Problème Trojan.Win32.BHO.abo

Résolu/Fermé
Aero-D - 3 déc. 2007 à 18:34
FillPCA Messages postés 2242 Date d'inscription samedi 21 avril 2007 Statut Contributeur sécurité Dernière intervention 18 février 2023 - 13 déc. 2007 à 22:31
Bonjour,

Suite a un problème sérieux detecté lors d'une analyse AV de kaspersky et une recommandation d'un membre, j'ouvre mon propre sujet concernant un problème insolvable avec le virus Trojan.Win32.BHO.abo que je ne peut supprimer

Je suis sur la corde raide merci de bien vouloir m'aider, je post ci-joint le rapport HijackThis :


Logfile of HijackThis v1.99.1
Scan saved at 18:28:22, on 03/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\apps\ABoard\ABoard.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Geffray\LOCALS~1\Temp\Rar$EX00.875\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {1182A964-F338-4150-B053-32772BC321E8} - C:\WINDOWS\system32\atkctr.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [UniqueDisplay] C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: 54M Wireless USB Adapter.lnk = C:\Program Files\USB\54M Wireless USB Adapter\Mrv8000x.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/default/TriJinx.1.0.0.87.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/default/mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/bingame/popcaploader_v10.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxcg_device - - C:\WINDOWS\system32\lxcgcoms.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

merci de bien vouloir m'aider

71 réponses

g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
4 déc. 2007 à 19:18
re,

essaie ceci :

Téléchargez ceci (de gchris) : http://komun.chez-alice.fr/Repertoire/Utilitaires.Desinfection.html
Dézippez-le sur votre bureau (clic droit -> extraire tout).
Vérifiez que vous êtes bien connecté à internet.
Dans le dossier créé, double-cliquez sur le fichier "Ad-Fix.bat" ou "Ad-fix"
Choisissez l'option 1.
Si vous avez un message de votre pare-feu qui vous demande si vous voulez autoriser le fichier URL2FILE.EXE à
se connecter à Internet, Autorisez, c'est nécessaire à ad-fix pour vérifier la version.
Quand c'est finit (cela peut prendre plusieurs minutes), un rapport s'ouvre avec le bloc-notes.
Merci de faire un copier/coller ici du contenu du rapport (Ad-Fix.txt)

@+
0
voila le rapport de Ad-Fix :


Ad-Fix v0.101e
by gchris


OPTION 1 (Scan) :

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Démarré à :

19:26:30.59 2007-12-04


Executé depuis :

C:\Documents and Settings\Geffray\Bureau\Ad-Fix


Os :

Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Recherche de fichier manquant


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Recherche de fichiers cachés (pas forcément mauvais)


Fichiers cachés à la racine du disque système :

BOOT.BAK
BOOT.INI
Bootfont.bin
cmldr
hiberfil.sys
IO.SYS
IPH.PH
MSDOS.SYS
pagefile.sys
sqmdata00.sqm
sqmdata01.sqm
sqmdata02.sqm
sqmdata03.sqm
sqmdata04.sqm
sqmdata05.sqm
sqmdata06.sqm
sqmdata07.sqm
sqmdata08.sqm
sqmdata09.sqm
sqmdata10.sqm
sqmdata11.sqm
sqmdata12.sqm
sqmdata13.sqm
sqmdata14.sqm
sqmdata15.sqm
sqmdata16.sqm
sqmdata17.sqm
sqmdata18.sqm
sqmdata19.sqm
sqmnoopt00.sqm
sqmnoopt01.sqm
sqmnoopt02.sqm
sqmnoopt03.sqm
sqmnoopt04.sqm
sqmnoopt05.sqm
sqmnoopt06.sqm
sqmnoopt07.sqm
sqmnoopt08.sqm
sqmnoopt09.sqm
sqmnoopt10.sqm
sqmnoopt11.sqm
sqmnoopt12.sqm
sqmnoopt13.sqm
sqmnoopt14.sqm
sqmnoopt15.sqm
sqmnoopt16.sqm
sqmnoopt17.sqm
sqmnoopt18.sqm
sqmnoopt19.sqm

Fichiers cachés dans le répertoire Windows :

QTFont.qfn
WindowsShell.Manifest
winnt.bmp
winnt256.bmp

Fichiers cachés dans le répertoire System32 :

cdplayer.exe.manifest
logonui.exe.manifest
ncpa.cpl.manifest
nwc.cpl.manifest
sapi.cpl.manifest
WindowsLogon.manifest
wuaucpl.cpl.manifest

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Analyse du registre


---------- USER AGENT -- POST PLATFORM

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

----------

---------- AppInit_DLLs

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\KASPER~1\\KASPER~1.0\\adialhk.dll"

----------
HKCR\Interface\{48E59292-9880-11CF-9754-00AA00C00908} Détecté !
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\media-motor.net Détecté !
HKLM\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908} Détecté !


Complete!

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Recherche de fichiers et dossiers


C:\WINDOWS\unvise32qt.exe Détecté !




»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Terminé à 19:36:44.37
0
maisj e peux affirmer que ce qu'il a trouvé c'est pas le virus car le fichier infecté est : atkctr.dll dans system32 mais impossible de le suppr manuellement, avec un prog en mode sans echec et meme dans la base de registre ... donc je sais plus trop quoi faire
0
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
4 déc. 2007 à 20:37
re,

fais deja ka suite de ad fix

¤Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter.
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).

Lancez de nouveau Ad-fix
Choisissez l'option 2
Le bureau ou les icônes vont disparaître, c'est normal.
Quand c'est terminé, pressez la touche "entrée" pour redémarrer l'ordinateur.
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
voila le rapport en mode sans echec :


Ad-Fix v0.101e
by gchris


OPTION 2 (Fix) :

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Démarré à :

20:45:35.96 2007-12-04
en mode sans échec


Executé depuis :

C:\Documents and Settings\Geffray\Bureau\Ad-Fix


Os :

Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Recherche de fichier manquant


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Nettoyage du registre

HKCR\Interface\{48E59292-9880-11CF-9754-00AA00C00908} Supprimé !
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\media-motor.net Supprimé !


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Suppression des fichiers

C:\WINDOWS\unvise32qt.exe Supprimé !

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Terminé à 20:54:54.79


Redémarrage effectué
0
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
4 déc. 2007 à 21:06
re,

on va essayer ca maintenant:

Une partie de la procédure se déroulera sans avoir accès à internet, prière d'imprimer ces instructions, ou de les coller dans un fichier texte, pour lecture durant cette désinfection.

Les manipulations sont à faire sans interruption et dans l'ordre.

Si tu ne comprends pas quelque chose, demande des explications avant de commencer.

1/Télécharge Brute Force Uninstaller (de Merijn)
http://www.merijn.org/files/bfu.zip

Créé un nouveau dossier directement sur le C:\ et nomme-le BFU. Décompresse le fichier téléchargé dans ce nouveau dossier (C:\BFU)

2/FAIS UN CLIC-DROIT sur le lien suivant

http://perso.orange.fr/Chercheur-perso/scripts/toolbar.bfu

et choisis "Enregistrer la cible sous..." afin de télécharger Toolbar.bfu de Chercheur

Sauvegarde dans le dossier créé (C:\BFU). **Note : si tu utilises Internet Explorer; lors de la sauvegarde, assure-toi que le champs "Type :" affiche "Tous les fichiers".
Tu dois maintenant avoir deux fichiers dans le dossier C:\BFU : Toolbar.bfu et BFU.exe (très important).

3/ Redémarre en mode Sans Échec :
au redémarrage, tapote immédiatement la touche F8 ou F5;
tu verras un écran avec choix de démarrages apparaitre.
Utilisant les flèches du clavier, choisis "Mode Sans Échec" et valide avec "Entrée".
Choisis ton compte usuel, et non Administrateur.

4/ Démarre le "Brute Force Uninstaller" en double-cliquant BFU.exe (du dossier C:\BFU)

Clique sur le petit dossier jaune, à la droite de la boîte scrïptline to execute, et
double-clique sur :
Toolbar.bfu
Dans la boîte "scrïptline to execute", tu devrais maintenant voir ceci :
C:\BFU\Toolbar.bfu
Clique sur Execute et laisse-le faire son travail.
Attendre que Complete scrïpt execution apparaisse et clique sur OK.
Clique Exit pour fermer le programme BFU.

5/Redémarre normalement et repost un hijack this stp

@+
0
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
5 déc. 2007 à 12:39
salut Aero-D,

Ca n´as pas l´air de donner grand chose ?, je me trompe ?

Quelle est le probleme, lorsque tu passe combofix, as tu un message d´erreur ?

Peux tu passer cet outil stp :

* Télécharge SREng (de Smallfrogs) : http://www.kztechs.com/eng/download.html
* Dézippe tout son contenu sur ton bureau (clic droit >Extraire ici).
* Ouvre le dossier SReng2 et double-clique sur SREng.exe.
* Clique sur "smart scan".
* Clique sur le bouton "scan".
* Quand l'analyse est terminée, clique sur le bouton "save reports".
* Sauvegarde alors le rapport sur ton bureau.
* Copie/colle le contenu du rapport SREnglLOG.log dans ta prochaine réponse.

@+
0
sa ne donne rien et pour BFU j'ai bien essayé de lancer le mode sans echec qui au début se lancais bien mais impossible l'ordi reboot a chaque fois que je le lance donc ... faut faire quelque chose :'(

j'essaie SREng et je te redis g!rly
0
voila le rapport de SREng

[CODE]

2007-12-05,13:27:23

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed

Follow item(s) have been choosed:
All Boot Items (Including Registry, Startup Folders, Services and so on)
Browser Add-ons
Runing Processes (Including process model information)
File Associations
Winsock Provider
Autorun.Inf
HOSTS File
Process Privileges Scan


Boot Items
Registry
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<PopUpStopperFreeEdition><"C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"> [Panicware, Inc.]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<nwiz><nwiz.exe /install> []
<SunJavaUpdateSched><"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"> [(Verified)"Sun Microsystems, Inc."]
<ACTIVBOARD><c:\apps\ABoard\ABoard.exe> [NEC Computers International]
<Logitech Hardware Abstraction Layer><KHALMNPR.EXE> [N/A]
<LogitechCommunicationsManager><"C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"> [(Verified)Logitech Inc]
<Launch LCDMon><"C:\Program Files\Logitech\G-series Software\LCDMon.exe"> [Logitech Inc.]
<ISUSPM Startup><C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup> [N/A]
<ISUSScheduler><"C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start> [InstallShield Software Corporation]
<UniqueDisplay><C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe> []
<NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [NVIDIA Corporation]
<SDTray><"C:\Program Files\Spyware Doctor\SDTrayApp.exe"> [(Verified)PC Tools]
<AVP><"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"> [(Verified)Kaspersky Lab]
<TrojanScanner><C:\Program Files\Trojan Remover\Trjscan.exe> [(Verified)Simply Super Software]
<UnlockerAssistant><"C:\Program Files\Unlocker\UnlockerAssistant.exe"> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll> [(Verified)Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [(Verified)Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
<IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<Carnet d'adresses 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<BootSkin Startup Jobs><; "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs> [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<DAEMON Tools><; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Echovoice Gamer Statistics><; C:\Program Files\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe> [Echovoice]
<EzPrint><; "C:\Program Files\Lexmark 2300 Series\ezprint.exe"> [N/A]
<FaxCenterServer><; "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s> [N/A]
<Launch LGDCore><; "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE> [Logitech Inc.]
<LogitechQuickCamRibbon><; "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide> [(Verified)Logitech Inc]
<lxcgmon.exe><; "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"> [N/A]
<SDTray><; "C:\Program Files\Spyware Doctor\SDTrayApp.exe"> [(Verified)PC Tools]
<Sony Ericsson PC Suite><; "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions> [Sony Ericsson Mobile Communications AB]
<SoundMan><; SOUNDMAN.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<TkBellExe><; "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<updateMgr><; C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<WinampAgent><; C:\Program Files\Winamp\winampa.exe> []

==================================
Startup Folders
[54M Wireless USB Adapter]
<C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\54M Wireless USB Adapter.lnk --> C:\Program Files\USB\54M Wireless USB Adapter\Mrv8000x.exe [N/A]><N>
[BHODemon 2.0]
<C:\Documents and Settings\Geffray\Menu Démarrer\Programmes\Démarrage\BHODemon 2.0.lnk --> C:\PROGRA~1\BHODEM~1\BHODemon.exe [Definitive Solutions, Inc.]><N>

==================================
Services
[Ad-Aware 2007 Service / aawservice][Running/Auto Start]
<"C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"><Lavasoft AB>
[Adobe LM Service / Adobe LM Service][Stopped/Disabled]
<"C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[AOL Connectivity Service / AOL ACS][Stopped/Disabled]
<C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe><America Online, Inc.>
[Gestion d'applications / AppMgmt][Stopped/Manual Start]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[Kaspersky Internet Security 7.0 / AVP][Running/Auto Start]
<"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r><Kaspersky Lab>
[##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## / Bonjour Service][Running/Auto Start]
<"C:\Program Files\Bonjour\mDNSResponder.exe"><Apple Computer, Inc.>
[CyberLink Background Capture Service (CBCS) / CLCapSvc][Running/Auto Start]
<"c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe"><>
[CyberLink Task Scheduler (CTS) / CLSched][Running/Auto Start]
<"c:\APPS\Powercinema\Kernel\TV\CLSched.exe"><>
[CyberLink Media Library Service / CyberLink Media Library Service][Running/Auto Start]
<"C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe"><Cyberlink>
[FLEXnet Licensing Service / FLEXnet Licensing Service][Stopped/Manual Start]
<"C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"><Macrovision Europe Ltd.>
[Generic Service for HID Keyboard Input Collections / GenericHidService][Running/Auto Start]
<c:\APPS\HIDSERVICE\HIDSERVICE.exe><N/A>
[InstallDriver Table Manager / IDriverT][Stopped/Manual Start]
<"C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>
[Process Monitor / LVPrcSrv][Running/Auto Start]
<c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe><Logitech Inc.>
[LVSrvLauncher / LVSrvLauncher][Stopped/Auto Start]
<C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe><Logitech Inc.>
[lxcg_device / lxcg_device][Stopped/Manual Start]
<C:\WINDOWS\system32\lxcgcoms.exe -service><>
[MSSQL$SONY_MEDIAMGR / MSSQL$SONY_MEDIAMGR][Stopped/Manual Start]
<C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR><Microsoft Corporation>
[MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start]
<C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe><N/A>
[MysqlInventime / MysqlInventime][Stopped/Manual Start]
<C:\Apps\INVENT~1\mysql\bin\mysqld-nt --defaults-file=C:\Apps\Inventime\mysql\my.ini MysqlInventime><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[PC Tools Auxiliary Service / sdAuxService][Running/Auto Start]
<C:\Program Files\Spyware Doctor\svcntaux.exe><PC Tools>
[PC Tools Security Service / sdCoreService][Running/Auto Start]
<C:\Program Files\Spyware Doctor\swdsvc.exe><PC Tools>
[SmartLinkService / SLService][Running/Auto Start]
<slserv.exe><>
[SQLAgent$SONY_MEDIAMGR / SQLAgent$SONY_MEDIAMGR][Stopped/Manual Start]
<C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR><Microsoft Corporation>

==================================
Drivers
[3xHybrid service / 3xHybrid][Stopped/Manual Start]
<system32\DRIVERS\3xHybrid.sys><Philips Semiconductors GmbH>
[abp480n5 / abp480n5][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ABP480N5.SYS><Microsoft Corporation>
[adpu160m / adpu160m][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\adpu160m.sys><Microsoft Corporation>
[Aha154x / Aha154x][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\aha154x.sys><Microsoft Corporation>
[aic78u2 / aic78u2][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\aic78u2.sys><Microsoft Corporation>
[aic78xx / aic78xx][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\aic78xx.sys><Microsoft Corporation>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AliIde / AliIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[Pilote de filtre du bus AMD AGP / amdagp][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\amdagp.sys><Advanced Micro Devices, Inc.>
[Pilote de processeur AMD / AmdK8][Running/System Start]
<system32\DRIVERS\AmdK8.sys><Advanced Micro Devices>
[asc / asc][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\asc.sys><Advanced System Products, Inc.>
[asc3350p / asc3350p][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\asc3350p.sys><Microsoft Corporation>
[asc3550 / asc3550][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\asc3550.sys><Advanced System Products, Inc.>
[cd20xrnt / cd20xrnt][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\cd20xrnt.sys><Microsoft Corporation>
[CmdIde / CmdIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[dac2w2k / dac2w2k][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\dac2w2k.sys><Mylex Corporation>
[dpti2o / dpti2o][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\dpti2o.sys><Microsoft Corporation>
[flnqvxin / flnqvxin][Running/Boot Start]
<\SystemRoot\system32\drivers\dhawtanq.dat><N/A>
[File Security Driver / IKFileSec][Running/Boot Start]
<\SystemRoot\system32\drivers\ikfilesec.sys><PCTools Research Pty Ltd.>
[System Filter Driver / IKSysFlt][Running/System Start]
<system32\drivers\iksysflt.sys><PCTools Research Pty Ltd.>
[System Security Driver / IKSysSec][Running/System Start]
<system32\drivers\iksyssec.sys><PCTools Research Pty Ltd.>
[ini910u / ini910u][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ini910u.sys><Microsoft Corporation>
[Sony Ericsson 750 driver (WDM) / k750bus][Stopped/Manual Start]
<system32\DRIVERS\k750bus.sys><MCCI>
[Sony Ericsson 750 USB WMC Modem Filter / k750mdfl][Stopped/Manual Start]
<system32\DRIVERS\k750mdfl.sys><MCCI>
[Sony Ericsson 750 USB WMC Modem Drivers / k750mdm][Stopped/Manual Start]
<system32\DRIVERS\k750mdm.sys><MCCI>
[Sony Ericsson 750 USB WMC Device Management Drivers / k750mgmt][Stopped/Manual Start]
<system32\DRIVERS\k750mgmt.sys><MCCI>
[Sony Ericsson 750 USB WMC OBEX Interface Drivers / k750obex][Stopped/Manual Start]
<system32\DRIVERS\k750obex.sys><MCCI>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[Kaspersky Anti-Virus NDIS Filter / klim5][Running/Manual Start]
<system32\DRIVERS\klim5.sys><Kaspersky Lab>
[Logitech SetPoint USB Receiver device driver / LHidUsbK][Stopped/Manual Start]
<System32\Drivers\LHidUsbK.Sys><N/A>
[Logitech SetPoint Mouse Filter Driver / LMouKE][Stopped/Manual Start]
<system32\DRIVERS\LMouKE.Sys><N/A>
[Logitech AEC Driver / LVcKap][Stopped/Manual Start]
<system32\DRIVERS\LVcKap.sys><>
[Logitech Machine Vision Engine Loader / LVMVDrv][Stopped/Manual Start]
<system32\DRIVERS\LVMVDrv.sys><Logitech Inc.>
[Logitech LVPr2Mon Driver / LVPr2Mon][Running/Manual Start]
<system32\DRIVERS\LVPr2Mon.sys><>
[Logitech USB Monitor Filter / LVUSBSta][Running/Manual Start]
<system32\drivers\LVUSBSta.sys><Logitech Inc.>
[mraid35x / mraid35x][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\mraid35x.sys><American Megatrends Inc.>
[Vista 32-bits Native WiFi Driver - USB / MRV6X32U][Stopped/Manual Start]
<system32\DRIVERS\MRVW23B.sys><>
[54M Wireless USB Adapter Dirver for Windows XP / MRVW225][Running/Manual Start]
<system32\DRIVERS\MRVW225.sys><>
[Mtlmnt5 / Mtlmnt5][Running/Manual Start]
<system32\DRIVERS\Mtlmnt5.sys><>
[Mtlstrm / Mtlstrm][Stopped/Manual Start]
<system32\DRIVERS\Mtlstrm.sys><>
[NtMtlFax / NtMtlFax][Stopped/Manual Start]
<system32\DRIVERS\NtMtlFax.sys><>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Volume Adapter / pepifilter][Running/Manual Start]
<system32\DRIVERS\lv302af.sys><Logitech Inc.>
[Logitech QuickCam IM(PID_PEPI) / PID_PEPI][Running/Manual Start]
<system32\DRIVERS\LV302V32.SYS><Logitech Inc.>
[Pilote de liaison parallèle directe / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[ql1080 / ql1080][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ql1080.sys><QLogic Corporation>
[Ql10wnt / Ql10wnt][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ql10wnt.sys><Microsoft Corporation>
[ql12160 / ql12160][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ql12160.sys><QLogic Corporation>
[ql1280 / ql1280][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ql1280.sys><QLogic Corporation>
[RecAgent / RecAgent][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\DRIVERS\RecAgent.sys><Smart Link>
[Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver / RTL8023xp][Stopped/Manual Start]
<system32\DRIVERS\Rtlnicxp.sys><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Running/Auto Start]
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[StarForce Protection Environment Driver (version 1.x) / sfdrv01][Running/Boot Start]
<\SystemRoot\System32\drivers\sfdrv01.sys><Protection Technology>
[StarForce Protection Helper Driver (version 2.x) / sfhlp02][Running/Boot Start]
<\SystemRoot\System32\drivers\sfhlp02.sys><Protection Technology>
[StarForce Protection VFS Driver (version 2.x) / sfvfs02][Running/Boot Start]
<\SystemRoot\System32\drivers\sfvfs02.sys><Protection Technology>
[Filtre de bus AGP SIS / sisagp][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\sisagp.sys><Silicon Integrated Systems Corporation>
[SmartLink AMR_PCI Driver / Slntamr][Running/Manual Start]
<system32\DRIVERS\slntamr.sys><>
[SlNtHal / SlNtHal][Stopped/Manual Start]
<system32\DRIVERS\Slnthal.sys><>
[SlWdmSup / SlWdmSup][Running/Manual Start]
<system32\DRIVERS\SlWdmSup.sys><Vireo Software>
[Sparrow / Sparrow][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\sparrow.sys><Adaptec, Inc.>
[sptd / sptd][Running/Boot Start]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[symc810 / symc810][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\symc810.sys><Symbios Logic Inc.>
[symc8xx / symc8xx][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\symc8xx.sys><LSI Logic>
[sym_hi / sym_hi][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\sym_hi.sys><LSI Logic>
[sym_u3 / sym_u3][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\sym_u3.sys><LSI Logic>
[TosIde / TosIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\toside.sys><Microsoft Corporation>
[ultra / ultra][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ultra.sys><Promise Technology, Inc.>
[ViaIde / ViaIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[WAN Miniport (ATW) / wanatw][Running/Manual Start]
<system32\DRIVERS\wanatw4.sys><America Online, Inc.>
[Codec Teletext standard / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

==================================
Browser Add-ons
[]
{1182A964-F338-4150-B053-32772BC321E8} <C:\WINDOWS\system32\atkctr.dll, N/A>
[Java Plug-in 1.6.0_03]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll, N/A>
[Statistiques d’Anti-Virus Internet]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll, Kaspersky Lab>
[Skype add-on (button)]
{77BF5300-1474-4EC7-9980-D32B190E9B07} <C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll, N/A>
[&Rechercher]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL, Microsoft Corporation>
[]
{e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Checkers Class]
{20A60F0D-9AFA-4515-A0FD-83BD84642501} <C:\WINDOWS\Downloaded Program Files\msgrchkr.dll, Microsoft Corporation>
[CPlayFirstTriJinxControl Object]
{2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} <C:\WINDOWS\Downloaded Program Files\TriJinx.1.0.0.87.dll, PlayFirst, Inc.>
[EARTPatchX Class]
{54B52E52-8000-4413-BD67-FC7FE24B59F2} <C:\WINDOWS\Downloaded Program Files\EARTPX.dll, >
[Solitaire Showdown Class]
{5C051655-FCD5-4969-9182-770EA5AA5565} <C:\WINDOWS\Downloaded Program Files\SolitaireShowdown.dll, Microsoft Corporation>
[UnoCtrl Class]
{5D6F45B3-9043-443D-A792-115447494D24} <C:\WINDOWS\Downloaded Program Files\GAME_UNO1.dll, Microsoft>
[MJLauncherCtrl Class]
{7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} <C:\WINDOWS\Downloaded Program Files\mjolauncher.dll, MumboJumbo Online>
[Java Plug-in 1.6.0_03]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll, N/A>
[MSN Games - Installer]
{B8BE5E93-A60C-4D26-A2DC-220313175592} <C:\WINDOWS\Downloaded Program Files\ZIntro.ocx, Microsoft Corporation>
[MessengerStatsClient Class]
{C3F79A2B-B9B4-4A66-B012-3EE46475B072} <C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll, Microsoft Corporation>
[Java Plug-in 1.4.2_05]
{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll, N/A>
[Java Plug-in 1.5.0_03]
{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll, N/A>
[Java Plug-in 1.5.0_11]
{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll, N/A>
[Java Plug-in 1.6.0_01]
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll, N/A>
[Java Plug-in 1.6.0_02]
{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll, N/A>
[Java Plug-in 1.6.0_03]
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll, N/A>
[Java Plug-in 1.6.0_03]
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll, Sun Microsystems, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[PopCapLoader Object]
{DF780F87-FF2B-4DF8-92D0-73DB16A1543A} <C:\WINDOWS\Downloaded Program Files\popcaploader.dll, PopCap Games>
[Minesweeper Flags Class]
{F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} <C:\WINDOWS\Downloaded Program Files\MineSweeper.dll, Microsoft Corporation>
[QuickTime Object]
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} <C:\Program Files\QuickTime\QTPlugin.ocx, Apple Computer, Inc.>
[DataCtl Class]
{0468C085-CA5B-11D0-AF08-00609797F0E0} <C:\PROGRA~1\MICROS~3\Office12\OUTLCTL.DLL, >
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[]
{1182A964-F338-4150-B053-32772BC321E8} <C:\WINDOWS\system32\atkctr.dll, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[Microsoft Visio Document]
{279D6C9A-652E-4833-BEFC-312CA8887857} <C:\PROGRA~1\MICROS~3\Office12\VVIEWER.DLL, Microsoft Corporation>
[EARTPatchX Class]
{54B52E52-8000-4413-BD67-FC7FE24B59F2} <C:\WINDOWS\Downloaded Program Files\EARTPX.dll, >
[InstallShield Update Service Agent]
{5B7524C8-2446-40E9-9474-94A779DBA224} <C:\WINDOWS\Downloaded Program Files\isusweb.dll, InstallShield Software Corporation>
[DivXBrowserPlugin Object]
{67DABFBF-D0AB-41FA-9C46-CC0F21721616} <C:\Program Files\DivX\DivX Web Player\npdivx32.dll, DivX,Inc.>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[Skype add-on (button)]
{77BF5300-1474-4EC7-9980-D32B190E9B07} <C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll, N/A>
[Microsoft Web Browser]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[MSN Games - Installer]
{B8BE5E93-A60C-4D26-A2DC-220313175592} <C:\WINDOWS\Downloaded Program Files\ZIntro.ocx, Microsoft Corporation>
[VIDEO__AVI Moniker Class]
{CD3AFA88-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__MPEG Moniker Class]
{CD3AFA89-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[QuickTimeCheck Class]
{DE4AF3B0-F4D4-11D3-B41A-0050DA2E6C21} <C:\WINDOWS\system32\QuickTimeCheck.OCX, Apple Computer, Inc.>
[XML DOM Document 3.0]
{F5078F32-C551-11D3-89B9-0000F81FE221} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XML HTTP]
{F6D90F16-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[Ajouter à Kaspersky Anti-Bannière]
<C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm, N/A>
[E&xporter vers Microsoft Excel]
<res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000, N/A>

==================================
Running Processes
[PID: 640 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1040 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 1064 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125]
[C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1112 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 1124 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 1292 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 1352 / SERVICE RÉSEAU][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125]
[PID: 1396 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll] [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[PID: 1456 / SERVICE RÉSEAU][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125]
[PID: 1596 / SERVICE LOCAL][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 1840 / SYSTEM][C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe] [Lavasoft AB, 7, 0, 2, 5]
[C:\Program Files\Lavasoft\Ad-Aware 2007\CEAPI.dll] [Lavasoft AB, 7, 0, 2, 3]
[C:\Program Files\Lavasoft\Ad-Aware 2007\PKArchive84cb.dll] [PKWARE, Inc., 8.4.219.0]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)]
[C:\Program Files\Lavasoft\Ad-Aware 2007\Update.dll] [, 7, 0, 1, 3]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 1924 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125]
[C:\WINDOWS\system32\lxcglmpm.DLL] [ , 1.154.19.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.2175.0]
[PID: 1968 / SYSTEM][c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe] [Logitech Inc., 10.5.1.2027]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 520 / SYSTEM][C:\Program Files\Bonjour\mDNSResponder.exe] [Apple Computer, Inc., 1,0,3,1]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 552 / SYSTEM][c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe] [, 4.00.1214]
[c:\Apps\Powercinema\Kernel\TV\CLCapSvcps.dll] [N/A, ]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125]
[c:\Apps\Powercinema\Kernel\TV\CLCapEngine.dll] [, 4.00.1214]
[c:\Apps\Powercinema\Kernel\TV\PCMRRec4.dll] [CyberLink Corp., 4.00.1304]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 476 / SYSTEM][c:\APPS\Powercinema\Kernel\TV\CLSched.exe] [, 4.00.1214]
[c:\Apps\Powercinema\Kernel\TV\CLCapSvcps.dll] [N/A, ]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125]
[c:\Apps\Powercinema\Kernel\TV\CLSchMgr.dll] [, 4.00.1214]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 736 / SYSTEM][C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe] [Cyberlink, 1, 1, 0, 1101]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 752 / SYSTEM][C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe] [Cyberlink, 1, 1, 0, 1101]
[c:\Apps\Powercinema\Kernel\HomeNetWorking\CLNetMedia.dll] [, 1, 0, 0, 1012]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 780 / SYSTEM][c:\APPS\HIDSERVICE\HIDSERVICE.exe] [N/A, ]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 896 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.11.6909]
[C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.6909]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 964 / SYSTEM][C:\Program Files\Spyware Doctor\svcntaux.exe] [PC Tools, 5.0.5.3]
[C:\Program Files\Spyware Doctor\rtl100.bpl] [Borland Software Corporation, 10.0.2288.42451]
[C:\Program Files\Spyware Doctor\vcl100.bpl] [Borland Software Corporation, 10.0.2288.42451]
[C:\Program Files\Spyware Doctor\SysAccess.dll] [PC Tools, 5.0.5.3]
[C:\Program Files\Spyware Doctor\ikdll.dll] [PCTools Research Pty Ltd., 5.0.2.1036]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 1472 / SYSTEM][C:\Program Files\Spyware Doctor\swdsvc.exe] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\SysAccess.dll] [PC Tools, 5.0.5.3]
[C:\Program Files\Spyware Doctor\rtl100.bpl] [Borland Software Corporation, 10.0.2288.42451]
[C:\Program Files\Spyware Doctor\ikdll.dll] [PCTools Research Pty Ltd., 5.0.2.1036]
[C:\Program Files\Spyware Doctor\CommOM.dll] [PC Tools, 5.0.5.5]
[C:\Program Files\Spyware Doctor\vcl100.bpl] [Borland Software Corporation, 10.0.2288.42451]
[C:\Program Files\Spyware Doctor\CommLib.dll] [PC Tools, 5.0.5.2]
[C:\Program Files\Spyware Doctor\commhlpr.dll] [PC Tools, 5.0.5.0]
[C:\Program Files\Spyware Doctor\RegHelper.dll] [PC Tools, 5.0.5.2]
[C:\Program Files\Spyware Doctor\inethlpr.dll] [PC Tools, 5.0.5.2]
[C:\Program Files\Spyware Doctor\filehlpr.dll] [PC Tools, 5.0.5.22]
[C:\Program Files\Spyware Doctor\sdcore.dll] [PC Tools, 5.0.5.25]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Spyware Doctor\FileStorage.sdp] [PC Tools, 5.0.5.1]
[C:\Program Files\Spyware Doctor\Settings.sdp] [PC Tools, 5.0.5.3]
[C:\Program Files\Spyware Doctor\IDBLib.sdp] [PC Tools, 5.0.5.2]
[C:\Program Files\Spyware Doctor\SDInfo.sdp] [PC Tools, 5.0.5.9]
[C:\Program Files\Spyware Doctor\SDExtra.sdp] [PC Tools, 5.0.5.3]
[C:\Program Files\Spyware Doctor\PCTWSC.dll] [PC Tools, 1, 0, 0, 7]
[C:\Program Files\Spyware Doctor\Immunizer.sdp] [PC Tools, 5.0.5.5]
[C:\Program Files\Spyware Doctor\Localizer.sdp] [PC Tools, 5.0.5.1]
[C:\Program Files\Spyware Doctor\NfyMan.sdp] [PC Tools, 5.0.5.1]
[C:\Program Files\Spyware Doctor\quarantine.sdp] [PC Tools, 5.0.5.2]
[C:\Program Files\Spyware Doctor\BH.dll] [PC Tools, 5.0.5.2]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)]
[C:\Program Files\Spyware Doctor\RebootManager.sdp] [PC Tools, 5.0.5.3]
[C:\Program Files\Spyware Doctor\scaneng.sdp] [PC Tools, 5.0.5.6]
[C:\Program Files\Spyware Doctor\stasks.sdp] [PC Tools, 5.0.5.1]
[C:\Program Files\Spyware Doctor\SystemMonitor.sdp] [PC Tools, 5.0.5.45]
[C:\Program Files\Spyware Doctor\whitelist.sdp] [PC Tools, 5.0.5.2]
[C:\Program Files\Spyware Doctor\plugins\Browsers.SDP] [PC Tools, 5.0.5.1]
[C:\Program Files\Spyware Doctor\plugins\cookie.sdp] [PC Tools, 5.0.5.3]
[C:\Program Files\Spyware Doctor\plugins\grfiles.SDP] [PC Tools, 5.0.5.28]
[C:\Program Files\Spyware Doctor\plugins\grregistry.SDP] [PC Tools, 5.0.5.1]
[C:\Program Files\Spyware Doctor\PCToolsComponents.bpl] [PC Tools, 5.0.5.3]
[C:\Program Files\Spyware Doctor\SH.dll] [PC Tools, 5.0.5.4]
[C:\Program Files\Spyware Doctor\plugins\KLGuard.SDP] [PC Tools, 5.0.5.3]
[C:\Program Files\Spyware Doctor\plugins\Network.SDP] [PC Tools, 5.0.5.13]
[C:\Program Files\Spyware Doctor\plugins\Process.SDP] [PC Tools, 5.0.5.5]
[C:\Program Files\Spyware Doctor\plugins\ScriptEngine.SDP] [PC Tools, 5.0.5.1]
[C:\Program Files\Spyware Doctor\plugins\SDNET.SDP] [PC Tools, 5.0.5.23]
[C:\Program Files\Spyware Doctor\plugins\StartUp.SDP] [PC Tools, 5.0.5.3]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll] [Kaspersky Lab, 7.0.0.125]
[PID: 1848 / SYSTEM][C:\WINDOWS\system32\slserv.exe] [ , 2.80.00(24Apr2000)]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 2004 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 3112 / SERVICE LOCAL][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[PID: 3952 / Geffray][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[C:\Program Files\SmartFTP Client\sfShellTools.dll] [SmartSoft Ltd, 1.0.1.0]
[C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll] [Kaspersky Lab, 7.0.0.125]
[C:\PROGRA~1\WINDOW~2\wmpband.dll] [Microsoft Corporation, 11.0.5721.5145 (WMP_11.061018-2006)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll] [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\SmartFTP Client\sfShellTools.dll] [SmartSoft Ltd, 1.0.1.0]
[PID: 2552 / Geffray][C:\Documents and Settings\Geffray\Bureau\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)]
[C:\Program Files\Spyware Doctor\smumhook.dll] [PC Tools, 5.0.5.24]
[C:\Program Files\Spyware Doctor\klg.dat] [PC Tools, 5.0.5.2]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll] [Logitech Inc., 10.5.1.2027]
[C:\Documents and Settings\Geffray\Bureau\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll] [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125]
[C:\PROGRA~1\PANICW~1\POP-UP~1\XAHook.dll] [Panicware, Inc., 1, 0, 0, 1008]

==================================
File Associations
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock Provider
N/A

==================================
Autorun.Inf
N/A

==================================
HOSTS File
127.0.0.1 localhost

==================================
Process Privileges Scan
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 520, C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 520, C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 552, C:\APPS\POWERCINEMA\KERNEL\TV\CLCAPSVC.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 552, C:\APPS\POWERCINEMA\KERNEL\TV\CLCAPSVC.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 476, C:\APPS\POWERCINEMA\KERNEL\TV\CLSCHED.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 476, C:\APPS\POWERCINEMA\KERNEL\TV\CLSCHED.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 736, C:\PROGRAM FILES\CYBERLINK\SHARED FILES\CLML_NTSERVICE\CLMLSERVER.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 736, C:\PROGRAM FILES\CYBERLINK\SHARED FILES\CLML_NTSERVICE\CLMLSERVER.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 752, C:\PROGRAM FILES\CYBERLINK\SHARED FILES\CLML_NTSERVICE\CLMLSERVICE.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 752, C:\PROGRAM FILES\CYBERLINK\SHARED FILES\CLML_NTSERVICE\CLMLSERVICE.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 780, C:\APPS\HIDSERVICE\HIDSERVICE.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 780, C:\APPS\HIDSERVICE\HIDSERVICE.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 896, C:\WINDOWS\SYSTEM32\NVSVC32.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 896, C:\WINDOWS\SYSTEM32\NVSVC32.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 3952, C:\WINDOWS\EXPLORER.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 3952, C:\WINDOWS\EXPLORER.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3952, C:\WINDOWS\EXPLORER.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 3472, C:\APPS\ABOARD\ABOARD.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 3472, C:\APPS\ABOARD\ABOARD.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3472, C:\APPS\ABOARD\ABOARD.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 3504, C:\APPS\ABOARD\AOSD.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 3504, C:\APPS\ABOARD\AOSD.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3504, C:\APPS\ABOARD\AOSD.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 3564, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LCDMON.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 3564, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LCDMON.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3564, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LCDMON.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 3668, C:\PROGRAM FILES\FICHIERS COMMUNS\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 3668, C:\PROGRAM FILES\FICHIERS COMMUNS\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3668, C:\PROGRAM FILES\FICHIERS COMMUNS\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 2052, C:\DOCUMENTS AND SETTINGS\GISELE.PCHOME\BUREAU\UNIQUEDISPLAY.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 2052, C:\DOCUMENTS AND SETTINGS\GISELE.PCHOME\BUREAU\UNIQUEDISPLAY.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 2052, C:\DOCUMENTS AND SETTINGS\GISELE.PCHOME\BUREAU\UNIQUEDISPLAY.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 3884, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCLOCK.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 3884, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCLOCK.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3884, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCLOCK.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 800, C:\PROGRAM FILES\UNLOCKER\UNLOCKERASSISTANT.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 800, C:\PROGRAM FILES\UNLOCKER\UNLOCKERASSISTANT.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 800, C:\PROGRAM FILES\UNLOCKER\UNLOCKERASSISTANT.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 1240, C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 1240, C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1240, C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 828, C:\PROGRAM FILES\BHODEMON 2\BHODEMON.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 828, C:\PROGRAM FILES\BHODEMON 2\BHODEMON.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 828, C:\PROGRAM FILES\BHODEMON 2\BHODEMON.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3040, C:\WINDOWS\SYSTEM32\WUAUCLT.EXE]
Special Privilege Enabled: SeSystemtimePrivilege [PID = 3040, C:\WINDOWS\SYSTEM32\WUAUCLT.EXE]

==================================
API HOOK
RVA Error: LoadLibraryA (Dangerous Level: High, Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA Error: LoadLibraryExA (Dangerous Level: High, Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA Error: LoadLibraryExW (Dangerous Level: High, Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA Error: LoadLibraryW (Dangerous Level: High, Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys)
Entrypoint Error: FreeLibrary (Dangerous Level: High, Hooked by Module: 0x7170002D)
RVA Error: GetProcAddress (Dangerous Level: High, Hooked by Module: \??\C:\WINDOWS\system32\drivers\klif.sys)

==================================
Hidden Process
N/A

==================================


[/CODE]
0
l'erreur (le fichier infecté) est dans browser add-on :

Browser Add-ons
[]
{1182A964-F338-4150-B053-32772BC321E8} <C:\WINDOWS\system32\atkctr.dll, N/A>
0
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
5 déc. 2007 à 14:21
re,

Sélectionne cette liste ci dessous :

Drivers to unload:
flnqvxin

Files to delete:
C:\system32\drivers\dhawtanq.dat
C:\WINDOWS\system32\atkctr.dll

registry keys to delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1182A964-F338-4150-B053-32772BC321E8}

--> Clic droit copier

- Ouvre le Bloc-Note et clic sur le menu Edition/Coller afin de coller le contenu qui est dans le cadre ci-dessus
- Enregistre le fichier sur ton bureau sous le nom remove.txt

ouvre the avenger
- Sélectionne "Load Script from File" et clique sur l'icône en forme de dossier.
- Sélectionne le fichier remove.txt qui est sur ton bureau
- Clique sur le feu vert pour lancer le script
- Clique sur "Oui"
- Accepte de redémarrer ton pc.

ps : le pc va redemarrer deux fois.

Quand le PC a redémarre ouvre le fichier C:\avenger.txt et copie/colle le contenu ici.

@+
0
Rapport d'avenger

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\oiheouac

*******************

Script file located at: \??\C:\WINDOWS\system32\nvhlqjhr.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open registry key \Registry\Machine\System\CurrentControlSet\Services\flnqvxin for deletion
Unload of driver flnqvxin failed!

Could not process line:
flnqvxin
Status: 0xc0000022



Could not open file C:\system32\drivers\dhawtanq.dat for deletion
Deletion of file C:\system32\drivers\dhawtanq.dat failed!

Could not process line:
C:\system32\drivers\dhawtanq.dat
Status: 0xc0000022



Could not open file C:\WINDOWS\system32\atkctr.dll for deletion
Deletion of file C:\WINDOWS\system32\atkctr.dll failed!

Could not process line:
C:\WINDOWS\system32\atkctr.dll
Status: 0xc0000022



Could not open registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1182A964-F338-4150-B053-32772BC321E8} for deletion
Deletion of registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1182A964-F338-4150-B053-32772BC321E8} failed!
Status: 0xc0000022


Completed script processing.

*******************

Finished! Terminate.
0
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
5 déc. 2007 à 18:08
re,

ca n´as toujours pas fonctionné :-(

* Télécharge delfkill32 (de Marckie) sur le bureau : http://users.telenet.be/marcvn/tools/win32delfkil.exe
* Double clique sur win32delfkil.exe et accepte les instructions. Ne t'inquiète pas si les icones disparaissent.
Si le PC ne redémarre pas tout seul, fais-le.
Poste le contenu du bloc-note qui s'ouvre.

@+
0
voila le rapport de defkill32 sans grand sucès qui ne detecte meme pas le fichier

WIN32DELFKIL LOGFILE - by Marckie


version 3.131
2007-12-05 18:32:09.83
running from: "C:\Documents and Settings\Geffray\Bureau"


--- File(s) found in Windows directory ---

--- File(s) found in system32 folder ---

--- Services ---

--- Export SharedTaskScheduler key ---
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"


--- Notify key ---


--- rebooting the computer ---


--- File(s) found in Windows directory ---

--- File(s) found in system32 folder ---

--- Services ---

--- Export SharedTaskSchedulerkey ---
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"



--- Notify key ---

Finished!
0
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
5 déc. 2007 à 18:56
aero-D

oui c´est un peu déséspérant...

un autre helper va me donner un coup de main un peut plus tards; des qu´il revient je te fais signe (il va diner)...

@+
0
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
5 déc. 2007 à 18:57
edit :

-> Télécharge DiagHelp.zip sur ton bureau.
Tuto : http://www.malekal.com/DiagHelp/DiagHelp.php
-> Ne double-clic pas dessus !! Fais un clic droit sur le fichier et extraire tout
-> Un nouveau dossier chercher va être créé DiagHelp
-> Ouvre le et double-clic sur go.cmd (le .cmd peut ne pas apparaître)
-> Une fenêtre va s'ouvrir, choisis l'option 1
-> L'analyse va commencer, ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand on te le demande.

ATTENTION : pendant l'analyse, après le rapport catchme, il te sera demandé d'appuyer sur une touche afin de poursuivre le scan, suis bien les instructions à l'écran !

-> A la fin de l'analyse, il peut-être (pas obligatoire) demandé de redemanderl'ordinateur... Une fois l'ordinateur redémarré le rapport va apparaître sur le bloc-note.. Ce dernier se trouve sur C:\resultat.txt
-> Copie/colle le contenu du bloc-note qui s'ouvre, pour cela :
-> Dans le bloc-note, cliquez sur le menu Edition / Selectionner tout
-> A nouveau menu Edition / copier
-> Dans un nouveau message ici, faire un clic droit / coller

@ toute
0
voila le rapport sans grand succès lui non plus ...

DiagHelp version v1.4 - http://www.malekal.com
excute le 2007-12-05 à 19:53:06.85


Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\WINDOWS\prefetch\CHCP.COM-17EDBDC9.pf -->2007-12-05 19:53:05
C:\WINDOWS\prefetch\S104..EXE-38CD3BDF.pf -->2007-12-05 19:52:31
C:\WINDOWS\prefetch\FIREFOX.EXE-06188867.pf -->2007-12-05 19:52:08
C:\WINDOWS\prefetch\BHODEMON.EXE-00DF676E.pf -->2007-12-05 19:51:56
C:\WINDOWS\prefetch\NOTEPAD.EXE-2F2D61E1.pf -->2007-12-05 19:51:54
C:\WINDOWS\prefetch\UNIQUEDISPLAY.EXE-173B7D3A.pf -->2007-12-05 19:51:44
C:\WINDOWS\prefetch\RUNDLL32.EXE-3CAE7316.pf -->2007-12-05 19:51:44
C:\WINDOWS\prefetch\LCDMON.EXE-13FBDAC6.pf -->2007-12-05 19:51:44
C:\WINDOWS\prefetch\ISSCH.EXE-2EFA1349.pf -->2007-12-05 19:51:43
C:\WINDOWS\prefetch\COMMUNICATIONS_HELPER.EXE-081C76F0.pf -->2007-12-05 19:51:42

C:\WINDOWS\System32\drivers\fidbox2.dat -->2007-12-05 19:51:11
C:\WINDOWS\System32\drivers\fidbox.dat -->2007-12-05 19:49:08
C:\WINDOWS\System32\drivers\fidbox2.idx -->2007-12-05 19:46:10
C:\WINDOWS\System32\drivers\fidbox.idx -->2007-12-05 19:46:10
C:\WINDOWS\System32\drivers\sixac^sr.sys -->2007-12-05 17:20:45
C:\WINDOWS\System32\drivers\klin.dat -->2007-12-02 13:54:01
C:\WINDOWS\System32\drivers\klick.dat -->2007-12-02 13:54:01

C:\WINDOWS\System32\adssite_sidebar_uninstall.exe -->2007-12-05 19:52:31
C:\WINDOWS\System32\swsc.exe -->2007-12-05 18:30:06
C:\WINDOWS\System32\swreg.exe -->2007-12-05 18:30:06
C:\WINDOWS\System32\restart.exe -->2007-12-05 18:30:06
C:\WINDOWS\System32\regdacl.exe -->2007-12-05 18:30:06
C:\WINDOWS\System32\reboot.exe -->2007-12-05 18:30:06
C:\WINDOWS\System32\process.exe -->2007-12-05 18:30:06
C:\WINDOWS\System32\VundoFixSVC.exe -->2007-12-04 18:22:18
C:\WINDOWS\System32\adssite_sidebar.dll -->2007-12-03 18:12:02
C:\WINDOWS\System32\atkctr.dll -->2007-12-03 09:43:44
C:\WINDOWS\System32\CONFIG.NT -->2007-12-02 13:40:32
C:\WINDOWS\System32\wpa.dbl -->2007-12-02 13:31:21
C:\WINDOWS\System32\PerfStringBackup.INI -->2007-12-02 13:15:34
C:\WINDOWS\System32\perfh00C.dat -->2007-12-02 13:15:34
C:\WINDOWS\System32\perfh009.dat -->2007-12-02 13:15:34
C:\WINDOWS\System32\perfc00C.dat -->2007-12-02 13:15:34
C:\WINDOWS\System32\perfc009.dat -->2007-12-02 13:15:34
C:\WINDOWS\System32\nvapps.xml -->2007-12-01 15:46:17
C:\WINDOWS\System32\FNTCACHE.DAT -->2007-12-01 15:45:56
C:\WINDOWS\System32\nsh5.dll -->2007-11-30 16:57:56
C:\WINDOWS\System32\lvcoinst.log -->2007-11-29 15:40:51
C:\WINDOWS\System32\jupdate-1.6.0_03-b05.log -->2007-11-20 10:12:33
C:\WINDOWS\System32\NVUNINST.EXE -->2007-11-12 08:03:34
C:\WINDOWS\System32\nwiz.exe -->2007-11-12 06:51:00
C:\WINDOWS\System32\nvwssr.dll -->2007-11-12 06:51:00

C:\WINDOWS\0.log -->2007-12-05 19:48:53
C:\WINDOWS\wiadebug.log -->2007-12-05 19:48:04
C:\WINDOWS\wiaservc.log -->2007-12-05 19:48:03
C:\WINDOWS\bootstat.dat -->2007-12-05 19:47:52
C:\WINDOWS\SchedLgU.Txt -->2007-12-05 19:45:51
C:\WINDOWS\WindowsUpdate.log -->2007-12-05 19:45:08
C:\WINDOWS\setupapi.log -->2007-12-05 19:26:41
C:\WINDOWS\QTFont.qfn -->2007-12-04 21:01:41
C:\WINDOWS\setupact.log -->2007-12-04 20:48:40
C:\WINDOWS\ntbtlog.txt -->2007-12-04 20:44:11
C:\WINDOWS\SpywareDoctor505Uninstall.log -->2007-12-02 13:09:16
C:\WINDOWS\SpywareDoctor505Installation.log -->2007-12-02 12:15:08
C:\WINDOWS\win.ini -->2007-12-01 20:41:54
C:\WINDOWS\DirectX.log -->2007-12-01 15:24:08
C:\WINDOWS\tsoc.log -->2007-11-29 22:08:48

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed


ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 3044
Command line: C:\WINDOWS\Explorer.EXE

Base Size Version Path
*** Loaded C:\WINDOWS\system32\kernel32.dll differs from file image:
*** File timestamp: Mon Apr 16 17:53:11 2007
*** Loaded image timestamp: Mon Apr 16 17:53:12 2007
*** Loaded C:\WINDOWS\system32\USER32.dll differs from file image:
*** File timestamp: Thu Mar 08 16:37:50 2007
*** Loaded image timestamp: Thu Mar 08 16:50:02 2007
*** Loaded C:\WINDOWS\system32\SHDOCVW.dll differs from file image:
*** File timestamp: Wed Aug 22 14:57:28 2007
*** Loaded image timestamp: Wed Aug 22 14:59:42 2007
0x44080000 0xcf000 7.00.6000.16544 C:\WINDOWS\system32\WININET.dll
0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x43e00000 0x45000 7.00.6000.16544 C:\WINDOWS\system32\iertutil.dll
*** Loaded C:\WINDOWS\system32\SHELL32.dll differs from file image:
*** File timestamp: Thu Oct 25 18:43:25 2007
*** Loaded image timestamp: Thu Oct 25 18:56:00 2007
0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll
0x636e0000 0x29000 5.00.0005.0024 C:\Program Files\Spyware Doctor\smumhook.dll
0x5a000000 0x1f000 5.00.0005.0002 C:\Program Files\Spyware Doctor\klg.dat
0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
0x00fd0000 0x17000 10.05.0001.2027 C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll
0x10000000 0x64000 1.00.0001.0000 C:\Program Files\SmartFTP Client\sfShellTools.dll
0x01120000 0x17000 7.00.0000.0125 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
0x01440000 0x28000 7.00.0000.0125 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll
0x13420000 0x1a000 11.00.5721.5145 C:\PROGRA~1\WINDOW~2\wmpband.dll
0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
0x017b0000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll
0x44360000 0x5cb000 7.00.6000.16544 C:\WINDOWS\system32\ieframe.dll
0x44160000 0x124000 7.00.6000.16544 C:\WINDOWS\system32\urlmon.dll
0x442b0000 0x3c000 7.00.6000.16544 C:\WINDOWS\system32\webcheck.dll
0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\WPDShServiceObj.dll
0x01ad0000 0x26000 1.00.0002.0002 C:\Program Files\SmartFTP Client\smarthook.dll
0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceTypes.dll
0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll
0x01160000 0x4000 C:\Program Files\Unlocker\UnlockerHook.dll
0x01ab0000 0xf000 1.00.0000.1008 C:\PROGRA~1\PANICW~1\POP-UP~1\XAHook.dll
0x02ea0000 0x1c000 7.00.0000.0000 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
0x6bd10000 0x10000 12.00.4518.1014 C:\Program Files\Microsoft Office\Office12\msohevi.dll
0x78130000 0x9b000 8.00.50727.0163 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\MSVCR80.dll
0x60980000 0x7000 3.01.4000.1823 C:\WINDOWS\system32\MSISIP.DLL
0x74e10000 0x10000 5.06.0000.8820 C:\WINDOWS\system32\wshext.dll
0x73d20000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL
0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL
0x59000000 0xe000 5.06.0000.6626 C:\WINDOWS\system32\wshFR.DLL

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 1060
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe
*** Loaded C:\WINDOWS\system32\kernel32.dll differs from file image:
*** File timestamp: Mon Apr 16 17:53:11 2007
*** Loaded image timestamp: Mon Apr 16 17:53:12 2007
*** Loaded C:\WINDOWS\system32\USER32.dll differs from file image:
*** File timestamp: Thu Mar 08 16:37:50 2007
*** Loaded image timestamp: Thu Mar 08 16:50:02 2007
*** Loaded C:\WINDOWS\system32\SHELL32.dll differs from file image:
*** File timestamp: Thu Oct 25 18:43:25 2007
*** Loaded image timestamp: Thu Oct 25 18:56:00 2007
0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll
0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x10000000 0x17000 7.00.0000.0125 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
0x012b0000 0x33000 7.00.0000.0125 C:\WINDOWS\system32\klogon.dll
0x636e0000 0x29000 5.00.0005.0024 C:\Program Files\Spyware Doctor\smumhook.dll
0x5a000000 0x1f000 5.00.0005.0002 C:\Program Files\Spyware Doctor\klg.dat
*** Loaded C:\WINDOWS\system32\RASAPI32.dll differs from file image:
*** File timestamp: Wed Aug 04 09:53:42 2004
*** Loaded image timestamp: Wed Aug 04 09:58:24 2004
0x014b0000 0x17000 7.00.0000.0125 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL


Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 0861-D979

Répertoire de C:\WINDOWS\system32

2004-08-05 13:00 6,144 csrss.exe
1 fichier(s) 6,144 octets
0 Rép(s) 109,386,919,936 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 0861-D979

Répertoire de C:\WINDOWS\Downloaded Program Files

2007-08-30 18:37 <REP> .
2007-08-30 18:37 <REP> ..
2004-08-16 17:08 65 desktop.ini
2002-07-25 16:13 24,576 dwusplay.dll
2002-07-25 16:13 196,608 dwusplay.exe
2003-10-26 14:25 133,712 EARTPX.dll
2003-10-26 14:13 321 EARTPX.inf
2007-04-13 01:14 382,344 GAME_UNO1.dll
2007-01-17 14:44 316 GAME_UNO1.INF
2005-02-16 15:15 401,408 isusweb.dll
2007-02-22 23:41 304,544 MessengerStatsPAClient.dll
2007-02-28 14:21 130,472 MineSweeper.dll
2005-11-09 08:28 126,976 mjolauncher.dll
2005-11-09 08:26 230 mjolauncher.inf
2007-02-28 14:21 131,472 msgrchkr.dll
2005-04-21 09:59 131,072 popcaploader.dll
2005-04-18 13:45 242 popcaploader.inf
2007-02-28 13:21 142,248 SolitaireShowdown.dll
2006-11-09 14:36 5,019 swflash.inf
2006-12-18 17:17 1,652,320 TriJinx.1.0.0.87.dll
2006-12-18 17:16 248 TriJinx.1.0.0.87.inf
2003-08-29 14:55 2,136 WMAVAX.inf
2003-06-30 21:41 1,689 WMV9VCM.inf
2007-02-19 11:26 159,128 ZIntro.ocx
22 fichier(s) 3,927,146 octets

Total des fichiers listés :
22 fichier(s) 3,927,146 octets
2 Rép(s) 109,386,919,936 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..


Liste des fichiers en exception sur le pare-feu XP SP2

"%ProgramFiles%\\AOL 9.0\\aol.exe"="%ProgramFiles%\\AOL 9.0\\aol.exe:*:Enabled:AOL"
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA"
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe:*:Enabled:PANDORA"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\APPS\\Inventime\\my.exe"="C:\\APPS\\Inventime\\my.exe:*:Enabled:INVENTIME"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Assistance à distance - Windows Messenger et voix"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client\\SmartFTP.exe:*:Enabled:SmartFTP Client 2.5"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"



exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001



Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1319 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-05 19:54:16
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3a,52,47,b9,e1,d1,98,fc,8b,d8,59,0d,ff,c4,07,24,1f,94,62,5f,87,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,83,a9,ae,73,08,58,07,9c,ff,7f,2f,db,75,41,98,1c,25,..
"khjeh"=hex:1f,c8,5f,e8,0d,9a,7a,77,e2,77,6e,61,ed,80,54,f6,93,91,f0,f2,c3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ab,13,1b,8a,7a,b1,2f,ec,06,9d,82,3b,05,e5,4f,7d,e2,f5,fc,1b,6a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3a,52,47,b9,e1,d1,98,fc,8b,d8,59,0d,ff,c4,07,24,1f,94,62,5f,87,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,83,a9,ae,73,08,58,07,9c,ff,7f,2f,db,75,41,98,1c,25,..
"khjeh"=hex:1f,c8,5f,e8,0d,9a,7a,77,e2,77,6e,61,ed,80,54,f6,93,91,f0,f2,c3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ab,13,1b,8a,7a,b1,2f,ec,06,9d,82,3b,05,e5,4f,7d,e2,f5,fc,1b,6a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3a,52,47,b9,e1,d1,98,fc,8b,d8,59,0d,ff,c4,07,24,1f,94,62,5f,87,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,83,a9,ae,73,08,58,07,9c,ff,7f,2f,db,75,41,98,1c,25,..
"khjeh"=hex:1f,c8,5f,e8,0d,9a,7a,77,e2,77,6e,61,ed,80,54,f6,93,91,f0,f2,c3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ab,13,1b,8a,7a,b1,2f,ec,06,9d,82,3b,05,e5,4f,7d,e2,f5,fc,1b,6a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3a,52,47,b9,e1,d1,98,fc,8b,d8,59,0d,ff,c4,07,24,1f,94,62,5f,87,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,83,a9,ae,73,08,58,07,9c,ff,7f,2f,db,75,41,98,1c,25,..
"khjeh"=hex:1f,c8,5f,e8,0d,9a,7a,77,e2,77,6e,61,ed,80,54,f6,93,91,f0,f2,c3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ab,13,1b,8a,7a,b1,2f,ec,06,9d,82,3b,05,e5,4f,7d,e2,f5,fc,1b,6a,..
IPC error: 2 Le fichier spécifié est introuvable.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:22910da0
"s2"=dword:069374f3
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3a,52,47,b9,e1,d1,98,fc,8b,d8,59,0d,ff,c4,07,24,1f,94,62,5f,87,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,83,a9,ae,73,08,58,07,9c,ff,7f,2f,db,75,41,98,1c,25,..
"khjeh"=hex:1f,c8,5f,e8,0d,9a,7a,77,e2,77,6e,61,ed,80,54,f6,93,91,f0,f2,c3,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:20,d0,24,17,4d,20,95,e4,77,d6,3b,7e,11,43,81,e6,f6,2b,6e,fa,7a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:3a,52,47,b9,e1,d1,98,fc,8b,d8,59,0d,ff,c4,07,24,1f,94,62,5f,87,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,83,a9,ae,73,08,58,07,9c,ff,7f,2f,db,75,41,98,1c,25,..
"khjeh"=hex:1f,c8,5f,e8,0d,9a,7a,77,e2,77,6e,61,ed,80,54,f6,93,91,f0,f2,c3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:20,d0,24,17,4d,20,95,e4,77,d6,3b,7e,11,43,81,e6,f6,2b,6e,fa,7a,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\xd8\x2022\x20ac|\xff\xff\xff\xff\22\x2022\x20ac|\xf9\x20229~\2]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\Software\Adobe\FeatureSubscriptions\DVAAdobeDocMeta\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\Registered"

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0


KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
204 - mDNSResponder.e
240 - CLSched.exe
256 - svcntaux.exe
376 - CLMLService.exe
404 - HidService.exe
580 - nvsvc32.exe
812 - BHODemon.exe
908 - swdsvc.exe
1000 - AOSD.EXE
1028 - firefox.exe
1036 - csrss.exe
1060 - winlogon.exe
1108 - services.exe
1120 - lsass.exe
1284 - svchost.exe
1340 - svchost.exe
1384 - svchost.exe
1448 - svchost.exe
1492 - slserv.exe
1592 - svchost.exe
1692 - LCDClock.exe
1836 - aawservice.exe
1916 - spoolsv.exe
1960 - LVPrcSrv.exe
2036 - avp.exe
2752 - LCDMon.exe
3044 - explorer.exe
3052 - alg.exe
3152 - avp.exe
3168 - SDTrayApp.exe
3712 - PSFree.exe
3752 - ctfmon.exe
3988 - cmd.exe
5944 - KProcCheck.exe
-1304204150 - x --[Hidden]--

Total number of processes = 36
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\ntoskrnl.exe
806EC000 - \WINDOWS\system32\hal.dll
F7AAF000 - \WINDOWS\system32\KDCOM.DLL
F79BF000 - \WINDOWS\system32\BOOTVID.dll
F74A4000 - sptd.sys
F7AB1000 - \WINDOWS\System32\Drivers\WMILIB.SYS
F748C000 - \WINDOWS\System32\Drivers\SCSIPORT.SYS
F745D000 - ACPI.sys
F744C000 - pci.sys
F75AF000 - isapnp.sys
F782F000 - dhawtanq.dat
F7B77000 - pciide.sys
F7837000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
F7AB3000 - aliide.sys
F7AB5000 - cmdide.sys
F7AB7000 - toside.sys
F7AB9000 - viaide.sys
F7ABB000 - intelide.sys
F75BF000 - MountMgr.sys
F742D000 - ftdisk.sys
F783F000 - PartMgr.sys
F75CF000 - VolSnap.sys
F79C3000 - cpqarray.sys
F7415000 - atapi.sys
F79C7000 - aha154x.sys
F7847000 - sparrow.sys
F79CB000 - symc810.sys
F75DF000 - aic78xx.sys
F79CF000 - dac960nt.sys
F75EF000 - ql10wnt.sys
F79D3000 - amsint.sys
F784F000 - asc.sys
F79D7000 - asc3550.sys
F7857000 - mraid35x.sys
F785F000 - i2omp.sys
F79DB000 - ini910u.sys
F75FF000 - ql1240.sys
F760F000 - aic78u2.sys
F7867000 - symc8xx.sys
F786F000 - sym_hi.sys
F7877000 - sym_u3.sys
F787F000 - ABP480N5.SYS
F7887000 - asc3350p.sys
F7ABD000 - cd20xrnt.sys
F761F000 - ultra.sys
F73FC000 - adpu160m.sys
F788F000 - dpti2o.sys
F762F000 - ql1080.sys
F763F000 - ql1280.sys
F764F000 - ql12160.sys
F7897000 - perc2.sys
F7ABF000 - perc2hib.sys
F789F000 - hpn.sys
F79DF000 - cbidf2k.sys
F73D0000 - dac2w2k.sys
F765F000 - disk.sys
F766F000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
F73B0000 - fltMgr.sys
F739E000 - sr.sys
F767F000 - ikfilesec.sys
F768F000 - PxHelp20.sys
F7387000 - KSecDD.sys
F72FA000 - Ntfs.sys
F72CD000 - NDIS.sys
F769F000 - sisagp.sys
F76AF000 - viaagp.sys
F72BA000 - sfvfs02.sys
F78A7000 - sfhlp02.sys
F72A8000 - sfdrv01.sys
F76BF000 - ohci1394.sys
F76CF000 - \WINDOWS\system32\DRIVERS\1394BUS.SYS
F728D000 - Mup.sys
F7271000 - kl1.sys
F78AF000 - \WINDOWS\system32\drivers\TDI.SYS
F76DF000 - alim1541.sys
F76EF000 - amdagp.sys
F76FF000 - agp440.sys
F770F000 - agpCPQ.sys
F773F000 - \SystemRoot\system32\DRIVERS\nic1394.sys
F653C000 - \SystemRoot\system32\DRIVERS\nv4_mini.sys
F6528000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
F7967000 - \SystemRoot\system32\DRIVERS\usbohci.sys
F6505000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
F796F000 - \SystemRoot\system32\DRIVERS\usbehci.sys
F7211000 - \SystemRoot\system32\DRIVERS\imapi.sys
F7201000 - \SystemRoot\system32\DRIVERS\cdrom.sys
F71F1000 - \SystemRoot\system32\DRIVERS\redbook.sys
F64E2000 - \SystemRoot\system32\DRIVERS\ks.sys
F64D1000 - \SystemRoot\system32\DRIVERS\serial.sys
F7171000 - \SystemRoot\system32\DRIVERS\serenum.sys
F7977000 - \SystemRoot\system32\DRIVERS\fdc.sys
F6495000 - \SystemRoot\system32\DRIVERS\parport.sys
F6441000 - \SystemRoot\system32\DRIVERS\slntamr.sys
F797F000 - \SystemRoot\system32\DRIVERS\SlWdmSup.sys
F6412000 - \SystemRoot\system32\DRIVERS\Mtlmnt5.sys
F7987000 - \SystemRoot\System32\Drivers\Modem.SYS
F61DB000 - \SystemRoot\system32\drivers\ALCXWDM.SYS
F61B7000 - \SystemRoot\system32\drivers\portcls.sys
F774F000 - \SystemRoot\system32\drivers\drmk.sys
F6CE3000 - \SystemRoot\system32\DRIVERS\AmdK8.sys
F798F000 - \SystemRoot\system32\DRIVERS\klim5.sys
F7D05000 - \SystemRoot\system32\DRIVERS\audstub.sys
F6C73000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
F7161000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
F5E6A000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
F6C63000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
F6C53000 - \SystemRoot\system32\DRIVERS\raspptp.sys
F5E59000 - \SystemRoot\system32\DRIVERS\psched.sys
F775F000 - \SystemRoot\system32\DRIVERS\msgpc.sys
F79A7000 - \SystemRoot\system32\DRIVERS\ptilink.sys
F79AF000 - \SystemRoot\system32\DRIVERS\raspti.sys
F79B7000 - \SystemRoot\system32\DRIVERS\wanatw4.sys
F776F000 - \SystemRoot\system32\DRIVERS\termdd.sys
F78E7000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
F78EF000 - \SystemRoot\system32\DRIVERS\mouclass.sys
F7AF5000 - \SystemRoot\system32\DRIVERS\swenum.sys
F5E25000 - \SystemRoot\system32\DRIVERS\update.sys
F715D000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
F778F000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F779F000 - \SystemRoot\system32\DRIVERS\usbhub.sys
F7AF9000 - \SystemRoot\system32\DRIVERS\USBD.SYS
F78FF000 - \SystemRoot\system32\DRIVERS\flpydisk.sys
F37A9000 - \SystemRoot\system32\drivers\iksysflt.sys
F77BF000 - \SystemRoot\system32\drivers\KCOM.SYS
F3792000 - \SystemRoot\system32\drivers\iksyssec.sys
F7AFB000 - \SystemRoot\System32\Drivers\i2omgmt.SYS
F7AFD000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F7BE7000 - \SystemRoot\System32\Drivers\Null.SYS
F7AFF000 - \SystemRoot\System32\Drivers\Beep.SYS
F7917000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
F791F000 - \SystemRoot\System32\drivers\vga.sys
F7B03000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F7B05000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F7927000 - \SystemRoot\System32\Drivers\Msfs.SYS
F792F000 - \SystemRoot\System32\Drivers\Npfs.SYS
F71A5000 - \SystemRoot\system32\DRIVERS\rasacd.sys
F36E7000 - \SystemRoot\system32\DRIVERS\ipsec.sys
F368F000 - \SystemRoot\system32\DRIVERS\tcpip.sys
F3667000 - \SystemRoot\system32\DRIVERS\netbt.sys
F3645000 - \SystemRoot\System32\drivers\afd.sys
F77DF000 - \SystemRoot\system32\DRIVERS\netbios.sys
F361A000 - \SystemRoot\system32\DRIVERS\rdbss.sys
F35AB000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys
F356D000 - \??\C:\WINDOWS\system32\drivers\klif.sys
F77FF000 - \SystemRoot\System32\Drivers\Fips.SYS
F354C000 - \SystemRoot\system32\DRIVERS\ipnat.sys
F781F000 - \SystemRoot\system32\DRIVERS\wanarp.sys
F7261000 - \SystemRoot\system32\DRIVERS\arp1394.sys
F7947000 - \SystemRoot\system32\DRIVERS\usbccgp.sys
F794F000 - \SystemRoot\system32\DRIVERS\USBSTOR.SYS
F2F56000 - \SystemRoot\system32\DRIVERS\MRVW225.sys
F3881000 - \SystemRoot\system32\DRIVERS\hidusb.sys
F7221000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
F71E1000 - \SystemRoot\system32\drivers\LVUSBSta.sys
F2C94000 - \SystemRoot\system32\DRIVERS\LV302V32.SYS
F7B2B000 - \SystemRoot\system32\DRIVERS\lv302af.sys
F71D1000 - \SystemRoot\system32\drivers\usbaudio.sys
F6C83000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F370E000 - \SystemRoot\system32\DRIVERS\mouhid.sys
F370A000 - \SystemRoot\system32\DRIVERS\kbdhid.sys
F2C7C000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F7B65000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F3534000 - \SystemRoot\System32\drivers\Dxapi.sys
F5E81000 - \SystemRoot\System32\watchdog.sys
BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
F7B89000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9D5000 - \SystemRoot\System32\nv4_disp.dll
BFFA0000 - \SystemRoot\System32\ATMFD.DLL
BAF10000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
BAC8B000 - \SystemRoot\system32\DRIVERS\mrxdav.sys
BAABE000 - \SystemRoot\system32\drivers\wdmaud.sys
BAC33000 - \SystemRoot\system32\drivers\sysaudio.sys
BA97E000 - \SystemRoot\system32\DRIVERS\srv.sys
BA74E000 - \SystemRoot\system32\DRIVERS\secdrv.sys
F7C6B000 - \??\C:\WINDOWS\system32\Drivers\mchInjDrv.sys
F376A000 - \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
BA33B000 - \SystemRoot\system32\drivers\kmixer.sys
B9CCE000 - \SystemRoot\System32\Drivers\HTTP.sys
F7BD9000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 180

Liste des programmes installes

54M Wireless USB Adapter
Ad-Aware 2007
Adobe Acrobat 5.0
Adobe After Effects CS3
Adobe After Effects CS3
Adobe After Effects CS3 Presets
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Audition 2.0
Adobe Audition 2.0
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Recommended Settings
Adobe Color JA Extra Settings
Adobe Color NA Extra Settings
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe Fonts All
Adobe Help Center 2.0
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe MotionPicture Color Files
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Photoshop CS3
Adobe Reader 7.0.9 - Français
Adobe Setup
Adobe Setup
Adobe Shockwave Player
Adobe Stock Photos 1.0
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe Video Profiles
Adobe WinSoft Linguistics Plugin
Adobe XMP DVA Panels CS3
Adobe XMP Panels CS3
aMSN 0.97RC1
Archiveur WinRAR
AutoUpdate
AV Voice Changer Software DIAMOND 5.0
BHODemon 2.0.0.23
Bink and Smacker
Condition Zero
Correctif pour Lecteur Windows Media 11 (KB939683)
Correctif pour Windows XP (KB914440)
Correctif Windows XP - KB873333
Correctif Windows XP - KB873339
Correctif Windows XP - KB885250
Correctif Windows XP - KB885835
Correctif Windows XP - KB885836
Correctif Windows XP - KB886185
Correctif Windows XP - KB887472
Correctif Windows XP - KB888113
Correctif Windows XP - KB888302
Correctif Windows XP - KB890047
Correctif Windows XP - KB890175
Correctif Windows XP - KB890859
Correctif Windows XP - KB890923
Correctif Windows XP - KB891781
Correctif Windows XP - KB893066
Correctif Windows XP - KB893086
Counter-Strike: Source
Dark Messiah Might and Magic Single Player
Dawn Of War
Dawn Of War - Winter Assault
Disc2Phone
DivX Codec
DivX Web Player
DVD Decoder Pak for Windows XP
Dynomite
EVEREST Ultimate Edition v2.50
GameSpy Comrade
Gif Movie Gear 4
Google Earth
HijackThis 1.99.1
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 3
Java 2 Runtime Environment, SE v1.4.2_05
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) SE Runtime Environment 6 Update 1
Jigsaw Gallery
Kaspersky Internet Security 7.0
Kaspersky Internet Security 7.0
Lecteur Windows Media 11
LimeWire PRO 4.12.11
Logitech Audio Echo Cancellation Component
Logitech G-series Keyboard Software
Logitech QuickCam
Logitech Video Enumerator
Macromedia Extension Manager
Macromedia Flash Player 8
Macromedia Flash Player 8
Macromedia Flash Player 8 Plugin
Macromedia Shockwave Player
Messenger Plus! Live
MessengerDiscovery Live 1.3.0322
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 French Language Pack
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Access MUI (French) 2007
Microsoft Office Excel MUI (French) 2007
Microsoft Office InfoPath MUI (French) 2007
Microsoft Office Outlook MUI (French) 2007
Microsoft Office PowerPoint MUI (French) 2007
Microsoft Office Professional Plus 2007
Microsoft Office Professional Plus 2007
Microsoft Office Proof (Arabic) 2007
Microsoft Office Proof (Dutch) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (French) 2007
Microsoft Office Publisher MUI (French) 2007
Microsoft Office Shared MUI (French) 2007
Microsoft Office Word MUI (French) 2007
Microsoft Software Update for Web Folders (French) 12
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Mise à jour de sécurité pour Lecteur Windows Media (KB911564)
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)
Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)
Mise à jour de sécurité pour Windows XP (KB893756)
Mise à jour de sécurité pour Windows XP (KB896358)
Mise à jour de sécurité pour Windows XP (KB896423)
Mise à jour de sécurité pour Windows XP (KB896424)
Mise à jour de sécurité pour Windows XP (KB896428)
Mise à jour de sécurité pour Windows XP (KB899587)
Mise à jour de sécurité pour Windows XP (KB899591)
Mise à jour de sécurité pour Windows XP (KB900725)
Mise à jour de sécurité pour Windows XP (KB901017)
Mise à jour de sécurité pour Windows XP (KB901190)
Mise à jour de sécurité pour Windows XP (KB901214)
Mise à jour de sécurité pour Windows XP (KB902400)
Mise à jour de sécurité pour Windows XP (KB904706)
Mise à jour de sécurité pour Windows XP (KB905414)
Mise à jour de sécurité pour Windows XP (KB905749)
Mise à jour de sécurité pour Windows XP (KB908519)
Mise à jour de sécurité pour Windows XP (KB911562)
Mise à jour de sécurité pour Windows XP (KB911927)
Mise à jour de sécurité pour Windows XP (KB912919)
Mise à jour de sécurité pour Windows XP (KB913580)
Mise à jour de sécurité pour Windows XP (KB914388)
Mise à jour de sécurité pour Windows XP (KB914389)
Mise à jour de sécurité pour Windows XP (KB917344)
Mise à jour de sécurité pour Windows XP (KB917422)
Mise à jour de sécurité pour Windows XP (KB917953)
Mise à jour de sécurité pour Windows XP (KB918118)
Mise à jour de sécurité pour Windows XP (KB918439)
Mise à jour de sécurité pour Windows XP (KB919007)
Mise à jour de sécurité pour Windows XP (KB920213)
Mise à jour de sécurité pour Windows XP (KB920670)
Mise à jour de sécurité pour Windows XP (KB920683)
Mise à jour de sécurité pour Windows XP (KB920685)
Mise à jour de sécurité pour Windows XP (KB921503)
Mise à jour de sécurité pour Windows XP (KB922819)
Mise à jour de sécurité pour Windows XP (KB923191)
Mise à jour de sécurité pour Windows XP (KB923414)
Mise à jour de sécurité pour Windows XP (KB923689)
Mise à jour de sécurité pour Windows XP (KB923694)
Mise à jour de sécurité pour Windows XP (KB923980)
Mise à jour de sécurité pour Windows XP (KB924191)
Mise à jour de sécurité pour Windows XP (KB924270)
Mise à jour de sécurité pour Windows XP (KB924496)
Mise à jour de sécurité pour Windows XP (KB924667)
Mise à jour de sécurité pour Windows XP (KB925902)
Mise à jour de sécurité pour Windows XP (KB926255)
Mise à jour de sécurité pour Windows XP (KB926436)
Mise à jour de sécurité pour Windows XP (KB927779)
Mise à jour de sécurité pour Windows XP (KB927802)
Mise à jour de sécurité pour Windows XP (KB928090)
Mise à jour de sécurité pour Windows XP (KB928255)
Mise à jour de sécurité pour Windows XP (KB928843)
Mise à jour de sécurité pour Windows XP (KB929123)
Mise à jour de sécurité pour Windows XP (KB929969)
Mise à jour de sécurité pour Windows XP (KB930178)
Mise à jour de sécurité pour Windows XP (KB931261)
Mise à jour de sécurité pour Windows XP (KB931768)
Mise à jour de sécurité pour Windows XP (KB931784)
Mise à jour de sécurité pour Windows XP (KB932168)
Mise à jour de sécurité pour Windows XP (KB933566)
Mise à jour de sécurité pour Windows XP (KB933729)
Mise à jour de sécurité pour Windows XP (KB935839)
Mise à jour de sécurité pour Windows XP (KB935840)
Mise à jour de sécurité pour Windows XP (KB936021)
Mise à jour de sécurité pour Windows XP (KB937143)
Mise à jour de sécurité pour Windows XP (KB938127)
Mise à jour de sécurité pour Windows XP (KB938829)
Mise à jour de sécurité pour Windows XP (KB939653)
Mise à jour de sécurité pour Windows XP (KB941202)
Mise à jour de sécurité pour Windows XP (KB943460)
Mise à jour pour Windows XP (KB894391)
Mise à jour pour Windows XP (KB898461)
Mise à jour pour Windows XP (KB900485)
Mise à jour pour Windows XP (KB904942)
Mise à jour pour Windows XP (KB908531)
Mise à jour pour Windows XP (KB910437)
Mise à jour pour Windows XP (KB911280)
Mise à jour pour Windows XP (KB916595)
Mise à jour pour Windows XP (KB920872)
Mise à jour pour Windows XP (KB922582)
Mise à jour pour Windows XP (KB927891)
Mise à jour pour Windows XP (KB929338)
Mise à jour pour Windows XP (KB930916)
Mise à jour pour Windows XP (KB931836)
Mise à jour pour Windows XP (KB933360)
Mise à jour pour Windows XP (KB938828)
Mozilla Firefox (2.0.0.11)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
mTC (remove only)
MVision
MyPhoneExplorer
Neuf - Kit de connexion
NI Service Center
NVIDIA Drivers
Pack Vista Inspirat 2 1.0
particleIllusion 3.0 demo
PDF Settings
Pop-Up Stopper Free Edition
PremiumSoft Navicat 8.0 for MySQL
PremiumSoft Navicat MySQL 7.2
Programme de gestion Camera de Logitech®
Realtek AC'97 Audio
Search Assistant Adssite
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Excel 2007 (KB936509)
Security Update for Office 2007 (KB934062)
Security Update for Office 2007 (KB936514)
Security Update for Publisher 2007 (KB936646)
Security Update for the 2007 Microsoft Office System (KB936960)
Security Update pour Microsoft .NET Framework 2.0 (KB928365)
Skype™ 3.5
SLD Codec Pack
SmartFTP Client
Sonic RecordNow!
Sony Ericsson PC Suite 1.20.173
Sony Ericsson Themes Creator 3.18
Sony Media Manager 2.2
Sony Sound Forge 8.0d
Sony Vegas 7.0
Spybot - Search & Destroy 1.4
Spyware Doctor 5.1
Steam
TeamSpeak 2 RC2
TimeShift
TrackMania Nations ESWC 1.7.9
Trojan Remover 6.5.9
Ulead GIF Animator 5 Evaluation
Unlocker 1.8.5
Update for Office 2007 (KB932080)
Update for Office 2007 (KB934391)
Update for Office 2007 (KB934393)
Update for Outlook 2007 (KB937608)
Update for Outlook 2007 Junk Email Filter (kb943559)
Update for Word 2007 (KB934173)
VideoLAN VLC media player 0.8.6b
VideoMach 4.0.4
WebAnimé v6.05 (Enterprise Version)
WebFldrs XP
Winamp (remove only)
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live installer
Windows Live Messenger
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
WinHTTrack Website Copier 3.41-3
World of Warcraft
Xfire (remove only)



Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 0861-D979

Répertoire de C:\Program Files

2007-12-04 19:16 <REP> .
2007-12-04 19:16 <REP> ..
2007-11-27 17:13 <REP> Adobe
2007-07-01 16:02 <REP> Alwil Software
2007-03-11 01:29 <REP> AMD
2007-07-26 12:55 <REP> aMSN
2007-10-04 18:37 <REP> AV Vcs 5.0 DIAMOND
2007-03-10 17:55 <REP> Avast
2007-12-04 19:18 <REP> BHODemon 2
2007-08-31 13:30 <REP> Bonjour
2007-11-27 17:09 <REP> Common Files
2007-11-27 17:09 <REP> Cosmi
2007-03-11 01:29 <REP> CyberLink
2007-05-16 12:50 <REP> Disc2Phone
2007-11-03 19:09 <REP> DivX
2007-09-07 20:22 <REP> Echovoice
2007-08-22 13:13 <REP> Everest Ultimate Edition 2007
2007-12-03 17:30 <REP> Fichiers communs
2007-12-01 15:32 <REP> GameSpy
2007-09-12 12:06 <REP> Google
2007-11-29 22:08 <REP> Internet Explorer
2007-11-20 10:12 <REP> Java
2007-12-02 13:45 <REP> Kaspersky Lab
2007-11-24 09:51 <REP> Lavasoft
2007-11-28 19:30 <REP> LimeWire
2007-03-28 10:57 <REP> Logitech
2007-08-18 09:55 <REP> Lx_cats
2007-11-03 19:17 <REP> Macromedia
2007-03-14 01:51 <REP> Messenger
2007-06-19 18:00 <REP> Messenger Plus! Live
2007-11-15 19:35 <REP> MessengerDiscovery
2007-06-20 20:07 <REP> Microsoft CAPICOM 2.1.0.2
2007-03-11 01:29 <REP> microsoft frontpage
2007-08-18 14:35 <REP> Microsoft Office
2007-08-18 14:35 <REP> Microsoft Visual Studio
2007-08-18 14:29 <REP> Microsoft Visual Studio 8
2007-08-18 14:35 <REP> Microsoft Works
2007-08-18 14:33 <REP> Microsoft.NET
2007-08-30 19:36 <REP> Movie Maker
2007-12-05 19:52 <REP> Mozilla Firefox
2007-08-21 19:53 <REP> MSBuild
2007-03-11 01:29 <REP> MSN
2007-11-29 11:16 <REP> MSN Games
2007-03-11 01:29 <REP> MSN Gaming Zone
2007-11-15 19:35 <REP> MSN Messenger
2007-09-02 12:32 <REP> MSXML 4.0
2007-09-19 12:44 <REP> mTC
2007-09-21 18:25 <REP> MyPhoneExplorer
2007-04-23 13:08 <REP> MySQL
2007-06-19 19:17 <REP> NetMeeting
2007-03-12 18:41 <REP> Neuf
2007-08-30 19:36 <REP> Outlook Express
2007-05-05 10:29 <REP> Panicware
2007-11-24 17:57 <REP> particleIllusion_3_demo
2007-09-19 17:46 <REP> photofiltre
2007-11-05 21:13 <REP> PremiumSoft
2007-03-14 01:52 <REP> QuickTime
2007-06-27 19:02 <REP> RADVideo
2007-03-11 01:29 <REP> Real
2007-08-19 00:19 <REP> RegCleaner
2007-12-01 15:24 <REP> Sierra Entertainment
2007-05-23 11:24 <REP> Skype
2007-04-11 20:21 <REP> SLD Codec Pack
2007-10-21 12:20 <REP> SmartFTP Client
2007-06-03 21:19 <REP> Sony
2007-09-19 12:48 <REP> Sony Ericsson
2007-06-03 21:18 <REP> Sony Setup
2007-12-03 18:13 <REP> Spybot - Search & Destroy
2007-12-02 14:38 <REP> Spyware Doctor
2007-12-02 11:34 <REP> Steam
2007-03-11 19:45 <REP> Teamspeak
2007-04-26 12:50 <REP> THQ
2007-11-24 21:27 <REP> TrackMania Nations ESWC
2007-12-05 19:51 <REP> Trojan Remover
2007-11-03 19:10 <REP> tsG15
2007-12-04 18:58 <REP> Unlocker
2007-08-09 11:28 <REP> USB
2007-08-19 00:55 <REP> VideoLAN
2007-11-24 16:38 <REP> VideoMach-4.0.4
2007-03-11 01:29 <REP> Viewpoint
2007-11-03 13:03 <REP> Visicom Media
2007-09-30 11:53 <REP> WebAnimé
2007-09-08 19:38 <REP> Winamp
2007-06-19 21:00 <REP> Windows Live
2007-06-30 19:37 <REP> Windows Media Components
2007-03-28 10:40 <REP> Windows Media Connect 2
2007-03-28 10:40 <REP> Windows Media Player
2007-03-14 01:53 <REP> Windows NT
2007-08-18 15:37 <REP> WinRAR
2007-11-05 22:02 <REP> world of warcraft
2007-08-12 13:41 <REP> world of warcraft 2.0.12
2007-03-11 01:29 <REP> xerox
0 fichier(s) 0 octets
92 Rép(s) 109,192,118,272 octets libres
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 0861-D979

Répertoire de C:\Program Files\fichiers communs

2007-12-03 17:30 <REP> .
2007-12-03 17:30 <REP> ..
2007-11-27 17:13 <REP> Adobe
2007-04-30 13:07 <REP> Adobe Systems Shared
2007-03-14 01:50 <REP> AOL
2007-03-14 01:50 <REP> aolshare
2007-04-23 11:05 <REP> Blizzard Entertainment
2007-11-27 17:09 <REP> Cosmi
2007-08-18 15:17 <REP> DESIGNER
2007-03-24 10:02 <REP> DirectX
2007-04-13 18:00 <REP> GTK
2007-08-30 18:37 <REP> InstallShield
2007-03-11 01:29 <REP> Java
2007-03-14 18:07 <REP> LogiShrd
2007-11-03 19:17 <REP> Macromedia
2007-08-18 15:48 <REP> Macromedia Shared
2007-08-31 13:19 <REP> Macrovision Shared
2007-08-18 15:17 <REP> Microsoft Shared
2007-03-11 01:29 <REP> MSSoap
2007-11-09 22:33 <REP> NSV
2007-03-11 01:29 <REP> Nullsoft
2007-03-11 01:29 <REP> ODBC
2007-03-11 01:29 <REP> Real
2007-03-14 01:51 <REP> Services
2007-09-09 14:07 <REP> Skype
2007-03-14 01:51 <REP> Sonic Shared
2007-03-11 01:29 <REP> SpeechEngines
2007-03-14 01:51 <REP> SureThing Shared
2007-03-14 13:35 <REP> Symantec Shared
2007-08-18 14:41 <REP> System
2007-05-16 11:22 <REP> Teleca Shared
2007-04-25 18:13 <REP> Vbox
2007-11-24 09:49 <REP> Wise Installation Wizard
2007-03-11 01:29 <REP> xing shared
0 fichier(s) 0 octets
34 Rép(s) 109,192,114,176 octets libres
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 0861-D979

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

2007-08-18 14:41 <REP> .
2007-08-18 14:41 <REP> ..
2007-03-14 01:50 <REP> 1033
2007-08-18 14:42 <REP> 1036
2006-10-26 18:49 970,528 MSONSEXT.DLL
2006-10-26 19:12 40,256 MSOSV.DLL
1999-06-03 11:09 122,937 MSOWS409.DLL
2001-03-07 06:00 127,033 MSOWS40c.DLL
2003-07-11 01:25 80,448 PKMWS.DLL
5 fichier(s) 1,341,202 octets
4 Rép(s) 109,192,114,176 octets libres
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 0861-D979

Répertoire de C:\Program Files\common files

2007-11-27 17:09 <REP> .
2007-11-27 17:09 <REP> ..
2007-11-27 17:09 <REP> Borland Shared
0 fichier(s) 0 octets
3 Rép(s) 109,192,114,176 octets libres
Le volume dans le lecteur C s'appelle HDD
Le numéro de série du volume est 0861-D979

Répertoire de C:\

2007-12-05 18:30 280,286 win32delfkil.exe
1 fichier(s) 280,286 octets
0 Rép(s) 109,192,114,176 octets libres




c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.0.125\French\setup.exe
c:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\E12C95FCBD1240FEAE314D89676CA6F8\LieDetector.exe
c:\Documents and Settings\Geffray\.limewire\.NetworkShare\LimeWireWin4.14.10.exe
c:\Documents and Settings\Geffray\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_fr_FR.exe
c:\Documents and Settings\Geffray\Application Data\Macromedia\Flash Player\#SharedObjects\6KTRWYBF\localhost\Program Files\FLV Player\FLVPlayer.exe
c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{83F12F73-D52E-40C0-93B1-463C311C4E17}\Icon8255BBAC1.exe
c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{83F12F73-D52E-40C0-93B1-463C311C4E17}\Icon83F12F734.exe
c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{83F12F73-D52E-40C0-93B1-463C311C4E17}\Icon83F12F738.exe
c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{885A63EA-382B-4DD4-A755-14809B8557D6}\ARPPRODUCTICON.exe
c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{91057632-CA70-413C-B628-2D3CDBBB906B}\ARPPRODUCTICON.exe
c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{DD8408E9-9421-484F-979D-DB6361E3E828}\IconDD8408E910.exe
c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{DD8408E9-9421-484F-979D-DB6361E3E828}\IconDD8408E96.exe
c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC.exe
c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC1.exe
c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B.exe
c:\Documents and Settings\Geffray\Application Data\Microsoft\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\IconDED53B0B1.exe
c:\Documents and Settings\Geffray\Application Data\Simply Super Software\Trojan Remover\fplB.exe
c:\Documents and Settings\Geffray\Application Data\Simply Super Software\Trojan Remover\xaq9.exe
c:\Documents and Settings\Geffray\Bureau\UniqueDisplay.exe
c:\Documents and Settings\Geffray\Bureau\BFU\BFU.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\catchme.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\diff.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\dumphive.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\FilesInfoCmd.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\find2.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\Fport.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\grep.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\gzip.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\KProcCheck.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\LFiles.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\LISTDLLS.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\md5sums.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\pslist.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\sigcheck.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\streams.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\swreg.exe
c:\Documents and Settings\Geffray\Bureau\DiagHelp\tar.exe
c:\Documents and Settings\Geffray\Local Settings\Application Data\Adobe\Updater5\Install\aftereffects8\after_effects_8.0.1_update.exe
c:\Documents and Settings\Geffray\Local Settings\Application Data\GameSpy\Comrade\updates\ComradeFull160.exe~
c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer2996\Setup.exe
c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer2996\redist\WindowsInstaller-KB893803-v2-x86.exe
c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer2996\redist\WindowsServer2003-KB898715-ia64-enu.exe
c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer2996\redist\WindowsServer2003-KB898715-x64-enu.exe
c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer2996\redist\WindowsServer2003-KB898715-x86-enu.exe
c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer2996\redist\WindowsXP-KB898715-x64-enu.exe
c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer3748\Setup.exe
c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer3748\redist\WindowsInstaller-KB893803-v2-x86.exe
c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer3748\redist\WindowsServer2003-KB898715-ia64-enu.exe
c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer3748\redist\WindowsServer2003-KB898715-x64-enu.exe
c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer3748\redist\WindowsServer2003-KB898715-x86-enu.exe
c:\Documents and Settings\Geffray\Local Settings\Application Data\Installer3748\redist\WindowsXP-KB898715-x64-enu.exe
c:\Documents and Settings\Geffray\Local Settings\Temp\s104..exe
c:\Documents and Settings\Geffray\Local Settings\Temp\s2q0.8.exe
c:\Documents and Settings\Geffray\Local Settings\Temp\Rar$EX00.391\avenger.exe
c:\Documents and Settings\Geffray\Mes documents\internet\codecs\DivXPlay.exe
c:\Documents and Settings\Geffray\Mes documents\internet\codecs\quick time.exe
c:\Documents and Settings\Geffray\Mes documents\internet\codecs\WM9Codecs.exe
c:\Documents and Settings\Geffray\Mes documents\internet\graphisme et montage\audition 2.0\Audition 2.0 Setup.exe
c:\Documents and Settings\Geffray\Mes documents\internet\graphisme et montage\audition 2.0\keygen.exe
c:\Documents and Settings\Geffray\Mes documents\internet\graphisme et montage\sony\SF8_Retail.exe
c:\Documents and Settings\Geffray\Mes documents\internet\graphisme et montage\sony\SF8_Trial.exe
c:\Documents and Settings\Geffray\Mes documents\internet\installation\avast.exe
c:\Documents and Settings\Geffray\Mes documents\internet\installation\live messenger +.exe
c:\Documents and Settings\Geffray\Mes documents\internet\installation\live messenger.exe
c:\Documents and Settings\Geffray\Mes documents\internet\installation\mozilla firefox.exe
c:\Documents and Settings\Geffray\Mes documents\internet\installation\Nvidia 7300 series.exe
c:\Documents and Settings\Geffray\Mes documents\internet\installation\Skype.exe
c:\Documents and Settings\Geffray\Mes documents\internet\installation\SteamInstall_Full.exe
c:\Documents and Settings\Geffray\Mes documents\internet\jeux\counter\HUD conter\INpact_CSS_Hud_tweaker_1.19.exe
c:\Documents and Settings\Geffray\Mes documents\internet\jeux\counter\HUD conter\data\vtf_tools\jpg2tga.exe
c:\Documents and Settings\Geffray\Mes documents\internet\jeux\counter\HUD conter\data\vtf_tools\vtex.exe
c:\Documents and Settings\Geffray\Mes documents\internet\jeux\game boy\gameboy advance\VisualBoyAdvance.exe
c:\Documents and Settings\Geffray\Mes documents\internet\jeux\kotor 2\KSE\kse_333.exe
c:\Documents and Settings\Geffray\Mes documents\internet\jeux\mini jeux\ConquerAntarctica.exe
c:\Documents and Settings\Geffray\Mes documents\internet\jeux\mini jeux\DirtBike.exe
c:\Documents and Settings\Geffray\Mes documents\internet\jeux\WoW\BurningCrusade installer\Installer.exe
c:\Documents and Settings\Geffray\Mes documents\internet\jeux\WoW\WoW Installer\Installer.exe
c:\Documents and Settings\Geffray\Mes documents\internet\jeux\WoW\WoW Installer\DirectX\dxsetup.exe
c:\Documents and Settings\Geffray\Mes documents\internet\jeux\WoW\WoW-2.0.0-frFR-Installer\Installer.exe
c:\Documents and Settings\Geffray\Mes documents\internet\jeux\WoW\WoW-2.0.0-frFR-Installer\DirectX\dxsetup.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\dossier installation\caméra.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\dossier installation\DivXInstaller.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\dossier installation\GoogleEarth.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\dossier installation\wmp11-windowsxp-x86-fr-fr.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\dossier installation\plugin firefox\WGAPluginInstall.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\msn\BlackWizzer.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\msn\stuffplug_stuffplug_3.0.387_beta_anglais_38488.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\RAD Video Tools.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\AMV convert tool\MP3set3_68\InstMsiA.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\AMV convert tool\MP3set3_68\InstMsiW.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\AMV convert tool\MP3set3_68\setup.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\AMV convert tool\MP3set3_68\vcredist.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\sound forge\soundforge80d-trial.exe
c:\Documents and Settings\Geffray\Mes documents\internet\loisirs\outils vidéos\sound forge\keygen\keygen.exe
c:\Documents and Settings\Geffray\Mes documents\internet\protection\a2 free\a2freesetup.exe
c:\Documents and Settings\Geffray\Mes documents\internet\protection\avast home\setupfre.exe
c:\Documents and Settings\Geffray\Mes documents\internet\protection\pop up stopper\PopUpStopper.exe
c:\Documents and Settings\Geffray\Mes documents\internet\protection\regcleaner\RegCleaner.exe
c:\Documents and Settings\Geffray\Mes documents\internet\protection\spybot\spybotsd14.exe
c:\Documents and Settings\Gisele.PCHOME\Application Data\MEGAUPLOADTOOLBAR\megauper.exe
c:\Documents and Settings\Gisele.PCHOME\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe
c:\Documents and Settings\Gisele.PCHOME\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe
c:\Documents and Settings\Gisele.PCHOME\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe
c:\Documents and Settings\Gisele.PCHOME\Bureau\PREVXCSIFREE.EXE
c:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
c:\Documents and Settings\All Users\Application Data\Logishrd\LQCVFX\Filters\MMSEF.dll
c:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\bejeweled2\Bejeweled2.dll
c:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\Zuma.dll
c:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\E12C95FCBD1240FEAE314D89676CA6F8\dbghelp.dll
c:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\E12C95FCBD1240FEAE314D89676CA6F8\GdiPlus.dll
c:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\E12C95FCBD1240FEAE314D89676CA6F8\zlib.dll
c:\Documents and Settings\Geffray\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll
c:\Documents and Settings\Gisele.PCHOME\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll
c:\Documents and Settings\Gisele.PCHOME\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{18AA4E21-D540-4a3a-9F9F-E6DE33D6F253}\MSExcel.dll
c:\Documents and Settings
0
FillPCA Messages postés 2242 Date d'inscription samedi 21 avril 2007 Statut Contributeur sécurité Dernière intervention 18 février 2023 123
5 déc. 2007 à 21:12
Salut,

Diaghelp est un programme de diagnostic et non un programme de nettoyage.


1/ Clique sur démarrer>Exécuter>cmd puis valide par "entrée".
Tape sc stop flnqvxin
et
sc delete flnqvxin


Continue même si un message d'erruer apparait.

2/ Ouvre le dossier DiagHelp.
Double-clique sur catchme.exe (le .exe peut ne pas apparaître).

Une fenêtre va s'ouvrir, va dans l'onglet Script.
Copie/colle ceci :

files to kill:
C:\system32\drivers\dhawtanq.dat
C:\WINDOWS\system32\atkctr.dll


Clique sur Run.

3/ Ouvre le Bloc-note
et copie-colle les lignes entre --- ci-dessous (y compris la ligne vide à la fin)

-----------------------------------------------------------------------------------
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1182A964-F338-4150-B053-32772BC321E8}]

--------------------------------------------------------------------------------------------------------------

Enregistre ce fichier sur ton bureau (Nom du fichier : "Fixme.reg " -sans inclure les guillemets- ; Type : Tous les fichiers).

Double-clique sur Fixme.reg et clique sur Oui lorsqu'on te demande confirmation pour Fusionner.
Lorsque tu reçois un message du bon déroulement, supprime le fichier Fixme.reg.

Edite un nouveau rapport Hijackthis.

FillPCA
0
Logfile of HijackThis v1.99.1
Scan saved at 21:24, on 2007-12-05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Geffray\LOCALS~1\Temp\Rar$EX00.281\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {1182A964-F338-4150-B053-32772BC321E8} - C:\WINDOWS\system32\atkctr.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [UniqueDisplay] C:\Documents and Settings\Gisele.PCHOME\Bureau\UniqueDisplay.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [BootSkin Startup Jobs] ; "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [Echovoice Gamer Statistics] ; C:\Program Files\Echovoice\Gamer Statistics\G15 Echovoice Gamer Statistics.exe
O4 - HKLM\..\Run: [EzPrint] ; "C:\Program Files\Lexmark 2300 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] ; "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Launch LGDCore] ; "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] ; "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [lxcgmon.exe] ; "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"
O4 - HKLM\..\Run: [PCMService] ; "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] ; "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] ; "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] ; C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] ; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [updateMgr] ; C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: 54M Wireless USB Adapter.lnk = C:\Program Files\USB\54M Wireless USB Adapter\Mrv8000x.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/default/TriJinx.1.0.0.87.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/default/mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/bingame/popcaploader_v10.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxcg_device - - C:\WINDOWS\system32\lxcgcoms.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
0
FillPCA Messages postés 2242 Date d'inscription samedi 21 avril 2007 Statut Contributeur sécurité Dernière intervention 18 février 2023 123
5 déc. 2007 à 21:29
Re,

* Télécharge gmer sur le bureau et dézippe-le (clic droit et extraire ici) : http://www2.gmer.net/gmer.zip
* Double-clique sur gmer.exe sur le bureau. Si ton antivirus réagit, ne t'inquiète et ignore l'alerte.
* Clique sur l'onglet "rootkit",
* A droite, coche "Files" et "Services" puis clique sur scan.
* A la fin du scan, clique sur le bouton copy.
* Dans démarrer>programmes>accessoires : ouvre le bloc-note et clique sur CTRL+V afin de copier le rapport dans ce même bloc-note.
* Edite ce rapport dans ta prochaine réponse.
0