DRIVE, S, CD-R/RW SCW-081, CD-RW SCW-081, 8x8x24x, CDRW/DVD DBW-481, DBW-521, DBW-522, SBW-161, SBW-241, SBW-242, SBW242B, SBW242C, SBW242G, SBW242U, SBW243, SWB242U, UBW-241, UBW241G, CDRWDVD SBW-245, SBW-245T, UBW-242, Combo DBW521S, UBW241SE, DDW-161 DVD Dual, DVD+-RW SDW-082, SDW-082G, SDW-082K, SDW-082S, SDW-083, SDW-085, UDW-042, DVD+RW SDW-081, SDW-081G, SDW-081L, SDW-081S, UDW-041, DVD-RAM SDW-086, SDW-086K, SDW-086L, DVD/CDRW SBW-081, SBW-161, SBW-242, DVDRW DDW-041, DDW-061, DDW-081, DDW-082, DDW-121, DDW-122, DDW-161, DDW-162, SDW-041, SDW-042.
136. RICOH: DM-828, CD-R/RW MC104S, MP6200S, MP6201S, MP6200A, MP7040A, MP7040S, MP7060A, MP7060S, MP7063A, MP7080A, MP7080S, MP7083A, MP7120A, MP7120S, MP7125A, MP7125AP, MP7163A, MP7200A, MP7240A, MP7400A, MP8040A, MP8080A, MP9060, MP9120, MP9200, RW7040A, RW7040S, RW7060A, RW7060S, RW8040A, RW9060, RW104S, RW7080S, RW7080A, RW7063A, RW7120A, RW7120S, RW7083A, RW9120, RW7125A, RW8080A, RW7200A, RW9200, RW7163A, RW7400A, CD-RW MP7320A, MP7400A, MP7480A, MP7520A, RW7400A, RW7480A, RW7520A, DVD+RW MP5120, MP5125, MP5240, MP5240A, MP5240A24, MP5308, MP5308D, MP5308DB, MP5312DB, MP5316DA, MP5316DAD, MP5316DAG, MP5316DB, MP8160, MP8165, RW5120, RW5125, RW5240, RW5308, RW5308D, RW5308DB, RW5312DB, RW5316DA, RW5316DAD, RW5316DAG, RW5316DB, RW8160, RW8165.
137. RIDATA (AccessTek): DVD DUAL 4XMax, DVD RW 16XMax, 4XMax, 8XMax, DVD+RW 4XMax, 4XMaxA, 8XMax, DVD-RW 4XMax, 8XMax, DVDRW RDA-12042.
138. RM (BTC): CD-RW BCE5224IM, BCE5232IM, COMBO BCO5216IM.
139. RWD (JVC): RW2224, RW4224, XR-RW4424.
140. SAF: CD-R6024, CD-RW4416S, CD-R6024, CD-RW2224, CD-RW4224A, CD-R8020, CD-RW8220, CD-RW8432, CD-RW12432, CD-RW6424S, CD-RW6424A.
141. SAMSUNG: CD-R/RW SCW-230, SN-208B, SW-204B, SW-204F, SW-206, SW-207F, SW-208B, SW-208F, SW-212B, SW-216B, SW-216F, SW-220B, SW-224B, SW-224F, SW-232B, SW-240B, SW-248B, SW-248F, SW-252B, SW-252F, SW-252S, SW-252T, SW-408B, SWE-240B, CDRW/DVD SM-308B, SM-308N, SM-312B, SM316B, SM-332B, SM-352B, SM-352F, SM-352N, SM-352S, SM-408B, SN-308B, SN-324B, SN-324F, SN-324S, SN-W08B, SU-408B, COMBO SM-304B, SM-304F, DVD-MULTI SRT03B, SRT04B, SRT08B, DVD+RW SH-W08A, SH-W12A.
142. SANYO: CD-R CRD-R800S (firmware version 1.23 or later), CRD-RW1 (firmware version 1.09 or later), CRD-RW800P, CRD-RW2, CRD-BP2, CRD-BP900P, CRD-BP3, CRD-BP1300P, CRD-BP4, CRD-BP1400P, CRD-BP5, CRD-BP1500P, CRD-BP1600P, CRD-BP6, CRD-BP1700P, CRD-BP1800P.
143. SATA (BENQ): DVD DD 4X16X4X16.
144. SATA-BD (PHILIPS): BDRE1001.
145. SCSI-CD (PHILIPS): ReWritable-2x2x6.
146. SCSI-ID (PHILIPS): ReWritable-2x2x6.
147. SHARK (BTC): CDRW1610IM, CDRW2410IM, CDRW3212IM.
148. Shecom: ikebana.
149. Slimtype (LITE-ON): LSC-24081MX, LSC-24081X, LSC-24082KX, LSC-24083K, XJ-SC241, XJ-SC241M, XJ-SC242K, XJ-SC242M, XJ-SC242S, COMBI LSC-24081, LSC-24081S, LSC-24101, LSC-24101S, LSC-24121, LSC-24121S, COMBO LSC-24081, LSC-24081M, LSC-24081S, LSC-24082K, LSC-24082M, LSC-24082S, LSC-24101, LSC-24101S, LSC-24121, LSC-24121S, LSC-2485K, SOLC-2481K, SOSC-2483K, SOSW-2483K, SSC-2481K, SSC-2485K, DVD+RW SDW-421S, SOSW-822S, SOSW-842S, SOSW-862S, SOSW-872S, SOUW-861Y, DVDRW SDW-200D, SDW-421S, SDW-431S, SDW-431Z, SDW-452S, SLW-831S, SLW-831SX, SOLW-831S, SOLW-891S, SOSW-452S, SOSW-813S, SOSW-832S, SOSW-833S, SOSW-833SX, SOSW-852S, SOUW-871Y, SSM-8515S, SSM-85H5S, SSW-8015S, SSW-8515S.
150. SONY: PCGA-DVRW1, iLINK DRIVE, CD-R CDU928E, CRX110E, CD-RW CRX-850E, CRX0811, CRX0821, CRX100E, CRX10U, CRX120E, CRX140E, CRX140S, CRX145E, CRX145S, CRX155E, CRX160E, CRX160S, CRX1611, CRX1611E, CRX1621, CRX1650L, CRX168B, CRX170E, CRX1750MU, CRX1750U, CRX175A, CRX175A1, CRX175A2, CRX175E, CRX175E1, CRX175E2, CRX175M, CRX185A1, CRX185E1, CRX185E2, CRX185E3, CRX195A1, CRX195E, CRX195E1, CRX195E4, CRX205E1,

exXelior · Answer

cela presage til quelque chose de bon?

Lyonnais92 · Answer

Re,

Télécharge ce programme puis double clic dessus (ferme ton antivirus s'il te détecte quoi que ce soit) 
http://www.suspectfile.com/systemscan/ 

* Coche uniquement ces cases, décoche tout le reste : 

- Recent Files, 60 days 

Puis clic sur scan now, soit patient. 
Une fois qu'il aura terminé, un rapport va s'ouvrir, copie et colle son contenu ici et vérifie qu'il soit bien en entier, si besoin crée deux messages.

exXelior · Answer

antivir ma détécté des trojan! tes sur que c'est sûr ?
enfin voila

SystemScan - www.suspectfile.com - ver. 3.2.2

Running on: Windows XP PROFESSIONAL Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS

Date: 2007-12-01
Time: 22:17:57
  
Output limited to: 
 -Recent files

===================== Recent files (60 days old)=====================

----- recent files in C:\
01-12-2007 00:59:56 (DIR)        0 byte      0 days old -- qoobox
01-12-2007 16:25:42 (DIR)        0 byte      0 days old -- ComboFix
01-12-2007 16:41:14 (DIR)1595043840 byte      0 days old -- pagefile.sys
01-12-2007 16:41:16      1063436288 byte      0 days old -- hiberfil.sys
01-12-2007 22:17:56 (DIR)        0 byte      0 days old -- suspectfile
09-10-2007 17:56:20 (DIR)        0 byte     53 days old -- Config.Msi
23-10-2007 17:21:52 (DIR)        0 byte     39 days old -- Intel
30-11-2007 16:52:56 (DIR)        0 byte      1 days old -- kav
30-11-2007 18:38:22 (DIR)        0 byte      1 days old -- Navipromo
30-11-2007 18:43:38           6032 byte      1 days old -- egd.txt
30-11-2007 19:41:42 (DIR)        0 byte      1 days old -- MSNFix

----- recent files in C:\WINDOWS\
01-12-2007 01:01:20 (DIR)        0 byte      0 days old -- erdnt
01-12-2007 02:27:30        1344422 byte      0 days old -- WindowsUpdate.log
01-12-2007 10:48:46             50 byte      0 days old -- wiaservc.log
01-12-2007 10:48:46             12 byte      0 days old -- bthservsdp.dat
01-12-2007 10:48:46          32600 byte      0 days old -- SchedLgU.Txt
01-12-2007 16:41:22 (DIR)        0 byte      0 days old -- Minidump
01-12-2007 16:41:22           2048 byte      0 days old -- bootstat.dat
01-12-2007 16:41:50            157 byte      0 days old -- wiadebug.log
01-12-2007 16:41:52           3864 byte      0 days old -- ModemLog_Agere Systems HDA Modem.txt
01-12-2007 17:56:48         585791 byte      0 days old -- gmer.dll
01-12-2007 17:56:48             80 byte      0 days old -- gmer_uninstall.cmd
01-12-2007 18:14:50            250 byte      0 days old -- gmer.ini
01-12-2007 18:38:48            733 byte      0 days old -- win.ini
08-11-2007 16:59:02         136704 byte     23 days old -- catchme.exe
10-10-2007 16:46:06 (DIR)        0 byte     52 days old -- $NtUninstallKB941202$
10-10-2007 16:47:02 (DIR)        0 byte     52 days old -- $NtUninstallKB933729$
25-10-2007 15:29:24 (DIR)        0 byte     37 days old -- restauration systeme du 25oct2007
15-11-2007 17:29:30 (DIR)        0 byte     16 days old -- $NtUninstallKB943460$
21-11-2007 11:48:14          10593 byte     10 days old -- CSTBox.INI
26-11-2007 16:02:58 (DIR)        0 byte      5 days old -- Sun
30-11-2007 19:43:38            954 byte      1 days old -- msnfix.txt
12-11-2007 21:01:54           1421 byte     19 days old -- mozver.dat

----- recent files in C:\WINDOWS\Downloaded Program Files\

----- recent files in C:\WINDOWS\system\

----- recent files in C:\WINDOWS\system32\
01-12-2007 16:42:20           1158 byte      0 days old -- wpa.dbl
02-11-2007 08:12:58       18238072 byte     29 days old -- MRT.exe
09-10-2007 18:01:46          10752 byte     53 days old -- BASSMOD.dll
21-10-2007 17:59:22           6561 byte     41 days old -- lvcoinst.log
25-10-2007 15:28:14 (DIR)        0 byte     37 days old -- NtmsData
25-10-2007 17:43:26        8516608 byte     37 days old -- shell32.dll
29-10-2007 16:07:16         369152 byte     33 days old -- xpsp3res.dll
16-11-2007 19:27:54           5013 byte     15 days old -- jupdate-1.6.0_02-b05.log
29-11-2007 13:51:42         270984 byte      2 days old -- FNTCACHE.DAT
30-11-2007 16:33:32          54614 byte      1 days old -- perfc009.dat
30-11-2007 16:33:32          65800 byte      1 days old -- perfc00C.dat
30-11-2007 16:33:32         964218 byte      1 days old -- PerfStringBackup.INI
30-11-2007 16:33:32         384930 byte      1 days old -- perfh009.dat
30-11-2007 16:33:34         449978 byte      1 days old -- perfh00C.dat
30-11-2007 18:43:10 (DIR)        0 byte      1 days old -- bfubackups
30-11-2007 22:32:44           3072 byte      1 days old -- CONFIG.NT

----- recent files in C:\WINDOWS\system32\drivers\
01-12-2007 17:56:48          70001 byte      0 days old -- gmer.sys
01-12-2007 19:43:24            459 byte      0 days old -- fwdrv.err
07-10-2007 21:26:54         163644 byte     55 days old -- secdrv.sys
09-10-2007 17:23:28             32 byte     53 days old -- fidbox2.dat
09-10-2007 17:23:28             32 byte     53 days old -- fidbox.idx
09-10-2007 17:23:28             32 byte     53 days old -- fidbox.dat
09-10-2007 17:23:28             32 byte     53 days old -- fidbox2.idx
18-10-2007 00:14:00          41288 byte     44 days old -- ikfilesec.sys
18-10-2007 00:15:00          62280 byte     44 days old -- iksysflt.sys
18-10-2007 00:16:00          29000 byte     44 days old -- kcom.sys
18-10-2007 00:16:00          79688 byte     44 days old -- iksyssec.sys
22-10-2007 12:55:02         685816 byte     40 days old -- sptd.sys
30-11-2007 22:41:16          61632 byte      1 days old -- avipbb.sys

----- recent files in C:\WINDOWS	emp\
01-12-2007 10:50:00          16384 byte      0 days old -- Perflib_Perfdata_4f0.dat
01-12-2007 10:50:50          16384 byte      0 days old -- Perflib_Perfdata_9a0.dat
01-12-2007 16:41:42          16384 byte      0 days old -- Perflib_Perfdata_624.dat
01-12-2007 16:41:52              0 byte      0 days old -- T30DebugLogFile.txt
01-12-2007 16:42:16            255 byte      0 days old -- WGAErrLog.txt
01-12-2007 16:42:24            409 byte      0 days old -- WGANotify.settings
01-12-2007 16:42:54          16384 byte      0 days old -- Perflib_Perfdata_978.dat
01-12-2007 17:01:40            816 byte      0 days old -- MpCmdRun.log

----- recent files in C:\Program Files\
01-12-2007 00:14:24 (DIR)        0 byte      0 days old -- SUPERAntiSpyware
01-12-2007 10:37:02 (DIR)        0 byte      0 days old -- Sunbelt Software
07-10-2007 19:39:02 (DIR)        0 byte     55 days old -- Ubisoft
07-11-2007 13:58:50 (DIR)        0 byte     24 days old -- Creative
09-10-2007 18:01:30 (DIR)        0 byte     53 days old -- TuneUp Utilities 2007
21-10-2007 15:13:20 (DIR)        0 byte     41 days old -- splus
22-10-2007 12:58:04 (DIR)        0 byte     40 days old -- DAEMON Tools
16-11-2007 19:27:20 (DIR)        0 byte     15 days old -- Java
16-11-2007 19:28:10 (DIR)        0 byte     15 days old -- OpenOffice.org 2.3
30-11-2007 14:36:12 (DIR)        0 byte      1 days old -- a-squared Free
30-11-2007 18:10:40 (DIR)        0 byte      1 days old -- Trend Micro
30-11-2007 18:22:26 (DIR)        0 byte      1 days old -- BFU
30-11-2007 22:38:48 (DIR)        0 byte      1 days old -- AntiVir PersonalEdition Classic
30-11-2007 23:47:24 (DIR)        0 byte      1 days old -- Navilog1

----- recent files in C:\Program Files\Fichiers communs\
09-10-2007 18:00:20 (DIR)        0 byte     53 days old -- Wise Installation Wizard
16-11-2007 19:27:18 (DIR)        0 byte     15 days old -- Java

----- recent files in C:\Documents and Settings\alexX\Application Data\
01-12-2007 00:14:24 (DIR)        0 byte      0 days old -- SUPERAntiSpyware.com
07-11-2007 14:08:20 (DIR)        0 byte     24 days old -- Creative
25-10-2007 14:46:24 (DIR)        0 byte     37 days old -- RegistrySmart
16-11-2007 19:27:08 (DIR)        0 byte     15 days old -- Sun
16-11-2007 19:33:52 (DIR)        0 byte     15 days old -- OpenOffice.org2
30-11-2007 14:42:36 (DIR)        0 byte      1 days old -- PC Tools

----- recent files in C:\DOCUME~1\alexX\LOCALS~1\Temp\
01-12-2007 10:50:44          22704 byte      0 days old -- Danish.bin
01-12-2007 10:50:44          25670 byte      0 days old -- Dutch.bin
01-12-2007 10:50:44          16913 byte      0 days old -- TradChin.bin
01-12-2007 10:50:44          20101 byte      0 days old -- Korean.bin
01-12-2007 10:50:44          24256 byte      0 days old -- Japanese.bin
01-12-2007 10:50:46          25684 byte      0 days old -- German.bin
01-12-2007 10:50:46          26062 byte      0 days old -- Russian.bin
01-12-2007 10:50:46          27330 byte      0 days old -- Italian.bin
01-12-2007 10:50:46          27178 byte      0 days old -- French.bin
01-12-2007 10:50:48          21913 byte      0 days old -- Thai.bin
01-12-2007 10:50:48          20919 byte      0 days old -- Arabic.bin
01-12-2007 10:50:48          16374 byte      0 days old -- SimChin.bin
01-12-2007 10:50:48          24147 byte      0 days old -- Polish.bin
01-12-2007 10:50:48          24999 byte      0 days old -- Portuguese(Brazil).bin
01-12-2007 10:50:48          25003 byte      0 days old -- Greek.bin
01-12-2007 10:50:48          24028 byte      0 days old -- SWEDISH.bin
01-12-2007 10:50:48          27689 byte      0 days old -- Spanish.bin
01-12-2007 10:50:48          21857 byte      0 days old -- English.bin
01-12-2007 10:50:48          26187 byte      0 days old -- Portuguese.bin
01-12-2007 10:50:50          24252 byte      0 days old -- Czech.bin
01-12-2007 10:50:52          26001 byte      0 days old -- Hungarian.bin
01-12-2007 10:50:52          21901 byte      0 days old -- Norwegian.bin
01-12-2007 10:50:52          22194 byte      0 days old -- Turkish.bin
01-12-2007 10:50:52          19487 byte      0 days old -- Hebrew.bin
01-12-2007 10:50:52          22793 byte      0 days old -- Finnish.bin
01-12-2007 10:50:54         507904 byte      0 days old -- RtkBtMnt.exe
01-12-2007 10:51:34          16384 byte      0 days old -- Perflib_Perfdata_af4.dat
01-12-2007 10:51:36          16384 byte      0 days old -- ~DFEB17.tmp
01-12-2007 12:04:58 (DIR)        0 byte      0 days old -- MessengerCache
01-12-2007 14:26:42          32204 byte      0 days old -- TFR15.tmp
01-12-2007 14:26:42          27777 byte      0 days old -- TFR14.tmp
01-12-2007 14:26:42          10225 byte      0 days old -- TFR1A.tmp
01-12-2007 14:26:42          23262 byte      0 days old -- TFR1B.tmp
01-12-2007 14:26:42          21122 byte      0 days old -- TFR26.tmp
01-12-2007 14:26:42          23427 byte      0 days old -- TFR22.tmp
01-12-2007 14:26:42          67560 byte      0 days old -- TFR2D.tmp
01-12-2007 16:43:30          16384 byte      0 days old -- Perflib_Perfdata_4c4.dat
01-12-2007 16:43:32          16384 byte      0 days old -- ~DF59FE.tmp
01-12-2007 16:48:02            346 byte      0 days old -- jusched.log
01-12-2007 20:47:38           1272 byte      0 days old -- wmplog00.sqm
01-12-2007 21:15:02 (DIR)        0 byte      0 days old -- CTJBNS
01-12-2007 22:02:32           6164 byte      0 days old -- LVCOMSX.LOG
01-12-2007 22:11:44 (DIR)        0 byte      0 days old -- nsc92.tmp
01-12-2007 22:16:08 (DIR)        0 byte      0 days old -- nse96.tmp
01-12-2007 22:16:16          16384 byte      0 days old -- ~DF1DAD.tmp

==========================================
Scan completed in 0.1 minutes
End of report


~~~~~~~~~~~~~~~~~~~~~-----CREDITS-----~~~~~~~~~~~~~~~~~~~~~
SystemScan uses some freeware tools that remain property of their authors:

* SteelWerX Registry Console Tool, Who Am I (Bobby Flekman: www.xs4all.nl/~fstaal01) --> "Registry scan", "PC accounts "
* dumphive (Markus Stephany)--> "Registry scan"
* Listdlls (M.Russinovich, B.Cogswell: www.sysinternals.com) --> "Loaded modules"
* Catchme (gmer: www.gmer.net) --> "Hidden objects"
* LADS (Frank Heyne Software: http://www.heysoft.de) --> "Alternate Data Streams"

Thanks to them all for their hard work

Lyonnais92 · Answer

Re,

Ouvre ce lien  (merci a S!RI pour ce programme). http://siri.urz.free.fr/Fix/SmitfraudFix.php 
et télécharge SmitfraudFix.exe.

Regarde le tuto
Exécute le en choisissant l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.

exXelior · Answer

et voila

SmitFraudFix v2.256

Rapport fait à 23:00:02.98, 2007-12-01
Executé à partir de C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est FAT32
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\DOCUME~1\alexX\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Windows Media Player\VideoLAN\VLC\vlc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1	legal-at-spybot.info
127.0.0.1	www.legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\alexX


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\alexX\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ALEXX\FAVORIS


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5C350B32-4BE3-4424-9857-CCE90652DCFF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5C350B32-4BE3-4424-9857-CCE90652DCFF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{5C350B32-4BE3-4424-9857-CCE90652DCFF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

i

Lyonnais92 · Answer

Re,

Ouvre ce lien et télécharge RHosts de SiRi :

http://siri.urz.free.fr/RHosts.php

Double cliquer dessus pour l'exécuter

et cliquer sur " Restore original Hosts "

Refais passer zeb restore et réessaye Windows update.

exXelior · Answer

négatif toujours page blanche avec terminer en bas a gauche sur IE

Lyonnais92 · Answer

Re,

redémarre l'ordi, remets un rapport Smitfraudfix choix 1

exXelior · Answer

et voia apres le redemarrage

SmitFraudFix v2.256

Rapport fait à 23:43:40.43, 2007-12-01
Executé à partir de C:\Documents and Settings\alexX\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est FAT32
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\DOCUME~1\alexX\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\alexX


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\alexX\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ALEXX\FAVORIS


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5C350B32-4BE3-4424-9857-CCE90652DCFF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5C350B32-4BE3-4424-9857-CCE90652DCFF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{5C350B32-4BE3-4424-9857-CCE90652DCFF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Lyonnais92 · Answer

Re,

supprime ta version actuelle de genproc (le .zip et les fichiers extraits) et recommence la procédure du post 1.

Poste le rapport de Genproc.

Attention à ne l'exécuter qu'une fois comme dit sur le tuto.

exXelior · Answer

ok je te repondrais demain.Merci pour le temps consacré.

exXelior · Answer

[1] Aucune infection caractéristique trouvée !

Lyonnais92 · Answer

Re,

un conflit entre kerio et combofix;

Fais ceci :

Le driver KHIPS.SYS est utilisé dans kerio mais n'est pas indispensable. Il peut être supprimé de ton système. 

Ce driver peut également poser des soucis avec VirusScan 8.0 

Voici l'extrait trouvé sur le site de Kerio: 

1°) Désactiver HIPS dans la fenêtre deKerio Personnal Firewall dans l'onglet intrusions 
(ndt : Tu possèdes normalement 3 cases à cocher sur cet onglet dont l'une des cases qui se rapporte à l'option hips) 
2°) Fermer Kerio 
3°) Entrez en ligne de commande (démarrer, exécuter, cmd) "net stop khips" ---> Ceci desactivera le driver 
4°) Pour eviter que ce driver ne se recharge à nouveau, aller dans c:\windows\system32\drivers et supprimer khips.sys. 
5°) redemarrer le pc 

Cette option ne sera plus lancée jusqu'à la réinstallation complète du logiciel. 

Relance combofix et poste le rapport.

exXelior · Answer

ComboFix 07-11-19.4C - alexX 2007-12-02 15:19:56.3 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.449 [GMT 1:00] Running from: C:\Documents and Settings\alexX\Mes documents\Aides Comment sa marche\ComboFix.exe . ((((((((((((((((((((((((((((( Fichiers créés 2007-11-02 to 2007-12-02 )))))))))))))))))))))))))))))))))))) . 2007-12-01 23:00 5,868 --a------ C:\WINDOWS\system32 mp.reg 2007-12-01 22:59 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-12-01 22:59 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-12-01 22:59 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-12-01 22:59 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-12-01 22:59 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-12-01 12:07 459 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-12-01 10:37 d-------- C:\Program Files\Sunbelt Software 2007-12-01 00:14 d-------- C:\Program Files\SUPERAntiSpyware 2007-12-01 00:14 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2007-12-01 00:14 d-------- C:\Documents and Settings\alexX\Application Data\SUPERAntiSpyware.com 2007-11-30 23:47 d-------- C:\Program Files\Navilog1 2007-11-30 22:38 d-------- C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic 2007-11-30 19:41 d-------- C:\MSNFix 2007-11-30 18:43 d-------- C:\WINDOWS\system32\bfubackups 2007-11-30 18:38 d-------- C:\Navipromo 2007-11-30 18:22 d-------- C:\Program Files\BFU 2007-11-30 18:10 d-------- C:\Program Files\Trend Micro 2007-11-30 17:33 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-11-30 17:33 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-11-30 16:52 d-------- C:\kav 2007-11-30 14:42 d-------- C:\Documents and Settings\alexX\Application Data\PC Tools 2007-11-30 14:42 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-30 14:42 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-30 14:42 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-30 14:42 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-30 14:42 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-30 14:36 d-------- C:\Program Files\a-squared Free 2007-11-26 16:02 d-------- C:\WINDOWS\Sun 2007-11-16 19:33 d-------- C:\Documents and Settings\alexX\Application Data\OpenOffice.org2 2007-11-16 19:28 d-------- C:\Program Files\OpenOffice.org 2.3 2007-11-16 19:27 d-------- C:\Program Files\Java 2007-11-16 19:27 d-------- C:\Program Files\Fichiers communs\Java 2007-11-14 11:54 45,568 --a------ C:\WINDOWS\UniFish3.exe 2007-11-07 14:11 d-------- C:\Documents and Settings\All Users\Application Data\Creative 2007-11-07 14:08 d-------- C:\Documents and Settings\alexX\Application Data\Creative 2007-11-07 14:03 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx 2007-11-07 14:03 41,984 --------- C:\WINDOWS\Ctregrun.exe 2007-11-07 14:01 71,596 --------- C:\WINDOWS\system32\drivers\PfModNT.sys 2007-11-07 13:58 d-------- C:\Program Files\Creative 2007-11-07 13:58 229,376 --a------ C:\WINDOWS\system32\CTPmsMan.dll 2007-11-07 13:58 200,704 --a------ C:\WINDOWS\system32\CTPdeSrv.exe 2007-11-07 13:58 149,504 --a------ C:\WINDOWS\UNWISE.EXE 2007-11-07 13:58 143,360 --a------ C:\WINDOWS\system32\CTPmsWma.dll 2007-11-07 13:58 45,056 --a------ C:\WINDOWS\system32\Jb4Inst.crl 2007-11-07 13:58 32,768 --a------ C:\WINDOWS\system32\PdePgHlp.dll 2007-11-07 13:58 28,672 --a------ C:\WINDOWS\system32\PdeSrvps.dll 2007-11-07 13:58 28,672 --a------ C:\WINDOWS\system32\Jb4Inst.dll 2007-11-07 13:58 16,880 --a------ C:\WINDOWS\system32\drivers\ctpdusb.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-28 13:53 --------- d-----w C:\Documents and Settings\acer\Application Data\TuneUp Software 2007-10-25 16:43 8,516,608 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-25 13:46 --------- d-----w C:\Documents and Settings\alexX\Application Data\RegistrySmart 2007-10-22 11:58 --------- d-----w C:\Program Files\DAEMON Tools 2007-10-22 11:55 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-21 14:13 --------- d-----w C:\Program Files\splus 2007-10-09 17:01 --------- d-----w C:\Program Files\TuneUp Utilities 2007 2007-10-09 17:00 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2007-10-09 16:23 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-10-09 16:23 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2007-10-09 16:23 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-10-09 16:23 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-10-07 20:26 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-10-07 18:39 --------- d-----w C:\Program Files\Ubisoft 2007-09-26 14:44 69,689 ----a-w C:\WINDOWS\UNZIP.DLL 2007-09-26 14:44 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL 2007-09-26 14:44 286,720 ----a-w C:\WINDOWS\PATCH.EXE 2007-09-10 08:15 920,088 ----a-w C:\WINDOWS\system32\igxpun.exe . ((((((((((((((((((((((((((((( snapshot@2007-12-01_ 1.04.07.35 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE + 2007-12-01 16:56:48 585,791 ----a-w C:\WINDOWS\gmer.dll + 2007-06-29 08:38:18 581,632 ----a-w C:\WINDOWS\gmer.exe + 2007-12-01 09:37:06 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\ARPPRODUCTICON.exe + 2007-12-01 09:37:06 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe + 2007-12-01 09:37:06 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut2_8315396A5EA1419DBEC4978284BDF556.exe + 2007-04-26 09:21:30 302,000 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys + 2007-12-01 16:56:48 70,001 ----a-w C:\WINDOWS\system32\drivers\gmer.sys + 2007-12-02 14:17:14 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_2e4.dat + 2007-12-02 14:18:00 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_a40.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 05:00] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 13:24] "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:55 C:\WINDOWS\system32\bthprops.cpl] "LaunchApp"="Alaunch" [] "AGRSMMSG"="AGRSMMSG.exe" [2005-12-13 21:50 C:\WINDOWS\AGRSMMSG.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-07-19 09:42 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-07-19 09:42 C:\WINDOWS\SkyTel.exe] "AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-07-19 09:41] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-29 06:13] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "ntiMUI"="C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7 tiMUI.exe" [2006-05-15 11:15] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 05:00] "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 05:00] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00] "eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 15:00] "Acer ePresentation HPD"="C:\Acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-06-07 20:18] "ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-07-12 15:48] "Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 22:12] "LManager"="C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE" [2006-07-14 12:13] "eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 14:40] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2006-06-23 10:39] "LogitechCameraAssistant"="C:\Program Files\Acer\OrbiCam\CameraAssistant.exe" [2006-06-26 15:47] "LogitechVideo[inspector]"="C:\Program Files\Acer\OrbiCam\InstallHelper.exe" [2006-06-26 15:55] "LogitechCameraService(E)"="C:\WINDOWS\system32\ElkCtrl.exe" [2004-11-01 18:22] "SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 13:16] "OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 12:45] "WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2000-07-12 12:59] "Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2000-07-12 14:14] "Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [2000-08-04 03:01] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-08-24 11:01] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-08-24 11:01] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-08-24 11:00] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-06-14 18:32] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-30 22:41] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 05:00] "DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38] C:\Documents and Settings\alexX\Menu D‚marrer\Programmes\D‚marrage\ OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 22:57:56] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe [2004-12-14 04:44:06] Acer Empowering Technology.lnk - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-06-29 10:45:00] OFFICE One Startup v7.lnk - C:\Program Files\OFFICE One v7\OFFICE One Startup v7\oostartupv7.exe [2007-07-03 19:38:03] Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe [2004-12-14 04:44:06] Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2007-07-03 20:57:03] Rappels du Calendrier Microsoft Works.lnk - C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe [2000-07-12 14:14:38] [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll C:\WINDOWS\system32\klogon.dll 2007-06-26 16:53 206088 C:\WINDOWS\system32\klogon.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys R2 EpmPsd;Acer EPM Power Scheme Driver;\??\C:\WINDOWS\system32\drivers\epm-psd.sys R2 EpmShd;Acer EPM System Hardware Driver;\??\C:\WINDOWS\system32\drivers\epm-shd.sys R2 int15;int15;\??\C:\WINDOWS\system32\drivers\int15.sys R2 procguard;procguard;\??\C:\WINDOWS\system32\drivers\procguard.sys R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" R2 tvicport;tvicport;\??\C:\WINDOWS\system32\drivers vicport.sys R2 UxTuneUp;Extension de conception TuneUp;C:\WINDOWS\System32\svchost.exe -k netsvcs R3 DKbFltr;Dritek Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DKbFltr.sys R3 lv321av;Logitech USB PC Camera (VC0321);C:\WINDOWS\system32\DRIVERS\lv321av.sys R3 LVPrcMon;Logitech LVPrcMon Driver;\??\C:\WINDOWS\system32\drivers\LVPrcMon.sys R3 psdfilter;psdfilter;\??\C:\WINDOWS\system32\Drivers\psdfilter.sys R3 psdvdisk;psdvdisk;\??\C:\WINDOWS\system32\Drivers\psdvdisk.sys S1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys S2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2007-11-16 16:15:58 C:\WINDOWS\Tasks\Maintenance en 1 clic.job" - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe "2007-12-02 14:20:14 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-02 15:21:07 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-02 15:21:36 . --- E O F ---

exXelior · Answer

Maintenant quand je lance yahoo anti spy il me detecte tout le temps le "backdoor" et ISTbar!!!!

Lyonnais92 · Answer

Re,

il te les détecete où ?

tu as un rapport à poster ?

exXelior · Answer

non!!!
bon je pense que je vais enmenner ma machine a un infomaticien pacque la ya trop de problemes

exXelior · Answer

je te remercie pour ton aide.

Lyonnais92 · Answer

Re,

je te comprends.

Je me demandais depuis un cedrtain temps s'il ne frallait pas chercher à réparer Windows.

Je ne comprends rien à ce qui se passe. Tous les outils que je te fais passer reviennent avec "négatif" et l'ordi continue à beuguer.

Tu me tiens au courant.

exXelior · Answer

salut lyonnais92.Donc voila jai effectué c'est dernier temps un scan avec ceci 
http://www.sophos.fr/support/knowledgebase/article/13251.html
qui ma effectivement trouvé un virus type "Mal/packer" dans la clé de tune up utilities.
Cependant le scan n'as pas réussi a ouvrir C:/programmefiles....

exXelior · Answer

hein?

Lyonnais92 · Answer

Salut

pb de connection

Tune up, c'est la version d'essai ?

exXelior · Answer

non jai la version complete mais craké
le répertoire qui ne peu etre ouvert est le suiviant : C:\WINDOWS\Systeme32\drivers\SPTD.sys

Lyonnais92 · Answer

Re,

trouvé un virus type "Mal/packer" dans la clé de tune up utilities.

non jai la version complete mais craké 

voila la source de tes ennuis.

exXelior · Answer

Bonjour lyonnais92.
Probleme résolu jai tout reinstaller et cetait la meilleure solution.Merci pour tout l'aide apportée.
A plus...Enfin tu le prendra pas mal mais jespere pas ;)

Lyonnais92 · Answer

Bonjour,

pas de souci.

mais si tu a gardé ton crack, tu risques de tout voir repartir.

De rien pour l'aide.

Bonnes fêtes.

Virus ISTbar +Inconnu

69 réponses

Discussions similaires

Newsletters