virus récalcitrant ? Win32.WORM.BAGLE.ZJJRésolu/Fermé

Question

Bonjour,
Depuis plusieurs jours, mon PC, qui bien que fonctionnant normalement, reboote de façon intempestive et aléatoire et il semblerait qu'il soit infecté.
Aprés plusieurs scans en ligne (Norton, Secuser, Freedom, FSecure, BitDefender, eTrustOnLine), il apparait que BitDefender (et lui seul) détecte W32.Worm.Bagle ZJJ. Les autres antivurus ne détectent strictement rien.
La désinfection et la suppression du fichier infecté sont impossibles et n'apportent aucun résultat, l'anomalie persiste, avec bien sur les précautions d'usage (désactivation restauration du système, etc...).
Tentatives aussi avec AVG, Spybot et CCCLeaner, de même que plusieurs outils destinés à éliminer ce ver (SDFix, AntiBagle-fr, FxBeagle), toujours sans résultat.
Le fichier "infecté" est localisé dans un sous-dossier de Documents & settings, mais rien a faire...
Quelqu'un a t'il une idée ?
Merci

DarkRodWarrior · Answer

Salut,

Tu peux formater ton PC ?

FillPCA · Answer

Salut,

Si c'est pour proposer un foramatage, il vaut mieux s'abstenir.
 Télécharge ELIBAGLA en bas de cette page : http://www.zonavirus.com/datos/descargas/95/elibagla.asp
(clique sur le bouton "Descargar Elibagla") sur ton bureau.
Lance-le, de préférence en mode sans échec si tu en as la possibilité, en mode normal dans le cas contraire. Patiente le temps du scan.
Lorsqu'il a terminé, poste le contenu du fichier infoSat.txt qui se trouve dans Poste de travail > Disque C:\
Et par la même occasion, précise si tu peux à nouveau démarrer en mode sans échec.

Ne pas rebooter en passant par msconfig.

FillPCA

Moi même · Answer

Merci pour ton aide
Voici le résultat.
Oui, je peux démarrer en mode sans echec.

	  Sat Dec 22 14:08:20 2007
EliBagle v10.78  (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios:   10601
Nº Total de Ficheros:      157910
Nº de Ficheros Analizados: 14519
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

FillPCA · Answer

Re,

Poste les 3 rapports en plusieurs fois s'ils sont trop longsp our être publiés en une seule fois.

1/     *  Télécharge DiagHelp.zip sur ton bureau(Merci Malekal)  : http://www.malekal.com/download/DiagHelp.zip
Tuto : http://www.malekal.com/DiagHelp/DiagHelp.php
    * Ne double-clique pas dessus !! Fais un clic droit sur le fichier et extraire tout.
    * Un nouveau dossier chercher va être créé.
    * Ouvre le et double-clic sur go.cmd (le .cmd peut ne pas apparaître)
    * Une fenêtre va s'ouvrir, choisis l'option 1
    * L'analyse va commencer, ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand on te le demande.
    * Pendant l'analyse après le rapport CATCHME sur l'écran rouge, tu dois appuyer sue entrée pour que l'outil continue ses recherches. Suis les consignes écrites.
    * Une fenêtre avec le rapport s'ouvre alors. Copie/colle son contenu. (Il se trouve aussi ici : c:\resultat.txt)
    * Double-clique sur ce fichier, Fais CTRL+A puis CTRL+C.
    * Dans ta prochaine réponse, colle le rapport en faisant CTRL+V.

2/     *  Télécharge SREng (de Smallfrogs) : http://www.kztechs.com/eng/download.html
    * Dézippe tout son contenu sur ton bureau (clic droit >Extraire ici).
    * Ouvre le dossier SReng2 et double-clique sur SREng.exe.
    * Clique sur "smart scan".
    * Clique sur le bouton "scan".
    * Quand l'analyse est terminée, clique sur le bouton "save reports".
    * Sauvegarde alors le rapport sur ton bureau.
    * Copie/colle le contenu du rapport  SREnglLOG.log dans ta prochaine réponse.

3/ Edite aussi un rapport Hijackthis :
http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe
Démo en image
http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm


Fais un scan et poste l'analyse.

FillPCA

Cobr@3 · Answer

Télécharger HijackThis
- http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis
Installe le sur le bureau, lance le et clique sur Do a System Scan puis poste ton rapport ;)

Moi même · Answer

Merci encore, voila le résultat __________________________________________________________________________________________________________ DiagHelp version v1.4 - http://www.malekal.com excute le 22/12/2007 à 15:21:02,20 Liste des derniers fichies modifies/crees dans windir\system32 et prefetch C:\WINDOWS\prefetch\MSIMN.EXE-3356F448.pf -->27/12/2007 15:37:26 C:\WINDOWS\prefetch\IEXPLORE.EXE-06887102.pf -->27/12/2007 15:34:09 C:\WINDOWS\prefetch\VERCLSID.EXE-3B227142.pf -->27/12/2007 15:34:06 C:\WINDOWS\prefetch\ACDSEEQV.EXE-2174EC4D.pf -->27/12/2007 14:58:10 C:\WINDOWS\prefetch\CIDAEMON.EXE-2B2C6F8A.pf -->27/12/2007 14:51:30 C:\WINDOWS\prefetch\USNSVC.EXE-06863237.pf -->27/12/2007 14:48:37 C:\WINDOWS\prefetch\LIVECALL.EXE-124D8E6F.pf -->27/12/2007 14:48:31 C:\WINDOWS\prefetch\YUPDATER.EXE-290842D1.pf -->27/12/2007 14:48:13 C:\WINDOWS\prefetch\MSNMSGR.EXE-1C291C3F.pf -->27/12/2007 14:47:59 C:\WINDOWS\prefetch\WUAUCLT.EXE-12D8E25E.pf -->27/12/2007 14:45:02 C:\WINDOWS\System32\drivers\gmer.sys -->19/12/2007 14:21:48 C:\WINDOWS\System32\drivers\aswmon.sys -->04/12/2007 15:56:02 C:\WINDOWS\System32\drivers\aswmon2.sys -->04/12/2007 15:55:46 C:\WINDOWS\System32\drivers\aswRdr.sys -->04/12/2007 15:53:39 C:\WINDOWS\System32\drivers\aswTdi.sys -->04/12/2007 15:51:52 C:\WINDOWS\System32\drivers\aavmker4.sys -->04/12/2007 15:49:02 C:\WINDOWS\System32\drivers\secdrv.sys -->13/11/2007 11:25:54 C:\WINDOWS\System32\LVCOMSX.LOG -->22/12/2007 15:16:48 C:\WINDOWS\System32\wpa.dbl -->22/12/2007 11:36:51 C:\WINDOWS\System32\Uninstall.ico -->21/12/2007 00:51:29 C:\WINDOWS\System32\pavas.ico -->21/12/2007 00:51:29 C:\WINDOWS\System32\Help.ico -->21/12/2007 00:51:29 C:\WINDOWS\System32\CONFIG.NT -->12/12/2007 09:32:51 C:\WINDOWS\System32\TZLog.log -->12/12/2007 01:30:26 C:\WINDOWS\System32\aswBoot.exe -->04/12/2007 14:04:28 C:\WINDOWS\System32\AVASTSS.scr -->04/12/2007 13:54:04 C:\WINDOWS\System32\MRT.exe -->03/12/2007 00:00:05 C:\WINDOWS\System32 zchange.exe -->13/11/2007 12:31:11 C:\WINDOWS\System32\mshtml.dll -->31/10/2007 00:23:48 C:\WINDOWS\System32\quartz.dll -->29/10/2007 23:43:32 C:\WINDOWS\System32\xpsp3res.dll -->29/10/2007 16:07:16 C:\WINDOWS\System32\jupdate-1.6.0_03-b05.log -->28/10/2007 13:20:46 C:\WINDOWS\System32\perfh00C.dat -->28/10/2007 09:19:00 C:\WINDOWS\System32\perfh009.dat -->28/10/2007 09:19:00 C:\WINDOWS\System32\perfc00C.dat -->28/10/2007 09:19:00 C:\WINDOWS\System32\perfc009.dat -->28/10/2007 09:19:00 C:\WINDOWS\System32\PerfStringBackup.INI -->28/10/2007 09:18:59 C:\WINDOWS\System32\shell32.dll -->25/10/2007 17:43:25 C:\WINDOWS\System32\wmasf.dll -->25/10/2007 09:28:30 C:\WINDOWS\System32\wininet.dll -->11/10/2007 00:49:45 C:\WINDOWS\System32\webcheck.dll -->11/10/2007 00:49:45 C:\WINDOWS\System32\urlmon.dll -->11/10/2007 00:49:45 C:\WINDOWS tbtlog.txt -->22/12/2007 15:15:35 C:\WINDOWS\bootstat.dat -->22/12/2007 14:31:34 C:\WINDOWS\WindowsUpdate.log -->22/12/2007 14:29:32 C:\WINDOWS\SchedLgU.Txt -->22/12/2007 13:42:15 C:\WINDOWS\wiaservc.log -->22/12/2007 13:42:07 C:\WINDOWS\wiadebug.log -->22/12/2007 13:42:06 C:\WINDOWS\setupapi.log -->22/12/2007 12:44:02 C:\WINDOWS\0.log -->22/12/2007 11:36:36 C:\WINDOWS\TempFile -->22/12/2007 11:36:03 C:\WINDOWS\NeroDigital.ini -->21/12/2007 19:33:25 C:\WINDOWS\pavsig.txt -->21/12/2007 00:51:35 C:\WINDOWS\gmer.ini -->19/12/2007 14:24:43 C:\WINDOWS\gmer_uninstall.cmd -->19/12/2007 14:21:48 C:\WINDOWS\gmer.dll -->19/12/2007 14:21:48 C:\WINDOWS\setupact.log -->19/12/2007 10:34:09 winlogon.exe Verified: Signed svchost.exe Verified: Signed ws2_32.dll Verified: Signed user32.dll Verified: Signed tcpip.sys Verified: Signed ndis.sys Verified: Signed null.sys Verified: Signed ListDLLs v2.25 - DLL lister for Win9x/NT Copyright (C) 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ explorer.exe pid: 816 Command line: C:\WINDOWS\Explorer.EXE Base Size Version Path 0x44080000 0xcf000 7.00.6000.16574 C:\WINDOWS\system32\WININET.dll 0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll 0x43e00000 0x45000 7.00.6000.16574 C:\WINDOWS\system32\iertutil.dll 0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll 0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL 0x44360000 0x5cd000 7.00.6000.16574 C:\WINDOWS\system32\ieframe.dll 0x44160000 0x127000 7.00.6000.16574 C:\WINDOWS\system32\urlmon.dll 0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll 0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll 0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll 0x00f80000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll 0x16200000 0x6000 4.01.0000.0000 C:\PROGRA~1\WINZIP~1.1FR\WZSHLSTB.DLL 0x02410000 0x5d000 1.03.0004.0001 C:\Program Files\Sony Ericsson\Mobile\auexpext.dll 0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll 0x02470000 0x2b000 1.03.0004.0001 C:\Program Files\Sony Ericsson\Mobile\FilGuiLg.dll 0x024b0000 0x28000 C:\Program Files\WinRAR arext.dll 0x64000000 0x30000 2005.01.0001.0004 C:\PROGRA~1\Yahoo!\Common\ymmapi.dll 0x10000000 0x2a000 7.05.0001.0036 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll 0x64f00000 0x12000 4.07.1098.0000 C:\Program Files\Alwil Software\Avast4\ashShell.dll 0x02ae0000 0x22000 8.02.0000.1192 C:\Program Files\Logitech\Video\Namespc2.dll 0x7c140000 0x103000 7.10.3077.0000 C:\WINDOWS\system32\MFC71.DLL 0x7c340000 0x56000 7.10.3052.0004 C:\WINDOWS\system32\MSVCR71.dll 0x7c3a0000 0x7b000 7.10.3077.0000 C:\WINDOWS\system32\MSVCP71.dll 0x5d360000 0xf000 7.10.3077.0000 C:\WINDOWS\system32\MFC71FRA.DLL 0x02400000 0x8000 8.02.0000.1192 C:\Program Files\Logitech\Video\AlbuDBps.dll 0x5a500000 0x4e000 8.01.0178.0000 C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll 0x78130000 0x9b000 8.00.50727.0163 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\MSVCR80.dll 0x02b30000 0x27e000 5.02.5721.5145 C:\WINDOWS\system32\wpdshext.dll 0x07160000 0x46000 5.02.5721.5145 C:\WINDOWS\system32\Audiodev.dll 0x15110000 0x25a000 11.00.5721.5145 C:\WINDOWS\system32\WMVCore.DLL 0x11c70000 0x3a000 11.00.5721.5238 C:\WINDOWS\system32\WMASF.DLL 0x02db0000 0x2f000 11.00.0000.0001 C:\WINDOWS\system32\WDShell.dll 0x02df0000 0x13000 7.05.0001.0036 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll 0x61c20000 0x54000 8.00.0000.9118 C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll 0x5fc70000 0x18000 8.00.0000.9107 C:\Program Files\OpenOffice.org 2.2\program\uwinapi.dll 0x61740000 0x8e000 4.05.2003.0120 C:\Program Files\OpenOffice.org 2.2\program\stlport_vc7145.dll 0x60980000 0x7000 3.01.4000.1823 C:\WINDOWS\system32\MSISIP.DLL 0x74e10000 0x10000 5.06.0000.8820 C:\WINDOWS\System32\wshext.dll 0x73d20000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL 0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL 0x59000000 0xe000 5.06.0000.6626 C:\WINDOWS\System32\wshFR.DLL ListDLLs v2.25 - DLL lister for Win9x/NT Copyright (C) 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ winlogon.exe pid: 268 Command line: winlogon.exe Base Size Version Path 0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe 0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll 0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll 0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll 0x00df0000 0x3b000 1.07.0018.0005 C:\WINDOWS\system32\WgaLogon.dll 0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\WINDOWS\system 10/09/1999 12:06 4 672 WOWPOST.EXE 1 fichier(s) 4 672 octets 0 Rép(s) 48 208 277 504 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\WINDOWS\system32 20/08/2004 00:09 6 144 csrss.exe 1 fichier(s) 6 144 octets 0 Rép(s) 48 208 277 504 octets libres Contenu de Downloaded Program Files Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\WINDOWS\Downloaded Program Files 22/12/2007 12:44 . 22/12/2007 12:44 .. 07/03/2007 00:59 300 680 arclib.dll 24/08/2006 07:28 141 424 asinst.dll 22/08/2006 08:06 537 asinst.inf 09/12/2007 00:46 312 680 avsniff.dll 09/12/2007 00:38 773 avsniff.inf 09/12/2007 00:46 255 336 avsniffdlgs.dll 07/12/2004 16:07 32 bdcore.dll 25/05/2006 00:21 118 784 bdupd.dll 21/03/2002 14:26 815 bitdefender.inf 30/01/2003 15:52 348 160 bitdefender.ocx 25/06/2003 18:00 541 ca.pub 09/12/2007 00:38 241 CabSA.inf 14/11/2007 01:00 2 504 catalog.dat 27/03/2002 13:02 168 014 cssweb.dll 24/04/2003 14:11 259 cssweb.inf 17/01/2006 16:11 580 663 daas_s.dll 14/08/2004 13:51 65 desktop.ini 25/07/2002 17:13 24 576 dwusplay.dll 25/07/2002 17:13 196 608 dwusplay.exe 14/11/2007 01:00 6 899 ecbootil.vxd 09/12/2007 00:36 42 112 ecmldr32.dll 14/11/2007 01:00 284 016 ecmsvr32.dll 20/11/2007 16:04 1 523 536 FP_AX_CAB_INSTALLER.exe 03/02/2006 10:20 188 416 fsauc.dll 16/06/2006 14:31 181 856 fscax.dll 13/04/2007 15:52 482 fscax.inf 12/07/2000 01:02 36 864 fxfileop.dll 25/05/2006 00:21 53 248 ipsupd.dll 10/06/2005 09:44 417 792 isusweb.dll 07/01/2007 12:55 2 305 kavwebscan.inf 16/03/2005 11:34 7 407 lang.ini 11/12/2006 16:44 367 LegitCheckControl.inf 07/12/2004 16:07 32 libfn.dll 14/03/2005 13:38 126 live.ini 24/02/2006 11:49 882 mcfscan.inf 18/11/1999 12:48 995 mpeg4ax.inf 18/11/1999 12:49 992 msaudio.inf 09/12/2007 00:36 6 850 navapi.vxd 09/12/2007 00:36 201 896 navapi32.dll 14/11/2007 01:00 124 272 naveng32.dll 14/11/2007 01:00 914 800 navex32a.dll 17/01/2005 16:09 227 opuc.inf 01/06/2006 01:57 1 331 oscan8.inf 01/06/2006 01:54 471 040 oscan8.ocx 31/05/2006 03:15 10 oscan81.ocx_x 09/12/2007 00:46 296 336 rufsi.dll 14/03/2005 13:58 7 073 scanoptions.tsi 14/11/2007 01:00 97 776 scrauth.dat 20/11/2007 15:50 247 swflash.inf 14/11/2007 01:00 11 816 symaveng.cat 14/11/2007 01:00 1 061 symaveng.inf 14/11/2007 01:00 400 415 tcdefs.dat 14/11/2007 01:00 2 344 295 tcscan7.dat 14/11/2007 01:00 413 082 tcscan8.dat 14/11/2007 01:00 968 800 tcscan9.dat 14/11/2007 01:00 453 tinf.dat 14/11/2007 01:00 148 tinfidx.dat 14/11/2007 01:00 1 957 tinfl.dat 14/11/2007 01:00 67 815 tscan1.dat 14/11/2007 01:00 3 240 tscan1hd.dat 31/10/2001 09:37 118 uninst.bat 14/11/2007 01:00 4 778 v.grd 14/11/2007 01:00 2 267 v.sig 21/12/2007 19:08 294 403 vet.da1 19/11/2007 01:18 13 076 520 vet.dat 13/07/2007 05:11 1 353 016 vete.dll 14/11/2007 01:00 106 244 virscan.inf 14/11/2007 01:00 996 122 virscan1.dat 14/11/2007 01:00 570 966 virscan2.dat 14/11/2007 01:00 150 536 virscan3.dat 14/11/2007 01:00 320 253 virscan4.dat 14/11/2007 01:00 4 871 963 virscan5.dat 14/11/2007 01:00 392 074 virscan6.dat 14/11/2007 01:00 14 386 178 virscan7.dat 14/11/2007 01:00 1 862 947 virscan8.dat 14/11/2007 01:00 5 260 290 virscan9.dat 14/11/2007 01:00 32 virscant.dat 18/12/2007 13:34 2 072 vscanmsx.dat 20/11/2006 12:02 180 282 webscan.dll 21/07/2006 12:55 477 webscan.inf 02/11/2005 17:01 1 777 xscan.inf 02/11/2005 17:07 435 712 xscan53.ocx 14/11/2007 01:00 224 zdone.dat 83 fichier(s) 55 805 210 octets Total des fichiers listés : 83 fichier(s) 55 805 210 octets 2 Rép(s) 48 208 273 408 octets libres Recherche de rootkit! (Merci S!Ri) Recherche d'infections connues Export des clefs sensibles.. Liste des fichiers en exception sur le pare-feu XP SP2 "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Age of Empires 2\age2_x1.exe"="C:\Program Files\Age of Empires 2\age2_x1.exe:*:Enabled:Age of Empires II Expansion" "C:\Program Files\EasyPHP1-7\apache\apache.exe"="C:\Program Files\EasyPHP1-7\apache\apache.exe:*:Enabled:apache" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Exécuter une DLL en tant qu'application" "C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting®" "C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer" "C:\Program Files\Empire Earth\Empire Earth.exe"="C:\Program Files\Empire Earth\Empire Earth.exe:*:Enabled:Empire Earth" "C:\WINDOWS\system32\rtcshare.exe"="C:\WINDOWS\system32\rtcshare.exe:*:Enabled:Partage de l'application RTC" "C:\Program Files\GlobalSCAPE\CuteFTP Pro\TE\ftpte.exe"="C:\Program Files\GlobalSCAPE\CuteFTP Pro\TE\ftpte.exe:*:Enabled:FTP Transfer Engine" "C:\Program Files\MixW\Teoan.exe"="C:\Program Files\MixW\Teoan.exe:*:Enabled:TEOAN" "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe"="C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe:*:Enabled:mRouterRuntime" "C:\Program Files\EchoLink\EchoLink.exe"="C:\Program Files\EchoLink\EchoLink.exe:*:Enabled:EchoLink" "C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\Program Files\Kazaa Lite K++\KazaaLite.kpp"="C:\Program Files\Kazaa Lite K++\KazaaLite.kpp:*:Enabled:KazaaLite" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Freeplayer\vlc\vlc.exe"="C:\Program Files\Freeplayer\vlc\vlc.exe:*:Enabled:VLC media player" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\WINDOWS\system32\svchost.exe"="C:\WINDOWS\system32\svchost.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\11exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\11exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\38exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\38exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\43exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\43exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\74exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\74exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\51exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\51exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\0exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\0exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\80exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\80exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\75exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\75exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\63exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\63exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\8exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\8exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\48exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\48exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\2exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\2exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\36exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\36exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\66exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\66exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\50exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\50exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\73exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\73exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\54exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\54exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\29exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\29exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\6exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\6exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\61exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\61exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\41exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\41exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\45exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\45exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\64exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\64exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\37exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\37exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\19exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\19exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\69exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\69exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\12exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\12exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\84exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\84exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\15exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\15exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\5exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\5exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\21exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\21exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\99exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\99exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\65exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\65exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\23exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\23exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\26exinjs.a6.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\26exinjs.a6.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\98exinjs.a6.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\98exinjs.a6.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\17exinjs.a6.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\17exinjs.a6.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\10exinjs.a6.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\10exinjs.a6.exe:*:Enabled:Microsoft Update" "C:\Program Files\Microsoft Office\Office\EXCEL.EXE"="C:\Program Files\Microsoft Office\Office\EXCEL.EXE:*:Enabled:Microsoft Excel for Windows" "C:\Program Files\FileZilla\FileZilla.exe"="C:\Program Files\FileZilla\FileZilla.exe:*:Enabled:FileZilla" "C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe:*:Enabled:Assistance à distance - Windows Messenger et voix" "C:\Program Files\Apache Group\Apache2\bin\Apache.exe"="C:\Program Files\Apache Group\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server" "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Export de la clef SharedTaskScheduler [SharedTaskScheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant" exports des policies REGEDIT4 [system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 Export des clefs sensibles.. Rechercher adresses sensibles dans le fichier HOSTS... catchme 0.3.1319 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-22 15:21:40 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2C4D257C-72E2-E577-A752-291333787D00}] "hagepphnhnalohlb"=hex:61,61,00,00 "hagepphnnnglgocp"=hex:61,61,00,00 "iakfpidebimpimgooj"=hex:6b,61,68,69,67,68,6d,70,69,62,66,67,61,65,6c,66,67,70,61,6f,6f,.. "haegjngplkgkgjhj"=hex:6b,61,68,69,67,68,6d,70,69,62,66,67,61,65,6c,66,67,70,61,6f,6f,.. scanning hidden files ... scan completed successfully hidden services: 0 hidden files: 0 KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Error loading kernel support driver! Make sure you are running this as Administrator. KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Error loading kernel support driver! Make sure you are running this as Administrator. Liste des programmes installes 3D Home Architect Home Design Deluxe 6 3D Home Architect Home Design Deluxe 6 ACDSee 9 Gestionnaire de photos Ad-Aware SE Personal Adobe Acrobat 5.0 Adobe Flash Player 9 ActiveX Adobe Flash Player ActiveX Adobe Photoshop 7.0 Ahead InCD Apache HTTP Server 2.0.55 Archiveur WinRAR ARTEC ATI Control Panel ATI Display Driver avast! Antivirus AVG Anti-Spyware 7.5 Barre d'outils MSN Camfrog Video Chat 3.91 (remove only) CamStudio 2.0 Fr Canon i560 CCleaner (remove only) Command On Demand for Command Software Compel Adaptec WinASPI ConTEXT Copernic Agent Professional Corel Paint Shop Pro X CorelDRAW Graphics Suite 12 Correctif pour Lecteur Windows Media 11 (KB939683) Cucusoft MPEG/MOV/RM/DivX/AVI to DVD/VCD/SVCD Creator Pro 7.07 CuteFTP Pro EasyCleaner EchoLink eMule Etats Et Requêtes EVEREST Home Edition v2.01 Extension HighMAT pour l'Assistant Graver un CD de Microsoft Windows XP Fake Webcam 2.9.16 FileSpecs plug-in for Ad-Aware SE FileZilla (remove only) Freeplayer Frontline Attack - War over Europe Google Earth Google Toolbar for Firefox Google Toolbar for Internet Explorer HelpNDoc Version 1.10 Personal Edition HijackThis 1.99.1 Hotfix for Windows Media Format 11 SDK (KB929399) HydraVision J2SE Runtime Environment 5.0 J2SE Runtime Environment 5.0 Update 10 J2SE Runtime Environment 5.0 Update 11 J2SE Runtime Environment 5.0 Update 2 J2SE Runtime Environment 5.0 Update 4 J2SE Runtime Environment 5.0 Update 6 J2SE Runtime Environment 5.0 Update 9 Java(TM) 6 Update 2 Java(TM) 6 Update 3 Java(TM) SE Runtime Environment 6 Update 1 K-Lite Codec Pack 3.4.0 Full Kaspersky Online Scanner Language Pack for Ad-aware 6 Language pack for Ad-Aware SE Lecteur Windows Media 11 LiveReg (Symantec Corporation) LiveUpdate 1.80 (Symantec Corporation) Logitech Desktop Messenger Logitech MouseWare 9.79.1 Logitech Print Service Logitech QuickCam LST PCSOFT Macromedia Dreamweaver MX Macromedia Extension Manager Macromedia Fireworks 8 Meracl FontMap v2.1.1 Messenger Plus! Live Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 French Language Pack Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Data Access Components KB870669 Microsoft IntelliType Pro 5.0 Microsoft Internationalized Domain Names Mitigation APIs Microsoft Money 2001 Microsoft National Language Support Downlevel APIs Microsoft Office 2000 SR-1 Professional Microsoft Publisher 98 Microsoft User-Mode Driver Framework Feature Pack 1.0 Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615) Mise à jour de sécurité pour Windows XP (KB918118) Mise à jour de sécurité pour Windows XP (KB921503) Mise à jour de sécurité pour Windows XP (KB924667) Mise à jour de sécurité pour Windows XP (KB925902) Mise à jour de sécurité pour Windows XP (KB926436) Mise à jour de sécurité pour Windows XP (KB927779) Mise à jour de sécurité pour Windows XP (KB927802) Mise à jour de sécurité pour Windows XP (KB928255) Mise à jour de sécurité pour Windows XP (KB928843) Mise à jour de sécurité pour Windows XP (KB929123) Mise à jour de sécurité pour Windows XP (KB930178) Mise à jour de sécurité pour Windows XP (KB931261) Mise à jour de sécurité pour Windows XP (KB931784) Mise à jour de sécurité pour Windows XP (KB932168) Mise à jour de sécurité pour Windows XP (KB933729) Mise à jour de sécurité pour Windows XP (KB935839) Mise à jour de sécurité pour Windows XP (KB935840) Mise à jour de sécurité pour Windows XP (KB936021) Mise à jour de sécurité pour Windows XP (KB938829) Mise à jour de sécurité pour Windows XP (KB941202) Mise à jour de sécurité pour Windows XP (KB941568) Mise à jour de sécurité pour Windows XP (KB941569) Mise à jour de sécurité pour Windows XP (KB943460) Mise à jour de sécurité pour Windows XP (KB944653) Mise à jour pour Windows XP (KB927891) Mise à jour pour Windows XP (KB929338) Mise à jour pour Windows XP (KB930916) Mise à jour pour Windows XP (KB931836) Mise à jour pour Windows XP (KB933360) Mise à jour pour Windows XP (KB938828) Mise à jour pour Windows XP (KB942763) MixW 2.18 (Jan-09-2007) Mozilla Firefox (2.0.0.11) MSN Pictures Displayer 4.5 MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) NeoTrace Express 3.25 Nero 6 Ultra Edition Norton Ghost Novarm DipTrace OpenOffice.org 2.2 Panda ActiveScan PC Camera PC Camera Philips SPC 900NC PC Camera Philips VLounge Picasa 2 PowerCheck 4.2.3 Programme de gestion Camera de Logitech® RamBoost XP 4.0.6 RFSim99 Saisie de Schéma SDS Soldiers - Heroes of World War II Sonic Foundry Sound Forge 6.0 Sony Ericsson PC Suite 3.1.1 Spamihilator Tracé de CI Trust R-Series Mouse Trust R-Series Mouse TyanSystemMonitor V2.13 USB Card Reader \Writer USB Storage Device USB Video Camera Driver v1.10 VideoLAN VLC media player 0.8.5-freehd Visionneuse Journal Windows Microsoft VX2 Cleaner plug-in for Ad-Aware SE WebFldrs XP Windows Genuine Advantage Notifications (KB905474) Windows Internet Explorer 7 Windows Live Messenger Windows Live OneCare safety scanner Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows XP Service Pack 2 Yahoo! Messenger Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\Program Files 19/12/2007 10:30 . 19/12/2007 10:30 .. 10/03/2005 13:37 3D Home Architect 14/08/2005 23:14 AboutTime 01/08/2007 22:03 ACD Systems 14/12/2005 19:13 AdaURL 24/03/2005 11:59 Adobe 21/11/2004 20:11 Age of Empires 2 22/08/2005 12:10 Ahead 02/06/2006 20:58 Alcohol Soft 23/06/2005 13:50 Alwil Software 03/05/2007 12:24 AnalogX 02/07/2007 16:55 Apache Group 14/08/2004 14:16 ATI Technologies 13/04/2007 23:40 Camfrog 23/09/2006 16:46 CamStudio 14/02/2007 17:08 CCleaner 04/09/2007 18:14 CodecSniper 13/08/2005 15:55 Codemasters 22/08/2005 17:20 Common Files 03/06/2007 22:41 ConCon 05/02/2007 22:22 ConTEXT 22/01/2005 18:05 Copernic Agent 18/07/2007 09:36 Corel 02/01/2007 00:15 Cucusoft 16/02/2007 00:50 Cuisinons 30/09/2006 15:27 Dial-Messenger 15/04/2007 00:04 Dictionnaire 31/10/2007 06:45 DipTrace 23/09/2004 20:02 directx 04/08/2007 01:10 DivX 04/10/2005 11:35 Drive Rescue 30/10/2004 11:47 EasyPHP1-7 07/09/2006 21:45 EchoLink 04/02/2006 15:46 Eidos Interactive 31/01/2005 00:38 Empire Earth 16/12/2007 15:42 eMule 19/05/2007 22:04 Fake Webcam 28/11/2007 20:23 Fichiers communs 05/10/2006 22:45 FileZilla 07/01/2007 21:47 Freeplayer 09/10/2004 23:37 GlobalSCAPE 16/12/2007 01:25 Google 10/08/2007 03:18 Grisoft 04/09/2007 18:23 GSpot 18/09/2007 18:56 HelpNDoc 23/04/2005 19:21 HighMAT CD Writing Wizard 17/12/2007 21:42 hijackthis 18/12/2005 16:48 ICprog 16/12/2007 01:26 Internet Explorer 01/09/2006 19:34 Intuwave Ltd 28/10/2007 13:20 Java 15/07/2007 14:10 Kazaa Lite K++ 04/09/2007 18:15 K-Lite Codec Pack 27/06/2005 23:06 Lavalys 21/08/2004 10:18 Lavasoft 03/09/2005 23:46 Logitech 09/07/2007 20:26 Macromedia 30/07/2006 14:08 ManyCam 14/08/2004 15:14 Meracl FontMap 07/06/2007 17:03 Messenger 19/12/2007 18:29 Messenger Plus! Live 21/08/2004 18:03 Micro Application 14/08/2004 16:26 microsoft frontpage 16/12/2007 01:39 Microsoft IntelliType Pro 05/08/2005 18:17 Microsoft Money 14/08/2004 17:53 Microsoft Office 26/03/2007 21:58 MixW 09/02/2005 15:54 Movie Maker 27/11/2005 13:58 Movies 16/12/2007 18:10 Mozilla Firefox 14/08/2004 13:49 MSN 15/05/2005 12:58 MSN Apps 14/08/2004 13:49 MSN Gaming Zone 19/12/2007 18:29 MSN Messenger 03/06/2007 22:37 MSN Pictures Displayer 16/11/2006 18:13 MSXML 4.0 24/03/2007 17:19 MyUninstall 02/01/2007 00:06 NeoDivx Suite 08/09/2007 16:29 NeoTrace Express 26/05/2007 21:04 NetMeeting 23/04/2005 19:28 OfficeUpdate11 02/10/2005 16:45 Ontrack 19/05/2007 14:26 OpenOffice.org 2.2 24/12/2005 19:35 Opera 13/06/2007 16:26 Outlook Express 06/08/2006 09:11 Paltalk Messenger 07/11/2007 20:35 PC Camera 15/07/2007 16:03 PC SOFT 14/11/2007 17:14 Philips 24/12/2005 16:55 Picasa2 19/08/2004 19:11 PopUp Destroy 16/12/2007 01:48 PowerCheck 22/12/2007 11:36 RamBoost XP 14/09/2006 20:55 RegSeeker 25/04/2005 14:36 RFSim99 27/01/2005 18:59 Saisie de Schéma 14/08/2004 13:51 Services en ligne 22/08/2004 12:39 Sonic Foundry 22/08/2004 12:39 Sonic Foundry Setup 01/09/2006 19:35 Sony Ericsson 22/08/2004 12:39 Sound Forge 6.0 22/12/2007 13:04 Spamihilator 16/08/2007 19:39 Spybot - Search & Destroy 10/08/2007 03:03 STOPzilla! 24/02/2007 21:14 StuffPlug3 05/08/2005 17:58 Symantec 08/07/2006 14:13 The Weather Channel FW 05/02/2005 23:26 ToniArts 27/01/2005 19:06 Tracé de CI 13/12/2007 12:08 Trust 20/08/2005 16:35 Tyan Computer Corp 14/08/2004 14:05 VIA Technologies, Inc 14/12/2007 13:25 VideoLAN 16/05/2005 17:57 vso 16/12/2007 01:50 WebcamMax 02/01/2007 00:01 WinASPI 23/09/2006 17:18 Windows AntiSpy 23/04/2005 19:21 Windows Journal Viewer 10/06/2007 10:14 Windows Live 19/12/2007 22:18 Windows Live Safety Center 03/11/2006 08:49 Windows Media Connect 2 03/11/2006 08:49 Windows Media Player 09/02/2005 15:49 Windows NT 23/04/2005 18:29 WinRAR 27/04/2005 08:26 WINRLC 10/03/2005 00:07 WinZip 8.1 Fr 14/08/2004 13:52 xerox 14/04/2007 10:53 Yahoo! 0 fichier(s) 0 octets 129 Rép(s) 48 190 070 784 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\Program Files\fichiers communs 28/11/2007 20:23 . 28/11/2007 20:23 .. 01/08/2007 22:07 ACD Systems 24/03/2005 11:59 Adobe 22/08/2005 12:09 Ahead 14/11/2007 17:26 ArcSoft 14/08/2004 15:33 Copernic 18/07/2007 09:37 Corel 18/07/2007 09:20 Designer 23/09/2004 20:02 FotoWire 15/07/2007 13:52 InstallShield 10/08/2007 02:38 iS3 28/12/2004 09:59 Java 03/09/2005 23:46 Logitech 09/07/2007 20:26 Macromedia 18/07/2007 09:37 Microsoft Shared 14/08/2004 13:50 MSSoap 14/08/2004 14:43 ODBC 01/10/2006 16:02 Panda Software 17/07/2007 00:01 PC SOFT 14/08/2004 13:50 Services 14/08/2004 14:43 SpeechEngines 05/08/2005 17:57 Symantec Shared 24/11/2007 10:14 System 20/08/2004 11:31 Vbox 0 fichier(s) 0 octets 25 Rép(s) 48 190 078 976 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders 19/05/2007 16:28 . 19/05/2007 16:28 .. 28/02/2002 23:03 561 209 MSONSEXT.DLL 03/06/1999 13:09 122 937 MSOWS409.DLL 07/03/2001 08:00 127 033 MSOWS40c.DLL 18/03/1999 05:37 593 977 RAGENT.DLL 4 fichier(s) 1 405 156 octets 2 Rép(s) 48 190 078 976 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\Program Files\common files 22/08/2005 17:20 . 22/08/2005 17:20 .. 22/08/2005 17:20 PCCamera 14/08/2004 15:49 System 0 fichier(s) 0 octets 4 Rép(s) 48 190 078 976 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\ c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\aspiinst.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\CMDS.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\CMDS16.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\E.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\GUEST.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\MSCDEX.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\Net.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\OHCI.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\PROTMAN.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\UHCI.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom CBE10-100BTX\Cbendis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Ethernet 10-100 + Modem\Cbendis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Ethernet II PS\Xpsndis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom PE3-10Bx\Pe3ndis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Re-100Btx + Ce3B-100Btx\Ce3ndis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom RE10BT\Ce3ndis.exe c:\Documents and Settings\Bernard\.housecall\getMac.exe c:\Documents and Settings\Bernard\.housecall\patch.exe c:\Documents and Settings\Bernard\.housecall sc.exe c:\Documents and Settings\Bernard\.housecall6.6\getMac.exe c:\Documents and Settings\Bernard\.housecall6.6\patch.exe c:\Documents and Settings\Bernard\.housecall6.6 sc.exe c:\Documents and Settings\Bernard\Application Data\Microsoft\Installer\{D085A1B6-90A4-11D3-82B7-00C04FA309DE}\MnyIco.exe c:\Documents and Settings\Bernard\Bureau\avg75free_503a1205.exe c:\Documents and Settings\Bernard\Bureau\EliBaglA.exe c:\Documents and Settings\Bernard\Bureau\FxBeagle.exe c:\Documents and Settings\Bernard\Bureau\gmer.exe c:\Documents and Settings\Bernard\Bureau\clean\clean\gzip.exe c:\Documents and Settings\Bernard\Bureau\clean\clean\LFiles.exe c:\Documents and Settings\Bernard\Bureau\clean\clean\pskill.exe c:\Documents and Settings\Bernard\Bureau\clean\clean ar.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\catchme.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\diff.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\dumphive.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\FilesInfoCmd.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\find2.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\Fport.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\grep.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\gzip.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\KProcCheck.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\LFiles.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\LISTDLLS.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\md5sums.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\pslist.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\sigcheck.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\streams.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\swreg.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp ar.exe c:\Documents and Settings\Bernard\Bureau\LECTEUR MP3\audiodream_3410_2420.exe c:\Documents and Settings\Bernard\Bureau\LECTEUR MP3\mp3_recovery_drv.exe c:\Documents and Settings\Bernard\Bureau\OM a tester\Commander471Archive.exe c:\Documents and Settings\Bernard\Bureau\OM a tester\TRX MANAGER trmde376.exe c:\Documents and Settings\Bernard\Bureau\Référenceur\submitic.exe c:\Documents and Settings\Bernard\Bureau\SAT\04-2005\Firmware_Flash308+.exe c:\Documents and Settings\Bernard\Bureau\SAT\flash XSAT\exe\Firmware_Flash308+.exe c:\Documents and Settings\Bernard\Bureau\SONY P900\UpdateService_Inst_2.6.4.9.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\catchme.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\diff.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\dumphive.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\FilesInfoCmd.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\find2.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\Fport.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\grep.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\gzip.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\KProcCheck.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\LFiles.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\LISTDLLS.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\md5sums.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\pslist.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\sigcheck.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\streams.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\swreg.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp ar.exe c:\WinDev 11\Composants\Composants exemples\WD DerniersDocuments\WD DerniersDocuments - Exemple\Exe\WD DerniersDocuments - Exemple.exe c:\Documents and Settings\All Users\Application Data\Adobe\AWSCommonUI.dll c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll c:\Documents and Settings\Bernard\Application Data\Adobe\AWSCommonUI.dll c:\Documents and Settings\Bernard\Application Data\Macromedia\Dreamweaver MX\Configuration\Flash Player\FlashPlayerW.dll c:\Documents and Settings\Bernard\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll c:\Documents and Settings\Bernard\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll c:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll c:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll ****** Fin du rapport DiagHelp Veuillez svp envoyer le fichier C:\upload_moi_BV.tar.gz a l'adresse http://upload.malekal.com __________________________________________________________________________________________________________ [CODE] 2007-12-22,15:46:16 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Home Edition Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed Follow item(s) have been choosed: All Boot Items (Including Registry, Startup Folders, Services and so on) Browser Add-ons Runing Processes (Including process model information) File Associations Winsock Provider Autorun.Inf HOSTS File Process Privileges Scan Boot Items Registry [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <"C:\Program Files\Spamihilator\spamihilator.exe"> [Michel Krämer] <\Program\BackWeb-8876480.exe> [N/A] [(Verified)Microsoft Windows Publisher] [Gildas LE BOURNAULT] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] [ATI Technologies, Inc.] <"C:\Program Files\Microsoft IntelliType Pro ype32.exe"> [Microsoft Corporation] [(Verified)Microsoft Windows Hardware Compatibility Publisher] [] [Logitech Inc.] [Logitech Inc.] [Logitech Inc.] <"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"> [(Verified)"Sun Microsystems, Inc."] [(Verified)ALWIL Software] [Symantec Corporation] [Ahead Software Gmbh] [(Verified)Microsoft Windows Publisher] <"C:\Program Files\WebcamMax\CAMTHINS.exe" /m> [] [Corel Corporation] <%SystemRoot%\System32\drivers\PhiBtn.exe> [Philips] <%SystemRoot%\System32\drivers\Tray900.exe> [Philips] [N/A] <"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized> [(Verified)GRISOFT LTD] [N/A] <%systemroot%\system32\dumprep 0 -k> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Component Publisher] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{5ECD31F0-F91A-11d4-B3CA-00D0B70A09D2}> [N/A] <{57B86673-276A-48B2-BAE7-C6DBB3020EB8}> [(Verified)GRISOFT LTD] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [Microsoft Corporation] ================================== Startup Folders [Acrobat Assistant] C:\PROGRA~1\Adobe\ACROBA~1.0\Distillr\AcroTray.exe [Adobe Systems Inc.]> [Adobe Gamma Loader] C:\PROGRA~1\FICHIE~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]> [Logitech Desktop Messenger] C:\PROGRA~1\Logitech\DESKTO~1\8876480\Program\LDMConf.exe [Logitech]> [Microsoft Office] C:\PROGRA~1\MICROS~3\Office\OSA9.EXE [Microsoft Corporation]> [Monitor Apache Servers] C:\PROGRA~1\APACHE~1\Apache2\bin\APACHE~1.EXE [Apache Software Foundation]> [Phone Connection Monitor] C:\PROGRA~1\SONYER~1\Mobile\AUDEVI~1.EXE [Teleca Software Solutions AB]> [PowerCheck] C:\PROGRA~1\POWERC~1\POWERC~1.EXE [N/A]> [MSN Pictures Displayer] C:\PROGRA~1\MSNPIC~1\MSNPIC~1.EXE []> [OpenOffice.org 2.2] C:\PROGRA~1\OPENOF~1.2\program\QUICKS~1.EXE [N/A]> ================================== Services [Apache2 / Apache2][Stopped/Auto Start] <"C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice> [Service d'état ASP.NET / aspnet_state][Stopped/Manual Start] [avast! iAVS4 Control Service / aswUpdSv][Running/Auto Start] <"C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"> [avast! Antivirus / avast! Antivirus][Running/Auto Start] <"C:\Program Files\Alwil Software\Avast4\ashServ.exe"> [avast! Mail Scanner / avast! Mail Scanner][Running/Manual Start] <"C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service> [avast! Web Scanner / avast! Web Scanner][Running/Manual Start] <"C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service> [AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start] [GhostStartService / GhostStartService][Running/Auto Start] [Keyboard And Mouse Communication Service / KMWDSERVICE][Running/Auto Start] [UStorage Server Service / UStorage Server Service][Running/Auto Start] ================================== Drivers [Aladdin HASP Key / akshasp][Stopped/Manual Start] [Aladdin USB Key / aksusb][Stopped/Manual Start] [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] [PS/2 Port Mouse Filter Driver / Amps2prt][Stopped/Manual Start] <(Standard Mouse Types)> [ati2mtag / ati2mtag][Running/Manual Start] [AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start] <\??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys> [AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start] [InCD Storage Helper Driver / BsStor][Running/Boot Start] <\SystemRoot\System3

Moi même · Answer

Merci encore, voila le résultat __________________________________________________________________________________________________________ DiagHelp version v1.4 - http://www.malekal.com excute le 22/12/2007 à 15:21:02,20 Liste des derniers fichies modifies/crees dans windir\system32 et prefetch C:\WINDOWS\prefetch\MSIMN.EXE-3356F448.pf -->27/12/2007 15:37:26 C:\WINDOWS\prefetch\IEXPLORE.EXE-06887102.pf -->27/12/2007 15:34:09 C:\WINDOWS\prefetch\VERCLSID.EXE-3B227142.pf -->27/12/2007 15:34:06 C:\WINDOWS\prefetch\ACDSEEQV.EXE-2174EC4D.pf -->27/12/2007 14:58:10 C:\WINDOWS\prefetch\CIDAEMON.EXE-2B2C6F8A.pf -->27/12/2007 14:51:30 C:\WINDOWS\prefetch\USNSVC.EXE-06863237.pf -->27/12/2007 14:48:37 C:\WINDOWS\prefetch\LIVECALL.EXE-124D8E6F.pf -->27/12/2007 14:48:31 C:\WINDOWS\prefetch\YUPDATER.EXE-290842D1.pf -->27/12/2007 14:48:13 C:\WINDOWS\prefetch\MSNMSGR.EXE-1C291C3F.pf -->27/12/2007 14:47:59 C:\WINDOWS\prefetch\WUAUCLT.EXE-12D8E25E.pf -->27/12/2007 14:45:02 C:\WINDOWS\System32\drivers\gmer.sys -->19/12/2007 14:21:48 C:\WINDOWS\System32\drivers\aswmon.sys -->04/12/2007 15:56:02 C:\WINDOWS\System32\drivers\aswmon2.sys -->04/12/2007 15:55:46 C:\WINDOWS\System32\drivers\aswRdr.sys -->04/12/2007 15:53:39 C:\WINDOWS\System32\drivers\aswTdi.sys -->04/12/2007 15:51:52 C:\WINDOWS\System32\drivers\aavmker4.sys -->04/12/2007 15:49:02 C:\WINDOWS\System32\drivers\secdrv.sys -->13/11/2007 11:25:54 C:\WINDOWS\System32\LVCOMSX.LOG -->22/12/2007 15:16:48 C:\WINDOWS\System32\wpa.dbl -->22/12/2007 11:36:51 C:\WINDOWS\System32\Uninstall.ico -->21/12/2007 00:51:29 C:\WINDOWS\System32\pavas.ico -->21/12/2007 00:51:29 C:\WINDOWS\System32\Help.ico -->21/12/2007 00:51:29 C:\WINDOWS\System32\CONFIG.NT -->12/12/2007 09:32:51 C:\WINDOWS\System32\TZLog.log -->12/12/2007 01:30:26 C:\WINDOWS\System32\aswBoot.exe -->04/12/2007 14:04:28 C:\WINDOWS\System32\AVASTSS.scr -->04/12/2007 13:54:04 C:\WINDOWS\System32\MRT.exe -->03/12/2007 00:00:05 C:\WINDOWS\System32 zchange.exe -->13/11/2007 12:31:11 C:\WINDOWS\System32\mshtml.dll -->31/10/2007 00:23:48 C:\WINDOWS\System32\quartz.dll -->29/10/2007 23:43:32 C:\WINDOWS\System32\xpsp3res.dll -->29/10/2007 16:07:16 C:\WINDOWS\System32\jupdate-1.6.0_03-b05.log -->28/10/2007 13:20:46 C:\WINDOWS\System32\perfh00C.dat -->28/10/2007 09:19:00 C:\WINDOWS\System32\perfh009.dat -->28/10/2007 09:19:00 C:\WINDOWS\System32\perfc00C.dat -->28/10/2007 09:19:00 C:\WINDOWS\System32\perfc009.dat -->28/10/2007 09:19:00 C:\WINDOWS\System32\PerfStringBackup.INI -->28/10/2007 09:18:59 C:\WINDOWS\System32\shell32.dll -->25/10/2007 17:43:25 C:\WINDOWS\System32\wmasf.dll -->25/10/2007 09:28:30 C:\WINDOWS\System32\wininet.dll -->11/10/2007 00:49:45 C:\WINDOWS\System32\webcheck.dll -->11/10/2007 00:49:45 C:\WINDOWS\System32\urlmon.dll -->11/10/2007 00:49:45 C:\WINDOWS tbtlog.txt -->22/12/2007 15:15:35 C:\WINDOWS\bootstat.dat -->22/12/2007 14:31:34 C:\WINDOWS\WindowsUpdate.log -->22/12/2007 14:29:32 C:\WINDOWS\SchedLgU.Txt -->22/12/2007 13:42:15 C:\WINDOWS\wiaservc.log -->22/12/2007 13:42:07 C:\WINDOWS\wiadebug.log -->22/12/2007 13:42:06 C:\WINDOWS\setupapi.log -->22/12/2007 12:44:02 C:\WINDOWS\0.log -->22/12/2007 11:36:36 C:\WINDOWS\TempFile -->22/12/2007 11:36:03 C:\WINDOWS\NeroDigital.ini -->21/12/2007 19:33:25 C:\WINDOWS\pavsig.txt -->21/12/2007 00:51:35 C:\WINDOWS\gmer.ini -->19/12/2007 14:24:43 C:\WINDOWS\gmer_uninstall.cmd -->19/12/2007 14:21:48 C:\WINDOWS\gmer.dll -->19/12/2007 14:21:48 C:\WINDOWS\setupact.log -->19/12/2007 10:34:09 winlogon.exe Verified: Signed svchost.exe Verified: Signed ws2_32.dll Verified: Signed user32.dll Verified: Signed tcpip.sys Verified: Signed ndis.sys Verified: Signed null.sys Verified: Signed ListDLLs v2.25 - DLL lister for Win9x/NT Copyright (C) 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ explorer.exe pid: 816 Command line: C:\WINDOWS\Explorer.EXE Base Size Version Path 0x44080000 0xcf000 7.00.6000.16574 C:\WINDOWS\system32\WININET.dll 0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll 0x43e00000 0x45000 7.00.6000.16574 C:\WINDOWS\system32\iertutil.dll 0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll 0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL 0x44360000 0x5cd000 7.00.6000.16574 C:\WINDOWS\system32\ieframe.dll 0x44160000 0x127000 7.00.6000.16574 C:\WINDOWS\system32\urlmon.dll 0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll 0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll 0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll 0x00f80000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll 0x16200000 0x6000 4.01.0000.0000 C:\PROGRA~1\WINZIP~1.1FR\WZSHLSTB.DLL 0x02410000 0x5d000 1.03.0004.0001 C:\Program Files\Sony Ericsson\Mobile\auexpext.dll 0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll 0x02470000 0x2b000 1.03.0004.0001 C:\Program Files\Sony Ericsson\Mobile\FilGuiLg.dll 0x024b0000 0x28000 C:\Program Files\WinRAR arext.dll 0x64000000 0x30000 2005.01.0001.0004 C:\PROGRA~1\Yahoo!\Common\ymmapi.dll 0x10000000 0x2a000 7.05.0001.0036 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll 0x64f00000 0x12000 4.07.1098.0000 C:\Program Files\Alwil Software\Avast4\ashShell.dll 0x02ae0000 0x22000 8.02.0000.1192 C:\Program Files\Logitech\Video\Namespc2.dll 0x7c140000 0x103000 7.10.3077.0000 C:\WINDOWS\system32\MFC71.DLL 0x7c340000 0x56000 7.10.3052.0004 C:\WINDOWS\system32\MSVCR71.dll 0x7c3a0000 0x7b000 7.10.3077.0000 C:\WINDOWS\system32\MSVCP71.dll 0x5d360000 0xf000 7.10.3077.0000 C:\WINDOWS\system32\MFC71FRA.DLL 0x02400000 0x8000 8.02.0000.1192 C:\Program Files\Logitech\Video\AlbuDBps.dll 0x5a500000 0x4e000 8.01.0178.0000 C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll 0x78130000 0x9b000 8.00.50727.0163 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\MSVCR80.dll 0x02b30000 0x27e000 5.02.5721.5145 C:\WINDOWS\system32\wpdshext.dll 0x07160000 0x46000 5.02.5721.5145 C:\WINDOWS\system32\Audiodev.dll 0x15110000 0x25a000 11.00.5721.5145 C:\WINDOWS\system32\WMVCore.DLL 0x11c70000 0x3a000 11.00.5721.5238 C:\WINDOWS\system32\WMASF.DLL 0x02db0000 0x2f000 11.00.0000.0001 C:\WINDOWS\system32\WDShell.dll 0x02df0000 0x13000 7.05.0001.0036 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll 0x61c20000 0x54000 8.00.0000.9118 C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll 0x5fc70000 0x18000 8.00.0000.9107 C:\Program Files\OpenOffice.org 2.2\program\uwinapi.dll 0x61740000 0x8e000 4.05.2003.0120 C:\Program Files\OpenOffice.org 2.2\program\stlport_vc7145.dll 0x60980000 0x7000 3.01.4000.1823 C:\WINDOWS\system32\MSISIP.DLL 0x74e10000 0x10000 5.06.0000.8820 C:\WINDOWS\System32\wshext.dll 0x73d20000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL 0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL 0x59000000 0xe000 5.06.0000.6626 C:\WINDOWS\System32\wshFR.DLL ListDLLs v2.25 - DLL lister for Win9x/NT Copyright (C) 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ winlogon.exe pid: 268 Command line: winlogon.exe Base Size Version Path 0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe 0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll 0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll 0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll 0x00df0000 0x3b000 1.07.0018.0005 C:\WINDOWS\system32\WgaLogon.dll 0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\WINDOWS\system 10/09/1999 12:06 4 672 WOWPOST.EXE 1 fichier(s) 4 672 octets 0 Rép(s) 48 208 277 504 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\WINDOWS\system32 20/08/2004 00:09 6 144 csrss.exe 1 fichier(s) 6 144 octets 0 Rép(s) 48 208 277 504 octets libres Contenu de Downloaded Program Files Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\WINDOWS\Downloaded Program Files 22/12/2007 12:44 . 22/12/2007 12:44 .. 07/03/2007 00:59 300 680 arclib.dll 24/08/2006 07:28 141 424 asinst.dll 22/08/2006 08:06 537 asinst.inf 09/12/2007 00:46 312 680 avsniff.dll 09/12/2007 00:38 773 avsniff.inf 09/12/2007 00:46 255 336 avsniffdlgs.dll 07/12/2004 16:07 32 bdcore.dll 25/05/2006 00:21 118 784 bdupd.dll 21/03/2002 14:26 815 bitdefender.inf 30/01/2003 15:52 348 160 bitdefender.ocx 25/06/2003 18:00 541 ca.pub 09/12/2007 00:38 241 CabSA.inf 14/11/2007 01:00 2 504 catalog.dat 27/03/2002 13:02 168 014 cssweb.dll 24/04/2003 14:11 259 cssweb.inf 17/01/2006 16:11 580 663 daas_s.dll 14/08/2004 13:51 65 desktop.ini 25/07/2002 17:13 24 576 dwusplay.dll 25/07/2002 17:13 196 608 dwusplay.exe 14/11/2007 01:00 6 899 ecbootil.vxd 09/12/2007 00:36 42 112 ecmldr32.dll 14/11/2007 01:00 284 016 ecmsvr32.dll 20/11/2007 16:04 1 523 536 FP_AX_CAB_INSTALLER.exe 03/02/2006 10:20 188 416 fsauc.dll 16/06/2006 14:31 181 856 fscax.dll 13/04/2007 15:52 482 fscax.inf 12/07/2000 01:02 36 864 fxfileop.dll 25/05/2006 00:21 53 248 ipsupd.dll 10/06/2005 09:44 417 792 isusweb.dll 07/01/2007 12:55 2 305 kavwebscan.inf 16/03/2005 11:34 7 407 lang.ini 11/12/2006 16:44 367 LegitCheckControl.inf 07/12/2004 16:07 32 libfn.dll 14/03/2005 13:38 126 live.ini 24/02/2006 11:49 882 mcfscan.inf 18/11/1999 12:48 995 mpeg4ax.inf 18/11/1999 12:49 992 msaudio.inf 09/12/2007 00:36 6 850 navapi.vxd 09/12/2007 00:36 201 896 navapi32.dll 14/11/2007 01:00 124 272 naveng32.dll 14/11/2007 01:00 914 800 navex32a.dll 17/01/2005 16:09 227 opuc.inf 01/06/2006 01:57 1 331 oscan8.inf 01/06/2006 01:54 471 040 oscan8.ocx 31/05/2006 03:15 10 oscan81.ocx_x 09/12/2007 00:46 296 336 rufsi.dll 14/03/2005 13:58 7 073 scanoptions.tsi 14/11/2007 01:00 97 776 scrauth.dat 20/11/2007 15:50 247 swflash.inf 14/11/2007 01:00 11 816 symaveng.cat 14/11/2007 01:00 1 061 symaveng.inf 14/11/2007 01:00 400 415 tcdefs.dat 14/11/2007 01:00 2 344 295 tcscan7.dat 14/11/2007 01:00 413 082 tcscan8.dat 14/11/2007 01:00 968 800 tcscan9.dat 14/11/2007 01:00 453 tinf.dat 14/11/2007 01:00 148 tinfidx.dat 14/11/2007 01:00 1 957 tinfl.dat 14/11/2007 01:00 67 815 tscan1.dat 14/11/2007 01:00 3 240 tscan1hd.dat 31/10/2001 09:37 118 uninst.bat 14/11/2007 01:00 4 778 v.grd 14/11/2007 01:00 2 267 v.sig 21/12/2007 19:08 294 403 vet.da1 19/11/2007 01:18 13 076 520 vet.dat 13/07/2007 05:11 1 353 016 vete.dll 14/11/2007 01:00 106 244 virscan.inf 14/11/2007 01:00 996 122 virscan1.dat 14/11/2007 01:00 570 966 virscan2.dat 14/11/2007 01:00 150 536 virscan3.dat 14/11/2007 01:00 320 253 virscan4.dat 14/11/2007 01:00 4 871 963 virscan5.dat 14/11/2007 01:00 392 074 virscan6.dat 14/11/2007 01:00 14 386 178 virscan7.dat 14/11/2007 01:00 1 862 947 virscan8.dat 14/11/2007 01:00 5 260 290 virscan9.dat 14/11/2007 01:00 32 virscant.dat 18/12/2007 13:34 2 072 vscanmsx.dat 20/11/2006 12:02 180 282 webscan.dll 21/07/2006 12:55 477 webscan.inf 02/11/2005 17:01 1 777 xscan.inf 02/11/2005 17:07 435 712 xscan53.ocx 14/11/2007 01:00 224 zdone.dat 83 fichier(s) 55 805 210 octets Total des fichiers listés : 83 fichier(s) 55 805 210 octets 2 Rép(s) 48 208 273 408 octets libres Recherche de rootkit! (Merci S!Ri) Recherche d'infections connues Export des clefs sensibles.. Liste des fichiers en exception sur le pare-feu XP SP2 "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Age of Empires 2\age2_x1.exe"="C:\Program Files\Age of Empires 2\age2_x1.exe:*:Enabled:Age of Empires II Expansion" "C:\Program Files\EasyPHP1-7\apache\apache.exe"="C:\Program Files\EasyPHP1-7\apache\apache.exe:*:Enabled:apache" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Exécuter une DLL en tant qu'application" "C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting®" "C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer" "C:\Program Files\Empire Earth\Empire Earth.exe"="C:\Program Files\Empire Earth\Empire Earth.exe:*:Enabled:Empire Earth" "C:\WINDOWS\system32\rtcshare.exe"="C:\WINDOWS\system32\rtcshare.exe:*:Enabled:Partage de l'application RTC" "C:\Program Files\GlobalSCAPE\CuteFTP Pro\TE\ftpte.exe"="C:\Program Files\GlobalSCAPE\CuteFTP Pro\TE\ftpte.exe:*:Enabled:FTP Transfer Engine" "C:\Program Files\MixW\Teoan.exe"="C:\Program Files\MixW\Teoan.exe:*:Enabled:TEOAN" "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe"="C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe:*:Enabled:mRouterRuntime" "C:\Program Files\EchoLink\EchoLink.exe"="C:\Program Files\EchoLink\EchoLink.exe:*:Enabled:EchoLink" "C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\Program Files\Kazaa Lite K++\KazaaLite.kpp"="C:\Program Files\Kazaa Lite K++\KazaaLite.kpp:*:Enabled:KazaaLite" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Freeplayer\vlc\vlc.exe"="C:\Program Files\Freeplayer\vlc\vlc.exe:*:Enabled:VLC media player" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\WINDOWS\system32\svchost.exe"="C:\WINDOWS\system32\svchost.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\11exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\11exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\38exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\38exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\43exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\43exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\74exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\74exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\51exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\51exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\0exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\0exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\80exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\80exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\75exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\75exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\63exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\63exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\8exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\8exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\48exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\48exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\2exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\2exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\36exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\36exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\66exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\66exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\50exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\50exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\73exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\73exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\54exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\54exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\29exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\29exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\6exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\6exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\61exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\61exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\41exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\41exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\45exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\45exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\64exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\64exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\37exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\37exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\19exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\19exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\69exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\69exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\12exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\12exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\84exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\84exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\15exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\15exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\5exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\5exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\21exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\21exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\99exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\99exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\65exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\65exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\23exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\23exinjs.a5.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\26exinjs.a6.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\26exinjs.a6.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\98exinjs.a6.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\98exinjs.a6.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\17exinjs.a6.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\17exinjs.a6.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\Bernard\LOCALS~1\Temp\10exinjs.a6.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\10exinjs.a6.exe:*:Enabled:Microsoft Update" "C:\Program Files\Microsoft Office\Office\EXCEL.EXE"="C:\Program Files\Microsoft Office\Office\EXCEL.EXE:*:Enabled:Microsoft Excel for Windows" "C:\Program Files\FileZilla\FileZilla.exe"="C:\Program Files\FileZilla\FileZilla.exe:*:Enabled:FileZilla" "C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe:*:Enabled:Assistance à distance - Windows Messenger et voix" "C:\Program Files\Apache Group\Apache2\bin\Apache.exe"="C:\Program Files\Apache Group\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server" "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Export de la clef SharedTaskScheduler [SharedTaskScheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant" exports des policies REGEDIT4 [system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 Export des clefs sensibles.. Rechercher adresses sensibles dans le fichier HOSTS... catchme 0.3.1319 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-22 15:21:40 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2C4D257C-72E2-E577-A752-291333787D00}] "hagepphnhnalohlb"=hex:61,61,00,00 "hagepphnnnglgocp"=hex:61,61,00,00 "iakfpidebimpimgooj"=hex:6b,61,68,69,67,68,6d,70,69,62,66,67,61,65,6c,66,67,70,61,6f,6f,.. "haegjngplkgkgjhj"=hex:6b,61,68,69,67,68,6d,70,69,62,66,67,61,65,6c,66,67,70,61,6f,6f,.. scanning hidden files ... scan completed successfully hidden services: 0 hidden files: 0 KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Error loading kernel support driver! Make sure you are running this as Administrator. KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Error loading kernel support driver! Make sure you are running this as Administrator. Liste des programmes installes 3D Home Architect Home Design Deluxe 6 3D Home Architect Home Design Deluxe 6 ACDSee 9 Gestionnaire de photos Ad-Aware SE Personal Adobe Acrobat 5.0 Adobe Flash Player 9 ActiveX Adobe Flash Player ActiveX Adobe Photoshop 7.0 Ahead InCD Apache HTTP Server 2.0.55 Archiveur WinRAR ARTEC ATI Control Panel ATI Display Driver avast! Antivirus AVG Anti-Spyware 7.5 Barre d'outils MSN Camfrog Video Chat 3.91 (remove only) CamStudio 2.0 Fr Canon i560 CCleaner (remove only) Command On Demand for Command Software Compel Adaptec WinASPI ConTEXT Copernic Agent Professional Corel Paint Shop Pro X CorelDRAW Graphics Suite 12 Correctif pour Lecteur Windows Media 11 (KB939683) Cucusoft MPEG/MOV/RM/DivX/AVI to DVD/VCD/SVCD Creator Pro 7.07 CuteFTP Pro EasyCleaner EchoLink eMule Etats Et Requêtes EVEREST Home Edition v2.01 Extension HighMAT pour l'Assistant Graver un CD de Microsoft Windows XP Fake Webcam 2.9.16 FileSpecs plug-in for Ad-Aware SE FileZilla (remove only) Freeplayer Frontline Attack - War over Europe Google Earth Google Toolbar for Firefox Google Toolbar for Internet Explorer HelpNDoc Version 1.10 Personal Edition HijackThis 1.99.1 Hotfix for Windows Media Format 11 SDK (KB929399) HydraVision J2SE Runtime Environment 5.0 J2SE Runtime Environment 5.0 Update 10 J2SE Runtime Environment 5.0 Update 11 J2SE Runtime Environment 5.0 Update 2 J2SE Runtime Environment 5.0 Update 4 J2SE Runtime Environment 5.0 Update 6 J2SE Runtime Environment 5.0 Update 9 Java(TM) 6 Update 2 Java(TM) 6 Update 3 Java(TM) SE Runtime Environment 6 Update 1 K-Lite Codec Pack 3.4.0 Full Kaspersky Online Scanner Language Pack for Ad-aware 6 Language pack for Ad-Aware SE Lecteur Windows Media 11 LiveReg (Symantec Corporation) LiveUpdate 1.80 (Symantec Corporation) Logitech Desktop Messenger Logitech MouseWare 9.79.1 Logitech Print Service Logitech QuickCam LST PCSOFT Macromedia Dreamweaver MX Macromedia Extension Manager Macromedia Fireworks 8 Meracl FontMap v2.1.1 Messenger Plus! Live Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 French Language Pack Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Data Access Components KB870669 Microsoft IntelliType Pro 5.0 Microsoft Internationalized Domain Names Mitigation APIs Microsoft Money 2001 Microsoft National Language Support Downlevel APIs Microsoft Office 2000 SR-1 Professional Microsoft Publisher 98 Microsoft User-Mode Driver Framework Feature Pack 1.0 Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615) Mise à jour de sécurité pour Windows XP (KB918118) Mise à jour de sécurité pour Windows XP (KB921503) Mise à jour de sécurité pour Windows XP (KB924667) Mise à jour de sécurité pour Windows XP (KB925902) Mise à jour de sécurité pour Windows XP (KB926436) Mise à jour de sécurité pour Windows XP (KB927779) Mise à jour de sécurité pour Windows XP (KB927802) Mise à jour de sécurité pour Windows XP (KB928255) Mise à jour de sécurité pour Windows XP (KB928843) Mise à jour de sécurité pour Windows XP (KB929123) Mise à jour de sécurité pour Windows XP (KB930178) Mise à jour de sécurité pour Windows XP (KB931261) Mise à jour de sécurité pour Windows XP (KB931784) Mise à jour de sécurité pour Windows XP (KB932168) Mise à jour de sécurité pour Windows XP (KB933729) Mise à jour de sécurité pour Windows XP (KB935839) Mise à jour de sécurité pour Windows XP (KB935840) Mise à jour de sécurité pour Windows XP (KB936021) Mise à jour de sécurité pour Windows XP (KB938829) Mise à jour de sécurité pour Windows XP (KB941202) Mise à jour de sécurité pour Windows XP (KB941568) Mise à jour de sécurité pour Windows XP (KB941569) Mise à jour de sécurité pour Windows XP (KB943460) Mise à jour de sécurité pour Windows XP (KB944653) Mise à jour pour Windows XP (KB927891) Mise à jour pour Windows XP (KB929338) Mise à jour pour Windows XP (KB930916) Mise à jour pour Windows XP (KB931836) Mise à jour pour Windows XP (KB933360) Mise à jour pour Windows XP (KB938828) Mise à jour pour Windows XP (KB942763) MixW 2.18 (Jan-09-2007) Mozilla Firefox (2.0.0.11) MSN Pictures Displayer 4.5 MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) NeoTrace Express 3.25 Nero 6 Ultra Edition Norton Ghost Novarm DipTrace OpenOffice.org 2.2 Panda ActiveScan PC Camera PC Camera Philips SPC 900NC PC Camera Philips VLounge Picasa 2 PowerCheck 4.2.3 Programme de gestion Camera de Logitech® RamBoost XP 4.0.6 RFSim99 Saisie de Schéma SDS Soldiers - Heroes of World War II Sonic Foundry Sound Forge 6.0 Sony Ericsson PC Suite 3.1.1 Spamihilator Tracé de CI Trust R-Series Mouse Trust R-Series Mouse TyanSystemMonitor V2.13 USB Card Reader \Writer USB Storage Device USB Video Camera Driver v1.10 VideoLAN VLC media player 0.8.5-freehd Visionneuse Journal Windows Microsoft VX2 Cleaner plug-in for Ad-Aware SE WebFldrs XP Windows Genuine Advantage Notifications (KB905474) Windows Internet Explorer 7 Windows Live Messenger Windows Live OneCare safety scanner Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows XP Service Pack 2 Yahoo! Messenger Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\Program Files 19/12/2007 10:30 . 19/12/2007 10:30 .. 10/03/2005 13:37 3D Home Architect 14/08/2005 23:14 AboutTime 01/08/2007 22:03 ACD Systems 14/12/2005 19:13 AdaURL 24/03/2005 11:59 Adobe 21/11/2004 20:11 Age of Empires 2 22/08/2005 12:10 Ahead 02/06/2006 20:58 Alcohol Soft 23/06/2005 13:50 Alwil Software 03/05/2007 12:24 AnalogX 02/07/2007 16:55 Apache Group 14/08/2004 14:16 ATI Technologies 13/04/2007 23:40 Camfrog 23/09/2006 16:46 CamStudio 14/02/2007 17:08 CCleaner 04/09/2007 18:14 CodecSniper 13/08/2005 15:55 Codemasters 22/08/2005 17:20 Common Files 03/06/2007 22:41 ConCon 05/02/2007 22:22 ConTEXT 22/01/2005 18:05 Copernic Agent 18/07/2007 09:36 Corel 02/01/2007 00:15 Cucusoft 16/02/2007 00:50 Cuisinons 30/09/2006 15:27 Dial-Messenger 15/04/2007 00:04 Dictionnaire 31/10/2007 06:45 DipTrace 23/09/2004 20:02 directx 04/08/2007 01:10 DivX 04/10/2005 11:35 Drive Rescue 30/10/2004 11:47 EasyPHP1-7 07/09/2006 21:45 EchoLink 04/02/2006 15:46 Eidos Interactive 31/01/2005 00:38 Empire Earth 16/12/2007 15:42 eMule 19/05/2007 22:04 Fake Webcam 28/11/2007 20:23 Fichiers communs 05/10/2006 22:45 FileZilla 07/01/2007 21:47 Freeplayer 09/10/2004 23:37 GlobalSCAPE 16/12/2007 01:25 Google 10/08/2007 03:18 Grisoft 04/09/2007 18:23 GSpot 18/09/2007 18:56 HelpNDoc 23/04/2005 19:21 HighMAT CD Writing Wizard 17/12/2007 21:42 hijackthis 18/12/2005 16:48 ICprog 16/12/2007 01:26 Internet Explorer 01/09/2006 19:34 Intuwave Ltd 28/10/2007 13:20 Java 15/07/2007 14:10 Kazaa Lite K++ 04/09/2007 18:15 K-Lite Codec Pack 27/06/2005 23:06 Lavalys 21/08/2004 10:18 Lavasoft 03/09/2005 23:46 Logitech 09/07/2007 20:26 Macromedia 30/07/2006 14:08 ManyCam 14/08/2004 15:14 Meracl FontMap 07/06/2007 17:03 Messenger 19/12/2007 18:29 Messenger Plus! Live 21/08/2004 18:03 Micro Application 14/08/2004 16:26 microsoft frontpage 16/12/2007 01:39 Microsoft IntelliType Pro 05/08/2005 18:17 Microsoft Money 14/08/2004 17:53 Microsoft Office 26/03/2007 21:58 MixW 09/02/2005 15:54 Movie Maker 27/11/2005 13:58 Movies 16/12/2007 18:10 Mozilla Firefox 14/08/2004 13:49 MSN 15/05/2005 12:58 MSN Apps 14/08/2004 13:49 MSN Gaming Zone 19/12/2007 18:29 MSN Messenger 03/06/2007 22:37 MSN Pictures Displayer 16/11/2006 18:13 MSXML 4.0 24/03/2007 17:19 MyUninstall 02/01/2007 00:06 NeoDivx Suite 08/09/2007 16:29 NeoTrace Express 26/05/2007 21:04 NetMeeting 23/04/2005 19:28 OfficeUpdate11 02/10/2005 16:45 Ontrack 19/05/2007 14:26 OpenOffice.org 2.2 24/12/2005 19:35 Opera 13/06/2007 16:26 Outlook Express 06/08/2006 09:11 Paltalk Messenger 07/11/2007 20:35 PC Camera 15/07/2007 16:03 PC SOFT 14/11/2007 17:14 Philips 24/12/2005 16:55 Picasa2 19/08/2004 19:11 PopUp Destroy 16/12/2007 01:48 PowerCheck 22/12/2007 11:36 RamBoost XP 14/09/2006 20:55 RegSeeker 25/04/2005 14:36 RFSim99 27/01/2005 18:59 Saisie de Schéma 14/08/2004 13:51 Services en ligne 22/08/2004 12:39 Sonic Foundry 22/08/2004 12:39 Sonic Foundry Setup 01/09/2006 19:35 Sony Ericsson 22/08/2004 12:39 Sound Forge 6.0 22/12/2007 13:04 Spamihilator 16/08/2007 19:39 Spybot - Search & Destroy 10/08/2007 03:03 STOPzilla! 24/02/2007 21:14 StuffPlug3 05/08/2005 17:58 Symantec 08/07/2006 14:13 The Weather Channel FW 05/02/2005 23:26 ToniArts 27/01/2005 19:06 Tracé de CI 13/12/2007 12:08 Trust 20/08/2005 16:35 Tyan Computer Corp 14/08/2004 14:05 VIA Technologies, Inc 14/12/2007 13:25 VideoLAN 16/05/2005 17:57 vso 16/12/2007 01:50 WebcamMax 02/01/2007 00:01 WinASPI 23/09/2006 17:18 Windows AntiSpy 23/04/2005 19:21 Windows Journal Viewer 10/06/2007 10:14 Windows Live 19/12/2007 22:18 Windows Live Safety Center 03/11/2006 08:49 Windows Media Connect 2 03/11/2006 08:49 Windows Media Player 09/02/2005 15:49 Windows NT 23/04/2005 18:29 WinRAR 27/04/2005 08:26 WINRLC 10/03/2005 00:07 WinZip 8.1 Fr 14/08/2004 13:52 xerox 14/04/2007 10:53 Yahoo! 0 fichier(s) 0 octets 129 Rép(s) 48 190 070 784 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\Program Files\fichiers communs 28/11/2007 20:23 . 28/11/2007 20:23 .. 01/08/2007 22:07 ACD Systems 24/03/2005 11:59 Adobe 22/08/2005 12:09 Ahead 14/11/2007 17:26 ArcSoft 14/08/2004 15:33 Copernic 18/07/2007 09:37 Corel 18/07/2007 09:20 Designer 23/09/2004 20:02 FotoWire 15/07/2007 13:52 InstallShield 10/08/2007 02:38 iS3 28/12/2004 09:59 Java 03/09/2005 23:46 Logitech 09/07/2007 20:26 Macromedia 18/07/2007 09:37 Microsoft Shared 14/08/2004 13:50 MSSoap 14/08/2004 14:43 ODBC 01/10/2006 16:02 Panda Software 17/07/2007 00:01 PC SOFT 14/08/2004 13:50 Services 14/08/2004 14:43 SpeechEngines 05/08/2005 17:57 Symantec Shared 24/11/2007 10:14 System 20/08/2004 11:31 Vbox 0 fichier(s) 0 octets 25 Rép(s) 48 190 078 976 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders 19/05/2007 16:28 . 19/05/2007 16:28 .. 28/02/2002 23:03 561 209 MSONSEXT.DLL 03/06/1999 13:09 122 937 MSOWS409.DLL 07/03/2001 08:00 127 033 MSOWS40c.DLL 18/03/1999 05:37 593 977 RAGENT.DLL 4 fichier(s) 1 405 156 octets 2 Rép(s) 48 190 078 976 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\Program Files\common files 22/08/2005 17:20 . 22/08/2005 17:20 .. 22/08/2005 17:20 PCCamera 14/08/2004 15:49 System 0 fichier(s) 0 octets 4 Rép(s) 48 190 078 976 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\ c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\aspiinst.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\CMDS.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\CMDS16.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\E.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\GUEST.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\MSCDEX.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\Net.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\OHCI.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\PROTMAN.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\UHCI.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom CBE10-100BTX\Cbendis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Ethernet 10-100 + Modem\Cbendis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Ethernet II PS\Xpsndis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom PE3-10Bx\Pe3ndis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Re-100Btx + Ce3B-100Btx\Ce3ndis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom RE10BT\Ce3ndis.exe c:\Documents and Settings\Bernard\.housecall\getMac.exe c:\Documents and Settings\Bernard\.housecall\patch.exe c:\Documents and Settings\Bernard\.housecall sc.exe c:\Documents and Settings\Bernard\.housecall6.6\getMac.exe c:\Documents and Settings\Bernard\.housecall6.6\patch.exe c:\Documents and Settings\Bernard\.housecall6.6 sc.exe c:\Documents and Settings\Bernard\Application Data\Microsoft\Installer\{D085A1B6-90A4-11D3-82B7-00C04FA309DE}\MnyIco.exe c:\Documents and Settings\Bernard\Bureau\avg75free_503a1205.exe c:\Documents and Settings\Bernard\Bureau\EliBaglA.exe c:\Documents and Settings\Bernard\Bureau\FxBeagle.exe c:\Documents and Settings\Bernard\Bureau\gmer.exe c:\Documents and Settings\Bernard\Bureau\clean\clean\gzip.exe c:\Documents and Settings\Bernard\Bureau\clean\clean\LFiles.exe c:\Documents and Settings\Bernard\Bureau\clean\clean\pskill.exe c:\Documents and Settings\Bernard\Bureau\clean\clean ar.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\catchme.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\diff.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\dumphive.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\FilesInfoCmd.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\find2.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\Fport.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\grep.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\gzip.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\KProcCheck.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\LFiles.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\LISTDLLS.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\md5sums.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\pslist.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\sigcheck.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\streams.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\swreg.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp ar.exe c:\Documents and Settings\Bernard\Bureau\LECTEUR MP3\audiodream_3410_2420.exe c:\Documents and Settings\Bernard\Bureau\LECTEUR MP3\mp3_recovery_drv.exe c:\Documents and Settings\Bernard\Bureau\OM a tester\Commander471Archive.exe c:\Documents and Settings\Bernard\Bureau\OM a tester\TRX MANAGER trmde376.exe c:\Documents and Settings\Bernard\Bureau\Référenceur\submitic.exe c:\Documents and Settings\Bernard\Bureau\SAT\04-2005\Firmware_Flash308+.exe c:\Documents and Settings\Bernard\Bureau\SAT\flash XSAT\exe\Firmware_Flash308+.exe c:\Documents and Settings\Bernard\Bureau\SONY P900\UpdateService_Inst_2.6.4.9.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\catchme.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\diff.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\dumphive.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\FilesInfoCmd.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\find2.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\Fport.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\grep.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\gzip.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\KProcCheck.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\LFiles.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\LISTDLLS.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\md5sums.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\pslist.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\sigcheck.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\streams.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp\swreg.exe c:\Documents and Settings\Bernard\Bureau\zip\DiagHelp ar.exe c:\WinDev 11\Composants\Composants exemples\WD DerniersDocuments\WD DerniersDocuments - Exemple\Exe\WD DerniersDocuments - Exemple.exe c:\Documents and Settings\All Users\Application Data\Adobe\AWSCommonUI.dll c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll c:\Documents and Settings\Bernard\Application Data\Adobe\AWSCommonUI.dll c:\Documents and Settings\Bernard\Application Data\Macromedia\Dreamweaver MX\Configuration\Flash Player\FlashPlayerW.dll c:\Documents and Settings\Bernard\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll c:\Documents and Settings\Bernard\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll c:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll c:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll ****** Fin du rapport DiagHelp Veuillez svp envoyer le fichier C:\upload_moi_BV.tar.gz a l'adresse http://upload.malekal.com __________________________________________________________________________________________________________ [CODE] 2007-12-22,15:46:16 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Home Edition Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed Follow item(s) have been choosed: All Boot Items (Including Registry, Startup Folders, Services and so on) Browser Add-ons Runing Processes (Including process model information) File Associations Winsock Provider Autorun.Inf HOSTS File Process Privileges Scan Boot Items Registry [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <"C:\Program Files\Spamihilator\spamihilator.exe"> [Michel Krämer] <\Program\BackWeb-8876480.exe> [N/A] [(Verified)Microsoft Windows Publisher] [Gildas LE BOURNAULT] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] [ATI Technologies, Inc.] <"C:\Program Files\Microsoft IntelliType Pro ype32.exe"> [Microsoft Corporation] [(Verified)Microsoft Windows Hardware Compatibility Publisher] [] [Logitech Inc.] [Logitech Inc.] [Logitech Inc.] <"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"> [(Verified)"Sun Microsystems, Inc."] [(Verified)ALWIL Software] [Symantec Corporation] [Ahead Software Gmbh] [(Verified)Microsoft Windows Publisher] <"C:\Program Files\WebcamMax\CAMTHINS.exe" /m> [] [Corel Corporation] <%SystemRoot%\System32\drivers\PhiBtn.exe> [Philips] <%SystemRoot%\System32\drivers\Tray900.exe> [Philips] [N/A] <"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized> [(Verified)GRISOFT LTD] [N/A] <%systemroot%\system32\dumprep 0 -k> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Component Publisher] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{5ECD31F0-F91A-11d4-B3CA-00D0B70A09D2}> [N/A] <{57B86673-276A-48B2-BAE7-C6DBB3020EB8}> [(Verified)GRISOFT LTD] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [Microsoft Corporation] ================================== Startup Folders [Acrobat Assistant] C:\PROGRA~1\Adobe\ACROBA~1.0\Distillr\AcroTray.exe [Adobe Systems Inc.]> [Adobe Gamma Loader] C:\PROGRA~1\FICHIE~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]> [Logitech Desktop Messenger] C:\PROGRA~1\Logitech\DESKTO~1\8876480\Program\LDMConf.exe [Logitech]> [Microsoft Office] C:\PROGRA~1\MICROS~3\Office\OSA9.EXE [Microsoft Corporation]> [Monitor Apache Servers] C:\PROGRA~1\APACHE~1\Apache2\bin\APACHE~1.EXE [Apache Software Foundation]> [Phone Connection Monitor] C:\PROGRA~1\SONYER~1\Mobile\AUDEVI~1.EXE [Teleca Software Solutions AB]> [PowerCheck] C:\PROGRA~1\POWERC~1\POWERC~1.EXE [N/A]> [MSN Pictures Displayer] C:\PROGRA~1\MSNPIC~1\MSNPIC~1.EXE []> [OpenOffice.org 2.2] C:\PROGRA~1\OPENOF~1.2\program\QUICKS~1.EXE [N/A]> ================================== Services [Apache2 / Apache2][Stopped/Auto Start] <"C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice> [Service d'état ASP.NET / aspnet_state][Stopped/Manual Start] [avast! iAVS4 Control Service / aswUpdSv][Running/Auto Start] <"C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"> [avast! Antivirus / avast! Antivirus][Running/Auto Start] <"C:\Program Files\Alwil Software\Avast4\ashServ.exe"> [avast! Mail Scanner / avast! Mail Scanner][Running/Manual Start] <"C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service> [avast! Web Scanner / avast! Web Scanner][Running/Manual Start] <"C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service> [AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start] [GhostStartService / GhostStartService][Running/Auto Start] [Keyboard And Mouse Communication Service / KMWDSERVICE][Running/Auto Start] [UStorage Server Service / UStorage Server Service][Running/Auto Start] ================================== Drivers [Aladdin HASP Key / akshasp][Stopped/Manual Start] [Aladdin USB Key / aksusb][Stopped/Manual Start] [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] [PS/2 Port Mouse Filter Driver / Amps2prt][Stopped/Manual Start] <(Standard Mouse Types)> [ati2mtag / ati2mtag][Running/Manual Start] [AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start] <\??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys> [AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start] [InCD Storage Helper Driver / BsStor][Running/Boot Start] <\SystemRoot\System3

FillPCA · Answer

Re,

Le rapport SREng est incomplet.

Moi même · Answer

Bonsoir Désolé de ne pas avoir donné suite à ton dernier poste mais je me suis absenté quelques jours et dés mon retour j'ai repris le problème dont la situation est évidemment inchangée, le PC reboote toujours. Ci-dessous les éléments demandés mais certaines procédures ne semblent pas s'exécuter (fichiers introuvables et messages similaires) Merci de ton aide qui m'est trés précieuse ________________________________________________________________________________________ [CODE] 2007-12-27,15:13:35 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Home Edition Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed Follow item(s) have been choosed: All Boot Items (Including Registry, Startup Folders, Services and so on) Browser Add-ons Runing Processes (Including process model information) File Associations Winsock Provider Autorun.Inf HOSTS File Process Privileges Scan Boot Items Registry [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <"C:\Program Files\Spamihilator\spamihilator.exe"> [Michel Krämer] <\Program\BackWeb-8876480.exe> [N/A] [(Verified)Microsoft Windows Publisher] [Gildas LE BOURNAULT] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] [ATI Technologies, Inc.] <"C:\Program Files\Microsoft IntelliType Pro ype32.exe"> [Microsoft Corporation] [(Verified)Microsoft Windows Hardware Compatibility Publisher] [Logitech Inc.] [Logitech Inc.] [Logitech Inc.] <"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"> [(Verified)"Sun Microsystems, Inc."] [(Verified)ALWIL Software] [Symantec Corporation] [Ahead Software Gmbh] [(Verified)Microsoft Windows Hardware Compatibility Publisher] <"C:\Program Files\WebcamMax\CAMTHINS.exe" /m> [] [Corel Corporation] <%SystemRoot%\System32\drivers\PhiBtn.exe> [Philips] <%SystemRoot%\System32\drivers\Tray900.exe> [Philips] [N/A] <%systemroot%\system32\dumprep 0 -k> [N/A] [GRISOFT, s.r.o.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Component Publisher] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{5ECD31F0-F91A-11d4-B3CA-00D0B70A09D2}> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [Microsoft Corporation] ================================== Startup Folders [Acrobat Assistant] C:\PROGRA~1\Adobe\ACROBA~1.0\Distillr\AcroTray.exe [Adobe Systems Inc.]> [Adobe Gamma Loader] C:\PROGRA~1\FICHIE~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]> [Logitech Desktop Messenger] C:\PROGRA~1\Logitech\DESKTO~1\8876480\Program\LDMConf.exe [Logitech]> [Microsoft Office] C:\PROGRA~1\MICROS~3\Office\OSA9.EXE [Microsoft Corporation]> [Monitor Apache Servers] C:\PROGRA~1\APACHE~1\Apache2\bin\APACHE~1.EXE [Apache Software Foundation]> [Phone Connection Monitor] C:\PROGRA~1\SONYER~1\Mobile\AUDEVI~1.EXE [Teleca Software Solutions AB]> [PowerCheck] C:\PROGRA~1\POWERC~1\POWERC~1.EXE [N/A]> [MSN Pictures Displayer] C:\PROGRA~1\MSNPIC~1\MSNPIC~1.EXE []> [OpenOffice.org 2.2] C:\PROGRA~1\OPENOF~1.2\program\QUICKS~1.EXE [N/A]> ================================== Services [Apache2 / Apache2][Stopped/Auto Start] <"C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice> [Service d'état ASP.NET / aspnet_state][Stopped/Manual Start] [avast! iAVS4 Control Service / aswUpdSv][Running/Auto Start] <"C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"> [avast! Antivirus / avast! Antivirus][Running/Auto Start] <"C:\Program Files\Alwil Software\Avast4\ashServ.exe"> [avast! Mail Scanner / avast! Mail Scanner][Running/Manual Start] <"C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service> [avast! Web Scanner / avast! Web Scanner][Running/Manual Start] <"C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service> [AVG7 Alert Manager Server / Avg7Alrt][Running/Auto Start] [AVG7 Update Service / Avg7UpdSvc][Running/Auto Start] [AVG E-mail Scanner / AVGEMS][Running/Auto Start] [GhostStartService / GhostStartService][Running/Auto Start] [Keyboard And Mouse Communication Service / KMWDSERVICE][Running/Auto Start] [UStorage Server Service / UStorage Server Service][Running/Auto Start] ================================== Drivers [Aladdin HASP Key / akshasp][Stopped/Manual Start] [Aladdin USB Key / aksusb][Stopped/Manual Start] [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] [PS/2 Port Mouse Filter Driver / Amps2prt][Stopped/Manual Start] <(Standard Mouse Types)> [ati2mtag / ati2mtag][Running/Manual Start] [AVG7 Kernel / Avg7Core][Running/System Start] <\SystemRoot\System32\Drivers\avg7core.sys> [AVG7 Wrap Driver / Avg7RsW][Running/System Start] <\SystemRoot\System32\Drivers\avg7rsw.sys> [AVG7 Resident Driver XP / Avg7RsXP][Running/System Start] <\SystemRoot\System32\Drivers\avg7rsxp.sys> [AVG7 Clean Driver / AvgClean][Running/System Start] <\SystemRoot\System32\Drivers\avgclean.sys> [AVG Network Redirector / AvgTdi][Running/Auto Start] <\SystemRoot\System32\Drivers\avgtdi.sys> [InCD Storage Helper Driver / BsStor][Running/Boot Start] <\SystemRoot\System32\DRIVERS\bsstor.sys> [SM0121 USB 2.0 Video Camera / CAM1210][Stopped/Manual Start] [WebcamMax, WDM Video Capture / CamthWDM][Stopped/Auto Start] [Philips SPC 900NC PC Camera / camvid40][Stopped/Manual Start] [Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet / FETNDIS][Running/Manual Start] [GhostPciScanner / GhPciScan][Running/System Start] <\??\C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys> [IC-Prog Driver / giveio][Running/Auto Start] <\??\C:\Program Files\ICprog\icprog.sys> [gmer / gmer][Stopped/Manual Start] [hardlock / hardlock][Running/Auto Start] <\??\C:\WINDOWS\System32\drivers\hardlock.sys> [Haspnt / Haspnt][Running/Auto Start] <\??\C:\WINDOWS\System32\drivers\Haspnt.sys> [hpt3xx / hpt3xx][Running/Boot Start] <\SystemRoot\System32\DRIVERS\hpt3xx.sys> [hptpro / hptpro][Running/Boot Start] <\SystemRoot\System32\DRIVERS\hptpro.sys> [Caméra CS110 Intel(r) PC / ICAM5USB][Stopped/Manual Start] [imagedrv / imagedrv][Running/Boot Start] <\SystemRoot\System32\Drivers\imagedrv.sys> [imagesrv / imagesrv][Running/Boot Start] <\SystemRoot\system32\DRIVERS\imagesrv.sys> [KMWDFilter / KMWDFilter][Running/Manual Start] <\??\C:\WINDOWS\System32\Drivers\KMWDFilter.SYS> [Logitech PS/2 Mouse Filter Driver / L8042pr2][Stopped/Manual Start] [Logitech Mouse Class Filter Driver / LMouFlt2][Stopped/Manual Start] [ManyCam Virtual Webcam, WDM Video Capture Driver / ManyCam][Stopped/Manual Start] [Padus ASPI Shell / pfc][Running/Manual Start] [StarForce Protection Environment Driver v6 / prodrv06][Running/System Start] <\SystemRoot\System32\drivers\prodrv06.sys> [StarForce Protection Helper Driver v2 / prohlp02][Running/Boot Start] <\SystemRoot\System32\drivers\prohlp02.sys> [StarForce Protection Synchronization Driver v1 / prosync1][Running/Boot Start] <\SystemRoot\System32\drivers\prosync1.sys> [Pilote de liaison parallèle directe / Ptilink][Running/Manual Start] [PxHelp20 / PxHelp20][Running/Boot Start] <\SystemRoot\system32\DRIVERS\PxHelp20.sys> [Logitech QuickCam Communicate / QCMerced][Running/Manual Start] <> [Ultima2000 Scanner / SampleScanner][Running/Manual Start] <> [Secdrv / Secdrv][Stopped/Manual Start] [StarForce Protection Helper Driver / sfhlp01][Running/Boot Start] <\SystemRoot\System32\drivers\sfhlp01.sys> [Silicon Image SiI 3112 SATARaid Controller / SI3112r][Running/Boot Start] <\SystemRoot\System32\DRIVERS\SI3112r.sys> [SATALink driver accelerator / SiFilter][Running/Boot Start] <\SystemRoot\System32\DRIVERS\SiWinAcc.sys> [SoC PC-Camera / SoC PC-Camera Service][Stopped/Manual Start] <> [Susteen Serial port driver / SUSCOM][Running/Manual Start] [szkg / szkg][Stopped/Boot Start] <\SystemRoot\system32\DRIVERS\szkg.sys> [tmcomm / tmcomm][Running/Auto Start] <\??\C:\WINDOWS\system32\drivers mcomm.sys> [tyansmb / tyansmb][Running/Auto Start] <\??\C:\WINDOWS\system32\Drivers yansmb.sys> [VIA AGP Filter / viaagp1][Running/Boot Start] <\SystemRoot\System32\DRIVERS\viaagp1.sys> [ViaIde / ViaIde][Running/Boot Start] <\SystemRoot\System32\DRIVERS\viaide.sys> [VIA USB Host Controller Lower Filter / vulfnths][Running/Manual Start] <\SystemRoot\System32\Drivers\vulfnth.sys> [VIA USB Roothub Lower Filter / vulfntrs][Running/Manual Start] <\SystemRoot\System32\Drivers\vulfntr.sys> [Codec Teletext standard / WSTCODEC][Stopped/Manual Start] ================================== Browser Add-ons [AcroIEHlprObj Class] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [SSVHelper Class] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [ST] {9394EDE7-C8B5-483E-8773-474BF36AF6E4} [Google Toolbar Helper] {AA58ED58-01DD-4d91-8333-CF10577473F7} [MSNToolBandBHO] {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [Java Plug-in 1.6.0_03] {08B0E5C0-4FCB-11CF-AAA5-00401C608501} [] {85d1f590-48f4-11d9-9669-0800200c9a66} <%windir%\bdoscandel.exe, N/A> [] {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A> [NeoTrace It!] {9885224C-1217-4c5f-83C2-00002E6CEF2B} <, N/A> [Copernic Agent] {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} [MSN] {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [&Google] {2318C2B1-4965-11d4-9B18-009027A5CD4F} [Camfrog Toolbar] {AF2A1C5A-1AED-4E92-8BA8-D708EB79537E} [CKAVWebScan Object] {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} [Windows Genuine Advantage Validation Tool] {17492023-C23A-453E-A040-C7C580BBF700} [Symantec AntiVirus scanner] {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} [YInstStarter Class] {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} [Office Update Installation Engine] {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} [BDSCANONLINE Control] {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} [Symantec RuFSI Utility Class] {644E432F-49D3-41A1-8DD5-E099162EEEC5} [HouseCall Control] {74D05D43-3236-11D4-BDCD-00C04F9A3B61} [WScanCtl Class] {7B297BFD-85E4-4092-B2AF-16A91B2EA103} [Java Plug-in 1.6.0_03] {8AD9C840-044E-11D1-B3E9-00805F499D93} [ActiveScan Installer Class] {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} [F-Secure Online Scanner 3.0] {9D190AE6-C81E-4039-8061-978EBAD10073} [CSS Web Installer Class] {C81B5180-AFD1-41A3-97E1-99E8D254DB98} [Java Plug-in 1.5.0] {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} [Java Plug-in 1.5.0_02] {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} [Java Plug-in 1.5.0_04] {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} [Java Plug-in 1.5.0_06] {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} [Java Plug-in 1.5.0_09] {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} [Java Plug-in 1.5.0_10] {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} [Java Plug-in 1.5.0_11] {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} [Java Plug-in 1.6.0_01] {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} [Java Plug-in 1.6.0_02] {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} [Java Plug-in 1.6.0_03] {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [Java Plug-in 1.6.0_03] {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [McFreeScan Class] {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} [Google Script Object] {00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} [Yahoo! Toolbar Helper] {02478D38-C3F9-4EFB-9B51-7695ECA05670} <, N/A> [AcroIEHlprObj Class] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [CKAVWebScan Object] {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} [Classe PeerDraw] {10072CEC-8CC1-11D1-986E-00A0C955B42E} <%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll, N/A> [Windows Genuine Advantage Validation Tool] {17492023-C23A-453E-A040-C7C580BBF700} [InformationCardSigninHelper Class] {19916E01-B44E-4E31-94A4-4696DF46157B} [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} [&Google] {2318C2B1-4965-11D4-9B18-009027A5CD4F} [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} [XML DOM Document] {2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\System32\msxml3.dll, N/A> [Symantec AntiVirus scanner] {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} [XML Document] {48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\System32\msxml3.dll, N/A> [Reporte Class] {4A2A4430-3967-4461-94C7-BD95C419F3CF} [] {4F07F79F-087F-42CF-8B36-7A88D06088E9} [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} [InstallShield Update Service Agent] {5B7524C8-2446-40E9-9474-94A779DBA224} [BDSCANONLINE Control] {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} [CKAVReportCtrl Object] {6117669B-8C2D-41FA-A6D9-9E484B999CF0} [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} [Symantec RuFSI Utility Class] {644E432F-49D3-41A1-8DD5-E099162EEEC5} [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} [Seleccion Class] {6CEC0297-FAFB-41FB-97EA-77E3081B1DFE} [MUWebControl Class] {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} [ControlConexion Class] {6FDCDD41-6C97-4A3B-9E6D-0144B66A1CE4} [HouseCall Control] {74D05D43-3236-11D4-BDCD-00C04F9A3B61} [SSVHelper Class] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [WScanCtl Class] {7B297BFD-85E4-4092-B2AF-16A91B2EA103} [Microsoft Web Browser] {8856F961-340A-11D0-A96B-00C04FD705A2} [XML DOM Document 4.0] {88D969C0-F192-11D4-A65F-0040963251E5} [XML HTTP 4.0] {88D969C5-F192-11D4-A65F-0040963251E5} [Java Plug-in 1.6.0_03] {8AD9C840-044E-11D1-B3E9-00805F499D93} [CODDlg Class] {8F0A7264-3CF9-4605-8A79-4A6730AC9BFB} [ST] {9394EDE7-C8B5-483E-8773-474BF36AF6E4} [SOS Class] {94E9170B-7540-4C38-A2A5-3BF7EF1B80EB} [Panda ActiveScan] {96567F65-E04C-4611-AF29-7CDEA6FA6A84} [ActiveScan Installer Class] {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} [F-Secure Online Scanner 3.0] {9D190AE6-C81E-4039-8061-978EBAD10073} [YMailAttach Class] {AA218328-0EA8-4D70-8972-E987A9190FF4} [Google Toolbar Helper] {AA58ED58-01DD-4D91-8333-CF10577473F7} [Camfrog Toolbar] {AF2A1C5A-1AED-4E92-8BA8-D708EB79537E} [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\System32\shdocvw.dll, N/A> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} [MSN] {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [MSNToolBandBHO] {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [CSS Web Installer Class] {C81B5180-AFD1-41A3-97E1-99E8D254DB98} [Adobe Acrobat Control for ActiveX] {CA8A9780-280D-11CF-A24D-444553540000} [ApplicationHelper Object] {CBBD301C-32AA-4D15-A9BA-3611386AB945} [AUDIO__MID Moniker Class] {CD3AFA74-B84F-48F0-9393-7EDC34128127} [AUDIO__MP3 Moniker Class] {CD3AFA76-B84F-48F0-9393-7EDC34128127} [AUDIO__WAV Moniker Class] {CD3AFA7B-B84F-48F0-9393-7EDC34128127} [VIDEO__MPEG Moniker Class] {CD3AFA89-B84F-48F0-9393-7EDC34128127} [VIDEO__X_MS_ASF Moniker Class] {CD3AFA8F-B84F-48F0-9393-7EDC34128127} [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} [Msxml] {CFC399AF-D876-11D0-9C10-00C04FC99C8E} <%SystemRoot%\System32\msxml3.dll, N/A> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [OfficeObj Class] {D2BD7935-05FC-11D2-9059-00C04FD7A1BD} <, N/A> [Microsoft Agent Control 2.0] {D45FD31B-5C6E-11D1-9EC1-00C04FD7081F} [MessengerChecker Class] {DA4F543C-C8A9-4E88-9A79-548CBB46F18F} [] {E1771B7F-98BE-407F-BA67-AA16ADA5D0C5} [SVG Document] {EBF9B040-94C9-11D4-9064-00C04F78ACF9} [XML HTTP Request] {ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\System32\msxml3.dll, N/A> [McFreeScan Class] {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} [Yahoo! Toolbar] {EF99BD32-C1FB-11D2-892F-0090271D4F88} <, N/A> [Copernic Agent] {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} [XML DOM Document 3.0] {F5078F32-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\System32\msxml3.dll, N/A> [XML HTTP] {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\System32\msxml3.dll, N/A> [&NeoTrace It!] [&Traduire à partir de l'anglais] [Chercher avec Copernic Agent] [Pages liées] [Pages similaires] [Recherche &Google] [Version de la page actuelle disponible dans le cache Google] ================================== Running Processes [PID: 596 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 660 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 684 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WgaLogon.dll] [Microsoft Corporation, 1.7.0018.5] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 728 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)] [PID: 740 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 892 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 972 / SERVICE RÉSEAU][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1064 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [PID: 1104 / SERVICE RÉSEAU][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1168 / SERVICE LOCAL][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [PID: 1248 / SYSTEM][C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\aswCmnS.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\aswCmnOS.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Alwil Software\Avast4\aswCmnB.dll] [ALWIL Software, 4, 7, 1098, 0] [PID: 1408 / SYSTEM][C:\Program Files\Alwil Software\Avast4\ashServ.exe] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\aswAux.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Alwil Software\Avast4\aswCmnB.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\aswCmnOS.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\aswEngin.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\aswScan.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\aswCmnS.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\ashBase.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\ashTask.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\aswInteg.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\aswIdle.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\Aavm4h.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\French\Base.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\UNACEV2.DLL] [N/A, ] [C:\Program Files\Alwil Software\Avast4\AhResMai.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\ahResMes.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\AhResNS.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\AhResOut.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\ahResP2P.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\AhResStd.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\AhResWS.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\ashSSqlt.dll] [ALWIL Software, 4, 7, 1098, 0] [PID: 1656 / Bernard][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\WINDOWS\system32\WPDShServiceObj.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\PortableDeviceTypes.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\WDShell.dll] [PC SOFT, 11.00Ac] [C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll] [Sun Microsystems, Inc., 8.0.0.9118] [C:\Program Files\OpenOffice.org 2.2\program\uwinapi.dll] [Sun Microsystems, Inc., 8.0.0.9107] [C:\Program Files\OpenOffice.org 2.2\program\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\OpenOffice.org 2.2\program\stlport_vc7145.dll] [STLport Consulting, Inc., 4.5.2003.0120] [C:\Program Files\OpenOffice.org 2.2\program\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\PROGRA~1\WINZIP~1.1FR\WZSHLSTB.DLL] [WinZip Computing, Inc., 3.0 (32-bit)] [C:\Program Files\WinRAR arext.dll] [N/A, ] [C:\Program Files\Grisoft\AVG7\avgse.dll] [GRISOFT, s.r.o., 7.5.0.409] [C:\Program Files\Alwil Software\Avast4\ashShell.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx] [, 1, 0, 0, 1] [C:\PROGRA~1\Yahoo!\Common\ymmapi.dll] [Yahoo! Inc., 2005, 1, 1, 4] [PID: 1688 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\WINDOWS\system32\CNBJMON2.DLL] [Microsoft Corporation, 5.1.2600.2079 built by: xpsp(skatari)] [C:\WINDOWS\system32\CNMLM58.DLL] [CANON INC., 1.73.2.0] [C:\WINDOWS\System32\pdfports.dll] [Adobe Systems Incorporated., 5.0.000] [C:\Program Files\Adobe\Acrobat 5.0\Distillr\adistres.dll] [N/A, ] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD58.DLL] [CANON INC., 1.73.2.0] [PID: 1940 / Bernard][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe] [ATI Technologies, Inc., 6.13.10.3041] [C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.FRA] [ATI Technologies, Inc., 6.13.10.3041] [C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll] [ATI Technologies, Inc., 6.13.10.3041] [PID: 1948 / Bernard][C:\Program Files\Microsoft IntelliType Pro ype32.exe] [Microsoft Corporation, 5.00.174.0] [C:\Program Files\Microsoft IntelliType Pro ype32.dll] [Microsoft Corporation, 5.00.176.0] [C:\Program Files\Microsoft IntelliType Pro\dpgmkb.dll] [Microsoft Corporation, 5.00.174.0] [C:\Program Files\Microsoft IntelliType Pro\dpgcmd.dll] [Microsoft Corporation, 5.00.175.0] [C:\Program Files\Microsoft IntelliType Pro\srres.dll] [Microsoft Corporation, 5.00.154.0] [PID: 1960 / Bernard][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.0.14] [PID: 1968 / Bernard][C:\WINDOWS\System32\LVCOMSX.EXE] [Logitech Inc., 8.2.0.1192] [C:\WINDOWS\System32\lvmaenum.dll] [Logitech Inc., 8.2.0.1192] [C:\WINDOWS\System32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\System32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\System32\lvcomcx.dll] [Logitech Inc., 8.2.0.1192] [PID: 2004 / Bernard][C:\Program Files\Logitech\Video\LogiTray.exe] [Logitech Inc., 8.2.0.1192] [C:\Program Files\Logitech\Video\QCUI2.dll] [Logitech Inc., 8.2.0.1192] [C:\Program Files\Logitech\Video\LTWVC12n.dll] [LEAD Technologies, Inc., 12.1.0.011] [C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Logitech\Video\LTFIL12n.DLL] [LEAD Technologies, Inc., 12.1.0.011] [C:\Program Files\Logitech\Video\LTKRN12n.dll] [LEAD Technologies, Inc., 12.1.0.011] [C:\WINDOWS\system32\MFC71FRA.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Logitech\Video\LQCUI2.dll] [Logitech Inc., 8.2.0.1192] [C:\Program Files\Logitech\Video\LLogTray.dll] [Logitech Inc., 8.2.0.1192] [C:\Program Files\Logitech\Video\LTDIS12N.DLL] [LEAD Technologies, Inc., 12.1.0.011] [C:\Program Files\Logitech\Video\LTIMG12N.DLL] [LEAD Technologies, Inc., 12.1.0.011] [C:\Program Files\Logitech\Video\LTEFX12N.DLL] [LEAD Technologies, Inc., 12.1.0.011] [C:\Program Files\Logitech\Video\LFFAX12N.DLL] [LEAD Technologies, Inc., 12.1.0.011] [C:\Program Files\Logitech\Video\LFCMP12N.DLL] [LEAD Technologies, Inc., 12.1.0.011] [C:\Program Files\Logitech\Video\LFTIF12N.DLL] [LEAD Technologies, Inc., 12.1.0.011] [C:\Program Files\Logitech\Video\LFBMP12N.DLL] [LEAD Technologies, Inc., 12.1.0.011] [C:\Program Files\Logitech\Video\LFPCX12N.DLL] [LEAD Technologies, Inc., 12.1.0.011] [C:\WINDOWS\System32\lvmaenum.dll] [Logitech Inc., 8.2.0.1192] [C:\WINDOWS\System32\lvcomcx.dll] [Logitech Inc., 8.2.0.1192] [C:\Program Files\Logitech\Video\fxsvrps.dll] [Logitech Inc., 8.2.0.1192] [PID: 2012 / Bernard][C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe] [Sun Microsystems, Inc., 6.0.30.5] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [PID: 2028 / Bernard][C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe] [ALWIL Software, 4, 7, 1098, 0] [C:\PROGRA~1\ALWILS~1\Avast4\aswCmnOS.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\PROGRA~1\ALWILS~1\Avast4\ashBase.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\PROGRA~1\ALWILS~1\Avast4\aswCmnB.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\PROGRA~1\ALWILS~1\Avast4\aswCmnS.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\PROGRA~1\ALWILS~1\Avast4\ashTask.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\PROGRA~1\ALWILS~1\Avast4\aswAux.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\PROGRA~1\ALWILS~1\Avast4\Aavm4h.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\French\Base.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\Program Files\Alwil Software\Avast4\French\Lang.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MFC71FRA.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\PROGRA~1\ALWILS~1\Avast4\AavmRpch.dll] [ALWIL Software, 4, 7, 1098, 0] [c:\program files\alwil software\avast4\ahruimai.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\PROGRA~1\ALWILS~1\Avast4\ashUInt.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\PROGRA~1\ALWILS~1\Avast4\XT1922.dll] [Codejock Software, 1, 9, 4, 0] [c:\program files\alwil software\avast4\ahruimes.dll] [ALWIL Software, 4, 7, 1098, 0] [c:\program files\alwil software\avast4\ahruins.dll] [ALWIL Software, 4, 7, 1098, 0] [c:\program files\alwil software\avast4\ahruiout.dll] [ALWIL Software, 4, 7, 1098, 0] [C:\WINDOWS\system32\MAPI32.dll] [Microsoft Corporation, 1.0.2536.0 (XPClient.010817-1148)] [c:\program files\alwil software\avast4\ahruip2p.dll] [ALWIL Software, 4, 7, 1098, 0] [c:\program files\alwil software\avast4\ahruistd.dll] [ALWIL Software, 4, 7, 1098, 0] [c:\program files\alwil software\avast4\ahruiws.dll] [ALWIL Software, 4, 7, 1098, 0] [PID: 2036 / Bernard][C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe] [Symantec Corporation, 2003.775] [PID: 180 / Bernard][C:\WINDOWS\Logi_MwX.Exe] [Logitech Inc., 9.79.024] [PID: 212 / Bernard][C:\Program Files\WebcamMax\CAMTHINS.exe] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [C:\Program Files\WebcamMax\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\WebcamMax\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MFC71FRA.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\msdmo.dll] [, ] [PID: 176 / Bernard][C:\WINDOWS\System32\drivers\PhiBtn.exe] [Philips, 1.0.13.0] [PID: 260 / Bernard][C:\WINDOWS\System32\drivers\Tray900.exe] [Philips, 1.0.0.8] [PID: 280 / Bernard][C:\Program Files\Trust\Trust R-Series Mouse\StartAutorun.exe] [UASSOFT.COM, 1.0.0.1] [PID: 372 / Bernard][C:\PROGRA~1\Grisoft\AVG7\avgcc.exe] [GRISOFT, s.r.o., 7.5.0.504] [C:\PROGRA~1\Grisoft\AVG7\AvgTMgr.dll] [GRISOFT, s.r.o., 7.5.0.494] [C:\PROGRA~1\Grisoft\AVG7\AvgCtrl.dll] [GRISOFT, s.r.o., 7.5.0.506] [C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\PROGRA~1\Grisoft\AVG7\AvgAbout.dll] [GRISOFT, s.r.o., 7.5.0.507] [C:\PROGRA~1\Grisoft\AVG7\AvgTest.dll] [GRISOFT, s.r.o., 7.5.0.506] [C:\PROGRA~1\Grisoft\AVG7\AvgTRes.dll] [GRISOFT, s.r.o., 7.5.0.494] [C:\PROGRA~1\Grisoft\AVG7\AvgSet.dll] [, ] [C:\WINDOWS\system32\MFC71FRA.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\PROGRA~1\Grisoft\AVG7\avglog.dll] [GRISOFT, s.r.o., 7.5.0.429] [C:\Program Files\Grisoft\AVG7\avgcfg.dll] [GRISOFT, s.r.o., 7.5.0.504] [C:\Program Files\Grisoft\AVG7\avgklib.dll] [GRISOFT, s.r.o., 7.5.0.458] [C:\Program Files\Grisoft\AVG7\avglng.dll] [GRISOFT, s.r.o., 7.5.0.480] [C:\Program Files\Grisoft\AVG7\avgamsps.dll] [GRISOFT, s.r.o., 7.5.0.407] [C:\Program Files\Grisoft\AVG7\AVGRES.DLL] [GRISOFT, s.r.o., 7.5.0.503] [C:\Program Files\Grisoft\AVG7\avgcckrn.dll] [GRISOFT, s.r.o., 7.5.0.506] [C:\Program Files\Grisoft\AVG7\avgvault.dll] [GRISOFT, s.r.o., 7.5.0.458] [C:\Program Files\Grisoft\AVG7\avgrep.dll] [GRISOFT, s.r.o., 7.5.0.448] [C:\Program Files\Grisoft\AVG7\avgunarc.dll] [GRISOFT, s.r.o., 7.5.0.474] [C:\PROGRA~1\Grisoft\AVG7\avgemsui.dll] [GRISOFT, s.r.o., 7.5.0.506] [C:\PROGRA~1\Grisoft\AVG7\avgemcps.dll] [GRISOFT, s.r.o., 7.5.0.420] [C:\Program Files\Grisoft\AVG7\avgscan.dll] [GRISOFT, s.r.o., 7.5.0.491] [C:\Program Files\Grisoft\AVG7\avgcore.dll] [GRISOFT, s.r.o., 7.5.0.498] [C:\Program Files\Grisoft\AVG7\avgf.dll] [N/A, ] [PID: 380 / Bernard][C:\Program Files\Spamihilator\spamihilator.exe] [Michel Krämer, 0, 9, 9, 10] [C:\Program Files\Spamihilator\uclanguage.dll] [Michel Krämer, 1, 2, 0, 0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Spamihilator\SSLEAY32.dll] [N/A, ] [C:\Program Files\Spamihilator\LIBEAY32.dll] [N/A, ] [C:\Program Files\Spamihilator\zlib1.dll] [, 1.2.1] [C:\Program Files\Spamihilator\spu.dll] [N/A, ] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Spamihilator\plugins\attachmentfilter.dll] [Michel Krämer, 0, 9, 1, 0] [C:\Program Files\Spamihilator\plugins\dccfilter.dll] [Michel Krämer, 0, 0, 2, 4] [C:\Program Files\Spamihilator\plugins\imagefilter.dll] [Michel Krämer, 1, 2, 1, 0] [C:\Program Files\Spamihilator\plugins ewsletter.dll] [Michel Krämer, 1, 0, 1, 0] [PID: 436 / Bernard][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 472 / Bernard][C:\Program Files\RamBoost XP ambxpfr.exe] [Gildas LE BOURNAULT, 4.0.6.324] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [PID: 480 / Bernard][C:\Program Files\Trust\Trust R-Series Mouse\KMConfig.exe] [UASSOFT.COM, 3, 0, 0, 1] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16574 (vista_gdr.071008-1500)] [PID: 524 / Bernard][C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe] [Adobe Systems Inc., 5, 0, 0, 0] [PID: 552 / SYSTEM][C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe] [GRISOFT, s.r.o., 7.5.0.496] [C:\PROGRA~1\Grisoft\AVG7\avgklib.dll] [GRISOFT, s.r.o., 7.5.0.458] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\PROGRA~1\Grisoft\AVG7\avglog.dll] [GRISOFT, s.r.o., 7.5.0.429] [C:\Program Files\Grisoft\AVG7\avgcfg.dll] [GRISOFT, s.r.o., 7.5.0.504] [C:\Program Files\Grisoft\AVG7\avglng.dll] [GRISOFT, s.r.o., 7.5.0.480] [C:\Program Files\Grisoft\AVG7\avgamint.dll] [GRISOFT, s.r.o., 7.5.0.482] [C:\Program Files\Grisoft\AVG7\avgamsps.dll] [GRISOFT, s.r.o., 7.5.0.407] [PID: 640 / SYSTEM][C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe] [GRISOFT, s.r.o., 7.5.0.420] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Grisoft\AVG7\avgupd.dll] [GRISOFT, s.r.o., 7.5.0.515] [C:\Program Files\Grisoft\AVG7\avgklib.dll] [GRISOFT, s.r.o., 7.5.0.458] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Grisoft\AVG7\avgcfg.dll] [GRISOFT, s.r.o., 7.5.0.504] [C:\PROGRA~1\Grisoft\AVG7\avglog.dll] [GRISOFT, s.r.o., 7.5.0.429] [C:\Program Files\Grisoft\AVG7\avgupsvc.dll] [GRISOFT, s.r.o., 7.5.0.420] [C:\Program Files\Grisoft\AVG7\avgamsps.dll] [GRISOFT, s.r.o., 7.5.0.407] [PID: 704 / SYSTEM][C:\PROGRA~1\Grisoft\AVG7\avgemc.exe] [GRISOFT, s.r.o., 7.5.0.510] [C:\PROGRA~1\Grisoft\AVG7\libsasl.dll] [GRISOFT, s.r.o., 7.5.0.407] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\PROGRA~1\Grisoft\AVG7\avglog.dll] [GRISOFT, s.r.o., 7.5.0.429] [C:\Program Files\Grisoft\AVG7\avgcfg.dll] [GRISOFT, s.r.o., 7.5.0.504] [C:\Program Files\Grisoft\AVG7\avgklib.dll] [GRISOFT, s.r.o., 7.5.0.458] [C:\Program Files\Grisoft\AVG7\avglng.dll] [GRISOFT, s.r.o., 7.5.0.480] [C:\Program Files\Grisoft\AVG7\avgscan.dll] [GRISOFT, s.r.o., 7.5.0.491] [C:\Program Files\Grisoft\AVG7\avgunarc.dll] [GRISOFT, s.r.o., 7.5.0.474] [C:\PROGRA~1\Grisoft\AVG7\saslcrammd5.dll] [GRISOFT, s.r.o., 7.5.0.407] [C:\PROGRA~1\Grisoft\AVG7\sasldigestmd5.dll] [GRISOFT, s.r.o., 7.5.0.407] [C:\PROGRA~1\Grisoft\AVG7\sasllogin.dll] [GRISOFT, s.r.o., 7.5.0.407] [C:\PROGRA~1\Grisoft\AVG7\saslplain.dll] [GRISOFT, s.r.o., 7.5.0.407] [C:\Program Files\Grisoft\AVG7\avgmail.dll] [GRISOFT, s.r.o., 7.5.0.429] [C:\PROGRA~1\Grisoft\AVG7\avgemcps.dll] [GRISOFT, s.r.o., 7.5.0.420] [C:\Program Files\Grisoft\AVG7\avgcore.dll] [GRISOFT, s.r.o., 7.5.0.498] [PID: 904 / SYSTEM][C:\WINDOWS\system32\cisvc.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1016 / Bernard][C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe] [Apache Software Foundation, 2.0.55] [PID: 1048 / SYSTEM][C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE] [Symantec Corporation, 2003.775] [PID: 1128 / Bernard][C:\Program Files\Trust\Trust R-Series Mouse\KMProcess.exe] [UASSOFT.COM, 4.0.0.1] [C:\Program Files\Trust\Trust R-Series Mouse\keydll.dll] [N/A, ] [C:\Program Files\Trust\Trust R-Series Mouse\MouseHook.dll] [N/A, ] [PID: 1204 / Bernard][C:\Program Files\Logitech\Video\FxSvr2.exe] [Logitech Inc., 8.2.0.1192] [C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MFC71FRA.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS wain_32\LogiVid\HVidSp2.dll] [Logitech Inc., 8.2.0.1192] [C:\WINDOWS\System32\lvmaenum.dll] [Logitech Inc., 8.2.0.1192] [C:\WINDOWS\System32\lvcomcx.dll] [Logitech Inc., 8.2.0.1192] [C:\Program Files\Logitech\Video\fxsvrps.dll] [Logitech Inc., 8.2.0.1192] [PID: 1192 / SYSTEM][C:\Program Files\Trust\Trust R-Series Mouse\KMWDSrv.exe] [UASSOFT.COM, 1, 0, 6, 0] [PID: 1272 / Bernard][C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe] [Teleca Software Solutions AB, 1, 4, 0, 1] [C:\Program Files\Sony Ericsson\Mobile\DMLg.dll] [Teleca Software Solutions AB, 1, 3, 5, 0] [C:\PROGRA~1\SONYER~1\Mobile\Sync.ocx] [Teleca Software Solutions AB, 2, 2, 0, 18] [C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\ECENGI~1.DLL] [Symbian Ltd., 1, 0, 0, 41] [C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\Wswitch.dll] [N/A, ] [C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CracDlr.dll] [N/A, ] [C:\Program Files\Sony Ericsson\Mobile\Connectivity Pack\RtSock.dll] [Symbian Ltd., 1, 0, 0, 41] [C:\Program Files\Sony Ericsson\Mobile\Connectivity Pack\SCRFSProxy.dll] [N/A, ] [C:\Program Files\Sony Ericsson\Mobile\aufilemgr.dll] [N/A, ] [PID: 1516 / Bernard][C:\Program Files\PowerCheck\PowerCheck.exe] [N/A, ] [PID: 1512 / SYSTEM][C:\WINDOWS\System32\snmp.exe] [Microsoft Corporation, 5.1.2600.3038 (xpsp_sp2_gdr.061119-2303)] [PID: 1888 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 2084 / SYSTEM][C:\WINDOWS\system32\UStorSrv.exe] [OTi, 2, 0, 0, 4] [C:\WINDOWS\system32\OPDSL.dll] [, 1, 0, 0, 14] [PID: 2124 / Bernard][c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTE~2.EXE] [Intuwave Ltd., 2, 2, 0, 371] [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterGateway.DLL] [Intuwave Ltd., 2, 2, 0, 371] [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterPropPages.DLL] [Intuwave Ltd., 2, 2, 0, 371] [c:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterController.dll] [Intuwave Ltd., 2, 2, 0, 371] [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTERTCP.DLL] [Intuwave Ltd., 2, 2, 0, 371] [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTERSERIAL.DLL] [Intuwave Ltd., 2, 2, 0, 371] [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTERIRSOCKETS.DLL] [Intuwave Ltd., 2, 2, 0, 371] [c:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterBluetooth.dll] [Intuwave Ltd., 2, 2, 0, 371] [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTERWINSOCK.DLL] [Intuwave Ltd., 2, 2, 0, 371] [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterAccessPoint.dll] [Intuwave Ltd., 2, 2, 0, 371] [PID: 2192 / Bernard][C:\Program Files\OpenOffice.org 2.2\program\soffice.exe] [OpenOffice.org, 1.09.9129] [C:\Program Files\OpenOffice.org 2.2\program\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\OpenOffice.org 2.2\program\uwinapi.dll] [Sun Microsystems, Inc., 8.0.0.9107] [PID: 2272 / Bernard][C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN] [OpenOffice.org, 1.09.9129] [C:\Program Files\OpenOffice.org 2.2\program\vcl680mi.dll] [Sun Microsystems, Inc., 8.0.0.9118] [C:\Program Files\OpenOffice.org 2.2\program\sot680mi.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program l680mi.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\cppu3.dll] [Sun Microsystems, Inc., 8.0.0.9106] [C:\Program Files\OpenOffice.org 2.2\program\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\OpenOffice.org 2.2\program\sal3.dll] [Sun Microsystems, Inc., 8.0.0.9107] [C:\Program Files\OpenOffice.org 2.2\program\uwinapi.dll] [Sun Microsystems, Inc., 8.0.0.9107] [C:\Program Files\OpenOffice.org 2.2\program\stlport_vc7145.dll] [STLport Consulting, Inc., 4.5.2003.0120] [C:\Program Files\OpenOffice.org 2.2\program\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\OpenOffice.org 2.2\program\vos3MSC.dll] [Sun Microsystems, Inc., 8.0.0.9106] [C:\Program Files\OpenOffice.org 2.2\program\basegfx680mi.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\i18nisolang1MSC.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\utl680mi.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\salhelper3MSC.dll] [Sun Microsystems, Inc., 8.0.0.9106] [C:\Program Files\OpenOffice.org 2.2\program\comphelp4MSC.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\cppuhelper3MSC.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\ucbhelper3MSC.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\icuuc36.dll] [IBM Corporation and others, 3, 6, 0, 0] [C:\Program Files\OpenOffice.org 2.2\program\icudt36l.dll] [IBM Corporation and others, 3, 6, 0, 0] [C:\Program Files\OpenOffice.org 2.2\program\svl680mi.dll] [Sun Microsystems, Inc., 8.0.0.9118] [C:\Program Files\OpenOffice.org 2.2\program\svt680mi.dll] [Sun Microsystems, Inc., 8.0.0.9118] [C:\Program Files\OpenOffice.org 2.2\program k680mi.dll] [Sun Microsystems, Inc., 8.0.0.9119] [C:\Program Files\OpenOffice.org 2.2\program\jvmfwk3.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\libxml2.dll] [N/A, ] [C:\Program Files\OpenOffice.org 2.2\program\servicemgr.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\shlibloader.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\simplereg.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program estedreg.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program ypemgr.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\implreg.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\security.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program eg3.dll] [Sun Microsystems, Inc., 8.0.0.9106] [C:\Program Files\OpenOffice.org 2.2\program\store3.dll] [Sun Microsystems, Inc., 8.0.0.9106] [C:\Program Files\OpenOffice.org 2.2\program egtypeprov.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\configmgr2.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program ypeconverter.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\sysmgr1.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\sax.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\localebe1.uno.dll] [Sun Microsystems, Inc., 8.0.0.9118] [C:\Program Files\OpenOffice.org 2.2\program\behelper.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\uriproc.uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\ucb1.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\fwl680mi.dll] [Sun Microsystems, Inc., 8.0.0.9118] [C:\Program Files\OpenOffice.org 2.2\program\fwi680mi.dll] [Sun Microsystems, Inc., 8.0.0.9118] [C:\Program Files\OpenOffice.org 2.2\program\ucpfile1.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\sfx680mi.dll] [Sun Microsystems, Inc., 8.0.0.9124] [C:\Program Files\OpenOffice.org 2.2\program\fwe680mi.dll] [Sun Microsystems, Inc., 8.0.0.9118] [C:\Program Files\OpenOffice.org 2.2\program\sb680mi.dll] [Sun Microsystems, Inc., 8.0.0.9118] [C:\Program Files\OpenOffice.org 2.2\program\xcr680mi.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\j680mi_g.dll] [Sun Microsystems, Inc., 8.0.0.9118] [C:\Program Files\OpenOffice.org 2.2\program\jvmaccess3MSC.dll] [Sun Microsystems, Inc., 8.0.0.9107] [C:\Program Files\OpenOffice.org 2.2\program\fwk680mi.dll] [Sun Microsystems, Inc., 8.0.0.9124] [C:\Program Files\OpenOffice.org 2.2\program\msci_uno.dll] [Sun Microsystems, Inc., 8.0.0.9116] [C:\Program Files\OpenOffice.org 2.2\program\spl680mi.dll] [Sun Microsystems, Inc., 8.0.0.9129] [C:\Program Fi

FillPCA · Answer

Bonjour,

1/     *  Ouvrir l'explorateur windows (Démarrer>programmes>Accessoires>Explorateur windows ou Démarrer>programmes>Explorateur windows).
    * Cliquer sur outils>options des dossiers>affichage.
    * Sélectionner :
          o afficher les fichiers et dossiers cachés,
          o décocher "masquer les extensions des fichiers dont le type est connu",
          o décocher masquer les fichiers protégés du système d'exploitation (recommandé)".

    * "appliquer" et "ok"

2/     *  Peux-tu tester ceci : C:\windows\system32\DRIVERS\szkg.sys
    * Clique sur ce lien : http://www.virustotal.com/en/indexf.html
    * Clique sur parcourir et indique le chemin du fichier que j’ai désigné.
    * Clique sur send. Au bout de quelques minutes, un rapport est généré. Poste-le dans ta prochaine réponse.

3/ # Télécharge SDFix (créé par Andy Manchesta) et sauvegarde le sur ton Bureau : http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
# Imprime ceci.
# Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

    * Redémarre ton ordinateur.
    * Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (ou F5).
    * A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
    * Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
    * Choisis ton compte.

# Déroule la liste des instructions ci-dessous :

    * En mode sans échec, double-clique sur le fichier SDFix.exe et clique sur install,
    * Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.cmd pour lancer le script.
    * Appuie sur Y pour commencer le script.
    * Il va supprimer les services de certains trojans, effectuera aussi quelques réparations du Registre et il te demandera d'appuyer sur une touche pour redémarrer.
    * Appuie sur une touche pour redémarrer le PC.
    * Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
    * Après le chargement du Bureau, l'outil terminera son travail et affichera Finished
    * Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
    * Enfin, ouvre le dossier de SDFix sur ton Bureau et copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

FillPCA

Moi même · Answer

Bonjour et merci
je n'ai pas trouvé le fichier que tu m'indiques : C:\windows\system32\DRIVERS\szkg.sys et en conséquence la procédure 2/ n'a pas été effectuée...
Voici par contre le résultat des autres
_______________________________________________________________________

SDFix: Version 1.120

Run by Bernard on 28/12/2007 at 14:02

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services: 


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files: 

No Trojan Files Found





Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found. 

C:\WINDOWS\system32
No streams found. 

C:\WINDOWS\system32\svchost.exe
No streams found.
 
C:\WINDOWS\system32
toskrnl.exe
No streams found.
 


                                 Final Check:

catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-28 14:12:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2C4D257C-72E2-E577-A752-291333787D00}]
"hagepphnhnalohlb"=hex:61,61,00,00
"hagepphnnnglgocp"=hex:61,61,00,00
"iakfpidebimpimgooj"=hex:6b,61,68,69,67,68,6d,70,69,62,66,67,61,65,6c,66,67,70,61,6f,6f,..
"haegjngplkgkgjhj"=hex:6b,61,68,69,67,68,6d,70,69,62,66,67,61,65,6c,66,67,70,61,6f,6f,..

scanning hidden files ...

C:\WINDOWS\Temp\_av_proI.tm~a01980
C:\WINDOWS\Temp\_av_proI.tm~a01980\dld1.tmp 0 bytes
C:\WINDOWS\Temp\_av_proI.tm~a01980\setup.lok 0 bytes
C:\Documents and Settings\Bernard\Application Data\m\shared\BiblePromise : Scripture Verses for your Daily Bread 2.2 [Patch].zip 767430 bytes hidden from API

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 4


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Age of Empires 2\age2_x1.exe"="C:\Program Files\Age of Empires 2\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"C:\Program Files\EasyPHP1-7\apache\apache.exe"="C:\Program Files\EasyPHP1-7\apache\apache.exe:*:Enabled:apache"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Ex‚cuter une DLL en tant qu'application"
"C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows© NetMeeting©"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\Empire Earth\Empire Earth.exe"="C:\Program Files\Empire Earth\Empire Earth.exe:*:Enabled:Empire Earth"
"C:\WINDOWS\system32\rtcshare.exe"="C:\WINDOWS\system32\rtcshare.exe:*:Enabled:Partage de l'application RTC"
"C:\Program Files\GlobalSCAPE\CuteFTP Pro\TE\ftpte.exe"="C:\Program Files\GlobalSCAPE\CuteFTP Pro\TE\ftpte.exe:*:Enabled:FTP Transfer Engine"
"C:\Program Files\MixW\Teoan.exe"="C:\Program Files\MixW\Teoan.exe:*:Enabled:TEOAN"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe"="C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe:*:Enabled:mRouterRuntime"
"C:\Program Files\EchoLink\EchoLink.exe"="C:\Program Files\EchoLink\EchoLink.exe:*:Enabled:EchoLink"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\Kazaa Lite K++\KazaaLite.kpp"="C:\Program Files\Kazaa Lite K++\KazaaLite.kpp:*:Enabled:KazaaLite"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Freeplayer\vlc\vlc.exe"="C:\Program Files\Freeplayer\vlc\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\WINDOWS\system32\svchost.exe"="C:\WINDOWS\system32\svchost.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\11exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\11exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\38exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\38exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\43exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\43exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\74exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\74exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\51exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\51exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\0exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\0exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\80exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\80exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\75exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\75exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\63exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\63exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\8exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\8exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\48exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\48exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\2exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\2exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\36exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\36exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\66exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\66exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\50exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\50exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\73exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\73exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\54exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\54exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\29exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\29exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\6exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\6exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\61exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\61exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\41exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\41exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\45exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\45exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\64exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\64exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\37exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\37exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\19exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\19exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\69exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\69exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\12exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\12exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\84exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\84exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\15exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\15exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\5exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\5exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\21exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\21exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\99exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\99exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\65exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\65exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\23exinjs.a5.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\23exinjs.a5.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\26exinjs.a6.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\26exinjs.a6.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\98exinjs.a6.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\98exinjs.a6.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\17exinjs.a6.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\17exinjs.a6.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\Bernard\LOCALS~1\Temp\10exinjs.a6.exe"="C:\DOCUME~1\Bernard\LOCALS~1\Temp\10exinjs.a6.exe:*:Enabled:Microsoft Update"
"C:\Program Files\Microsoft Office\Office\EXCEL.EXE"="C:\Program Files\Microsoft Office\Office\EXCEL.EXE:*:Enabled:Microsoft Excel for Windows"
"C:\Program Files\FileZilla\FileZilla.exe"="C:\Program Files\FileZilla\FileZilla.exe:*:Enabled:FileZilla"
"C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"
"C:\Program Files\Apache Group\Apache2\bin\Apache.exe"="C:\Program Files\Apache Group\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\Grisoft\AVG7\avginet.exe"="C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe"
"C:\Program Files\Grisoft\AVG7\avgamsvr.exe"="C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\Program Files\Grisoft\AVG7\avgcc.exe"="C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe"
"C:\Program Files\Grisoft\AVG7\avgemc.exe"="C:\Program Files\Grisoft\AVG7\avgemc.exe:*:Enabled:avgemc.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------


Files with Hidden Attributes:

Fri 23 Dec 2005     4,027,936 ...H. --- "C:\Program Files\Picasa2\setup.exe"
Thu  5 Jun 2003        24,576 A..H. --- "C:\Program Files\RamBoost XP\StopRam.exe"
Mon  3 Sep 2007         1,890 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Fri 27 Aug 2004         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 14 Aug 2004        24,576 A..H. --- "C:\Documents and Settings\Bernard\Local Settings\TempIadHide4.dll"
Fri  3 Nov 2006             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 27 Aug 2004         4,348 ...H. --- "C:\Documents and Settings\Bernard\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Sun 30 Jan 2005            20 A..H. --- "C:\Documents and Settings\Bernard\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Fri 27 Aug 2004           400 A.SH. --- "C:\Documents and Settings\Bernard\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Wed 14 Aug 2002        65,088 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\3COM 3c556 Packet\3C556.COM"
Wed 14 Aug 2002        12,732 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\3COM 3c509 Packet\3C5X9PD.COM"
Wed 14 Aug 2002        26,424 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\3COM 3c59x Packet\3C59XPD.COM"
Wed 14 Aug 2002        28,062 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1207F Packet\EN5251PD.COM"
Wed 14 Aug 2002        10,710 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1207C Packet\PCIPD.COM"
Wed 14 Aug 2002        10,083 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1207D Packet\ACCPKT.COM"
Wed 14 Aug 2002        10,257 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1207TX Packet\PCIPD.COM"
Wed 14 Aug 2002        29,499 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1203 Packet\PCIPD.COM"
Wed 14 Aug 2002        12,660 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1204 Packet\VLNWPD.COM"
Wed 14 Aug 2002        11,031 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1207 Packet\PCIPD.COM"
Wed 14 Aug 2002        17,952 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1200 Packet\EC32PD.COM"
Wed 14 Aug 2002         9,424 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1208 Packet\1208PD.COM"
Wed 14 Aug 2002         7,825 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1650 Packet\NWPD.COM"
Wed 14 Aug 2002        13,673 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1640 Packet\NWPD.COM"
Wed 14 Aug 2002        14,438 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1658 Packet\NWPD.COM"
Wed 14 Aug 2002         7,825 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN166X Packet\NWPD.COM"
Wed 14 Aug 2002         7,825 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1651 Packet\NWPD.COM"
Wed 14 Aug 2002         7,825 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1652 Packet\NWPD.COM"
Wed 14 Aug 2002         7,243 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1653 Packet\NE2PD.COM"
Wed 14 Aug 2002        24,767 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN2216 Packet\PCMPD.COM"
Wed 14 Aug 2002         7,463 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1625 Packet\NEPD.COM"
Wed 14 Aug 2002         7,825 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1656 Packet\NWPD.COM"
Wed 14 Aug 2002        10,286 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN2228 Packet\PCMPD.COM"
Wed 14 Aug 2002        25,460 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN2218 Packet\PCMPD.COM"
Wed 14 Aug 2002        28,866 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN2320 Packet\EN5251PD.COM"
Wed 14 Aug 2002        14,438 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1657 Packet\NWPD.COM"
Wed 14 Aug 2002         8,544 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\CATC USB Ethernet\Elndis.sys"
Wed 14 Aug 2002        33,149 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\CATC USB Ethernet\Usbd.sys"
Wed 28 May 2003        51,150 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPI1394.SYS"
Wed 14 Aug 2002        35,340 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPI2DOS.SYS"
Wed 14 Aug 2002        14,378 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPI4DOS.SYS"
Wed 14 Aug 2002        37,984 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPI8DOS.SYS"
Wed 14 Aug 2002        44,828 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPI8U2.SYS"
Wed 14 Aug 2002        29,628 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPICD.SYS"
Wed 28 May 2003        52,106 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPIEHCI.SYS"
Wed 14 Aug 2002        49,242 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPIOHCI.SYS"
Wed 14 Aug 2002        50,606 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPIUHCI.SYS"
Wed 14 Aug 2002       161,792 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\BOOTSRV.SYS"
Wed 14 Aug 2002       174,080 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\bootsrv16.sys"
Wed 14 Aug 2002        21,971 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\BTCDROM.SYS"
Wed 14 Aug 2002        30,955 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\BTDOSM.SYS"
Wed 14 Aug 2002       202,517 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\CMDS.EXE"
Wed 14 Aug 2002       374,038 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\CMDS16.EXE"
Wed 14 Aug 2002        22,158 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\COUNTRY.SYS"
Wed 14 Aug 2002         1,608 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\DEVICE.COM"
Wed 14 Aug 2002        15,345 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\DISPLAY.SYS"
Wed 14 Aug 2002         7,840 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\DLSHELP.SYS"
Wed 14 Aug 2002        56,821 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\E.EXE"
Wed 14 Aug 2002        64,425 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\FLASHPT.SYS"
Wed 14 Aug 2002        32,396 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\GUEST.EXE"
Wed 14 Aug 2002        14,160 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\HIMEM.SYS"
Wed 14 Aug 2002        10,898 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\KEYB.COM"
Wed 14 Aug 2002        53,556 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\KEYBOARD.SYS"
Wed 14 Aug 2002        15,777 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\MODE.COM"
Wed 14 Aug 2002        37,681 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\MOUSE.COM"
Wed 14 Aug 2002       354,304 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\msbootsrv16.sys"
Wed 14 Aug 2002        21,180 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\MSCDEX.EXE"
Wed 14 Aug 2002       354,263 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\Net.exe"
Wed 14 Aug 2002         8,513 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\NETBIND.COM"
Wed 14 Aug 2002        41,302 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\OAKCDROM.SYS"
Wed 14 Aug 2002       129,240 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\OHCI.EXE"
Wed 14 Aug 2002        28,439 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\Paralink.com"
Wed 14 Aug 2002        13,770 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\PROTMAN.EXE"
Wed 14 Aug 2002       130,980 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\UHCI.EXE"
Wed 14 Aug 2002        11,854 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\DEC EtherWorks ISA (DE305) Packet\DE305.COM"
Wed 14 Aug 2002        52,715 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\DEC EtherWORKS DE450 Packet\DE450.COM"
Wed 14 Aug 2002        62,391 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\DEC EtherWORKS DE500 Packet\DE500.COM"
Wed 14 Aug 2002        11,491 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\DLink DMF560-TX Packet\Lmpd.com"
Wed 14 Aug 2002        17,791 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\DLink DT620 Packet\Dt620pd.com"
Wed 14 Aug 2002        17,043 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\DLink DE400 Packet\De400pd.com"
Wed 14 Aug 2002        11,786 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\IBM Crystal LAN Packet\Epktisa.com"
Wed 14 Aug 2002        18,300 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Kingston EtheRx KNE110TX Packet\Ktc110p.com"
Wed 14 Aug 2002        48,224 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Laneed LD 10-100AL Packet\L100al.com"
Wed 14 Aug 2002        13,360 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Laneed LD-CDF Packet\Ldcdt.com"
Wed 14 Aug 2002         9,190 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Laneed LD-PCI2TL Packet\Ldpcil.com"
Wed 14 Aug 2002        12,567 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Melco LPC2-T\Lpchkat2.com"
Wed 14 Aug 2002        44,640 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Planex FW-100TX Fast Ethernet Packet\FETPKT.COM"
Wed 14 Aug 2002        56,896 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Planex FW-100TX Fast Ethernet Packet\Rtspkt.com"
Wed 14 Aug 2002        44,640 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Planex FNW9x00T - ENW8300T Packet\fetpkt.com"
Wed 14 Aug 2002         9,692 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\PXE Packet Driver\Undipd.com"
Wed 14 Aug 2002         9,537 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\SN 2000p Packet\PNPPD.COM"
Wed 14 Aug 2002        32,484 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\WaveLAN Packet\Wvlan42.com"
Wed 14 Aug 2002        52,225 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Ethernet 10-100 + Modem\Cbendis.exe"
Wed 14 Aug 2002        48,491 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom RE10BT\Ce3ndis.exe"
Wed 14 Aug 2002        50,405 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom RE10 - RE100 Packet\Ce3pd.com"
Wed 14 Aug 2002        33,860 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom PE3-10Bx\Pe3ndis.exe"
Wed 14 Aug 2002        50,175 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Re-100Btx + Ce3B-100Btx\Ce3ndis.exe"
Wed 14 Aug 2002        50,795 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom CBE10-100BTX\Cbendis.exe"
Wed 14 Aug 2002        48,223 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom CBE10-100BTX Packet\Cbepd.com"
Wed 14 Aug 2002        48,641 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Ethernet II PS\Xpsndis.exe"
Wed 14 Aug 2002        49,015 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Ethernet II PS Packet\Xpspd.com"
Wed 14 Aug 2002        53,786 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\pcdos\command.com"
Wed 14 Aug 2002        44,240 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\pcdos\IBMBIO.COM"
Wed 14 Aug 2002        42,550 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\pcdos\IBMDOS.COM"

Finished! 
________________________________________________________________________________________________________
catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-28 14:12:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2C4D257C-72E2-E577-A752-291333787D00}]
"hagepphnhnalohlb"=hex:61,61,00,00
"hagepphnnnglgocp"=hex:61,61,00,00
"iakfpidebimpimgooj"=hex:6b,61,68,69,67,68,6d,70,69,62,66,67,61,65,6c,66,67,70,61,6f,6f,..
"haegjngplkgkgjhj"=hex:6b,61,68,69,67,68,6d,70,69,62,66,67,61,65,6c,66,67,70,61,6f,6f,..

scanning hidden files ...

C:\WINDOWS\Temp\_av_proI.tm~a01980
C:\WINDOWS\Temp\_av_proI.tm~a01980\dld1.tmp 0 bytes
C:\WINDOWS\Temp\_av_proI.tm~a01980\setup.lok 0 bytes
C:\Documents and Settings\Bernard\Application Data\m\shared\BiblePromise : Scripture Verses for your Daily Bread 2.2 [Patch].zip 767430 bytes hidden from API

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 4
_________________________________________________________________________________________________________
Logfile of HijackThis v1.99.1
Scan saved at 14:23:28, on 28/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\cisvc.exe
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\Program Files\Trust\Trust R-Series Mouse\KMWDSrv.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
C:\Program Files\PowerCheck\PowerCheck.exe
c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTE~2.EXE
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CapMan.exe
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\ElogErr.exe
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\BROADC~1.EXE
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\SCRFS.exe
C:\PROGRA~1\SONYER~1\Mobile\AUFILE~1.EXE
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\Ecfmserv.exe
C:\Program Files\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://news.google.com/topstories?hl=fr&gl=FR&ceid=FR:fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Camfrog Toolbar - {AF2A1C5A-1AED-4E92-8BA8-D708EB79537E} - C:\Program Files\Camfrog\CamfrogBar\CamfrogBar.dll
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
O4 - Global Startup: Phone Connection Monitor.lnk = ?
O4 - Global Startup: PowerCheck.lnk = C:\Program Files\PowerCheck\PowerCheck.exe
O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} - https://www.f-secure.com/en/home/support
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - https://www.f-secure.com/en/home/support
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - https://www.appdirect.com/products/apphelp/
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4886/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Trust\Trust R-Series Mouse\KMWDSrv.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

FillPCA · Answer

Bonjour,

    *  Télécharge combofix.exe (par sUBs) sur ton Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    * Double clique combofix.exe et suis les invites.
    * Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

Edite aussi un rapport Hijackthis.

FillPCA

Moi même · Answer

voila ________________________________________________________________________________________________________ ComboFix 07-12-21.4 - Bernard 2007-12-28 16:41:19.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.163 [GMT 1:00] Running from: C:\Documents and Settings\Bernard\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\Phibtn.exe C:\WINDOWS\system32\drivers\Tray900.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\poof ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-28 to 2007-12-28 )))))))))))))))))))))))))))))))))))) . 2007-12-28 16:40 . 2004-08-05 13:00 153,088 --a------ C:\WINDOWS egedit.exe 2007-12-28 14:01 . 2007-12-28 14:01 d-------- C:\WINDOWS\ERUNT 2007-12-27 15:03 . 2007-12-27 15:03 17,374,963 --a------ C:\upload_moi_BV.tar.gz 2007-12-27 14:39 . 2007-12-13 12:08 d-------- C:\Program Files\Trust 2007-12-25 19:54 . 2007-12-28 09:04 d-------- C:\Documents and Settings\Bernard\Application Data\AVG7 2007-12-25 19:53 . 2007-12-25 19:53 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2007-12-25 19:53 . 2007-12-25 19:58 d-------- C:\Documents and Settings\All Users\Application Data\avg7 2007-12-22 20:41 . 2007-12-22 20:41 d-------- C:\Program Files\PC Inspector File Recovery 2007-12-22 20:41 . 2002-02-18 18:40 6,200 --a------ C:\WINDOWS\system32\INT13EXT.VXD 2007-12-22 15:47 . 2007-12-22 15:47 d-------- C:\Program Files\Trend Micro 2007-12-21 00:54 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\RkPavProc.sys 2007-12-21 00:50 . 2007-12-21 00:50 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-12-19 14:21 . 2007-12-19 14:24 250 --a------ C:\WINDOWS\gmer.ini 2007-12-18 00:58 . 2007-12-18 00:58 d-------- C:\WINDOWS\AU_Temp 2007-12-18 00:57 . 2007-12-18 00:53 40,069,133 --a------ C:\WINDOWS\LPT$VPN.891 2007-12-18 00:53 . 2007-12-18 00:53 40,069,133 --a------ C:\WINDOWS\VPTNFILE.891 2007-12-14 13:27 . 2007-12-14 13:27 d-------- C:\Documents and Settings\Bernard\Application Data\vlc 2007-12-13 11:51 . 2007-02-13 07:42 14,848 --a------ C:\WINDOWS\system32\drivers\KMWDFilter.SYS 2007-12-13 11:50 . 2007-12-13 11:50 d-------- C:\Documents and Settings\All Users\Application Data\{3E318E90-4BE6-4440-A0EE-2EAF8419199C} 2007-12-13 11:39 . 2004-08-20 00:09 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2007-12-13 11:39 . 2004-08-20 00:09 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-28 15:47 --------- d-----w C:\Program Files\Spamihilator 2007-12-28 13:38 --------- d-----w C:\Documents and Settings\Bernard\Application Data\OpenOffice.org2 2007-12-28 08:04 --------- d-----w C:\Program Files\RamBoost XP 2007-12-26 23:04 --------- d-----w C:\Program Files\eMule 2007-12-25 18:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-25 00:03 --------- d-----w C:\Program Files\3D Home Architect 2007-12-24 23:48 --------- d-----w C:\Program Files\Fake Webcam 2007-12-24 23:37 --------- d-----w C:\Documents and Settings\Bernard\Application Data\m 2007-12-23 20:56 --------- d-----w C:\Program Files\Windows Live Safety Center 2007-12-22 19:41 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-19 17:29 --------- d-----w C:\Program Files\MSN Messenger 2007-12-19 17:29 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-12-17 23:58 86,094 ----a-w C:\WINDOWS\BPMNT.dll 2007-12-17 23:58 1,163,344 ----a-w C:\WINDOWS\vsapi32.dll 2007-12-17 23:53 71,749 ----a-w C:\WINDOWS\hcextoutput.dll 2007-12-17 23:53 267,845 ----a-w C:\WINDOWS sc.exe 2007-12-16 00:50 --------- d-----w C:\Program Files\WebcamMax 2007-12-16 00:48 --------- d-----w C:\Program Files\PowerCheck 2007-12-16 00:39 --------- d-----w C:\Program Files\Microsoft IntelliType Pro 2007-12-16 00:25 --------- d-----w C:\Program Files\Google 2007-12-14 12:25 --------- d-----w C:\Program Files\VideoLAN 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-28 19:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2007-11-18 05:49 286,720 ------w C:\WINDOWS\Setup1.exe 2007-11-14 16:28 --------- d-----w C:\Documents and Settings\Bernard\Application Data\ArcSoft 2007-11-14 16:26 --------- d-----w C:\Program Files\Fichiers communs\ArcSoft 2007-11-14 16:14 --------- d-----w C:\Program Files\Philips 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-07 19:35 --------- d-----w C:\Program Files\PC Camera 2007-10-31 05:45 --------- d-----w C:\Program Files\DipTrace 2007-10-28 12:20 --------- d-----w C:\Program Files\Java 2007-09-03 21:16 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LDM"="\Program\BackWeb-8876480.exe" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-25 19:53] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5ECD31F0-F91A-11d4-B3CA-00D0B70A09D2}"= WDShell [ ] R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\system32\DRIVERS\bsstor.sys [2002-06-06 00:07] R0 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys [2002-10-05 10:46] R0 hptpro;hptpro;C:\WINDOWS\system32\DRIVERS\hptpro.sys [2002-04-27 07:34] R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys [2004-05-12 13:01] R1 GhPciScan;GhostPciScanner;C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys [2002-08-14 14:11] R2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Trust\Trust R-Series Mouse\KMWDSrv.exe [2007-06-09 00:23] R2 tyansmb;tyansmb;C:\WINDOWS\system32\Drivers yansmb.sys [2003-06-05 13:14] R3 KMWDFilter;KMWDFilter;C:\WINDOWS\System32\Drivers\KMWDFilter.SYS [2007-02-13 07:42] R3 SampleScanner;Ultima2000 Scanner;C:\WINDOWS\system32\DRIVERS\GT680x.sys [2001-06-07 16:56] R3 SUSCOM;Susteen Serial port driver;C:\WINDOWS\system32\DRIVERS\SUSCOM.SYS [2002-10-22 12:58] S2 CamthWDM;WebcamMax, WDM Video Capture;C:\WINDOWS\system32\DRIVERS\CamthWDM.sys [2006-07-03 07:39] S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 17:08] S3 Amps2prt;PS/2 Port Mouse Filter Driver;C:\WINDOWS\system32\Drivers\Amps2prt.sys [2000-11-03 17:37] S3 CAM1210;SM0121 USB 2.0 Video Camera;C:\WINDOWS\system32\Drivers\cam1210.sys [2006-07-24 17:49] S3 camvid40;Philips SPC 900NC PC Camera;C:\WINDOWS\system32\DRIVERS\camdrv41.sys [2005-08-25 18:28] S3 ICAM5USB;Caméra CS110 Intel(r) PC;C:\WINDOWS\system32\Drivers\Icam5USB.sys [2001-08-17 21:06] S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;C:\WINDOWS\system32\DRIVERS\ManyCam.sys [2006-07-27 03:07] S4 BsUDF;InCD UDF Driver;C:\WINDOWS\system32\drivers\BsUDF.sys [2003-02-12 12:16] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2005-01-22 17:06:07 C:\WINDOWS\Tasks\1 Copernic Intra-Daily ~BV Bernard.job" - C:\Program Files\Copernic Agent\CopernicAgent.exe "2005-01-22 17:06:07 C:\WINDOWS\Tasks\2 Copernic Daily ~BV Bernard.job" - C:\Program Files\Copernic Agent\CopernicAgent.exe "2005-01-22 17:06:07 C:\WINDOWS\Tasks\3 Copernic Weekly ~BV Bernard.job" - C:\Program Files\Copernic Agent\CopernicAgent.exe "2005-01-22 17:06:07 C:\WINDOWS\Tasks\4 Copernic Monthly ~BV Bernard.job" - C:\Program Files\Copernic Agent\CopernicAgent.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-28 16:51:12 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-28 16:52:55 - machine was rebooted . 2007-12-12 08:34:57 --- E O F --- _________________________________________________________________________________________________________ Logfile of HijackThis v1.99.1 Scan saved at 16:54:42, on 28/12/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE C:\Program Files\Trust\Trust R-Series Mouse\KMWDSrv.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\UStorSrv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe C:\Program Files\PowerCheck\PowerCheck.exe c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTE~2.EXE C:\Program Files\OpenOffice.org 2.2\program\soffice.exe C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CapMan.exe C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\ElogErr.exe C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\BROADC~1.EXE C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\SCRFS.exe C:\PROGRA~1\SONYER~1\Mobile\AUFILE~1.EXE C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\Ecfmserv.exe C:\Program Files\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://news.google.com/topstories?hl=fr&gl=FR&ceid=FR:fr R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Camfrog Toolbar - {AF2A1C5A-1AED-4E92-8BA8-D708EB79537E} - C:\Program Files\Camfrog\CamfrogBar\CamfrogBar.dll O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe O4 - Global Startup: Phone Connection Monitor.lnk = ? O4 - Global Startup: PowerCheck.lnk = C:\Program Files\PowerCheck\PowerCheck.exe O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU) O11 - Options group: [INTERNATIONAL] International* O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: http://www.secuser.com O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} - https://www.f-secure.com/en/home/support O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - https://www.f-secure.com/en/home/support O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - https://www.appdirect.com/products/apphelp/ O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4886/mcfscan.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Trust\Trust R-Series Mouse\KMWDSrv.exe O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

FillPCA · Answer

Re,

1/     *  Sélectionne le texte suivant :

Driver::
szkg

File::
C:\Windows\system32\DRIVERS\szkg.sys

Folder::
"C:\Documents and Settings\Bernard\Application Data\m"

    * Copie le texte sélectionné (CTRL+C).
    * Ouvre le bloc-note (programme>Accessoire>bloc-note).
    * Colle le texte copié dans ce bloc-note (CTRL+V).
    * Sauvegarde ce fichier sous le nom de CFScript.txt
    * Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe
    * Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
    * Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal!
      Ne touche à rien tant que le scan n'est pas terminé.
    * Une fois le scan achevé, un rapport va s'afficher: Poste son contenu.
    * Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

2/ Télécharge Ccleaner Basic https://www.ccleaner.com/ccleaner/download

Ouvre Ccleaner, clique sur "lancer le nettoyage".

3/ Télécharge AVGantispyware : https://www.avg.com/en-ww/free-antivirus-download
Tu l'installes.
Lance AVG Anti-Spyware et clique sur le bouton Mise à jour. Patiente.

Clique sur le bouton Analyse (de la barre d'outils)
Puis sur l'onglets Comment réagir, clique sur Actions recommandées. Sélectionne Quarantaine.
Reviens à l'onglet Analyse. Clique sur Analyse complète du système.
A la fin du scan, choisis l'option " Appliquer toutes les actions " en bas. Ensuite.
Clique sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware. 

4/     *  Fais un scan en ligne en cliquant ici : https://www.bitdefender.com/toolbox/
    * Tu dois réaliser le scan en utilisant Internet explorer. Une information apparait en haut, près de la barre d'état. Tu dois accepter et installer l'activeX proposé. La mise à jour de l'antivirus se lance.
    * Réalise un scan complet du système.
    * Sauvegarde le rapport en mode texte à l'issue du scan.

5/ Edite ces rapports :
Combofix, AVGantispyware, bit defender.

FillPCA

Moi même · Answer

Bonsoir Effectivement, le virus est bien localisé dans C:\Documents and Settings\Bernard\Application Data\m à l'emplacement ou BitDefender l'avait localisé initialement. Il a bien été trouvé et supprimé a la suite de la procédure avec ComboFix.exe que tu as indiquée et n'apparait plus dans le dernier scan de BitDefender. Je pense qu'il est éradiqué et que tout est rentré dans l'ordre. Merci mille fois encore pour ta précieuse aide qui a été particulièrement efficace. Ci dessous les logs des procédures. ____________________________________________________________________________________________________________ ComboFix 07-12-21.4 - Bernard 2007-12-28 17:46:18.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.218 [GMT 1:00] Running from: C:\Documents and Settings\Bernard\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Bernard\Bureau\CFScript.txt * Created a new restore point FILE C:\Windows\system32\DRIVERS\szkg.sys . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Bernard\Application Data\m C:\Documents and Settings\Bernard\Application Data\m\shared\BiblePromise . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_SZKG -------\szkg ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-28 to 2007-12-28 )))))))))))))))))))))))))))))))))))) . 2007-12-28 16:40 . 2004-08-05 13:00 153,088 --a------ C:\WINDOWS egedit.exe 2007-12-28 14:01 . 2007-12-28 14:01 d-------- C:\WINDOWS\ERUNT 2007-12-27 15:03 . 2007-12-27 15:03 17,374,963 --a------ C:\upload_moi_BV.tar.gz 2007-12-27 14:39 . 2007-12-13 12:08 d-------- C:\Program Files\Trust 2007-12-25 19:54 . 2007-12-28 09:04 d-------- C:\Documents and Settings\Bernard\Application Data\AVG7 2007-12-25 19:53 . 2007-12-25 19:53 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2007-12-25 19:53 . 2007-12-25 19:58 d-------- C:\Documents and Settings\All Users\Application Data\avg7 2007-12-22 20:41 . 2007-12-22 20:41 d-------- C:\Program Files\PC Inspector File Recovery 2007-12-22 20:41 . 2002-02-18 18:40 6,200 --a------ C:\WINDOWS\system32\INT13EXT.VXD 2007-12-22 15:47 . 2007-12-22 15:47 d-------- C:\Program Files\Trend Micro 2007-12-21 00:54 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\RkPavProc.sys 2007-12-21 00:50 . 2007-12-21 00:50 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-12-19 14:21 . 2007-12-19 14:24 250 --a------ C:\WINDOWS\gmer.ini 2007-12-18 00:58 . 2007-12-18 00:58 d-------- C:\WINDOWS\AU_Temp 2007-12-18 00:57 . 2007-12-18 00:53 40,069,133 --a------ C:\WINDOWS\LPT$VPN.891 2007-12-18 00:53 . 2007-12-18 00:53 40,069,133 --a------ C:\WINDOWS\VPTNFILE.891 2007-12-14 13:27 . 2007-12-14 13:27 d-------- C:\Documents and Settings\Bernard\Application Data\vlc 2007-12-13 11:51 . 2007-02-13 07:42 14,848 --a------ C:\WINDOWS\system32\drivers\KMWDFilter.SYS 2007-12-13 11:50 . 2007-12-13 11:50 d-------- C:\Documents and Settings\All Users\Application Data\{3E318E90-4BE6-4440-A0EE-2EAF8419199C} 2007-12-13 11:39 . 2004-08-20 00:09 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2007-12-13 11:39 . 2004-08-20 00:09 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-28 16:42 --------- d-----w C:\Program Files\Spamihilator 2007-12-28 16:05 --------- d-----w C:\Documents and Settings\Bernard\Application Data\OpenOffice.org2 2007-12-28 08:04 --------- d-----w C:\Program Files\RamBoost XP 2007-12-26 23:04 --------- d-----w C:\Program Files\eMule 2007-12-25 18:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-25 00:03 --------- d-----w C:\Program Files\3D Home Architect 2007-12-24 23:48 --------- d-----w C:\Program Files\Fake Webcam 2007-12-23 20:56 --------- d-----w C:\Program Files\Windows Live Safety Center 2007-12-22 19:41 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-19 17:29 --------- d-----w C:\Program Files\MSN Messenger 2007-12-19 17:29 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-12-17 23:58 86,094 ----a-w C:\WINDOWS\BPMNT.dll 2007-12-17 23:58 1,163,344 ----a-w C:\WINDOWS\vsapi32.dll 2007-12-17 23:53 71,749 ----a-w C:\WINDOWS\hcextoutput.dll 2007-12-17 23:53 267,845 ----a-w C:\WINDOWS sc.exe 2007-12-16 00:50 --------- d-----w C:\Program Files\WebcamMax 2007-12-16 00:48 --------- d-----w C:\Program Files\PowerCheck 2007-12-16 00:39 --------- d-----w C:\Program Files\Microsoft IntelliType Pro 2007-12-16 00:25 --------- d-----w C:\Program Files\Google 2007-12-14 12:25 --------- d-----w C:\Program Files\VideoLAN 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-28 19:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2007-11-18 05:49 286,720 ------w C:\WINDOWS\Setup1.exe 2007-11-14 16:28 --------- d-----w C:\Documents and Settings\Bernard\Application Data\ArcSoft 2007-11-14 16:26 --------- d-----w C:\Program Files\Fichiers communs\ArcSoft 2007-11-14 16:14 --------- d-----w C:\Program Files\Philips 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-07 19:35 --------- d-----w C:\Program Files\PC Camera 2007-10-31 05:45 --------- d-----w C:\Program Files\DipTrace 2007-10-28 12:20 --------- d-----w C:\Program Files\Java 2007-09-03 21:16 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2007-12-28_16.52.11.56 ))))))))))))))))))))))))))))))))))))))))) . + 2007-12-28 16:54:02 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_1a0.dat + 2007-12-28 16:53:38 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_530.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LDM"="\Program\BackWeb-8876480.exe" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-25 19:53] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5ECD31F0-F91A-11d4-B3CA-00D0B70A09D2}"= WDShell [ ] R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\system32\DRIVERS\bsstor.sys [2002-06-06 00:07] R0 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys [2002-10-05 10:46] R0 hptpro;hptpro;C:\WINDOWS\system32\DRIVERS\hptpro.sys [2002-04-27 07:34] R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys [2004-05-12 13:01] R1 GhPciScan;GhostPciScanner;C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys [2002-08-14 14:11] R2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files\Trust\Trust R-Series Mouse\KMWDSrv.exe [2007-06-09 00:23] R2 tyansmb;tyansmb;C:\WINDOWS\system32\Drivers yansmb.sys [2003-06-05 13:14] R3 KMWDFilter;KMWDFilter;C:\WINDOWS\System32\Drivers\KMWDFilter.SYS [2007-02-13 07:42] R3 SampleScanner;Ultima2000 Scanner;C:\WINDOWS\system32\DRIVERS\GT680x.sys [2001-06-07 16:56] R3 SUSCOM;Susteen Serial port driver;C:\WINDOWS\system32\DRIVERS\SUSCOM.SYS [2002-10-22 12:58] S2 CamthWDM;WebcamMax, WDM Video Capture;C:\WINDOWS\system32\DRIVERS\CamthWDM.sys [2006-07-03 07:39] S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 17:08] S3 Amps2prt;PS/2 Port Mouse Filter Driver;C:\WINDOWS\system32\Drivers\Amps2prt.sys [2000-11-03 17:37] S3 CAM1210;SM0121 USB 2.0 Video Camera;C:\WINDOWS\system32\Drivers\cam1210.sys [2006-07-24 17:49] S3 camvid40;Philips SPC 900NC PC Camera;C:\WINDOWS\system32\DRIVERS\camdrv41.sys [2005-08-25 18:28] S3 ICAM5USB;Caméra CS110 Intel(r) PC;C:\WINDOWS\system32\Drivers\Icam5USB.sys [2001-08-17 21:06] S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;C:\WINDOWS\system32\DRIVERS\ManyCam.sys [2006-07-27 03:07] S4 BsUDF;InCD UDF Driver;C:\WINDOWS\system32\drivers\BsUDF.sys [2003-02-12 12:16] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2005-01-22 17:06:07 C:\WINDOWS\Tasks\1 Copernic Intra-Daily ~BV Bernard.job" - C:\Program Files\Copernic Agent\CopernicAgent.exe "2005-01-22 17:06:07 C:\WINDOWS\Tasks\2 Copernic Daily ~BV Bernard.job" - C:\Program Files\Copernic Agent\CopernicAgent.exe "2005-01-22 17:06:07 C:\WINDOWS\Tasks\3 Copernic Weekly ~BV Bernard.job" - C:\Program Files\Copernic Agent\CopernicAgent.exe "2005-01-22 17:06:07 C:\WINDOWS\Tasks\4 Copernic Monthly ~BV Bernard.job" - C:\Program Files\Copernic Agent\CopernicAgent.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-28 17:54:22 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-28 17:55:59 - machine was rebooted C:\ComboFix2.txt ... 2007-12-28 16:52 . 2007-12-12 08:34:57 --- E O F --- __________________________________________________________________________________________________________ --------------------------------------------------------- AVG Anti-Spyware - Rapport d'analyse --------------------------------------------------------- + Créé à: 20:03:45 28/12/2007 + Résultat de l'analyse: C:\Documents and Settings\Bernard\Bureau\Outils\EliBaglA.exe -> Heuristic.Win32.AVKiller : Nettoyé. :mozilla.47:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé. :mozilla.7:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé. :mozilla.8:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé. :mozilla.54:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé. :mozilla.38:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé. :mozilla.15:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé. C:\Documents and Settings\Bernard\Cookies\bernard@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Nettoyé. :mozilla.36:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Overture : Nettoyé. :mozilla.37:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Overture : Nettoyé. :mozilla.58:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Questionmarket : Nettoyé. :mozilla.59:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Questionmarket : Nettoyé. :mozilla.25:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé. :mozilla.26:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé. :mozilla.27:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé. :mozilla.28:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé. :mozilla.29:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé. :mozilla.44:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé. :mozilla.40:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé. :mozilla.41:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé. :mozilla.42:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé. :mozilla.45:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé. :mozilla.46:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé. :mozilla.53:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé. :mozilla.39:C:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé. Fin du rapport _________________________________________________________________________________________________________ BitDefender Online Scanner - Rapport virus en temps réel Généré à: Fri, Dec 28, 2007 - 22:20:56 -------------------------------------------------------------------------------- Info d'analyse Fichiers scannés 661967 Infectés Fichiers 0 Virus Détectés Aucun virus trouvé.

Moi même · Answer

Bonjour
Malheureusement, ca reboote encore ! Ce matin l'anomalie s'est à nouveau manifestée !

FillPCA · Answer

Bonjour,

Tu as des traces de 2 antivirus : AVG et Avast. Désinstalle proprement cleui qui tu n'utilises pas et édite un nouveau rapport Hijackthis et un rapport SREng.

FillPCA

Moi même · Answer

Les voici
_________________________________________________________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:38:31, on 29/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trust\Trust R-Series Mouse\KMWDSrv.exe
C:\Program Files\RamBoost XP\rambxpfr.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
C:\Program Files\PowerCheck\PowerCheck.exe
c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTE~2.EXE
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CapMan.exe
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\ElogErr.exe
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\BROADC~1.EXE
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\SCRFS.exe
C:\PROGRA~1\SONYER~1\Mobile\AUFILE~1.EXE
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\Ecfmserv.exe
C:\Program Files\Spamihilator\Spamihilator.exe
C:\Program Files\Alwil Software\Avast4\1ashDisp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://news.google.com/topstories?hl=fr&gl=FR&ceid=FR:fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Camfrog Toolbar - {AF2A1C5A-1AED-4E92-8BA8-D708EB79537E} - C:\Program Files\Camfrog\CamfrogBar\CamfrogBar.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RamBoostXp] C:\Program Files\RamBoost XP\rambxpfr.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
O4 - Global Startup: Phone Connection Monitor.lnk = ?
O4 - Global Startup: PowerCheck.lnk = C:\Program Files\PowerCheck\PowerCheck.exe
O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} - https://www.f-secure.com/en/home/support
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - https://www.f-secure.com/en/home/support
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - https://www.appdirect.com/products/apphelp/
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4886/mcfscan.cab
O23 - Service: Apache2 - Apache Software Foundation - C:\Program Files\Apache Group\Apache2\bin\Apache.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Trust\Trust R-Series Mouse\KMWDSrv.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

FillPCA · Answer

Re,

Ton antivirus apparait bien dans les services, mais pas au démarrage. ESt-il actif quand tu démarres le PC ? Je ne suis pas certain que le problème soit encore infectieux.

1/ Télécharge et utilise ATFcleaner et nettoie tout : http://pitcatsite.ovh.org/php/ATFCleaner.php
2/ Edite un nouveau rapport Diaghelp.

FillPCA

Moi même · Answer

Non l'antivirus ne se lance pas au démarrage ainsi que quelques autres applis auxiliaires Voici le rapport DiagHelp version v1.4 - http://www.malekal.com excute le 29/12/2007 à 21:11:19,89 Liste des derniers fichies modifies/crees dans windir\system32 et prefetch C:\WINDOWS\prefetch\CMD.EXE-137A0D53.pf -->29/12/2007 21:11:19 C:\WINDOWS\prefetch\CHCP.COM-17C61B40.pf -->29/12/2007 21:11:16 C:\WINDOWS\prefetch\WINZIP32.EXE-22905BC0.pf -->29/12/2007 21:10:41 C:\WINDOWS\prefetch\VERCLSID.EXE-3B227142.pf -->29/12/2007 21:10:30 C:\WINDOWS\prefetch\IEXPLORE.EXE-06887102.pf -->29/12/2007 21:09:19 C:\WINDOWS\prefetch\layout.ini -->29/12/2007 20:12:53 C:\WINDOWS\System32\drivers\gmer.sys -->19/12/2007 14:21:48 C:\WINDOWS\System32\drivers\aswmon.sys -->04/12/2007 15:56:02 C:\WINDOWS\System32\drivers\aswmon2.sys -->04/12/2007 15:55:46 C:\WINDOWS\System32\drivers\aswRdr.sys -->04/12/2007 15:53:39 C:\WINDOWS\System32\drivers\aswTdi.sys -->04/12/2007 15:51:52 C:\WINDOWS\System32\drivers\aavmker4.sys -->04/12/2007 15:49:02 C:\WINDOWS\System32\drivers\secdrv.sys -->13/11/2007 11:25:54 C:\WINDOWS\System32\wpa.dbl -->29/12/2007 19:35:43 C:\WINDOWS\System32\LVCOMSX.LOG -->28/12/2007 13:52:49 C:\WINDOWS\System32\Uninstall.ico -->21/12/2007 00:51:29 C:\WINDOWS\System32\pavas.ico -->21/12/2007 00:51:29 C:\WINDOWS\System32\Help.ico -->21/12/2007 00:51:29 C:\WINDOWS\System32\swreg.exe -->13/12/2007 21:26:50 C:\WINDOWS\System32\CONFIG.NT -->12/12/2007 09:32:51 C:\WINDOWS\System32\TZLog.log -->12/12/2007 01:30:26 C:\WINDOWS\System32\aswBoot.exe -->04/12/2007 14:04:28 C:\WINDOWS\System32\AVASTSS.scr -->04/12/2007 13:54:04 C:\WINDOWS\System32\MRT.exe -->03/12/2007 00:00:05 C:\WINDOWS\System32 zchange.exe -->13/11/2007 12:31:11 C:\WINDOWS\System32\mshtml.dll -->31/10/2007 00:23:48 C:\WINDOWS\System32\quartz.dll -->29/10/2007 23:43:32 C:\WINDOWS\System32\xpsp3res.dll -->29/10/2007 16:07:16 C:\WINDOWS\System32\jupdate-1.6.0_03-b05.log -->28/10/2007 13:20:46 C:\WINDOWS\System32\perfh00C.dat -->28/10/2007 09:19:00 C:\WINDOWS\System32\perfh009.dat -->28/10/2007 09:19:00 C:\WINDOWS\System32\perfc00C.dat -->28/10/2007 09:19:00 C:\WINDOWS\System32\perfc009.dat -->28/10/2007 09:19:00 C:\WINDOWS\System32\PerfStringBackup.INI -->28/10/2007 09:18:59 C:\WINDOWS\System32\shell32.dll -->25/10/2007 17:43:25 C:\WINDOWS\System32\wmasf.dll -->25/10/2007 09:28:30 C:\WINDOWS\System32\wininet.dll -->11/10/2007 00:49:45 C:\WINDOWS\System32\webcheck.dll -->11/10/2007 00:49:45 C:\WINDOWS\WindowsUpdate.log -->29/12/2007 21:04:48 C:\WINDOWS\0.log -->29/12/2007 19:35:15 C:\WINDOWS\wiadebug.log -->29/12/2007 19:34:53 C:\WINDOWS\wiaservc.log -->29/12/2007 19:34:45 C:\WINDOWS\TempFile -->29/12/2007 19:34:43 C:\WINDOWS\bootstat.dat -->29/12/2007 19:34:30 C:\WINDOWS\SchedLgU.Txt -->29/12/2007 19:32:31 C:\WINDOWS\system.ini -->29/12/2007 18:00:13 C:\WINDOWS\wmsetup.log -->29/12/2007 16:53:08 C:\WINDOWS sc.ini -->29/12/2007 11:45:57 C:\WINDOWS sc.ptn -->29/12/2007 09:56:29 C:\WINDOWS sc.exe -->29/12/2007 09:56:28 C:\WINDOWS\vsapi32.dll -->29/12/2007 09:56:27 C:\WINDOWS\hcextoutput.dll -->29/12/2007 09:56:27 C:\WINDOWS\VPTNFILE.919 -->29/12/2007 09:56:26 winlogon.exe Verified: Signed svchost.exe Verified: Signed ws2_32.dll Verified: Signed user32.dll Verified: Signed tcpip.sys Verified: Signed ndis.sys Verified: Signed null.sys Verified: Signed ListDLLs v2.25 - DLL lister for Win9x/NT Copyright (C) 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ explorer.exe pid: 1800 Command line: C:\WINDOWS\Explorer.EXE Base Size Version Path 0x44080000 0xcf000 7.00.6000.16574 C:\WINDOWS\system32\WININET.dll 0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll 0x43e00000 0x45000 7.00.6000.16574 C:\WINDOWS\system32\iertutil.dll 0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll 0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL 0x44360000 0x5cd000 7.00.6000.16574 C:\WINDOWS\system32\ieframe.dll 0x44160000 0x127000 7.00.6000.16574 C:\WINDOWS\system32\urlmon.dll 0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll 0x442b0000 0x3c000 7.00.6000.16574 C:\WINDOWS\system32\webcheck.dll 0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\WPDShServiceObj.dll 0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceTypes.dll 0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll 0x10000000 0x2f000 11.00.0000.0001 C:\WINDOWS\system32\WDShell.dll 0x61c20000 0x54000 8.00.0000.9118 C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll 0x5fc70000 0x18000 8.00.0000.9107 C:\Program Files\OpenOffice.org 2.2\program\uwinapi.dll 0x7c340000 0x56000 7.10.3052.0004 C:\Program Files\OpenOffice.org 2.2\program\MSVCR71.dll 0x61740000 0x8e000 4.05.2003.0120 C:\Program Files\OpenOffice.org 2.2\program\stlport_vc7145.dll 0x7c3a0000 0x7b000 7.10.3077.0000 C:\Program Files\OpenOffice.org 2.2\program\MSVCP71.dll 0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll 0x02e40000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll 0x00a60000 0x13000 7.05.0001.0036 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll 0x16200000 0x6000 4.01.0000.0000 C:\PROGRA~1\WINZIP~1.1FR\WZSHLSTB.DLL 0x01100000 0x28000 C:\Program Files\WinRAR arext.dll 0x02030000 0x5d000 1.03.0004.0001 C:\Program Files\Sony Ericsson\Mobile\auexpext.dll 0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll 0x018c0000 0x2b000 1.03.0004.0001 C:\Program Files\Sony Ericsson\Mobile\FilGuiLg.dll 0x00d90000 0x8000 1.00.0000.0001 C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx ListDLLs v2.25 - DLL lister for Win9x/NT Copyright (C) 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ winlogon.exe pid: 672 Command line: winlogon.exe Base Size Version Path 0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe 0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll 0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll 0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll 0x01150000 0x3b000 1.07.0018.0005 C:\WINDOWS\system32\WgaLogon.dll 0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll 0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\WINDOWS\system 10/09/1999 12:06 4 672 WOWPOST.EXE 1 fichier(s) 4 672 octets 0 Rép(s) 47 971 311 616 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\WINDOWS\system32 20/08/2004 00:09 6 144 csrss.exe 1 fichier(s) 6 144 octets 0 Rép(s) 47 971 311 616 octets libres Contenu de Downloaded Program Files Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\WINDOWS\Downloaded Program Files 25/12/2007 14:07 . 25/12/2007 14:07 .. 07/03/2007 00:59 300 680 arclib.dll 24/08/2006 07:28 141 424 asinst.dll 22/08/2006 08:06 537 asinst.inf 09/12/2007 00:46 312 680 avsniff.dll 09/12/2007 00:38 773 avsniff.inf 09/12/2007 00:46 255 336 avsniffdlgs.dll 07/12/2004 16:07 32 bdcore.dll 25/05/2006 00:21 118 784 bdupd.dll 21/03/2002 14:26 815 bitdefender.inf 30/01/2003 15:52 348 160 bitdefender.ocx 25/06/2003 18:00 541 ca.pub 09/12/2007 00:38 241 CabSA.inf 19/12/2007 01:00 2 504 catalog.dat 27/03/2002 13:02 168 014 cssweb.dll 24/04/2003 14:11 259 cssweb.inf 17/01/2006 16:11 580 663 daas_s.dll 14/08/2004 13:51 65 desktop.ini 25/07/2002 17:13 24 576 dwusplay.dll 25/07/2002 17:13 196 608 dwusplay.exe 19/12/2007 01:00 6 899 ecbootil.vxd 09/12/2007 00:36 42 112 ecmldr32.dll 19/12/2007 01:00 284 016 ecmsvr32.dll 20/11/2007 16:04 1 523 536 FP_AX_CAB_INSTALLER.exe 03/02/2006 10:20 188 416 fsauc.dll 16/06/2006 14:31 181 856 fscax.dll 13/04/2007 15:52 482 fscax.inf 12/07/2000 01:02 36 864 fxfileop.dll 25/05/2006 00:21 53 248 ipsupd.dll 10/06/2005 09:44 417 792 isusweb.dll 07/01/2007 12:55 2 305 kavwebscan.inf 16/03/2005 11:34 7 407 lang.ini 11/12/2006 16:44 367 LegitCheckControl.inf 07/12/2004 16:07 32 libfn.dll 14/03/2005 13:38 126 live.ini 24/02/2006 11:49 882 mcfscan.inf 18/11/1999 12:48 995 mpeg4ax.inf 18/11/1999 12:49 992 msaudio.inf 09/12/2007 00:36 6 850 navapi.vxd 09/12/2007 00:36 201 896 navapi32.dll 19/12/2007 01:00 124 272 naveng32.dll 19/12/2007 01:00 914 800 navex32a.dll 17/01/2005 16:09 227 opuc.inf 01/06/2006 01:57 1 331 oscan8.inf 01/06/2006 01:54 471 040 oscan8.ocx 31/05/2006 03:15 10 oscan81.ocx_x 09/12/2007 00:46 296 336 rufsi.dll 14/03/2005 13:58 7 073 scanoptions.tsi 19/12/2007 01:00 97 776 scrauth.dat 20/11/2007 15:50 247 swflash.inf 19/12/2007 01:00 11 816 symaveng.cat 19/12/2007 01:00 1 061 symaveng.inf 19/12/2007 01:00 402 118 tcdefs.dat 19/12/2007 01:00 2 429 629 tcscan7.dat 19/12/2007 01:00 428 396 tcscan8.dat 19/12/2007 01:00 1 000 625 tcscan9.dat 19/12/2007 01:00 453 tinf.dat 19/12/2007 01:00 148 tinfidx.dat 19/12/2007 01:00 1 957 tinfl.dat 19/12/2007 01:00 68 399 tscan1.dat 19/12/2007 01:00 3 294 tscan1hd.dat 31/10/2001 09:37 118 uninst.bat 19/12/2007 01:00 4 778 v.grd 19/12/2007 01:00 2 267 v.sig 21/12/2007 19:08 294 403 vet.da1 19/11/2007 01:18 13 076 520 vet.dat 13/07/2007 05:11 1 353 016 vete.dll 19/12/2007 01:00 106 244 virscan.inf 19/12/2007 01:00 997 354 virscan1.dat 19/12/2007 01:00 570 966 virscan2.dat 19/12/2007 01:00 150 932 virscan3.dat 19/12/2007 01:00 320 253 virscan4.dat 19/12/2007 01:00 5 198 791 virscan5.dat 19/12/2007 01:00 392 361 virscan6.dat 19/12/2007 01:00 18 131 798 virscan7.dat 19/12/2007 01:00 1 899 941 virscan8.dat 19/12/2007 01:00 5 410 050 virscan9.dat 19/12/2007 01:00 32 virscant.dat 20/11/2006 12:02 180 282 webscan.dll 21/07/2006 12:55 477 webscan.inf 02/11/2005 17:01 1 777 xscan.inf 02/11/2005 17:07 435 712 xscan53.ocx 19/12/2007 01:00 224 zdone.dat 82 fichier(s) 60 199 069 octets Total des fichiers listés : 82 fichier(s) 60 199 069 octets 2 Rép(s) 47 971 307 520 octets libres Recherche de rootkit! (Merci S!Ri) Recherche d'infections connues Export des clefs sensibles.. Liste des fichiers en exception sur le pare-feu XP SP2 "C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe"="C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe:*:Enabled:mRouterRuntime" Export de la clef SharedTaskScheduler [SharedTaskScheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant" exports des policies REGEDIT4 [system] Export des clefs sensibles.. Rechercher adresses sensibles dans le fichier HOSTS... catchme 0.3.1319 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-29 21:12:19 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2C4D257C-72E2-E577-A752-291333787D00}] "hagepphnhnalohlb"=hex:61,61,00,00 "hagepphnnnglgocp"=hex:61,61,00,00 "iakfpidebimpimgooj"=hex:6b,61,68,69,67,68,6d,70,69,62,66,67,61,65,6c,66,67,70,61,6f,6f,.. "haegjngplkgkgjhj"=hex:6b,61,68,69,67,68,6d,70,69,62,66,67,61,65,6c,66,67,70,61,6f,6f,.. scanning hidden files ... scan completed successfully hidden services: 0 hidden files: 0 KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Process list by traversal of KiWaitListHead 4 - System 164 - avgas.exe 176 - ctfmon.exe 268 - rambxpfr.exe 364 - snmp.exe 620 - MROUTE~2.EXE 648 - csrss.exe 672 - winlogon.exe 716 - services.exe 728 - lsass.exe 876 - svchost.exe 956 - svchost.exe 1024 - ApacheMonitor.e 1048 - svchost.exe 1092 - svchost.exe 1116 - PowerCheck.exe 1288 - soffice.bin 1320 - ashServ.exe 1504 - spoolsv.exe 1800 - explorer.exe 1836 - CONNMN~1.EXE 1848 - msimn.exe 1976 - guard.exe 2152 - ashMaiSv.exe 2172 - ashWebSv.exe 2268 - 1ashDisp.exe 2672 - alg.exe 3280 - BROADC~1.EXE 3688 - cmd.exe -1304204150 - x --[Hidden]-- Total number of processes = 30 NOTE: Under WinXP, this will not show all processes. KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Driver/Module list by traversal of PsLoadedModuleList 804D7000 - \WINDOWS\system32 toskrnl.exe 806EC000 - \WINDOWS\system32\hal.dll F8A35000 - \WINDOWS\system32\KDCOM.DLL F8945000 - \WINDOWS\system32\BOOTVID.dll F84F5000 - imagesrv.sys F84C6000 - ACPI.sys F8A37000 - \WINDOWS\System32\DRIVERS\WMILIB.SYS F84B5000 - pci.sys F8535000 - isapnp.sys F8A39000 - viaide.sys F87B5000 - \WINDOWS\System32\DRIVERS\PCIIDEX.SYS F8545000 - MountMgr.sys F8496000 - ftdisk.sys F87BD000 - PartMgr.sys F8555000 - VolSnap.sys F847E000 - atapi.sys F8466000 - SI3112r.sys F844E000 - \WINDOWS\System32\DRIVERS\SCSIPORT.SYS F8565000 - hpt3xx.sys F8A3B000 - imagedrv.sys F8575000 - disk.sys F8585000 - \WINDOWS\System32\DRIVERS\CLASSPNP.SYS F842E000 - fltmgr.sys F8595000 - PxHelp20.sys F8949000 - bsstor.sys F894D000 - SiWinAcc.sys F8951000 - hptpro.sys F8417000 - KSecDD.sys F838A000 - Ntfs.sys F835D000 - NDIS.sys F87C5000 - viaagp1.sys F8A3D000 - sfhlp01.sys F8A3F000 - prosync1.sys F834B000 - prohlp02.sys F8330000 - Mup.sys F8695000 - \SystemRoot\System32\DRIVERS\amdk7.sys F7A7E000 - \SystemRoot\System32\DRIVERS\ati2mtag.sys F7A6A000 - \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS F88E5000 - \SystemRoot\System32\DRIVERS\usbuhci.sys F7A47000 - \SystemRoot\System32\DRIVERS\USBPORT.SYS F8A6F000 - \SystemRoot\System32\Drivers\vulfnth.sys F88ED000 - \SystemRoot\System32\DRIVERS\usbehci.sys F86A5000 - \SystemRoot\System32\DRIVERS\imapi.sys F7E1D000 - \SystemRoot\system32\drivers\pfc.sys F86B5000 - \SystemRoot\System32\DRIVERS\cdrom.sys F86C5000 - \SystemRoot\System32\DRIVERS edbook.sys F7A24000 - \SystemRoot\System32\DRIVERS\ks.sys F7976000 - \SystemRoot\system32\drivers\ALCXWDM.SYS F7952000 - \SystemRoot\system32\drivers\portcls.sys F86D5000 - \SystemRoot\system32\drivers\drmk.sys F88F5000 - \SystemRoot\System32\DRIVERS\fetnd5.sys F88FD000 - \SystemRoot\System32\DRIVERS\fdc.sys F7941000 - \SystemRoot\System32\DRIVERS\serial.sys F7E11000 - \SystemRoot\System32\DRIVERS\serenum.sys F792D000 - \SystemRoot\System32\DRIVERS\parport.sys F86E5000 - \SystemRoot\System32\DRIVERS\i8042prt.sys F8905000 - \SystemRoot\System32\DRIVERS\kbdclass.sys F7E0D000 - \SystemRoot\System32\DRIVERS\gameenum.sys F8BFD000 - \SystemRoot\System32\DRIVERS\audstub.sys F86F5000 - \SystemRoot\System32\DRIVERS asl2tp.sys F7E09000 - \SystemRoot\System32\DRIVERS distapi.sys F7916000 - \SystemRoot\System32\DRIVERS diswan.sys F8705000 - \SystemRoot\System32\DRIVERS aspppoe.sys F8715000 - \SystemRoot\System32\DRIVERS aspptp.sys F890D000 - \SystemRoot\System32\DRIVERS\TDI.SYS F7905000 - \SystemRoot\System32\DRIVERS\psched.sys F8725000 - \SystemRoot\System32\DRIVERS\msgpc.sys F8915000 - \SystemRoot\System32\DRIVERS\ptilink.sys F891D000 - \SystemRoot\System32\DRIVERS aspti.sys F8735000 - \SystemRoot\System32\DRIVERS ermdd.sys F8925000 - \SystemRoot\System32\DRIVERS\mouclass.sys F8A71000 - \SystemRoot\System32\DRIVERS\swenum.sys F78D1000 - \SystemRoot\System32\DRIVERS\update.sys F89F1000 - \SystemRoot\System32\DRIVERS\mssmbios.sys F8775000 - \SystemRoot\System32\Drivers\NDProxy.SYS F8A15000 - \SystemRoot\System32\Drivers\vulfntr.sys F8795000 - \SystemRoot\System32\DRIVERS\usbhub.sys F8A77000 - \SystemRoot\System32\DRIVERS\USBD.SYS F892D000 - \SystemRoot\System32\DRIVERS\flpydisk.sys F8A79000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS F8C23000 - \SystemRoot\System32\Drivers\Null.SYS F8A7B000 - \SystemRoot\System32\Drivers\Beep.SYS F8C0D000 - \SystemRoot\System32\DRIVERS\AvgAsCln.sys F87FD000 - \SystemRoot\System32\DRIVERS\usbccgp.sys F8805000 - \??\C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys F880D000 - \SystemRoot\System32\drivers\vga.sys F8A7D000 - \SystemRoot\System32\Drivers\mnmdd.SYS F8A7F000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys F8815000 - \SystemRoot\System32\Drivers\Msfs.SYS F881D000 - \SystemRoot\System32\Drivers\Npfs.SYS F8308000 - \SystemRoot\System32\DRIVERS asacd.sys EF856000 - \SystemRoot\System32\DRIVERS\ipsec.sys EF7FE000 - \SystemRoot\System32\DRIVERS cpip.sys F7B92000 - \SystemRoot\System32\Drivers\aswTdi.SYS EF7D6000 - \SystemRoot\System32\DRIVERS etbt.sys F8304000 - \SystemRoot\System32\drivers\ws2ifsl.sys EF7B4000 - \SystemRoot\System32\drivers\afd.sys F7B82000 - \SystemRoot\System32\DRIVERS etbios.sys EF789000 - \SystemRoot\System32\DRIVERS dbss.sys F7B72000 - \SystemRoot\System32\drivers\prodrv06.sys EF6F2000 - \SystemRoot\System32\DRIVERS\mrxsmb.sys F7B62000 - \SystemRoot\System32\Drivers\Fips.SYS EF6D1000 - \SystemRoot\System32\DRIVERS\ipnat.sys F7B52000 - \SystemRoot\System32\DRIVERS\wanarp.sys F82E8000 - \SystemRoot\System32\DRIVERS\GT680x.sys F82E4000 - \??\C:\WINDOWS\System32\Drivers\KMWDFilter.SYS F82E0000 - \SystemRoot\system32\DRIVERS\hidusb.sys F7B42000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS F8825000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS F7B32000 - \SystemRoot\system32\DRIVERS\SUSCOM.SYS F8BA3000 - \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys F882D000 - \SystemRoot\System32\Drivers\Aavmker4.SYS EF5BE000 - \SystemRoot\System32\DRIVERS\LVCM.sys F85D5000 - \SystemRoot\System32\DRIVERS\STREAM.SYS EF59B000 - \SystemRoot\System32\Drivers\Fastfat.SYS F85F5000 - \SystemRoot\system32\drivers\usbaudio.sys F7E21000 - \SystemRoot\System32\DRIVERS\mouhid.sys EF583000 - \SystemRoot\System32\Drivers\dump_atapi.sys F8A95000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS BF800000 - \SystemRoot\System32\win32k.sys EF88D000 - \SystemRoot\System32\drivers\Dxapi.sys F884D000 - \SystemRoot\System32\watchdog.sys BF9C3000 - \SystemRoot\System32\drivers\dxg.sys F8C10000 - \SystemRoot\System32\drivers\dxgthk.sys BF9D5000 - \SystemRoot\System32\ati2dvag.dll BFA10000 - \SystemRoot\System32\ati3d1ag.dll EF2ED000 - \SystemRoot\System32\Drivers\aswMon2.SYS EF170000 - \SystemRoot\system32\drivers\wdmaud.sys EF51B000 - \SystemRoot\system32\drivers\sysaudio.sys EEE95000 - \SystemRoot\System32\DRIVERS\mrxdav.sys F8635000 - \??\C:\WINDOWS\System32\drivers\Haspnt.sys F8AC7000 - \SystemRoot\System32\Drivers\ParVdm.SYS EF185000 - \SystemRoot\System32\Drivers\Aspi32.SYS F8B60000 - \??\C:\Program Files\ICprog\icprog.sys EEDC5000 - \??\C:\WINDOWS\System32\drivers\hardlock.sys EECAB000 - \SystemRoot\System32\DRIVERS\srv.sys EEC49000 - \??\C:\WINDOWS\system32\drivers mcomm.sys EF299000 - \??\C:\WINDOWS\system32\Drivers yansmb.sys EEF02000 - \SystemRoot\System32\Drivers\Cdfs.SYS EE898000 - \SystemRoot\System32\Drivers\HTTP.sys EE7B4000 - \SystemRoot\System32\Drivers\aswRdr.SYS EE243000 - \SystemRoot\system32\DRIVERS\sr.sys EE218000 - \SystemRoot\system32\drivers\kmixer.sys F8C43000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys Total number of drivers = 144 Liste des programmes installes ACDSee 9 Gestionnaire de photos Ad-Aware SE Personal Adobe Acrobat 5.0 Adobe Flash Player ActiveX Adobe Photoshop 7.0 Ahead InCD Apache HTTP Server 2.0.55 Archiveur WinRAR ARTEC ATI Control Panel ATI Display Driver avast! Antivirus AVG Anti-Spyware 7.5 Barre d'outils MSN Camfrog Video Chat 3.91 (remove only) CamStudio 2.0 Fr Canon i560 CCleaner (remove only) Command On Demand for Command Software Compel Adaptec WinASPI ConTEXT Copernic Agent Professional Corel Paint Shop Pro X CorelDRAW Graphics Suite 12 Correctif pour Lecteur Windows Media 11 (KB939683) CuteFTP Pro EasyCleaner EchoLink eMule Etats Et Requêtes EVEREST Home Edition v2.01 Extension HighMAT pour l'Assistant Graver un CD de Microsoft Windows XP FileSpecs plug-in for Ad-Aware SE FileZilla (remove only) Freeplayer Frontline Attack - War over Europe Google Earth Google Toolbar for Firefox Google Toolbar for Internet Explorer HelpNDoc Version 1.10 Personal Edition HijackThis 2.0.2 Hotfix for Windows Media Format 11 SDK (KB929399) HydraVision J2SE Runtime Environment 5.0 J2SE Runtime Environment 5.0 Update 10 J2SE Runtime Environment 5.0 Update 11 J2SE Runtime Environment 5.0 Update 2 J2SE Runtime Environment 5.0 Update 4 J2SE Runtime Environment 5.0 Update 6 J2SE Runtime Environment 5.0 Update 9 Java(TM) 6 Update 2 Java(TM) 6 Update 3 Java(TM) SE Runtime Environment 6 Update 1 K-Lite Codec Pack 3.4.0 Full Kaspersky Online Scanner Language Pack for Ad-aware 6 Language pack for Ad-Aware SE Lecteur Windows Media 11 LiveReg (Symantec Corporation) LiveUpdate 1.80 (Symantec Corporation) Logitech Desktop Messenger Logitech MouseWare 9.79.1 Logitech Print Service Logitech QuickCam LST PCSOFT Macromedia Dreamweaver MX Macromedia Extension Manager Macromedia Fireworks 8 Meracl FontMap v2.1.1 Messenger Plus! Live Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 French Language Pack Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Data Access Components KB870669 Microsoft IntelliType Pro 5.0 Microsoft Internationalized Domain Names Mitigation APIs Microsoft Money 2001 Microsoft National Language Support Downlevel APIs Microsoft Office 2000 SR-1 Professional Microsoft Publisher 98 Microsoft User-Mode Driver Framework Feature Pack 1.0 Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615) Mise à jour de sécurité pour Windows XP (KB918118) Mise à jour de sécurité pour Windows XP (KB921503) Mise à jour de sécurité pour Windows XP (KB924667) Mise à jour de sécurité pour Windows XP (KB925902) Mise à jour de sécurité pour Windows XP (KB926436) Mise à jour de sécurité pour Windows XP (KB927779) Mise à jour de sécurité pour Windows XP (KB927802) Mise à jour de sécurité pour Windows XP (KB928255) Mise à jour de sécurité pour Windows XP (KB928843) Mise à jour de sécurité pour Windows XP (KB929123) Mise à jour de sécurité pour Windows XP (KB930178) Mise à jour de sécurité pour Windows XP (KB931261) Mise à jour de sécurité pour Windows XP (KB931784) Mise à jour de sécurité pour Windows XP (KB932168) Mise à jour de sécurité pour Windows XP (KB933729) Mise à jour de sécurité pour Windows XP (KB935839) Mise à jour de sécurité pour Windows XP (KB935840) Mise à jour de sécurité pour Windows XP (KB936021) Mise à jour de sécurité pour Windows XP (KB938829) Mise à jour de sécurité pour Windows XP (KB941202) Mise à jour de sécurité pour Windows XP (KB941568) Mise à jour de sécurité pour Windows XP (KB941569) Mise à jour de sécurité pour Windows XP (KB943460) Mise à jour de sécurité pour Windows XP (KB944653) Mise à jour pour Windows XP (KB927891) Mise à jour pour Windows XP (KB929338) Mise à jour pour Windows XP (KB930916) Mise à jour pour Windows XP (KB931836) Mise à jour pour Windows XP (KB933360) Mise à jour pour Windows XP (KB938828) Mise à jour pour Windows XP (KB942763) MixW 2.18 (Jan-09-2007) Mozilla Firefox (2.0.0.11) MSN Pictures Displayer 4.5 MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) NeoTrace Express 3.25 Nero 6 Ultra Edition Norton Ghost Novarm DipTrace OpenOffice.org 2.2 Panda ActiveScan PC Camera PC Camera Philips SPC 900NC PC Camera Philips VLounge PowerCheck 4.2.3 Programme de gestion Camera de Logitech® RamBoost XP 4.0.6 RFSim99 Saisie de Schéma SDS Soldiers - Heroes of World War II Sonic Foundry Sound Forge 6.0 Sony Ericsson PC Suite 3.1.1 Spamihilator Tracé de CI Trust R-Series Mouse Trust R-Series Mouse TyanSystemMonitor V2.13 USB Card Reader \Writer USB Storage Device USB Video Camera Driver v1.10 VideoLAN VLC media player 0.8.5-freehd Visionneuse Journal Windows Microsoft VX2 Cleaner plug-in for Ad-Aware SE WebFldrs XP Windows Genuine Advantage Notifications (KB905474) Windows Internet Explorer 7 Windows Live Messenger Windows Live OneCare safety scanner Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows XP Service Pack 2 Yahoo! Messenger Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\Program Files 29/12/2007 21:03 . 29/12/2007 21:03 .. 25/12/2007 01:03 3D Home Architect 14/08/2005 23:14 AboutTime 01/08/2007 22:03 ACD Systems 14/12/2005 19:13 AdaURL 24/03/2005 11:59 Adobe 21/11/2004 20:11 Age of Empires 2 22/08/2005 12:10 Ahead 23/06/2005 13:50 Alwil Software 03/05/2007 12:24 AnalogX 02/07/2007 16:55 Apache Group 14/08/2004 14:16 ATI Technologies 13/04/2007 23:40 Camfrog 23/09/2006 16:46 CamStudio 14/02/2007 17:08 CCleaner 04/09/2007 18:14 CodecSniper 13/08/2005 15:55 Codemasters 22/08/2005 17:20 Common Files 03/06/2007 22:41 ConCon 05/02/2007 22:22 ConTEXT 22/01/2005 18:05 Copernic Agent 18/07/2007 09:36 Corel 02/01/2007 00:15 Cucusoft 16/02/2007 00:50 Cuisinons 30/09/2006 15:27 Dial-Messenger 15/04/2007 00:04 Dictionnaire 31/10/2007 06:45 DipTrace 23/09/2004 20:02 directx 04/08/2007 01:10 DivX 04/10/2005 11:35 Drive Rescue 30/10/2004 11:47 EasyPHP1-7 07/09/2006 21:45 EchoLink 04/02/2006 15:46 Eidos Interactive 31/01/2005 00:38 Empire Earth 27/12/2007 00:04 eMule 25/12/2007 00:48 Fake Webcam 28/11/2007 20:23 Fichiers communs 05/10/2006 22:45 FileZilla 07/01/2007 21:47 Freeplayer 09/10/2004 23:37 GlobalSCAPE 16/12/2007 01:25 Google 29/12/2007 19:31 Grisoft 04/09/2007 18:23 GSpot 18/09/2007 18:56 HelpNDoc 23/04/2005 19:21 HighMAT CD Writing Wizard 28/12/2007 16:54 hijackthis 18/12/2005 16:48 ICprog 16/12/2007 01:26 Internet Explorer 01/09/2006 19:34 Intuwave Ltd 28/10/2007 13:20 Java 15/07/2007 14:10 Kazaa Lite K++ 04/09/2007 18:15 K-Lite Codec Pack 27/06/2005 23:06 Lavalys 21/08/2004 10:18 Lavasoft 03/09/2005 23:46 Logitech 09/07/2007 20:26 Macromedia 30/07/2006 14:08 ManyCam 14/08/2004 15:14 Meracl FontMap 07/06/2007 17:03 Messenger 19/12/2007 18:29 Messenger Plus! Live 21/08/2004 18:03 Micro Application 14/08/2004 16:26 microsoft frontpage 16/12/2007 01:39 Microsoft IntelliType Pro 05/08/2005 18:17 Microsoft Money 14/08/2004 17:53 Microsoft Office 26/03/2007 21:58 MixW 09/02/2005 15:54 Movie Maker 27/11/2005 13:58 Movies 16/12/2007 18:10 Mozilla Firefox 14/08/2004 13:49 MSN 15/05/2005 12:58 MSN Apps 14/08/2004 13:49 MSN Gaming Zone 19/12/2007 18:29 MSN Messenger 03/06/2007 22:37 MSN Pictures Displayer 16/11/2006 18:13 MSXML 4.0 24/03/2007 17:19 MyUninstall 02/01/2007 00:06 NeoDivx Suite 08/09/2007 16:29 NeoTrace Express 26/05/2007 21:04 NetMeeting 23/04/2005 19:28 OfficeUpdate11 19/05/2007 14:26 OpenOffice.org 2.2 24/12/2005 19:35 Opera 13/06/2007 16:26 Outlook Express 07/11/2007 20:35 PC Camera 15/07/2007 16:03 PC SOFT 14/11/2007 17:14 Philips 16/12/2007 01:48 PowerCheck 29/12/2007 19:34 RamBoost XP 14/09/2006 20:55 RegSeeker 25/04/2005 14:36 RFSim99 27/01/2005 18:59 Saisie de Schéma 14/08/2004 13:51 Services en ligne 22/08/2004 12:39 Sonic Foundry 22/08/2004 12:39 Sonic Foundry Setup 01/09/2006 19:35 Sony Ericsson 22/08/2004 12:39 Sound Forge 6.0 29/12/2007 21:05 Spamihilator 16/08/2007 19:39 Spybot - Search & Destroy 10/08/2007 03:03 STOPzilla! 24/02/2007 21:14 StuffPlug3 05/08/2005 17:58 Symantec 05/02/2005 23:26 ToniArts 27/01/2005 19:06 Tracé de CI 22/12/2007 15:47 Trend Micro 13/12/2007 12:08 Trust 20/08/2005 16:35 Tyan Computer Corp 14/08/2004 14:05 VIA Technologies, Inc 14/12/2007 13:25 VideoLAN 16/05/2005 17:57 vso 16/12/2007 01:50 WebcamMax 02/01/2007 00:01 WinASPI 23/09/2006 17:18 Windows AntiSpy 23/04/2005 19:21 Windows Journal Viewer 10/06/2007 10:14 Windows Live 23/12/2007 21:56 Windows Live Safety Center 03/11/2006 08:49 Windows Media Connect 2 03/11/2006 08:49 Windows Media Player 09/02/2005 15:49 Windows NT 23/04/2005 18:29 WinRAR 27/04/2005 08:26 WINRLC 10/03/2005 00:07 WinZip 8.1 Fr 14/08/2004 13:52 xerox 14/04/2007 10:53 Yahoo! 0 fichier(s) 0 octets 124 Rép(s) 47 960 502 272 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\Program Files\fichiers communs 28/11/2007 20:23 . 28/11/2007 20:23 .. 01/08/2007 22:07 ACD Systems 24/03/2005 11:59 Adobe 22/08/2005 12:09 Ahead 14/11/2007 17:26 ArcSoft 14/08/2004 15:33 Copernic 18/07/2007 09:37 Corel 18/07/2007 09:20 Designer 23/09/2004 20:02 FotoWire 15/07/2007 13:52 InstallShield 10/08/2007 02:38 iS3 28/12/2004 09:59 Java 03/09/2005 23:46 Logitech 09/07/2007 20:26 Macromedia 18/07/2007 09:37 Microsoft Shared 14/08/2004 13:50 MSSoap 14/08/2004 14:43 ODBC 01/10/2006 16:02 Panda Software 17/07/2007 00:01 PC SOFT 14/08/2004 13:50 Services 14/08/2004 14:43 SpeechEngines 05/08/2005 17:57 Symantec Shared 24/11/2007 10:14 System 20/08/2004 11:31 Vbox 0 fichier(s) 0 octets 25 Rép(s) 47 960 506 368 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders 19/05/2007 16:28 . 19/05/2007 16:28 .. 28/02/2002 23:03 561 209 MSONSEXT.DLL 03/06/1999 13:09 122 937 MSOWS409.DLL 07/03/2001 08:00 127 033 MSOWS40c.DLL 18/03/1999 05:37 593 977 RAGENT.DLL 4 fichier(s) 1 405 156 octets 2 Rép(s) 47 960 506 368 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\Program Files\common files 22/08/2005 17:20 . 22/08/2005 17:20 .. 22/08/2005 17:20 PCCamera 14/08/2004 15:49 System 0 fichier(s) 0 octets 4 Rép(s) 47 960 506 368 octets libres Le volume dans le lecteur C s'appelle Principal Le numéro de série du volume est D835-3672 Répertoire de C:\ c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\aspiinst.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\CMDS.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\CMDS16.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\E.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\GUEST.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\MSCDEX.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\Net.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\OHCI.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\PROTMAN.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\UHCI.EXE c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom CBE10-100BTX\Cbendis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Ethernet 10-100 + Modem\Cbendis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Ethernet II PS\Xpsndis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom PE3-10Bx\Pe3ndis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Re-100Btx + Ce3B-100Btx\Ce3ndis.exe c:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom RE10BT\Ce3ndis.exe c:\Documents and Settings\Bernard\.housecall\getMac.exe c:\Documents and Settings\Bernard\.housecall\patch.exe c:\Documents and Settings\Bernard\.housecall sc.exe c:\Documents and Settings\Bernard\.housecall6.6\getMac.exe c:\Documents and Settings\Bernard\.housecall6.6\patch.exe c:\Documents and Settings\Bernard\.housecall6.6 sc.exe c:\Documents and Settings\Bernard\Application Data\Microsoft\Installer\{D085A1B6-90A4-11D3-82B7-00C04FA309DE}\MnyIco.exe c:\Documents and Settings\Bernard\Bureau\ATF-Cleaner.exe c:\Documents and Settings\Bernard\Bureau\ComboFix.exe c:\Documents and Settings\Bernard\Bureau\WEBCAM DELIA LCVA_PCDrv_US_1_01_03_1104.EXE c:\Documents and Settings\Bernard\Bureau\A installer\2_Microsoft Flight Simulator 2002 crack.exe c:\Documents and Settings\Bernard\Bureau\A installer\Ahead Nero Burning Rom 6.0.0.9 Fr + serial.exe c:\Documents and Settings\Bernard\Bureau\A installer\Battlefield 1942 - Multi Keygen.exe c:\Documents and Settings\Bernard\Bureau\A installer\Codec - All CODECS for Windows Media Player (Will play ALL movies).exe c:\Documents and Settings\Bernard\Bureau\A installer\Deus_Ex_2_-_Invisible_War_Patch_v1.1.exe c:\Documents and Settings\Bernard\Bureau\A installer\Grand Prix 4 Patch (Official) 9.6.exe c:\Documents and Settings\Bernard\Bureau\A installer\Nero 6.0.0.9 - Fr Packet.exe c:\Documents and Settings\Bernard\Bureau\A installer\Nero 6.3.0.3 Ultra Full =Latest Version= + Key Gen.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\catchme.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\diff.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\dumphive.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\FilesInfoCmd.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\find2.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\Fport.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\grep.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\gzip.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\KProcCheck.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\LFiles.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\LISTDLLS.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\md5sums.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\pslist.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\sigcheck.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\streams.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp\swreg.exe c:\Documents and Settings\Bernard\Bureau\DiagHelp\DiagHelp ar.exe c:\Documents and Settings\Bernard\Bureau\LECTEUR MP3\audiodream_3410_2420.exe c:\Documents and Settings\Bernard\Bureau\LECTEUR MP3\mp3_recovery_drv.exe c:\Documents and Settings\Bernard\Bureau\OM a tester\Commander471Archive.exe c:\Documents and Settings\Bernard\Bureau\OM a tester\TRX MANAGER trmde376.exe c:\Documents and Settings\Bernard\Bureau\Outils\Antibagle-fr.exe c:\Documents and Settings\Bernard\Bureau\Outils\avgas-setup-7.5.1.43.exe c:\Documents and Settings\Bernard\Bureau\Outils\FxBeagle.exe c:\Documents and Settings\Bernard\Bureau\Outils\gmer.exe c:\Documents and Settings\Bernard\Bureau\Outils\SREngPS.EXE c:\Documents and Settings\Bernard\Bureau\Outils\clean\clean\gzip.exe c:\Documents and Settings\Bernard\Bureau\Outils\clean\clean\LFiles.exe c:\Documents and Settings\Bernard\Bureau\Outils\clean\clean\pskill.exe c:\Documents and Settings\Bernard\Bureau\Outils\clean\clean ar.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\catchme.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\diff.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\dumphive.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\FilesInfoCmd.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\find2.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\Fport.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\grep.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\gzip.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\KProcCheck.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\LFiles.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\LISTDLLS.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\md5sums.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\pslist.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\sigcheck.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\streams.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp\swreg.exe c:\Documents and Settings\Bernard\Bureau\Outils\DiagHelp ar.exe c:\Documents and Settings\Bernard\Bureau\Outils\zip\SREngPS.EXE c:\Documents and Settings\Bernard\Bureau\Référenceur\submitic.exe c:\Documents and Settings\Bernard\Bureau\SAT\04-2005\Firmware_Flash308+.exe c:\Documents and Settings\Bernard\Bureau\SAT\flash XSAT\exe\Firmware_Flash308+.exe c:\Documents and Settings\Bernard\Bureau\SONY P900\UpdateService_Inst_2.6.4.9.exe c:\WinDev 11\Composants\Composants exemples\WD DerniersDocuments\WD DerniersDocuments - Exemple\Exe\WD DerniersDocuments - Exemple.exe c:\Documents and Settings\All Users\Application Data\Adobe\AWSCommonUI.dll c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll c:\Documents and Settings\Bernard\Application Data\Adobe\AWSCommonUI.dll c:\Documents and Settings\Bernard\Application Data\Macromedia\Dreamweaver MX\Configuration\Flash Player\FlashPlayerW.dll c:\Documents and Settings\Bernard\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll c:\Documents and Settings\Bernard\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll c:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll c:\Documents and Settings\Bernard\Application Data\Mozilla\Firefox\Profiles\ptl3pb7z.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll ****** Fin du rapport DiagHelp Veuillez svp envoyer le fichier C:\upload_moi_BV.tar.gz a l'adresse http://upload.malekal.com

FillPCA · Answer

Re,

1/ Ton rapport n'indique pas d'infection, mais montre l'origine des problèmes :
Liste des programmes installes :
eMule, Kazaa Lite K++

Et surtout ceci :

 c:\Documents and Settings\Bernard\Bureau\A installer\2_Microsoft Flight Simulator 2002 crack.exe
 c:\Documents and Settings\Bernard\Bureau\A installer\Battlefield 1942 - Multi Keygen.exe

Vire-moi ces saletés de crack. Bagle se propage par cracks.

2/ Pour Avast, fais ceci :
Ouvre le Bloc-note et copie-colle les lignes entre --- ci-dessous (y compris la ligne vide à la fin)

-----------------------------------------------------------------------------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Avast!"="C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

--------------------------------------------------------------------------------------------------------------

Enregistre ce fichier sur ton bureau (Nom du fichier : "Fixme.reg " -sans inclure les guillemets- ; Type : Tous les fichiers).
Double-clique sur Fixme.reg et clique sur Oui lorsqu'on te demande confirmation pour Fusionner.
Lorsque tu reçois un message du bon déroulement, supprime le fichier Fixme.reg.

Redémarre le pc et édite un rapport Hijackthis. Pour les reboots, as-tu vérifié s'il n'y avait pas de poussière dans la tour. Aspire-la si nécessaire et dis-moi ce qu'il en est précisément.

FillPCA

Moi même · Answer

Kazaa Lite K++ n'est plus installé depuis des lustres, il ne reste qu'un répertoire quasiment vide que j'ai supprimé manuellement
Avast ne s'ouvre toujours pas au démarrage, mais bon, je réinstallerai si besoin
J'ai deja regardé s'il n'y avait pas de probleme de type poussière et tout semble correct, de même avec les connexions et tous les composants sur lesquels j'ai tapoté mécaniquement pour vérifié si ca n'influencait pas sur la machine, RAS de ce côté la et c'est curieux
En fait la machine reboote de façon intempestive seulement avec une action dans une appli quelconque mais peut rester des heures et des heures sans probleme Il s'agit d'une anomalie intermittente
Je vais a nouveau regarder demain de trés prés mais mécaniquement tout me semble bon
Volia ci dessous le rapport HiJackThis
Logfile of HijackThis v1.99.1
Scan saved at 22:24:33, on 29/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\Program Files\Trust\Trust R-Series Mouse\KMWDSrv.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RamBoost XP\rambxpfr.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
C:\Program Files\PowerCheck\PowerCheck.exe
c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTE~2.EXE
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Spamihilator\Spamihilator.exe
C:\Program Files\Alwil Software\Avast4\1ashDisp.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://news.google.com/topstories?hl=fr&gl=FR&ceid=FR:fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Camfrog Toolbar - {AF2A1C5A-1AED-4E92-8BA8-D708EB79537E} - C:\Program Files\Camfrog\CamfrogBar\CamfrogBar.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RamBoostXp] C:\Program Files\RamBoost XP\rambxpfr.exe
O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
O4 - Global Startup: Phone Connection Monitor.lnk = ?
O4 - Global Startup: PowerCheck.lnk = C:\Program Files\PowerCheck\PowerCheck.exe
O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} - https://www.f-secure.com/en/home/support
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - https://www.f-secure.com/en/home/support
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - https://www.appdirect.com/products/apphelp/
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4886/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Trust\Trust R-Series Mouse\KMWDSrv.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

FillPCA · Answer

Re,
Le regfix n'a pas fonctionné. Désinstalle Avast, redémarre le pc puis ré-installe-le.
Si la réinstallation se fait correctement, tu n'as plus bagle.
Vérifie aussi si tu as accès au mode sans échec et tiens-moi au courant. Je regarde cela demain, probablement dans l'après-midi.

FillPCA

Moi même · Answer

Bonjour
Oui, Avast a été réinstallé correctement et tout fonctionne au démarrage.
Le mode sans échec fonctionne aussi.
Il subsiste un petit probleme mineur qui consiste à l'appartion d'une fenêtre à l'ouverture de Windows : elle contient quelques caractères non identifiables. Je vais rechercher d'ou ca vient en démarrage pas a pas et supprimer l'appli qui se lance.
J'ai à nouveau ouvert la tour et nettoyé avec de l'air comprimé comme cela avait été fait auparavant.
Le PC tourne depuis 2 jours et rien ne s'est produit : il n'existe plus, semble t'il, de redémarrage intempestif mais je reste toutefois vigilant...
Je pense que, sauf imprévu ou oubli, tout a enfin été réglé.
Merci encore et meilleurs voeux pour 2008

FillPCA · Answer

Salut,

Content si c'est rentré dans l'ordre.

1/ Il est fortement recommandé d'avoir tous ses logiciels de sécurité à jour, afin d'éviter les failles par lesquelles s'engouffrent les infections.
2/ Tu peux supprimer tous les logiciels que nous avons utilisés (Type: SmitFraufix, Blacklight, SDFix, lopxpMH, ect.....) qui traitent des infections spécifiques et qui sont mis à jour régulièrement. Il est inutile de les garder sur ton PC.
Tu peux par contre, garder AVG Antispyware et CCleaner.
3/ /!\ Maintenant que ton PC n'est plus infecté, désactive puis réactive ta "Restauration du système" afin de créer un point de restauration sain.
Pour désactiver ou activer la Restauration du système, tu dois  ouvrir une session Administrateur sous Windows XP. 
Désactivation:
Cliquer droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > cocher la case "Désactiver la Restauration du système sur tous les lecteurs"
> Appliquer et Ok. 
Activation:
Suivre le même chemin ; décocher la case "Désactiver la Restauration du système sur tous les lecteurs" 
> Appliquer et Ok. Redémarrer l'ordinateur.
4/ Comment faire pour...(lettre A): https://forum.pcastuces.com/sujet.asp?f=25&s=3902 
Pour améliorer la sécurité de ton PC prend quelques instants pour lire:
Sécuriser son PC +WIFI (versions "hot" & "light"): https://forum.pcastuces.com/default.asp 
5/ Dénonce ton infection pour faire condamner les auteurs.

Crée un message pour faire avancer les choses sur Malware-Complaints, nous devons être les plus nombreux possibles, alors rends compte de ton infection :
- Voir les règles du forum : https://malwarecomplaints.info/
- Après t'être enregistré à l'aide du bouton en haut se nommant "Register"
Si tu as plus de 13 ans, choisir : "I Agree to these terms and am over or exactly 13 years of age"
Si tu as moins, clique sur : "I Agree to these terms and am under 13 years of age"

Tu as alors, sous forme de liste, un sujet par type d'infection (Look2Me, Smitfraud, SpywareQuake etc..).

*** Ton infection : Bagle ***
>> https://malwarecomplaints.info/
Si le malware que tu as eu n'apparaît pas dans la liste, ou si tu ne sais pas par quoi tu étais infecté(e), crée un message dans le sujet Autres infections, conforme au règle du forum (âge, ville, département etc..)
Indique aussi le nom du Forum qui t'a aidé : CCM 
6/ Tu peux marquer ton sujet comme résolu en cliquant sur le bouton.
7/ Je te conseille enfin de défragmenter ton PC : http://www.coupdepoucepc.com/modules/news/article.php?storyid=218

Bon surf et bonne fin d'année !

FillPCA

Virus récalcitrant ? Win32.WORM.BAGLE.ZJJ

25 réponses

Discussions similaires

Newsletters