infection trojan-dropper Résolu

Question

Bonjour,
voila depuis 2 jour avast et kaspersky on trouvé des objet malveillant sur mon pc...
je n'arrive pas a les supprimé... au lieu de supprimé le mechan trojan ca me supprime des fichier infecter par celui ci tel que:wanadoo exe...msn messenger exe etc...
pouvez vous m'aider svp??
merci d'avance

g!rly · Accepted Answer

--
mouvement de non entraide a suivre très prochainement...

la2s · Answer

pour les info complementaires voici le rapport hijackthis...
faut t'il d'autre rapport???
que faire maintenan??svp aidez moi!
merci


Logfile of HijackThis v1.99.1
Scan saved at 20:18:59, on 10/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\Ma10Pan.Exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp .exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Ma10Pan] Ma10Pan.Exe
O4 - HKLM\..\Run: [At01Pan] At01Pan.Exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

ep44 · Answer

re la2s

pour commencer 
tu vas supprimer ta version hijack
vérifie dans programme files et dans ajout et suppression de programmes 
ensuite télécharge dette version 
ftp://ftp.commentcamarche.com/download/HJTInstall.exe
 avant de lancer le scan hijack tu vas dans c:=>programmes files=>trend micro=>hijack=>tu ouvre le doosier hijack et tu retrouve un autre dossier hijack que tu renomme par ce que tu veux 
exemple la2s.exe
ensuite tu lance hijack et poste le rapport 
@+

la2s · Answer

voici le rapport...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:58:04, on 10/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Ma10Pan.Exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp .exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\la2s.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: {9e74126d-b24f-98a8-58e4-8bd303cb3844} - {4483bc30-3db8-4e85-8a89-f42bd62147e9} - C:\WINDOWS\system32\evgjwmwo.dll
O2 - BHO: (no name) - {46E41C62-A54B-4EAF-8554-F1699A1DEEAC} - C:\WINDOWS\system32\ddccd.dll
O2 - BHO: (no name) - {50A0D6FC-FB0B-437A-A758-3DD009074B9C} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {CBFA0E8E-7489-4A16-8D6E-0D58BFFB6134} - C:\WINDOWS\system32\awtrrpn.dll
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Ma10Pan] Ma10Pan.Exe
O4 - HKLM\..\Run: [At01Pan] At01Pan.Exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O20 - Winlogon Notify: awtrrpn - C:\WINDOWS\SYSTEM32\awtrrpn.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--

la2s · Answer

voici le rapport...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:58:04, on 10/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Ma10Pan.Exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp .exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\la2s.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: {9e74126d-b24f-98a8-58e4-8bd303cb3844} - {4483bc30-3db8-4e85-8a89-f42bd62147e9} - C:\WINDOWS\system32\evgjwmwo.dll
O2 - BHO: (no name) - {46E41C62-A54B-4EAF-8554-F1699A1DEEAC} - C:\WINDOWS\system32\ddccd.dll
O2 - BHO: (no name) - {50A0D6FC-FB0B-437A-A758-3DD009074B9C} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {CBFA0E8E-7489-4A16-8D6E-0D58BFFB6134} - C:\WINDOWS\system32\awtrrpn.dll
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Ma10Pan] Ma10Pan.Exe
O4 - HKLM\..\Run: [At01Pan] At01Pan.Exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O20 - Winlogon Notify: awtrrpn - C:\WINDOWS\SYSTEM32\awtrrpn.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--

ep44 · Answer

Télécharge VundoFix (par Atribune) sur ton Bureau :
http://www.atribune.org/ccount/click.php?id=4

    * Double-clique VundoFix.exe afin de le lancer
    * Clique sur le bouton Scan for Vundo
    * Lorsque le scan est complété, clique sur le bouton Remove Vundo
    * Une invite te demandera si tu veux supprimer les fichiers, clique YES
    * Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
    * Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
    * Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse
@+

la2s · Answer

voici le rapport de vundofix

VundoFix V6.7.7

Checking Java version...

Scan started at 16:31:18 11/01/2008

Listing files found while scanning....

C:\WINDOWS\system32\awtrrpn.dll
C:\WINDOWS\system32\dccdd.ini
C:\WINDOWS\system32\dccdd.ini2
C:\windows\system32\ddayx.dll
C:\WINDOWS\system32\ddccd.exe
C:\WINDOWS\system32\evgjwmwo.dll
C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32	uvsron.dll
C:\WINDOWS\system32	uvvuss.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\awtrrpn.dll
C:\WINDOWS\system32\awtrrpn.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\dccdd.ini
C:\WINDOWS\system32\dccdd.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\dccdd.ini2
C:\WINDOWS\system32\dccdd.ini2 Has been deleted!

 Attempting to delete C:\windows\system32\ddayx.dll
C:\windows\system32\ddayx.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ddccd.exe
C:\WINDOWS\system32\ddccd.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\evgjwmwo.dll
C:\WINDOWS\system32\evgjwmwo.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32	uvsron.dll
C:\WINDOWS\system32	uvsron.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32	uvvuss.dll
C:\WINDOWS\system32	uvvuss.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\awtrrpn.dll
C:\WINDOWS\system32\awtrrpn.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.7.7

Checking Java version...

Scan started at 16:50:07 11/01/2008

Listing files found while scanning...

la2s · Answer

et le nouveau rapport de hijackthis...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:54:26, on 11/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Ma10Pan.Exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\shell.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\la2s.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: {9e74126d-b24f-98a8-58e4-8bd303cb3844} - {4483bc30-3db8-4e85-8a89-f42bd62147e9} - C:\WINDOWS\system32\evgjwmwo.dll (file missing)
O2 - BHO: (no name) - {50A0D6FC-FB0B-437A-A758-3DD009074B9C} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {CBFA0E8E-7489-4A16-8D6E-0D58BFFB6134} - C:\WINDOWS\system32\awtrrpn.dll
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Ma10Pan] Ma10Pan.Exe
O4 - HKLM\..\Run: [At01Pan] At01Pan.Exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

la2s · Answer

quelq'un pour m'aider svp???

Regis59 · Answer

Bonsoir,

Comme tu es deja sur un poste, continue avec ep44 :-)

Au plaisir.

g!rly · Answer

salut la2s,

meme chose que  evasion60/PCA : ep44 va s´occuper de toi,  t´inkiet pas...

tu peux neamoins faire ceci pour avancer :

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe      

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

@+

g!rly · Answer

bonsoir evasion60/PCA,

je suis intervenue car la2s, m´a envoyé un mp; voila tout...

Pas besoin pour le moment de ComboFix / OK > chacun sa methode...

je vous laisse finir.

bye`

la2s · Answer

excusez moi tout le monde...
c juste que je m'inquietai de ne pas avoir de reponse alors jvs ai demander de l'aide...
mais les gens ici quan il commencent il finissent le boulo...(chose que je ne savai pas je suis nouveau ici...)
alors je vai attendre patiement le retour de ep44...encore merci a vous

la2s · Answer

ok merci a vs tous quan meme...
une epine du pied qui est presque enlever...lol







Si ton labeur est dur, et tes resultats sont minces, rappelle toi qu'un jour le grand chene a ete un gland....comme moi...

ep44 · Answer

Bonsoir la2s,

je suis vraiment désolé mais je suis en pleine période professionnelle 
partit ce matin vers 6h15 et de retour ce soir vers 20h :-(
en ce moment dur dur le boulot :-)

pour ton sujet 
je vois que tu as eu que du beau monde pour te répondre 
donc ne soit pas inquiet même si je me trompe tu auras du répondant derrière 
donc que du bonheur ;-)))) 

 pour suivre fait ceci 

Relance Vundofix

=> Ne clique pas sur "Scan for a vundo"
=> Clique droit au milieu de la fenêtre
=> Clique sur Add more files ?
=> Copie/colle les fichiers ci-dessous ( un par case) :

C:\WINDOWS\system32\awtrrpn.dll 


=> Clique sur Add files
=> Ensuite clique sur Close Windows
=> Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
=> Si l'outil demande un redémarrage, accepte
=> Poste le rapport Vundofix, ainsi qu'un nouveau log hijackthis 

@+

la2s · Answer

en tout cas merci a toi de m'accorder de ton temps pouyr regler mon soucis...
g relancer vundofix comme tu me la indiqué
la une page d'erreur me dis que le fichier sera supprimé au redemarrage....ca reboot
au lancement de windows il s'execute meme message d'ereur et au reboot a ma grande supprise le fichier n'apparaissait plus dans la fenetre de vundo fix...
g donc relancé un scan par precaution...ca me rend fou c bestiole la ! lol
 voici le rapport de vundofix

VundoFix V6.7.7

Checking Java version...

Scan started at 16:50:07 11/01/2008

Listing files found while scanning....


Beginning removal...

 Attempting to delete C:\WINDOWS\system32\awtrrpn.dll 
C:\WINDOWS\system32\awtrrpn.dll  Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\awtrrpn.dll 
C:\WINDOWS\system32\awtrrpn.dll  Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\awtrrpn.dll 
C:\WINDOWS\system32\awtrrpn.dll  Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\awtrrpn.dll 
C:\WINDOWS\system32\awtrrpn.dll  Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.7.7

Checking Java version...

Scan started at 22:23:22 11/01/2008

Listing files found while scanning....

C:\WINDOWS\system32\awtrrpn.dll
C:\WINDOWS\system32\ddccd.dll
C:\WINDOWS\system32\vturq.dll


et la le scan hijackthis...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:43:08, on 11/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Ma10Pan.Exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\shell.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\la2s.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: {9e74126d-b24f-98a8-58e4-8bd303cb3844} - {4483bc30-3db8-4e85-8a89-f42bd62147e9} - C:\WINDOWS\system32\evgjwmwo.dll (file missing)
O2 - BHO: (no name) - {50A0D6FC-FB0B-437A-A758-3DD009074B9C} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {CBFA0E8E-7489-4A16-8D6E-0D58BFFB6134} - C:\WINDOWS\system32\awtrrpn.dll
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Ma10Pan] Ma10Pan.Exe
O4 - HKLM\..\Run: [At01Pan] At01Pan.Exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

ep44 · Answer

bon ce n'est pas grave nous allons suivre le conseil de g!rly

Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix,
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
@+

la2s · Answer

ok j'ai fait la manip... g eu du mal a revenir dis donc mon gestionnaire internet etai desinstaller plus de connection et maintenant internet exploreur bugue...connection impossible...decidement ! voici le rapport de combo fix ComboFix 08-01-11.1 - MASSAS 2008-01-11 22:54:34.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.502 [GMT 1:00] Running from: C:\Documents and Settings\MASSAS\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\PROGRA~1\Wanadoo\GestMaj.exe C:\PROGRA~1\Wanadoo\Shell.exe C:\Program Files\Alwil Software\Avast4\ashDisp .exe C:\Program Files\Wanadoo\GestMaj .exe C:\Program Files\Wanadoo\Shell .exe C:\Program Files\Windows Live\Messenger\msnmsgr .exe C:\Program Files\Windows Live\Messenger\msnmsgr .exe C:\Program Files\Windows Live\Messenger\msnmsgr .exe C:\Program Files\Windows Live\Messenger\msnmsgr .exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\cookies.ini C:\WINDOWS\system32\cyrtpwkk.ini C:\WINDOWS\system32\ddccd.dll C:\WINDOWS\system32\msvcsv60.dll C:\WINDOWS\system32\stvwa.ini C:\WINDOWS\system32\stvwa.ini2 C:\WINDOWS\system32\vturq.dll [code]

C:\Program Files\Alwil Software\Avast4\ashDisp .exe ---> QooBox
C:\Program Files\Wanadoo\GestMaj .exe ---> QooBox
C:\Program Files\Wanadoo\Shell .exe ---> QooBox
Error moving C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe to C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe: 5.

[/code] . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-11 to 2008-01-11 )))))))))))))))))))))))))))))))))))) . 2008-01-11 22:53 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-11 22:52 . 2008-01-11 22:52 d-------- C:\Documents and Settings\MASSAS\WINDOWS 2008-01-11 22:52 . 1997-05-12 17:53 314,368 --a------ C:\WINDOWS\IsUninst.exe 2008-01-11 16:31 . 2008-01-11 22:36 d-------- C:\VundoFix Backups 2008-01-10 21:17 . 2008-01-10 21:30 1,374 --a------ C:\WINDOWS\imsins.BAK 2008-01-10 20:56 . 2008-01-10 20:56 d-------- C:\Program Files\Trend Micro 2008-01-10 20:56 . 2008-01-10 20:56 812,344 --a------ C:\HJTInstall.exe 2008-01-10 20:03 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2008-01-10 20:03 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2008-01-10 20:03 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2008-01-10 20:03 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2008-01-10 20:03 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2008-01-10 20:03 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2008-01-10 20:03 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2008-01-10 20:03 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2008-01-10 20:00 . 2008-01-10 20:00 d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-01-10 19:59 . 2008-01-10 20:00 d-------- C:\WINDOWS\system32\ZoneLabs 2008-01-10 19:59 . 2008-01-11 22:58 58,727 --a------ C:\WINDOWS\system32\vsconfig.xml 2008-01-10 19:54 . 2008-01-11 22:33 d-------- C:\WINDOWS\Internet Logs 2008-01-10 19:41 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-01-10 19:41 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-01-10 18:33 . 2005-01-04 20:32 d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau 2008-01-10 18:33 . 2005-01-04 20:32 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression 2008-01-10 18:33 . 2005-01-04 19:49 d--h----- C:\Documents and Settings\Administrateur\ModŠles 2008-01-10 18:33 . 2005-01-04 20:32 d-------- C:\Documents and Settings\Administrateur\Mes documents 2008-01-10 18:33 . 2005-01-04 20:32 dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer 2008-01-10 18:33 . 2005-01-04 20:32 d-------- C:\Documents and Settings\Administrateur\Favoris 2008-01-10 18:33 . 2005-01-04 20:32 d-------- C:\Documents and Settings\Administrateur\Bureau 2008-01-10 17:08 . 2008-01-10 18:42 d-------- C:\Program Files\The Cleaner Free 2008-01-10 17:08 . 2008-01-10 17:08 6,597,706 --a------ C:\cleaner5free.exe 2008-01-10 16:48 . 2008-01-10 16:48 4,839,016 --a------ C:\trsetup.exe 2008-01-09 18:42 . 2008-01-09 18:45 d-------- C:\Program Files\a-squared Free 2008-01-09 18:41 . 2008-01-09 18:41 21,263,712 --a------ C:\a2FreeSetup.exe 2008-01-09 18:33 . 2008-01-10 20:18 d-------- C:\hijackthis_199 2008-01-09 18:33 . 2008-01-09 18:33 212,843 --a------ C:\hijackthis_199.zip 2008-01-09 18:03 . 2008-01-09 18:03 d-------- C:\Program Files\SAGEM 2008-01-09 17:03 . 2008-01-09 17:03 d-------- C:\Program Files\Kaspersky Lab 2008-01-09 17:03 . 2008-01-09 17:03 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-01-08 23:18 . 2008-01-10 18:24 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-01-08 23:17 . 2008-01-08 23:17 d-------- C:\Spybot 2008-01-08 22:32 . 2008-01-11 21:51 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-01-08 22:31 . 2008-01-11 21:48 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-01-08 22:31 . 2008-01-08 22:31 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-01-08 21:17 . 2008-01-08 21:17 d-------- C:\Program Files\EA GAMES 2008-01-08 19:08 . 2008-01-08 19:09 d-------- C:\Documents and Settings\MASSAS\Application Data\DAEMON Tools 2008-01-08 18:46 . 2008-01-08 18:46 d-------- C:\Program Files\Alcohol Soft 2008-01-08 18:43 . 2008-01-08 18:43 715,248 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-01-08 18:22 . 2008-01-08 18:31 d-------- C:\Program Files\Windows Live 2008-01-08 18:22 . 2008-01-08 18:28 d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-01-08 18:22 . 2008-01-08 18:22 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-01-08 18:13 . 2008-01-08 18:19 25,773 --a------ C:\WINDOWS\system32\drivers\regguard.sys 2008-01-08 18:12 . 2008-01-08 18:12 d-------- C:\Program Files\Greatis 2008-01-08 18:12 . C:\WINDOWS\(2) C:\ComboFix\winstart.bat 2008-01-08 17:54 . 2008-01-08 17:54 d-------- C:\Program Files\CCleaner 2008-01-08 16:26 . 2008-01-09 17:46 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe 2008-01-07 22:44 . 2008-01-07 22:44 37,888 --------- C:\WINDOWS\system32\awtrrpn.dll 2008-01-07 17:44 . 2008-01-07 17:44 d-------- C:\Program Files\IK Multimedia 2008-01-07 17:44 . 2008-01-08 20:43 16 --a------ C:\WINDOWS\system32\w3data.vss 2008-01-07 17:44 . 2008-01-08 20:43 16 --a------ C:\WINDOWS\msocreg32.dat 2008-01-06 21:52 . 2008-01-06 21:52 d-------- C:\Documents and Settings\MASSAS\Application Data\CyberLink 2008-01-06 21:52 . 2008-01-06 21:52 d-------- C:\Documents and Settings\All Users\Application Data\CyberLink 2008-01-06 21:00 . 2008-01-06 21:00 d-------- C:\Program Files\DDD Pool 2008-01-06 20:23 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll 2008-01-06 20:23 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2008-01-06 20:23 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2008-01-06 20:23 . 2007-07-30 19:19 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2008-01-06 20:23 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2008-01-06 20:22 . 2008-01-06 20:22 d---s---- C:\Documents and Settings\MASSAS\UserData 2008-01-06 19:53 . 2008-01-06 19:53 0 --a------ C:\WINDOWS\Pool.INI 2008-01-06 19:26 . 2008-01-10 18:15 d-------- C:\Program Files\Google 2008-01-06 19:26 . 2008-01-06 19:26 d-------- C:\Program Files\GameHouse 2008-01-06 19:26 . 2008-01-06 19:26 d-------- C:\Documents and Settings\MASSAS\Application Data\GameHouse 2008-01-06 19:26 . 2008-01-06 19:26 d-------- C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9 2008-01-06 19:24 . 2008-01-06 19:24 0 --a------ C:\WINDOWS\LiveBilliards.INI 2008-01-06 19:18 . 2008-01-06 19:18 d-------- C:\Program Files\ReflexiveArcade 2008-01-06 17:59 . 2008-01-06 17:59 d-------- C:\Program Files\Microsoft Games . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-11 21:58 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-01-11 21:55 --------- d-----w C:\Program Files\Wanadoo 2008-01-10 19:00 75,932 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2008-01-10 19:00 74,396 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-01-10 17:25 --------- d-----w C:\Program Files\VstPlugins 2008-01-09 17:03 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-08 20:02 --------- d-----w C:\Program Files\Image-Line 2008-01-08 18:38 --------- d-----w C:\Program Files\eMule 2008-01-08 18:14 --------- d-----w C:\Documents and Settings\MASSAS\Application Data\Ahead 2008-01-08 17:30 --------- d-----w C:\Program Files\MSN Messenger 2007-12-05 00:41 7,435,392 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys . [code]

----a-w            56,928 2008-01-08 15:45:55  C:\Program Files\CyberLink\PowerDVD\PDVDServ .exe
----a-w            54,832 2008-01-08 15:45:56  C:\Program Files\CyberLink\PowerDVD\Language\Language .exe
----a-w           155,648 2008-01-08 15:45:57  C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck .exe
----a-w           143,360 2008-01-08 15:46:07  C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor .exe
----a-w           132,496 2008-01-08 15:46:03  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w           139,367 2008-01-10 18:49:16  C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp .exe
----a-w         5,674,352 2008-01-08 15:46:27  C:\Program Files\MSN Messenger\MsnMsgr .Exe
----a-w            20,480 2008-01-09 17:08:15  C:\Program Files\Wanadoo\Watch .exe
----a-w           919,016 2008-01-11 21:36:31  C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
----a-w            15,360 2008-01-09 16:46:01  C:\WINDOWS\system32\ctfmon .exe

[/code] ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4483bc30-3db8-4e85-8a89-f42bd62147e9}] C:\WINDOWS\system32\evgjwmwo.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CBFA0E8E-7489-4A16-8D6E-0D58BFFB6134}] 2008-01-07 22:44 37888 --------- C:\WINDOWS\system32\awtrrpn.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Raccourci vers la page des propriétés de High Definition Audio"="HDAShCut.exe" [2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe] "SoundMan"="SOUNDMAN.EXE" [2005-06-21 15:09 90112 C:\WINDOWS\SOUNDMAN.EXE] "AlcWzrd"="ALCWZRD.EXE" [2005-06-29 13:26 2806272 C:\WINDOWS\ALCWZRD.EXE] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [ ] "Ma10Pan"="Ma10Pan.Exe" [2006-03-15 14:34 786508 C:\WINDOWS\system32\Ma10Pan.exe] "At01Pan"="At01Pan.Exe" [2001-11-21 09:09 176128 C:\WINDOWS\system32\At01Pan.exe] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [ ] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] "System Patcher"= BTCPatcher.exe [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{CBFA0E8E-7489-4A16-8D6E-0D58BFFB6134}"= C:\WINDOWS\system32\awtrrpn.dll [2008-01-07 22:44 37888] R3 Ma10_01;Service for 1010 - 1;C:\WINDOWS\system32\drivers\Ma10Wdm.sys [2006-03-15 14:34] R3 Ma10_AA;Service for 1010 Audio Driver (EWDM);C:\WINDOWS\system32\drivers\Ma10.sys [2006-03-15 14:34] S0 Partizan;Partizan;C:\WINDOWS\system32\drivers\Partizan.sys [] S3 At01_01;Service for AT010-1;C:\WINDOWS\system32\drivers\At01wdm.sys [2001-11-21 09:09] S3 At01_02;Service for AT010-2;C:\WINDOWS\system32\drivers\At01wdm2.sys [2001-11-21 09:09] S3 At01_04;Service for AT010 MIDI;C:\WINDOWS\system32\drivers\At01wdm4.sys [2001-11-21 09:09] S3 At01_AA;Service for AT010 Audio Driver (EWDM);C:\WINDOWS\system32\drivers\At01.sys [2001-11-21 09:09] S3 RegGuard;RegGuard;C:\WINDOWS\system32\Drivers\regguard.sys [2008-01-08 18:19] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-11 22:58:05 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156] -> C:\WINDOWS\system32\awtrrpn.dll . Completion time: 2008-01-11 22:59:14 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-11 21:59:11 . 2008-01-10 20:30:55 --- E O F ---

ep44 · Answer

selectionne ceci


registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4483bc30-3db8-4e85-8a89-f42bd62147e9}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CBFA0E8E-7489-4A16-8D6E-0D58BFFB6134}] 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{CBFA0E8E-7489-4A16-8D6E-0D58BFFB6134}"=-

File::

C:\WINDOWS\system32\awtrrpn.dll 



=> Copie le texte sélectionné (CTRL+C).
=> Ouvre le bloc-notes (programme>Accessoires >bloc-notes).
=> Colle le texte copié dans ce bloc-notes (CTRL+V).
=> Sauvegarde ce fichier sous le nom de CFScript.txt
=> Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe
=> Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
=> Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
=> Une fois le scan achevé, un rapport va s'afficher : Poste son contenu.
=> Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

@+

la2s · Answer

ok merci je fais ca de suite et jte post le rapport...

la2s · Answer

voici le rapport... ComboFix 08-01-11.1 - MASSAS 2008-01-11 23:59:42.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.459 [GMT 1:00] Running from: C:\Documents and Settings\MASSAS\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\MASSAS\Bureau\CFScript.txt C:\Documents and Settings\MASSAS\Bureau\CFScript.txt * Created a new restore point FILE C:\WINDOWS\system32\awtrrpn.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\awtrrpn.dll . ((((((((((((((((((((((((((((( Fichiers créés 2007-12-11 to 2008-01-11 )))))))))))))))))))))))))))))))))))) . 2008-01-11 22:53 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-11 22:52 . 2008-01-11 22:52 d-------- C:\Documents and Settings\MASSAS\WINDOWS 2008-01-11 22:52 . 1997-05-12 17:53 314,368 --a------ C:\WINDOWS\IsUninst.exe 2008-01-11 16:31 . 2008-01-11 22:36 d-------- C:\VundoFix Backups 2008-01-10 21:17 . 2008-01-11 23:49 1,374 --a------ C:\WINDOWS\imsins.BAK 2008-01-10 20:56 . 2008-01-10 20:56 d-------- C:\Program Files\Trend Micro 2008-01-10 20:56 . 2008-01-10 20:56 812,344 --a------ C:\HJTInstall.exe 2008-01-10 20:03 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2008-01-10 20:03 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2008-01-10 20:03 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2008-01-10 20:03 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2008-01-10 20:03 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2008-01-10 20:03 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2008-01-10 20:03 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2008-01-10 20:03 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2008-01-10 20:00 . 2008-01-10 20:00 d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-01-10 20:00 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll 2008-01-10 20:00 . 2008-01-10 20:04 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-01-10 19:54 . 2008-01-11 23:53 d-------- C:\WINDOWS\Internet Logs 2008-01-10 19:41 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-01-10 19:41 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-01-10 18:33 . 2005-01-04 20:32 d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau 2008-01-10 18:33 . 2005-01-04 20:32 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression 2008-01-10 18:33 . 2005-01-04 19:49 d--h----- C:\Documents and Settings\Administrateur\Modèles 2008-01-10 18:33 . 2005-01-04 20:32 d-------- C:\Documents and Settings\Administrateur\Mes documents 2008-01-10 18:33 . 2005-01-04 20:32 dr------- C:\Documents and Settings\Administrateur\Menu Démarrer 2008-01-10 18:33 . 2005-01-04 20:32 d-------- C:\Documents and Settings\Administrateur\Favoris 2008-01-10 18:33 . 2005-01-04 20:32 d-------- C:\Documents and Settings\Administrateur\Bureau 2008-01-10 17:08 . 2008-01-10 18:42 d-------- C:\Program Files\The Cleaner Free 2008-01-10 17:08 . 2008-01-10 17:08 6,597,706 --a------ C:\cleaner5free.exe 2008-01-10 16:48 . 2008-01-10 16:48 4,839,016 --a------ C:\trsetup.exe 2008-01-09 18:42 . 2008-01-09 18:45 d-------- C:\Program Files\a-squared Free 2008-01-09 18:41 . 2008-01-09 18:41 21,263,712 --a------ C:\a2FreeSetup.exe 2008-01-09 18:33 . 2008-01-10 20:18 d-------- C:\hijackthis_199 2008-01-09 18:33 . 2008-01-09 18:33 212,843 --a------ C:\hijackthis_199.zip 2008-01-09 17:03 . 2008-01-09 17:03 d-------- C:\Program Files\Kaspersky Lab 2008-01-09 17:03 . 2008-01-09 17:03 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-01-08 23:18 . 2008-01-10 18:24 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-01-08 23:17 . 2008-01-08 23:17 d-------- C:\Spybot 2008-01-08 22:32 . 2008-01-11 21:51 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-01-08 22:31 . 2008-01-11 21:48 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-01-08 22:31 . 2008-01-08 22:31 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-01-08 21:17 . 2008-01-08 21:17 d-------- C:\Program Files\EA GAMES 2008-01-08 19:08 . 2008-01-08 19:09 d-------- C:\Documents and Settings\MASSAS\Application Data\DAEMON Tools 2008-01-08 18:46 . 2008-01-08 18:46 d-------- C:\Program Files\Alcohol Soft 2008-01-08 18:43 . 2008-01-08 18:43 715,248 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-01-08 18:22 . 2008-01-08 18:31 d-------- C:\Program Files\Windows Live 2008-01-08 18:22 . 2008-01-08 18:28 d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-01-08 18:22 . 2008-01-08 18:22 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-01-08 18:13 . 2008-01-08 18:19 25,773 --a------ C:\WINDOWS\system32\drivers\regguard.sys 2008-01-08 18:12 . 2008-01-08 18:12 d-------- C:\Program Files\Greatis 2008-01-08 18:12 . C:\WINDOWS\(2) C:\ComboFix\winstart.bat 2008-01-08 17:54 . 2008-01-08 17:54 d-------- C:\Program Files\CCleaner 2008-01-08 16:26 . 2008-01-09 17:46 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe 2008-01-07 17:44 . 2008-01-07 17:44 d-------- C:\Program Files\IK Multimedia 2008-01-07 17:44 . 2008-01-08 20:43 16 --a------ C:\WINDOWS\system32\w3data.vss 2008-01-07 17:44 . 2008-01-08 20:43 16 --a------ C:\WINDOWS\msocreg32.dat 2008-01-06 21:52 . 2008-01-06 21:52 d-------- C:\Documents and Settings\MASSAS\Application Data\CyberLink 2008-01-06 21:52 . 2008-01-06 21:52 d-------- C:\Documents and Settings\All Users\Application Data\CyberLink 2008-01-06 21:00 . 2008-01-06 21:00 d-------- C:\Program Files\DDD Pool 2008-01-06 20:23 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll 2008-01-06 20:23 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2008-01-06 20:23 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2008-01-06 20:23 . 2007-07-30 19:19 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2008-01-06 20:23 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2008-01-06 20:22 . 2008-01-06 20:22 d---s---- C:\Documents and Settings\MASSAS\UserData 2008-01-06 19:53 . 2008-01-06 19:53 0 --a------ C:\WINDOWS\Pool.INI 2008-01-06 19:26 . 2008-01-10 18:15 d-------- C:\Program Files\Google 2008-01-06 19:26 . 2008-01-06 19:26 d-------- C:\Program Files\GameHouse 2008-01-06 19:26 . 2008-01-06 19:26 d-------- C:\Documents and Settings\MASSAS\Application Data\GameHouse 2008-01-06 19:26 . 2008-01-06 19:26 d-------- C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9 2008-01-06 19:24 . 2008-01-06 19:24 0 --a------ C:\WINDOWS\LiveBilliards.INI 2008-01-06 19:18 . 2008-01-06 19:18 d-------- C:\Program Files\ReflexiveArcade 2008-01-06 17:59 . 2008-01-06 17:59 d-------- C:\Program Files\Microsoft Games . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-11 22:55 --------- d-----w C:\Program Files\Wanadoo 2008-01-11 22:54 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-01-11 22:18 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-10 17:25 --------- d-----w C:\Program Files\VstPlugins 2008-01-08 20:02 --------- d-----w C:\Program Files\Image-Line 2008-01-08 18:38 --------- d-----w C:\Program Files\eMule 2008-01-08 18:14 --------- d-----w C:\Documents and Settings\MASSAS\Application Data\Ahead 2008-01-08 17:30 --------- d-----w C:\Program Files\MSN Messenger 2008-01-07 16:55 37,888 ----a-w C:\WINDOWS\system32\rar.exe 2008-01-06 17:17 39,936 ----a-w C:\WINDOWS\system32\NTSpool.exe 2007-12-05 01:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE 2007-12-05 00:41 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll 2007-12-05 00:41 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll 2007-12-05 00:41 8,523,776 ----a-w C:\WINDOWS\system32\nvcpl.dll 2007-12-05 00:41 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe 2007-12-05 00:41 7,435,392 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-12-05 00:41 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll 2007-12-05 00:41 6,549,504 ----a-w C:\WINDOWS\system32\nvdisps.dll 2007-12-05 00:41 5,773,568 ----a-w C:\WINDOWS\system32\nv4_disp.dll 2007-12-05 00:41 5,611,520 ----a-w C:\WINDOWS\system32\nvdispsr.dll 2007-12-05 00:41 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll 2007-12-05 00:41 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll 2007-12-05 00:41 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll 2007-12-05 00:41 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe 2007-12-05 00:41 425,984 ----a-w C:\WINDOWS\system32\keystone.exe 2007-12-05 00:41 385,024 ----a-w C:\WINDOWS\system32\nvapi.dll 2007-12-05 00:41 356,352 ----a-w C:\WINDOWS\system32\nvudisp.exe 2007-12-05 00:41 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll 2007-12-05 00:41 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll 2007-12-05 00:41 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll 2007-12-05 00:41 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll 2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll 2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll 2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll 2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll 2007-12-05 00:41 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll 2007-12-05 00:41 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll 2007-12-05 00:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll 2007-12-05 00:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll 2007-12-05 00:41 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll 2007-12-05 00:41 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll 2007-12-05 00:41 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll 2007-12-05 00:41 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll 2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll 2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll 2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll 2007-12-05 00:41 3,715,072 ----a-w C:\WINDOWS\system32\nvvitvsr.dll 2007-12-05 00:41 3,710,976 ----a-w C:\WINDOWS\system32\nvvitvs.dll 2007-12-05 00:41 3,420,160 ----a-w C:\WINDOWS\system32\nvgames.dll 2007-12-05 00:41 3,334,144 ----a-w C:\WINDOWS\system32\nvgamesr.dll 2007-12-05 00:41 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll 2007-12-05 00:41 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll 2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll 2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll 2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll 2007-12-05 00:41 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll 2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll 2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll 2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll 2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll 2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll 2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll 2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll 2007-12-05 00:41 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll 2007-12-05 00:41 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll 2007-12-05 00:41 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll 2007-12-05 00:41 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll 2007-12-05 00:41 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll 2007-12-05 00:41 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll 2007-12-05 00:41 270,336 ----a-w C:\WINDOWS\system32\nvrsru.dll 2007-12-05 00:41 266,240 ----a-w C:\WINDOWS\system32\nvrsptb.dll 2007-12-05 00:41 266,240 ----a-w C:\WINDOWS\system32\nvrsja.dll 2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrstr.dll 2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrssl.dll 2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrssk.dll 2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll 2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrshu.dll 2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrsth.dll 2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrssv.dll 2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrspl.dll 2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrsno.dll 2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrsda.dll 2007-12-05 00:41 249,856 ----a-w C:\WINDOWS\system32\nvrsfi.dll 2007-12-05 00:41 249,856 ----a-w C:\WINDOWS\system32\nvrscs.dll 2007-12-05 00:41 245,760 ----a-w C:\WINDOWS\system32\nvrseng.dll 2007-12-05 00:41 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll 2007-12-05 00:41 225,280 ----a-w C:\WINDOWS\system32\nvrszhc.dll 2007-12-05 00:41 212,992 ----a-w C:\WINDOWS\system32\nvwrsja.dll 2007-12-05 00:41 2,854,912 ----a-w C:\WINDOWS\system32\nvmoblsr.dll 2007-12-05 00:41 2,519,040 ----a-w C:\WINDOWS\system32\nvwssr.dll 2007-12-05 00:41 2,498,560 ----a-w C:\WINDOWS\system32\nvwss.dll 2007-12-05 00:41 196,608 ----a-w C:\WINDOWS\system32\nvwrsko.dll 2007-12-05 00:41 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll 2007-12-05 00:41 167,936 ----a-w C:\WINDOWS\system32\nvwrszht.dll 2007-12-05 00:41 163,840 ----a-w C:\WINDOWS\system32\nvwrszhc.dll 2007-12-05 00:41 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe 2007-12-05 00:41 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe 2007-12-05 00:41 126,976 ----a-w C:\WINDOWS\system32\nvrszht.dll 2007-12-05 00:41 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll 2007-12-05 00:41 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe . [code]

----a-w            56,928 2008-01-08 15:45:55  C:\Program Files\CyberLink\PowerDVD\PDVDServ .exe
----a-w            54,832 2008-01-08 15:45:56  C:\Program Files\CyberLink\PowerDVD\Language\Language .exe
----a-w           155,648 2008-01-08 15:45:57  C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck .exe
----a-w           143,360 2008-01-08 15:46:07  C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor .exe
----a-w           132,496 2008-01-08 15:46:03  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w           139,367 2008-01-10 18:49:16  C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp .exe
----a-w         5,674,352 2008-01-08 15:46:27  C:\Program Files\MSN Messenger\MsnMsgr .Exe
----a-w            20,480 2008-01-09 17:08:15  C:\Program Files\Wanadoo\Watch .exe
----a-w           919,016 2008-01-11 21:36:31  C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
----a-w            15,360 2008-01-09 16:46:01  C:\WINDOWS\system32\ctfmon .exe

[/code] ((((((((((((((((((((((((((((( snapshot@2008-01-11_22.58.56.64 ))))))))))))))))))))))))))))))))))))))))) . - 2006-12-19 21:49:47 8,509,952 -c----w C:\WINDOWS\$NtUninstallKB943460$\shell32.dll - 2007-10-11 00:14:36 121,856 -c----w C:\WINDOWS\$NtUninstallKB943460$\xpsp3res.dll - 2008-01-11 21:54:24 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-01-11 22:59:39 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT - 2008-01-11 21:54:24 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat + 2008-01-11 22:59:39 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat - 2008-01-11 21:54:24 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT + 2008-01-11 22:59:39 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT - 2008-01-11 21:54:24 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat + 2008-01-11 22:59:39 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat - 2008-01-11 21:54:24 2,248,704 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT + 2008-01-11 22:59:39 2,383,872 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT - 2008-01-11 21:54:24 143,360 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat + 2008-01-11 22:59:39 143,360 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat + 2006-03-02 12:00:00 61,440 -c----w C:\WINDOWS\ie7\admparse.dll + 2006-03-02 12:00:00 101,888 -c----w C:\WINDOWS\ie7\advpack.dll + 2006-03-02 12:00:00 35,328 -c----w C:\WINDOWS\ie7\corpol.dll + 2006-06-02 19:32:20 33,792 -c----w C:\WINDOWS\ie7\custsat.dll + 2007-10-11 06:13:39 357,888 -c----w C:\WINDOWS\ie7\dxtmsft.dll + 2007-10-11 06:13:39 205,312 -c----w C:\WINDOWS\ie7\dxtrans.dll + 2007-10-11 06:13:39 55,808 -c----w C:\WINDOWS\ie7\extmgr.dll + 2006-03-02 12:00:00 38,912 -c----w C:\WINDOWS\ie7\hmmapi.dll + 2006-03-02 12:00:00 34,304 -c----w C:\WINDOWS\ie7\ie4uinit.exe + 2006-03-02 12:00:00 139,264 -c----w C:\WINDOWS\ie7\ieakeng.dll + 2006-03-02 12:00:00 221,696 -c----w C:\WINDOWS\ie7\ieaksie.dll + 2006-03-02 12:00:00 245,760 -c----w C:\WINDOWS\ie7\ieakui.dll + 2006-03-02 12:00:00 323,584 -c----w C:\WINDOWS\ie7\iedkcs32.dll + 2007-10-10 11:16:27 18,432 -c----w C:\WINDOWS\ie7\iedw.exe + 2006-03-02 12:00:00 81,920 -c----w C:\WINDOWS\ie7\ieencode.dll + 2007-10-11 06:13:39 251,392 -c----w C:\WINDOWS\ie7\iepeers.dll + 2006-03-02 12:00:00 49,152 -c----w C:\WINDOWS\ie7\iernonce.dll + 2006-03-02 12:00:00 63,488 -c----w C:\WINDOWS\ie7\iesetup.dll + 2006-03-02 12:00:00 93,184 -c----w C:\WINDOWS\ie7\iexplore.exe + 2006-03-02 12:00:00 35,840 -c----w C:\WINDOWS\ie7\imgutil.dll + 2007-10-11 06:13:39 96,768 -c----w C:\WINDOWS\ie7\inseng.dll + 2007-11-14 07:28:02 450,560 -c----w C:\WINDOWS\ie7\jscript.dll + 2007-10-11 06:13:39 16,384 -c----w C:\WINDOWS\ie7\jsproxy.dll + 2006-03-02 12:00:00 22,528 -c----w C:\WINDOWS\ie7\licmgr10.dll + 2006-03-02 12:00:00 29,184 -c----w C:\WINDOWS\ie7\mshta.exe + 2007-10-30 10:18:16 3,079,680 -c----w C:\WINDOWS\ie7\mshtml.dll + 2007-10-11 06:13:40 449,024 -c----w C:\WINDOWS\ie7\mshtmled.dll + 2006-03-02 12:00:00 57,344 -c----w C:\WINDOWS\ie7\mshtmler.dll + 2006-03-02 12:00:00 146,432 -c----w C:\WINDOWS\ie7\msls31.dll + 2007-10-11 06:13:40 146,432 -c----w C:\WINDOWS\ie7\msrating.dll + 2007-10-11 06:13:40 532,480 -c----w C:\WINDOWS\ie7\mstime.dll + 2006-03-02 12:00:00 97,280 -c----w C:\WINDOWS\ie7\occache.dll + 2007-10-11 06:13:40 39,424 -c----w C:\WINDOWS\ie7\pngfilt.dll + 2007-09-26 17:34:42 33,472 -c----w C:\WINDOWS\ie7\spuninst\iecustom.dll + 2007-09-26 17:32:30 66,048 -c--a-w C:\WINDOWS\ie7\spuninst\ieResetIcons.exe + 2006-09-06 16:43:28 216,800 -c----w C:\WINDOWS\ie7\spuninst\spuninst.exe + 2006-09-06 16:43:30 394,976 -c----w C:\WINDOWS\ie7\spuninst\updspapi.dll + 2006-03-02 12:00:00 37,888 -c----w C:\WINDOWS\ie7\url.dll + 2007-10-11 06:13:41 617,472 -c----w C:\WINDOWS\ie7\urlmon.dll + 2006-03-02 12:00:00 417,792 -c----w C:\WINDOWS\ie7\vbscript.dll + 2007-06-26 13:56:54 851,968 -c----w C:\WINDOWS\ie7\vgx.dll + 2006-03-02 12:00:00 281,600 -c----w C:\WINDOWS\ie7\webcheck.dll + 2007-10-11 06:13:41 663,552 -c----w C:\WINDOWS\ie7\wininet.dll + 2007-08-13 17:39:00 123,904 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\advpack.dll + 2007-08-13 17:35:38 214,528 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\dxtrans.dll + 2007-08-13 17:54:10 131,584 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\extmgr.dll + 2007-08-13 17:36:26 61,952 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\icardie.dll + 2007-08-13 17:39:06 54,784 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ie4uinit.exe + 2007-08-13 17:39:26 152,064 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieakeng.dll + 2007-08-13 17:39:54 229,376 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieaksie.dll + 2007-08-13 16:56:54 161,792 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieakui.dll + 2007-02-12 15:10:12 2,451,312 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieapfltr.dat + 2007-07-11 11:27:48 383,488 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieapfltr.dll + 2007-08-13 17:39:50 382,976 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iedkcs32.dll + 2007-08-13 17:54:10 6,049,280 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieframe.dll + 2007-08-13 17:39:10 43,008 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iernonce.dll + 2007-08-13 17:34:04 266,752 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iertutil.dll + 2007-08-13 17:39:10 13,312 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieudinit.exe + 2007-08-13 17:43:56 622,080 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iexplore.exe + 2007-08-13 17:54:10 27,136 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\jsproxy.dll + 2007-08-13 17:54:10 458,752 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msfeeds.dll + 2007-08-13 17:54:10 50,688 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msfeedsbs.dll + 2007-08-13 17:54:12 3,578,368 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mshtml.dll + 2007-08-13 17:54:10 475,648 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mshtmled.dll + 2007-08-13 17:44:26 192,000 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msrating.dll + 2007-08-13 17:54:10 670,720 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mstime.dll + 2007-08-13 17:44:06 101,376 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\occache.dll + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe + 2007-06-30 20:24:42 394,976 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\updspapi.dll + 2007-08-13 17:44:30 105,984 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\url.dll + 2007-08-13 17:54:10 1,162,240 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\urlmon.dll + 2007-08-13 17:54:10 231,424 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\webcheck.dll + 2007-08-13 17:54:10 818,688 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll + 2006-06-02 19:32:20 33,792 ------w C:\WINDOWS\network diagnostic\custsat.dll + 2006-10-10 12:44:50 557,568 ------w C:\WINDOWS\network diagnostic\xpnetdiag.exe - 2006-03-02 12:00:00 61,440 ----a-w C:\WINDOWS\system32\admparse.dll + 2007-08-13 17:39:20 71,680 ----a-w C:\WINDOWS\system32\admparse.dll - 2006-03-02 12:00:00 101,888 ----a-w C:\WINDOWS\system32\advpack.dll + 2007-10-10 23:49:42 124,928 ----a-w C:\WINDOWS\system32\advpack.dll - 2006-03-02 12:00:00 61,440 -c--a-w C:\WINDOWS\system32\dllcache\admparse.dll + 2007-08-13 17:39:20 71,680 -c--a-w C:\WINDOWS\system32\dllcache\admparse.dll - 2006-03-02 12:00:00 101,888 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll + 2007-10-10 23:49:42 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll - 2006-03-02 12:00:00 28,672 -c--a-w C:\WINDOWS\system32\dllcache\custsat.dll + 2007-08-13 17:54:10 33,792 -c--a-w C:\WINDOWS\system32\dllcache\custsat.dll - 2007-10-11 06:13:39 357,888 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll + 2007-08-13 17:35:46 346,624 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll - 2007-10-11 06:13:39 205,312 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll + 2007-10-10 23:49:42 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll - 2007-10-11 06:13:39 55,808 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll + 2007-10-10 23:49:42 132,608 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll - 2006-03-02 12:00:00 38,912 -c--a-w C:\WINDOWS\system32\dllcache\hmmapi.dll + 2007-08-13 17:18:02 60,416 -c--a-w C:\WINDOWS\system32\dllcache\hmmapi.dll + 2007-10-10 23:49:42 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll - 2006-03-02 12:00:00 34,304 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe + 2007-10-10 11:00:41 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe - 2006-03-02 12:00:00 139,264 -c--a-w C:\WINDOWS\system32\dllcache\ieakeng.dll + 2007-10-10 23:49:42 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll - 2006-03-02 12:00:00 221,696 -c--a-w C:\WINDOWS\system32\dllcache\ieaksie.dll + 2007-10-10 23:49:42 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll - 2006-03-02 12:00:00 245,760 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll + 2007-10-10 05:46:55 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll + 2007-07-01 03:31:33 2,455,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dat + 2007-10-10 23:49:42 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll - 2006-03-02 12:00:00 323,584 -c--a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll + 2007-10-10 23:49:42 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll - 2007-10-10 11:16:27 18,432 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe + 2007-08-13 17:44:02 69,120 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe - 2006-03-02 12:00:00 81,920 -c--a-w C:\WINDOWS\system32\dllcache\ieencode.dll + 2007-08-13 17:45:18 78,336 -c--a-w C:\WINDOWS\system32\dllcache\ieencode.dll + 2007-10-10 23:49:43 6,065,664 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll - 2007-10-11 06:13:39 251,392 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll + 2007-08-13 17:54:10 191,488 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll - 2006-03-02 12:00:00 49,152 -c--a-w C:\WINDOWS\system32\dllcache\iernonce.dll + 2007-10-10 23:49:43 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll + 2007-10-10 23:49:43 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll - 2006-03-02 12:00:00 63,488 -c--a-w C:\WINDOWS\system32\dllcache\iesetup.dll + 2007-08-13 17:39:12 55,296 -c--a-w C:\WINDOWS\system32\dllcache\iesetup.dll + 2007-10-10 10:59:40 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe - 2006-03-02 12:00:00 93,184 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe + 2007-10-10 11:00:59 625,152 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe - 2006-03-02 12:00:00 35,840 -c--a-w C:\WINDOWS\system32\dllcache\imgutil.dll + 2007-08-13 17:36:06 36,352 -c--a-w C:\WINDOWS\system32\dllcache\imgutil.dll - 2007-10-11 06:13:39 96,768 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll + 2007-08-13 17:39:02 92,672 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll - 2007-11-14 07:28:02 450,560 -c--a-w C:\WINDOWS\system32\dllcache\jscript.dll + 2007-08-13 17:38:04 491,520 -c--a-w C:\WINDOWS\system32\dllcache\jscript.dll - 2007-10-11 06:13:39 16,384 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2007-10-10 23:49:44 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll - 2006-03-02 12:00:00 22,528 -c--a-w C:\WINDOWS\system32\dllcache\licmgr10.dll + 2007-08-13 17:44:18 40,960 -c--a-w C:\WINDOWS\system32\dllcache\licmgr10.dll + 2007-10-10 23:49:44 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll + 2007-10-10 23:49:44 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll - 2006-03-02 12:00:00 29,184 -c--a-w C:\WINDOWS\system32\dllcache\mshta.exe + 2007-08-13 17:32:30 45,568 -c--a-w C:\WINDOWS\system32\dllcache\mshta.exe - 2007-10-30 10:18:16 3,079,680 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll + 2007-10-31 03:53:50 3,590,656 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll - 2007-10-11 06:13:40 449,024 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll + 2007-10-10 23:49:44 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll - 2006-03-02 12:00:00 57,344 -c--a-w C:\WINDOWS\system32\dllcache\mshtmler.dll + 2007-08-13 17:01:12 48,128 -c--a-w C:\WINDOWS\system32\dllcache\mshtmler.dll - 2006-03-02 12:00:00 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msls31.dll + 2007-08-13 17:54:10 156,160 -c--a-w C:\WINDOWS\system32\dllcache\msls31.dll - 2007-10-11 06:13:40 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll + 2007-10-10 23:49:44 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll - 2007-10-11 06:13:40 532,480 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll + 2007-10-10 23:49:45 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll - 2006-03-02 12:00:00 97,280 -c--a-w C:\WINDOWS\system32\dllcache\occache.dll + 2007-10-10 23:49:45 102,400 -c----w C:\WINDOWS\system32\dllcache\occache.dll - 2007-10-11 06:13:40 39,424 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll + 2007-08-13 17:36:12 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll - 2007-10-25 16:56:24 8,510,976 -c--a-w C:\WINDOWS\system32\dllcache\shell32.dll + 2007-10-25 16:43:25 8,516,608 -c--a-w C:\WINDOWS\system32\dllcache\shell32.dll - 2006-03-02 12:00:00 37,888 -c--a-w C:\WINDOWS\system32\dllcache\url.dll + 2007-10-10 23:49:45 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll - 2007-10-11 06:13:41 617,472 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll + 2007-10-10 23:49:45 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll - 2006-03-02 12:00:00 417,792 -c--a-w C:\WINDOWS\system32\dllcache\vbscript.dll + 2007-08-13 17:54:10 413,696 -c--a-w C:\WINDOWS\system32\dllcache\vbscript.dll - 2007-06-26 13:56:54 851,968 -c--a-w C:\WINDOWS\system32\dllcache\vgx.dll + 2007-08-13 17:54:10 765,952 -c--a-w C:\WINDOWS\system32\dllcache\VGX.dll - 2006-03-02 12:00:00 49,152 -c--a-w C:\WINDOWS\system32\dllcache\wdigest.dll + 2006-03-24 04:37:52 49,152 -c--a-w C:\WINDOWS\system32\dllcache\wdigest.dll - 2006-03-02 12:00:00 281,600 -c--a-w C:\WINDOWS\system32\dllcache\webcheck.dll + 2007-10-10 23:49:45 232,960 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll - 2007-10-11 06:13:41 663,552 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll + 2007-10-10 23:49:45 824,832 -c----w C:\WINDOWS\system32\dllcache\wininet.dll - 2007-10-11 06:13:39 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll + 2007-08-13 17:35:46 346,624 ----a-w C:\WINDOWS\system32\dxtmsft.dll - 2007-10-11 06:13:39 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2007-10-10 23:49:42 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll - 2007-10-11 06:13:39 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll + 2007-10-10 23:49:42 132,608 ------w C:\WINDOWS\system32\extmgr.dll + 2007-10-10 23:49:42 63,488 ----a-w C:\WINDOWS\system32\icardie.dll + 2006-06-29 07:05:44 26,112 ------w C:\WINDOWS\system32\idndl.dll - 2006-03-02 12:00:00 34,304 ----a-w C:\WINDOWS\system32\ie4uinit.exe + 2007-10-10 11:00:41 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe - 2006-03-02 12:00:00 139,264 ----a-w C:\WINDOWS\system32\ieakeng.dll + 2007-10-10 23:49:42 153,088 ------w C:\WINDOWS\system32\ieakeng.dll - 2006-03-02 12:00:00 221,696 ----a-w C:\WINDOWS\system32\ieaksie.dll + 2007-10-10 23:49:42 230,400 ------w C:\WINDOWS\system32\ieaksie.dll - 2006-03-02 12:00:00 245,760 ----a-w C:\WINDOWS\system32\ieakui.dll + 2007-10-10 05:46:55 161,792 ------w C:\WINDOWS\system32\ieakui.dll + 2007-07-01 03:31:33 2,455,488 ----a-w C:\WINDOWS\system32\ieapfltr.dat + 2007-10-10 23:49:42 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll - 2006-03-02 12:00:00 323,584 ----a-w C:\WINDOWS\system32\iedkcs32.dll + 2007-10-10 23:49:42 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll - 2006-03-02 12:00:00 81,920 ----a-w C:\WINDOWS\system32\ieencode.dll + 2007-08-13 17:45:18 78,336 ----a-w C:\WINDOWS\system32\ieencode.dll + 2007-10-10 23:49:43 6,065,664 ----a-w C:\WINDOWS\system32\ieframe.dll - 2007-10-11 06:13:39 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll + 2007-08-13 17:54:10 191,488 ----a-w C:\WINDOWS\system32\iepeers.dll - 2006-03-02 12:00:00 49,152 ----a-w C:\WINDOWS\system32\iernonce.dll + 2007-10-10 23:49:43 44,544 ------w C:\WINDOWS\system32\iernonce.dll + 2007-10-10 23:49:43 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll - 2006-03-02 12:00:00 63,488 ----a-w C:\WINDOWS\system32\iesetup.dll + 2007-08-13 17:39:12 55,296 ----a-w C:\WINDOWS\system32\iesetup.dll + 2007-10-10 10:59:40 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe + 2007-08-13 17:54:10 180,736 ------w C:\WINDOWS\system32\ieui.dll - 2006-03-02 12:00:00 35,840 ----a-w C:\WINDOWS\system32\imgutil.dll + 2007-08-13 17:36:06 36,352 ----a-w C:\WINDOWS\system32\imgutil.dll - 2007-10-11 06:13:39 96,768 ----a-w C:\WINDOWS\system32\inseng.dll + 2007-08-13 17:39:02 92,672 ----a-w C:\WINDOWS\system32\inseng.dll - 2007-11-14 07:28:02 450,560 ----a-w C:\WINDOWS\system32\jscript.dll + 2007-08-13 17:38:04 491,520 ----a-w C:\WINDOWS\system32\jscript.dll - 2007-10-11 06:13:39 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2007-10-10 23:49:44 27,648 ------w C:\WINDOWS\system32\jsproxy.dll - 2006-03-02 12:00:00 22,528 ----a-w C:\WINDOWS\system32\licmgr10.dll + 2007-08-13 17:44:18 40,960 ----a-w C:\WINDOWS\system32\licmgr10.dll + 2008-01-02 09:21:38 17,642,616 ----a-w C:\WINDOWS\system32\MRT.exe + 2007-10-10 23:49:44 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll + 2007-10-10 23:49:44 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll + 2007-08-13 17:36:40 12,288 ------w C:\WINDOWS\system32\msfeedssync.exe - 2006-03-02 12:00:00 29,184 ----a-w C:\WINDOWS\system32\mshta.exe + 2007-08-13 17:32:30 45,568 ----a-w C:\WINDOWS\system32\mshta.exe - 2007-10-30 10:18:16 3,079,680 ----a-w C:\WINDOWS\system32\mshtml.dll + 2007-10-31 03:53:50 3,590,656 ----a-w C:\WINDOWS\system32\mshtml.dll - 2007-10-11 06:13:40 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll + 2007-10-10 23:49:44 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll - 2006-03-02 12:00:00 57,344 ----a-w C:\WINDOWS\system32\mshtmler.dll + 2007-08-13 17:01:12 48,128 ----a-w C:\WINDOWS\system32\mshtmler.dll - 2006-03-02 12:00:00 146,432 ----a-w C:\WINDOWS\system32\msls31.dll + 2007-08-13 17:54:10 156,160 ----a-w C:\WINDOWS\system32\msls31.dll - 2007-10-11 06:13:40 146,432 ----a-w C:\WINDOWS\system32\msrating.dll + 2007-10-10 23:49:44 193,024 ------w C:\WINDOWS\system32\msrating.dll - 2007-10-11 06:13:40 532,480 ----a-w C:\WINDOWS\system32\mstime.dll + 2007-10-10 23:49:45 671,232 ------w C:\WINDOWS\system32\mstime.dll + 2006-06-28 16:59:26 24,576 ------w C:\WINDOWS\system32\nlsdl.dll + 2006-06-29 07:05:44 23,552 ------w C:\WINDOWS\system32\normaliz.dll - 2006-03-02 12:00:00 97,280 ----a-w C:\WINDOWS\system32\occache.dll + 2007-10-10 23:49:45 102,400 ------w C:\WINDOWS\system32\occache.dll - 2007-10-11 06:13:40 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2007-08-13 17:36:12 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll - 2007-10-25 16:56:24 8,510,976 ----a-w C:\WINDOWS\system32\shell32.dll + 2007-10-25 16:43:25 8,516,608 ----a-w C:\WINDOWS\system32\shell32.dll - 2005-06-28 09:21:34 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe + 2006-09-06 16:43:30 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe - 2006-03-02 12:00:00 37,888 ----a-w C:\WINDOWS\system32\url.dll + 2007-10-10 23:49:45 105,984 ----a-w C:\WINDOWS\system32\url.dll - 2007-10-11 06:13:41 617,472 ----a-w C:\WINDOWS\system32\urlmon.dll + 2007-10-10 23:49:45 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll - 2006-03-02 12:00:00 417,792 ----a-w C:\WINDOWS\system32\vbscript.dll + 2007-08-13 17:54:10 413,696 ----a-w C:\WINDOWS\system32\vbscript.dll - 2006-03-02 12:00:00 49,152 ----a-w C:\WINDOWS\system32\wdigest.dll + 2006-03-24 04:37:52 49,152 ----a-w C:\WINDOWS\system32\wdigest.dll - 2006-03-02 12:00:00 281,600 ----a-w C:\WINDOWS\system32\webcheck.dll + 2007-10-10 23:49:45 232,960 ----a-w C:\WINDOWS\system32\webcheck.dll + 2007-08-13 17:45:16 206,336 ------w C:\WINDOWS\system32\WinFXDocObj.exe - 2007-10-11 06:13:41 663,552 ----a-w C:\WINDOWS\system32\wininet.dll + 2007-10-10 23:49:45 824,832 ----a-w C:\WINDOWS\system32\wininet.dll + 2006-07-14 15:51:51 121,856 ------w C:\WINDOWS\system32\xmllite.dll - 2007-10-29 15:35:14 121,856 ----a-w C:\WINDOWS\system32\xpsp3res.dll + 2007-10-29 15:07:16 369,152 ----a-w C:\WINDOWS\system32\xpsp3res.dll + 2008-01-11 22:53:50 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4f8.dat . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Raccourci vers la page des propriétés de High Definition Audio"="HDAShCut.exe" [2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe] "SoundMan"="SOUNDMAN.EXE" [2005-06-21 15:09 90112 C:\WINDOWS\SOUNDMAN.EXE] "AlcWzrd"="ALCWZRD.EXE" [2005-06-29 13:26 2806272 C:\WINDOWS\ALCWZRD.EXE] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768] "Ma10Pan"="Ma10Pan.Exe" [2006-03-15 14:34 786508 C:\WINDOWS\system32\Ma10Pan.exe] "At01Pan"="At01Pan.Exe" [2001-11-21 09:09 176128 C:\WINDOWS\system32\At01Pan.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] "System Patcher"= BTCPatcher.exe R3 Ma10_01;Service for 1010 - 1;C:\WINDOWS\system32\drivers\Ma10Wdm.sys [2006-03-15 14:34] R3 Ma10_AA;Service for 1010 Audio Driver (EWDM);C:\WINDOWS\system32\drivers\Ma10.sys [2006-03-15 14:34] S0 Partizan;Partizan;C:\WINDOWS\system32\drivers\Partizan.sys [] S3 At01_01;Service for AT010-1;C:\WINDOWS\system32\drivers\At01wdm.sys [2001-11-21 09:09] S3 At01_02;Service for AT010-2;C:\WINDOWS\system32\drivers\At01wdm2.sys [2001-11-21 09:09] S3 At01_04;Service for AT010 MIDI;C:\WINDOWS\system32\drivers\At01wdm4.sys [2001-11-21 09:09] S3 At01_AA;Service for AT010 Audio Driver (EWDM);C:\WINDOWS\system32\drivers\At01.sys [2001-11-21 09:09] S3 RegGuard;RegGuard;C:\WINDOWS\system32\Drivers\regguard.sys [2008-01-08 18:19] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-12 00:01:07 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-12 0:01:35 ComboFix-quarantined-files.txt 2008-01-11 23:01:27 ComboFix2.txt 2008-01-11 21:59:14 . 2008-01-11 22:16:47 --- E O F ---

la2s · Answer

ha oui je vien juste de mettre a jour mon os chose que je n'avai pas faite depuis que je l'ai recup de chez le reparateur...

ep44 · Answer

refais hijack stp

la2s · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:19:23, on 12/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\Ma10Pan.Exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
C:\Program Files\Trend Micro\HijackThis\la2s.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Ma10Pan] Ma10Pan.Exe
O4 - HKLM\..\Run: [At01Pan] At01Pan.Exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

ep44 · Answer

Télécharge:
http://www.grisoft.cz/filedir/inst/avgas-setup-7.5.1.43.exe AVG-AntiSpyware

=> Installer
=> Le lancer
=> Clic : Mise à jour
------
= Redémarre en mode Sans Échec (le démarrage peut prendre plusieurs minutes)
Attention, pas d’accès à internet dans ce mode. Enregistre ou imprime les consignes.

Relance le Pc et tapote la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
Avec les touches « flèches », sélectionne Mode sans échec ==> entrée ==>nom utilisateur habituel
-------
=> Dans ANALYSE ( en forme de loupe )
=> Paramètres ==> sous COMMENT REAGIR==>clic sur Actions recommandées ==>Quarantaine
=> Clic : Analyse complète du système
-------
=> à la fin du scan ( qui est assez long)
=> Clic Appliquer toutes les actions <== ceci Très important
=> Clic Sauvegarder rapport puis Enregistrer sous et choisir bureau
-------
En mode normal
colle le rapport
@+

la2s · Answer

ok je te fais ca 
dis moi tu est la demain??il se fait tard je vai faire l'analyse et me pieuter ensuite...
en tout cas merci a toi je t'envoi le rapport des que c fini...
a++

ep44 · Answer

oui je suis présent l'aprés-midi 

bonne nuit à toi 
@+

la2s · Answer

voici le rapport...

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	01:53:10 12/01/2008

 + Résultat de l'analyse:	



C:\QooBox\Quarantine\C\Program Files\Wanadoo\GestMaj.exe.vir -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\QooBox\Quarantine\C\Program Files\Wanadoo\Shell.exe.vir -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\QooBox\Quarantine\C\Program Files\Windows Live\Messenger\msnmsgr     .exe.vir -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\QooBox\Quarantine\C\Program Files\Windows Live\Messenger\msnmsgr    .exe.vir -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\QooBox\Quarantine\C\Program Files\Windows Live\Messenger\msnmsgr   .exe.vir -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\QooBox\Quarantine\C\Program Files\Windows Live\Messenger\msnmsgr  .exe.vir -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\QooBox\Quarantine\catchme2008-01-11_225751.04.zip/zlclient.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP1\A0000002.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP1\A0000003.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP1\A0000004.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP2\A0000007.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP2\A0000027.rbf -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP2\A0000138.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP2\A0000139.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP2\A0000142.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP2\A0000157.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP2\A0000163.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP2\A0000165.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP2\A0000166.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP3\A0000624.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP3\A0000718.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP4\A0000793.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP4\A0000794.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP4\A0000795.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP4\A0000796.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP4\A0000797.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{39B3610A-1D18-437C-A3A2-CF6DDCF40955}\RP4\A0000798.exe -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\VundoFix Backups\ddccd.exe.bad -> Dropper.Agent.dgo : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\MASSAS\Cookies\massas@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\MASSAS\Cookies\massas@ehg-sgi.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\MASSAS\Cookies\massas@hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\MASSAS\Cookies\massas@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\MASSAS\Cookies\massas@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\MASSAS\Cookies\massas@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Nettoyé.
C:\Documents and Settings\MASSAS\Cookies\massas@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\MASSAS\Cookies\massas@m.webtrends[2].txt -> TrackingCookie.Webtrends : Nettoyé.


Fin du rapport


et celle d'une deuxieme analyse...pensant que la 1ere j'avai pas sauvegarder le rapport...


---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	02:39:10 12/01/2008

 + Résultat de l'analyse:	



	Rien à signaler.



Fin du rapport

en attente de suite... je vai me coucher
encore merci a toi !

ep44 · Answer

Bonjour 
Fais un scan antivirus en ligne avec Internet Explorer
https://www.bitdefender.fr/

 
=> En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE
=> Dans la nouvelle fenêtre, clique sur I agree
=> La fenêtre change encore, clique sur Click here to scan
=> Les signatures se chargent, etc.
=> copie colle le résultat ici

tuto en image

http://pageperso.aol.fr/rginformatique/mapage/defender.htm

et
reposte un nouveau rapport hijackthis

la2s · Answer

bonjour a toi...je fais le scan en ligne je te post tout ca des que c ok...

ep44 · Answer

ok @+

la2s · Answer

slt a toi ep 44 
dsl g eu un contre temp hier...
j'ai effectué l analyse en ligne mais je n ai eu aucun rappoit...
doije en refaire une???

ep44 · Answer

Bonjour 

as tu encore des soucis 

refais un hijack stp
@+

la2s · Answer

je n ai plus eu d'alerte de avast depuis l'analyse de avg...le pc fonction corretement pour le moment...rien a signaler
jte poste le rapport hijak... 


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:29:48, on 13/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Ma10Pan.Exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32
tvdm.exe
C:\Program Files\Trend Micro\HijackThis\la2s.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Ma10Pan] Ma10Pan.Exe
O4 - HKLM\..\Run: [At01Pan] At01Pan.Exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

la2s · Answer

comment faire pour enlever ca???
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe  a chaque  fois il me ressort plein de fichier rar...jles supprime mais il reaparraissen...

ep44 · Answer

Ouvre le bloc-notes et fais un copier coller de ce qui est en citation ci-dessous (copie tout d'un trait) :

REGEDIT4

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"System Patcher"=-

Puis "fichier"/"enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix.reg
type de fichier : "tous les fichiers"
clique sur "enregistrer"

L'icône de fix.reg doit ressembler à cela

quitte internet et double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui"
@+

la2s · Answer

peut tu me confirmer si la manip a bien marché??

rapport hijack...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:46:13, on 13/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Ma10Pan.Exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32
tvdm.exe
C:\Program Files\Trend Micro\HijackThis\la2s.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Ma10Pan] Ma10Pan.Exe
O4 - HKLM\..\Run: [At01Pan] At01Pan.Exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

l'affaire est resolu??
en tout cas un grand merci a toi et au forum de commentcamarche.net

ep44 · Answer

relance hijack et coche ceci 
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Ma10Pan] Ma10Pan.Exe
O4 - HKLM\..\Run: [At01Pan] At01Pan.Exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
ensuite clic sur fix checked 

ensuite tu peux supprimer tous les logiciels que nous avons utilisés
va dans ajout/suppression de programes et dans programmes files
pour vérifier



ensuite fais ceci (IMPORTANT)

=> démarrer
=> panneau de configuration
=> système
=> onglet Restauration système
=> coche la case (Désactiver la restauration système)
=> redémarre l'ordinateur
=> réactive la ensuite
 -------------------------------------
Logiciels intéressants a avoir

=>CCleaner 
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
tuto
https://forums.cnetfrance.fr

=> Ad-aware SE (scan passif )
https://www.google.com ou http://www.lavasoft.de/support/download/#free
Tutos :
http://home.tiscali.be/schouppeguy/adawarese/adawase.htm


=> SpyBot-Search & Destroy 1.5 (scan passif + protection préventive avec ces 2 résidents, ses vaccinations et sa list Hosts )

https://www.safer-networking.org/download/

démo d utilisation
http://perso.orange.fr/rginformatique/section%20virus/demo%20spybot.htm
https://www.malekal.com/spybot-search-destroy-proteger-desinfecter-pc-virus/
Tuto :
http://perso.orange.fr/jesses/Docs/Logiciels/Spybot.htm

=> a² free (anti-trojans) (scan passif )

- Téléchargement : https://www.emsisoft.com/fr/home/antimalware/
- Tuto : http://perso.orange.fr/jesses/Docs/Logiciels/a-squared.htm

=> ZebProtect (application ne nécessitant pas d installation)

https://www.zebulon.fr/dossiers/autres/40-zebprotect.html
http://telechargement.zebulon.fr/123.html

@+

Infection trojan-dropper

38 réponses

Discussions similaires

Newsletters