Pc infecté : besoin d'aide (cheval de troie)

Question

Bonjour,
je n'arrive pas à me débarrasser d'un (ou plusieurs) cheval de troie.Si quelqu'un peut m'aider ce serait super. 
Dites moi ce que je dois téléchager ou de quel rapport vous avez besoin. 
merci d'avance

FillPCA · Answer

Salut,

Comment sais-tu que ta machine est infectée ?
Edite un rapport Hijackthis comme sur ce tuto : https://forum.pcastuces.com/tutoriel_hijackthis_v_2002___tutoriel-f31s8.htm

FillPCA

Arno59 · Answer

Bonjour,

Fais une analyse en ligne ;-)

Via antivirus :
Secuser : http://www.secuser.com/antivirus/
TrendMicro : https://www.trendmicro.com/en_us/forHome/products/housecall.html

https://www.pcastuces.com/pratique/securite/tester_securite/page1.htm

FillPCA · Answer

Re,

Attends pour l'analyse. Elle sera iefficace sur un Vundo.

1/ # Télécharge Vundofix  (par Atribune) sur ton Bureau : http://www.atribune.org/ccount/click.php?id=4
# Double-clique VundoFix.exe afin de le lancer.
# Clique sur le bouton Scan for Vundo.
# Lorsque le scan est complété, clique sur le bouton Remove Vundo (uniquement si des fichiers infectieux sont trouvés).
# Une invite te demandera si tu veux supprimer les fichiers, clique YES.
# Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
# Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK.
# Copie/colle le contenu du rapport situé dans C:\vundofix.txt

2/     *  Télécharge combofix.exe (par sUBs) sur ton Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    * Double clique combofix.exe et suis les invites.
    * Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
    * Si tu ne le trouves pas, il est là : C:\ComboFix.txt

3/ Edite un rapport Hijackthis avec les rapports précédents.

FillPCA

marine · Answer

C'est normal que le scan avec Vundo dure longtemps ? (plus d'un quart d'heure et c'est pas fini)

FillPCA · Answer

Re,

Est-ce que le logiciel est figé ou est-il en train de scanner ? Ca peut en effet durer 15 - 30 min, selon la machine et la contenance du disque dur.

FillPCA

FillPCA · Answer

Re,

Tu choisis "Fix Vundo" et tu édites le rapport.

Ensuite, tu lances Combofix et tu édites aussi son rapport.

FillPCA

marine · Answer

VundoFix V7.0.3

Scan started at 13:54:38 17/04/2008

Listing files found while scanning....

C:\windows\system32\awvtq.dll
C:\windows\system32\awvvs.dll
C:\windows\system32\aybeg.ini
C:\windows\system32\aybeg.ini2
C:\windows\system32\gebya.dll
C:\windows\system32\gebyv.dll
C:\windows\system32\jkhff.dll
C:\windows\system32\jkhhf.dll
C:\windows\system32\jkhhh.dll
C:\windows\system32\mljgd.dll
C:\windows\system32\mljjg.dll
C:\windows\system32\mljjk.dll
C:\windows\system32\mllji.dll
C:\windows\system32\pmkhe.dll
C:\windows\system32\pmkji.dll
C:\windows\system32\qtvwa.ini
C:\windows\system32\qtvwa.ini2
C:\windows\system32\svvwa.ini
C:\windows\system32\svvwa.ini2
C:\windows\system32\vtstq.dll
C:\windows\system32\vturs.dll
C:\WINDOWS\system32\wvuroon.dll

Beginning removal...

 Attempting to delete C:\windows\system32\awvtq.dll
C:\windows\system32\awvtq.dll Has been deleted!

 Attempting to delete C:\windows\system32\awvvs.dll
C:\windows\system32\awvvs.dll Has been deleted!

 Attempting to delete C:\windows\system32\aybeg.ini
C:\windows\system32\aybeg.ini Has been deleted!

 Attempting to delete C:\windows\system32\aybeg.ini2
C:\windows\system32\aybeg.ini2 Has been deleted!

 Attempting to delete C:\windows\system32\gebya.dll
C:\windows\system32\gebya.dll Has been deleted!

 Attempting to delete C:\windows\system32\gebyv.dll
C:\windows\system32\gebyv.dll Has been deleted!

 Attempting to delete C:\windows\system32\jkhff.dll
C:\windows\system32\jkhff.dll Has been deleted!

 Attempting to delete C:\windows\system32\jkhhf.dll
C:\windows\system32\jkhhf.dll Has been deleted!

 Attempting to delete C:\windows\system32\jkhhh.dll
C:\windows\system32\jkhhh.dll Has been deleted!

 Attempting to delete C:\windows\system32\mljgd.dll
C:\windows\system32\mljgd.dll Has been deleted!

 Attempting to delete C:\windows\system32\mljjg.dll
C:\windows\system32\mljjg.dll Has been deleted!

 Attempting to delete C:\windows\system32\mljjk.dll
C:\windows\system32\mljjk.dll Has been deleted!

 Attempting to delete C:\windows\system32\mllji.dll
C:\windows\system32\mllji.dll Has been deleted!

 Attempting to delete C:\windows\system32\pmkhe.dll
C:\windows\system32\pmkhe.dll Has been deleted!

 Attempting to delete C:\windows\system32\pmkji.dll
C:\windows\system32\pmkji.dll Has been deleted!

 Attempting to delete C:\windows\system32\qtvwa.ini
C:\windows\system32\qtvwa.ini Has been deleted!

 Attempting to delete C:\windows\system32\qtvwa.ini2
C:\windows\system32\qtvwa.ini2 Has been deleted!

 Attempting to delete C:\windows\system32\svvwa.ini
C:\windows\system32\svvwa.ini Has been deleted!

 Attempting to delete C:\windows\system32\svvwa.ini2
C:\windows\system32\svvwa.ini2 Has been deleted!

 Attempting to delete C:\windows\system32\vtstq.dll
C:\windows\system32\vtstq.dll Has been deleted!

 Attempting to delete C:\windows\system32\vturs.dll
C:\windows\system32\vturs.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\wvuroon.dll
C:\WINDOWS\system32\wvuroon.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

Performing Repairs to the registry.
Done!
 Voila le raport Vundo. je mets beaucoup de temps désolé, mais c'est parce que mon pc rame au plus au point ! 
je m'occupe de combo maintenant

marine · Answer

Re, 
je n'arrive pas à avoir de rapport combofix, tout se déroule normalement, le pc redémarre et me dit que le rapport est en cours et puis ça rédemarre de nouveau et ensuite dans C:\ je n'ai pas combofix.txt mais juste un dossier combofix où il n'y a aucun rapport. 
Que dois-je faire ? 
Voulez vous quand même un nouveau rapport Hijackthis ?

FillPCA · Answer

Re,

Essaie de passer Combofix en mode sans échec.

FillPCA

marine · Answer

Mon pc ne veut pas redémarrer en mode sans échec, avant même d'avoir fini de redémarrer il se relance tout seul !! J'en ai marre !!!

FillPCA · Answer

Re,

1/ Edite un rapport Hijackthis.
2/     *  Télécharge DiagHelp.zip sur ton bureau(Merci Malekal)  : http://www.malekal.com/download/DiagHelp.zip
Tuto : http://www.malekal.com/DiagHelp/DiagHelp.php
    * Ne double-clique pas dessus !! Fais un clic droit sur le fichier et extraire tout.
    * Un nouveau dossier chercher va être créé.
    * Ouvre le et double-clic sur go.cmd (le .cmd peut ne pas apparaître)
    * Une fenêtre va s'ouvrir, choisis l'option 1
    * L'analyse va commencer, ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand on te le demande.
    * Pendant l'analyse après le rapport CATCHME sur l'écran rouge, tu dois appuyer sue entrée pour que l'outil continue ses recherches. Suis les consignes écrites.
    * Une fenêtre avec le rapport s'ouvre alors. Copie/colle son contenu. (Il se trouve aussi ici : c:\resultat.txt)
    * Double-clique sur ce fichier, Fais CTRL+A puis CTRL+C.
    * Dans ta prochaine réponse, colle le rapport en faisant CTRL+V.

FillPCA

FillPCA · Answer

Re,

1/ 
    *  Télécharge OTMoveIt2  (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
    * Double-clique sur OTMoveIt.exe pour lancer le programme,
    * Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste List of Files/Folders to Move" :

C:\WINDOWS\System32tutv.ini
C:\WINDOWS\System32tutv.ini2
C:\WINDOWS\System32
opjsiwr.ini
C:\WINDOWS\System32\geeba.dll
C:\WINDOWS\System32\crusqwjl.ini
C:\WINDOWS\System32\oopyllhc.ini
C:\WINDOWS\System32\kypxqxco.dll
C:\WINDOWS\System32\yejjuvsq.dll
C:\WINDOWS\System32\wftbisks.dll
C:\WINDOWS\System32\cpqrfcmn.dll
C:\WINDOWS\System32\vtutr.dll
C:\WINDOWS\System32\gebca.dll
C:\WINDOWS\System32\mljji.dll
C:\WINDOWS\System32\jkkjk.dll
C:\WINDOWS\System32\ufgfgpfj.dll
C:\WINDOWS\System32\jutjwrdi.dll
C:\WINDOWS\System32\sxcloiqd.dll
C:\WINDOWS\System32utuktfg.dll
EmptyTemp

    * Clique sur MoveIt! pour lancer la suppression,
    * Le résultat appraraîtra dans le cadre Results.
    * Clique sur Exit pour fermer le programme.
    * Poste le rapport qui est situé ici : C:\\_OTMoveIt\MovedFiles
    * Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

2/     *  Télécharge PCA (d'Evosla) : http://ww25.evosla.com/pca_cpt.php?agr=pca_securite
    * Dézippe-le dans un répertoire dédié comme c:\PCA au moyen d'un clic droit (Extraire...),
    * Clique sur l'onglet  "diagnostic du PC" puis "analyser".
    * Laisse l'analyse se dérouler. Cela ne prend que quelques secondes.
    * Clique sur "enregistrer le rapport" en bas à droite et sauvegarde-le sur le bureau.
    * Edite le contenu de ce rapport dans ta prochaine réponse. Il se nomme PCA_LOG.txt

3/ # Télécharge SREng (de Smallfrogs) : http://www.kztechs.com/eng/download.html
# Dézippe tout son contenu sur ton bureau (clic droit >Extraire ici).
# Ouvre le dossier SReng2 et double-clique sur SREngPS.exe.
# Clique sur "smart scan".
# Clique sur le bouton "scan".
# Quand l'analyse est terminée, clique sur le bouton "save reports".
# Sauvegarde alors le rapport sur ton bureau.
# Copie/colle le contenu du rapport  SREnglLOG.log dans ta prochaine réponse.

FillPCA

marine · Answer

1) C:\WINDOWS\System32 tutv.ini moved successfully. C:\WINDOWS\System32 tutv.ini2 moved successfully. C:\WINDOWS\System32 opjsiwr.ini moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\geeba.dll C:\WINDOWS\System32\geeba.dll NOT unregistered. C:\WINDOWS\System32\geeba.dll moved successfully. C:\WINDOWS\System32\crusqwjl.ini moved successfully. C:\WINDOWS\System32\oopyllhc.ini moved successfully. LoadLibrary failed for C:\WINDOWS\System32\kypxqxco.dll C:\WINDOWS\System32\kypxqxco.dll NOT unregistered. File move failed. C:\WINDOWS\System32\kypxqxco.dll scheduled to be moved on reboot. LoadLibrary failed for C:\WINDOWS\System32\yejjuvsq.dll C:\WINDOWS\System32\yejjuvsq.dll NOT unregistered. File move failed. C:\WINDOWS\System32\yejjuvsq.dll scheduled to be moved on reboot. LoadLibrary failed for C:\WINDOWS\System32\wftbisks.dll C:\WINDOWS\System32\wftbisks.dll NOT unregistered. File move failed. C:\WINDOWS\System32\wftbisks.dll scheduled to be moved on reboot. LoadLibrary failed for C:\WINDOWS\System32\cpqrfcmn.dll C:\WINDOWS\System32\cpqrfcmn.dll NOT unregistered. File move failed. C:\WINDOWS\System32\cpqrfcmn.dll scheduled to be moved on reboot. DllUnregisterServer procedure not found in C:\WINDOWS\System32\vtutr.dll C:\WINDOWS\System32\vtutr.dll NOT unregistered. File move failed. C:\WINDOWS\System32\vtutr.dll scheduled to be moved on reboot. DllUnregisterServer procedure not found in C:\WINDOWS\System32\gebca.dll C:\WINDOWS\System32\gebca.dll NOT unregistered. C:\WINDOWS\System32\gebca.dll moved successfully. LoadLibrary failed for C:\WINDOWS\System32\mljji.dll C:\WINDOWS\System32\mljji.dll NOT unregistered. C:\WINDOWS\System32\mljji.dll moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\jkkjk.dll C:\WINDOWS\System32\jkkjk.dll NOT unregistered. C:\WINDOWS\System32\jkkjk.dll moved successfully. LoadLibrary failed for C:\WINDOWS\System32\ufgfgpfj.dll C:\WINDOWS\System32\ufgfgpfj.dll NOT unregistered. File move failed. C:\WINDOWS\System32\ufgfgpfj.dll scheduled to be moved on reboot. LoadLibrary failed for C:\WINDOWS\System32\jutjwrdi.dll C:\WINDOWS\System32\jutjwrdi.dll NOT unregistered. File move failed. C:\WINDOWS\System32\jutjwrdi.dll scheduled to be moved on reboot. LoadLibrary failed for C:\WINDOWS\System32\sxcloiqd.dll C:\WINDOWS\System32\sxcloiqd.dll NOT unregistered. File move failed. C:\WINDOWS\System32\sxcloiqd.dll scheduled to be moved on reboot. LoadLibrary failed for C:\WINDOWS\System32 utuktfg.dll C:\WINDOWS\System32 utuktfg.dll NOT unregistered. File move failed. C:\WINDOWS\System32 utuktfg.dll scheduled to be moved on reboot. < EmptyTemp > File delete failed. C:\WINDOWS emp\Perflib_Perfdata_644.dat scheduled to be deleted on reboot. File delete failed. C:\WINDOWS emp\_avast4_\Webshlock.txt scheduled to be deleted on reboot. Temp folders emptied. IE temp folders emptied. OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04172008_173137 2) Pour PCA je n'ai pas l bonpour enregistrer le scan, c'est comme si la fenêtre était coupée; 3) [CODE] 2008-04-17,18:08:34 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Home Edition Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed Follow item(s) have been choosed: All Boot Items (Including Registry, Startup Folders, Services and so on) Browser Add-ons Runing Processes (Including process model information) File Associations Winsock Provider Autorun.Inf HOSTS File Process Privileges Scan Boot Items Registry [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] [] [(Verified)Microsoft Windows Publisher] <> [N/A] <"C:\Program Files\CCleaner\ccleaner.exe" /AUTO> [(Verified)Piriform Ltd] [N/A] [(Verified)Google Inc] [Creative Technology Ltd] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] [NVIDIA Corporation] [NVIDIA Corporation] [NVIDIA Corporation] [(Verified)Microsoft Windows XP Publisher] [N/A] [Ahead Software Gmbh] [Ahead Software AG] <"C:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.] <"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"> [(Verified)"Sun Microsystems, Inc."] <"C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions> [] <"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"> [(Verified)"Adobe Systems, Incorporated"] <"C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" -osboot> [(Verified)"RealNetworks, Inc."] [] [France Télécom R&D] [N/A] [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Component Publisher] [(Verified)Microsoft Windows Publisher] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [(Verified)Microsoft Corporation] ================================== Startup Folders [EPSON Status Monitor 3 Environment Check 2] C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [SEIKO EPSON CORPORATION]> [InterVideo WinCinema Manager] C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE []> [Lancer l'utilitaire d'enregistrement] C:\PROGRA~1\WIFICO~1\NINTEN~1.EXE []> [Microsoft Office] C:\PROGRA~1\MICROS~3\Office\OSA9.EXE [Microsoft Corporation]> ================================== Services [Gestion d'applications / AppMgmt][Stopped/Manual Start] %SystemRoot%\System32\appmgmts.dll> [avast! iAVS4 Control Service / aswUpdSv][Running/Auto Start] <"C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"> [avast! Antivirus / avast! Antivirus][Running/Auto Start] <"C:\Program Files\Alwil Software\Avast4\ashServ.exe"> [avast! Mail Scanner / avast! Mail Scanner][Running/Manual Start] <"C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service> [avast! Web Scanner / avast! Web Scanner][Running/Manual Start] <"C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service> [Canon Camera Access Library 8 / CCALib8][Running/Auto Start] [Creative Service for CDROM Access / Creative Service for CDROM Access][Running/Auto Start] [EPSON Printer Status Agent2 / EPSONStatusAgent2][Running/Auto Start] [France Telecom Routing Table Service / FTRTSVC][Running/Auto Start] [Google Updater Service / gusvc][Stopped/Manual Start] <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"> [Accès du périphérique d'interface utilisateur / HidServ][Stopped/Disabled] %SystemRoot%\System32\hidserv.dll> [InstallDriver Table Manager / IDriverT][Stopped/Manual Start] <"C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe"> [InCD Helper / InCDsrv][Running/Auto Start] [InCD Helper (read only) / InCDsrvR][Stopped/Auto Start] [NVIDIA Display Driver Service / NVSvc][Stopped/Auto Start] [Control Parental / OPTENET_FILTER][Stopped/Auto Start] [Windows Live Setup Service / WLSetupSvc][Stopped/Manual Start] <"C:\Program Files\Windows Live\installer\WLSetupSvc.exe"> ================================== Drivers [aaudstum / aaudstum][Stopped/Manual Start] <\??\C:\DOCUME~1\ALAIN\LOCALS~1\Temp\aaudstum.sys> [aswFsBlk / aswFsBlk][Running/Auto Start] [catchme / catchme][Stopped/Manual Start] <\??\C:\combofix\catchme.sys> [C-Media High Definition Audio Interface / cmudax][Running/Manual Start]

[ENTECH / ENTECH][Stopped/Manual Start] <\??\C:\WINDOWS\system32\DRIVERS\ENTECH.SYS> [GMSIPCI / GMSIPCI][Stopped/Manual Start] <\??\D:\INSTALL\GMSIPCI.SYS> [Pilote de fonction Microsoft UAA pour Service High Definition Audio / HdAudAddService][Stopped/Manual Start] [Pilote de bus Microsoft UAA pour High Definition Audio / HDAudBus][Running/Manual Start] [InCDPass / InCDPass][Running/System Start] [nv / nv][Running/Manual Start] [PCAMPR5 NDIS Protocol Driver / PCAMPR5][Stopped/Manual Start] <\??\C:\WINDOWS\system32\PCAMPR5.SYS> [PCANDIS5 NDIS Protocol Driver / PCANDIS5][Running/Manual Start] <\??\C:\WINDOWS\system32\PCANDIS5.SYS> [Pilote de liaison parallèle directe / Ptilink][Running/Manual Start] [Nintendo Wi-Fi USB Connector Service / RT25USBAP][Stopped/Manual Start] [Sony Ericsson Device 716 driver (WDM) / s716bus][Stopped/Manual Start] [Sony Ericsson Device 716 USB WMC Modem Filter / s716mdfl][Stopped/Manual Start] [Sony Ericsson Device 716 USB WMC Modem Driver / s716mdm][Stopped/Manual Start] [Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM) / s716mgmt][Stopped/Manual Start] [Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS) / s716nd5][Stopped/Manual Start] [Sony Ericsson Device 716 USB WMC OBEX Interface / s716obex][Stopped/Manual Start] [Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM) / s716unic][Stopped/Manual Start] [Secdrv / Secdrv][Stopped/Manual Start] [tmcomm / tmcomm][Running/Auto Start] <\??\C:\WINDOWS\system32\drivers mcomm.sys> [USBIO Driver (usbio.sys) / USBIO][Stopped/Manual Start] [viamraid / viamraid][Running/Boot Start] <\SystemRoot\system32\DRIVERS\viamraid.sys> [NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller / yukonwxp][Running/Manual Start] ================================== Browser Add-ons [Aide pour le lien d'Adobe PDF Reader] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [] {5BF13299-636F-4C88-9BCD-21B386A70033} [] {6f47fcaa-2f43-4b2c-9637-4a264683a75f} [SSVHelper Class] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [Programme d'aide de l'Assistant de connexion Windows Live] {9030D464-4C02-4ABF-8ECC-5164760863C6} [ST] {9394EDE7-C8B5-483E-8773-474BF36AF6E4} [Google Toolbar Helper] {AA58ED58-01DD-4d91-8333-CF10577473F7} [Google Toolbar Notifier BHO] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} [] {B55814B8-9530-4317-B298-399277821CFA} [MSNToolBandBHO] {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [EpsonToolBandKicker Class] {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} [Java Plug-in 1.6.0_03] {08B0E5C0-4FCB-11CF-AAA5-00401C608501} [BlogThisToolbarButton Class] {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} [] {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A> [MSN] {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [EPSON Web-To-Page] {EE5D279F-081B-4404-994D-C6B60AAEBA6D} [&Google] {2318C2B1-4965-11d4-9B18-009027A5CD4F} [QuickTime Object] {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [Shockwave ActiveX Control] {166B1BCA-3F9C-11CF-8075-444553540000} [Shockwave ActiveX Control] {233C1507-6A77-46A4-9443-F871F945D258} [Citrix ICA Client] {238F6F83-B8B4-11CF-8771-00A024541EE3} [MSN Photo Upload Tool] {4F1E5B1A-2A80-42CA-8532-2D05CB959537} [UnoCtrl Class] {5D6F45B3-9043-443D-A792-115447494D24} [Java Plug-in 1.6.0_03] {8AD9C840-044E-11D1-B3E9-00805F499D93} [MessengerStatsClient Class] {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} [MessengerStatsClient Class] {C3F79A2B-B9B4-4A66-B012-3EE46475B072} [Java Plug-in 1.6.0_02] {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} [Java Plug-in 1.6.0_03] {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [Java Plug-in 1.6.0_03] {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [Minesweeper Flags Class] {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} [Bibliothèque d'objets Microsoft Outlook 8.0] {0006F033-0000-0000-C000-000000000046} <, N/A> [Microsoft Outlook] {0006F03A-0000-0000-C000-000000000046} <, N/A> [Google Script Object] {00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} [Yahoo! Toolbar Helper] {02478D38-C3F9-4EFB-9B51-7695ECA05670} <, N/A> [QuickTime Object] {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [Aide pour le lien d'Adobe PDF Reader] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [Windows Genuine Advantage Validation Tool] {17492023-C23A-453E-A040-C7C580BBF700} [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} [&Google] {2318C2B1-4965-11D4-9B18-009027A5CD4F} [Shockwave ActiveX Control] {233C1507-6A77-46A4-9443-F871F945D258} [Citrix ICA Client] {238F6F83-B8B4-11CF-8771-00A024541EE3} [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} [HtmlDlgSafeHelper Class] {3050F819-98B5-11CF-BB82-00AA00BDCE0B} [Tabular Data Control] {333C7BC4-460F-11D0-BC04-0080C7055A83} [QuickTime Object] {4063BE15-3B08-470D-A0D5-B37161CFFD69} [XML Document] {48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A> [] {4F07F79F-087F-42CF-8B36-7A88D06088E9} [MSN Photo Upload Tool] {4F1E5B1A-2A80-42CA-8532-2D05CB959537} [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} [] {5BF13299-636F-4C88-9BCD-21B386A70033} [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} [SonicSelectorPlugin.Script] {6DB52B5A-5CD4-4EAB-9C23-DD84D09E914E} [] {6F47FCAA-2F43-4B2C-9637-4A264683A75F} [Active Desktop Mover] {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A> [Windows Media Services DRM Storage object] {760C4B83-E211-11D2-BF3E-00805FBE84A6} [SSVHelper Class] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [Microsoft Web Browser] {8856F961-340A-11D0-A96B-00C04FD705A2} [XML DOM Document 4.0] {88D969C0-F192-11D4-A65F-0040963251E5} [Programme d'aide de l'Assistant de connexion Windows Live] {9030D464-4C02-4ABF-8ECC-5164760863C6} [ST] {9394EDE7-C8B5-483E-8773-474BF36AF6E4} [Google Toolbar Helper] {AA58ED58-01DD-4D91-8333-CF10577473F7} [Google Toolbar Notifier BHO] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [] {B55814B8-9530-4317-B298-399277821CFA} [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} [MSN] {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [MSNToolBandBHO] {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [] {BF47D68C-0F24-404D-9E1E-63F13C8761CD} [AUDIO__MID Moniker Class] {CD3AFA74-B84F-48F0-9393-7EDC34128127} [VIDEO__X_MS_ASF Moniker Class] {CD3AFA8F-B84F-48F0-9393-7EDC34128127} [Contrôle de l'Assistant de connexion Windows Live] {D2517915-48CE-4286-970F-921E881B8C5C} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [OfficeObj Class] {D2BD7935-05FC-11D2-9059-00C04FD7A1BD} <, N/A> [QuickTimeCheck Class] {DE4AF3B0-F4D4-11D3-B41A-0050DA2E6C21} [] {E1771B7F-98BE-407F-BA67-AA16ADA5D0C5} [EpsonToolBandKicker Class] {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} [XML HTTP Request] {ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\system32\msxml3.dll, N/A> [EPSON Web-To-Page] {EE5D279F-081B-4404-994D-C6B60AAEBA6D} [Yahoo! Toolbar] {EF99BD32-C1FB-11D2-892F-0090271D4F88} <, N/A> [] {F06608C7-1874-4EEA-B3B2-DF99EBB144B8} [JScript Language] {F414C260-6AC0-11CF-B6D1-00AA00BBBB58} [XML DOM Document] {F6D90F11-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A> [XML HTTP] {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A> ================================== Running Processes [PID: 584 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 644 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 668 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WgaLogon.dll] [Microsoft Corporation, 1.7.0018.5] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 712 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)] [PID: 724 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 884 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 952 / SERVICE RÉSEAU][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1048 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [PID: 1068 / SYSTEM][C:\Program Files\Ahead\InCD\InCDsrv.exe] [Ahead Software AG, 4, 2, 16, 0] [C:\Program Files\Fichiers communs\Ahead\Lib\AdvrCntr.dll] [Ahead Software AG, 1,0,13, 2126] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\Program Files\Fichiers communs\Ahead\Lib\DriveLocker.dll] [Ahead Software AG, 1, 0, 0, 13] [C:\Program Files\Ahead\InCD\incdshx.dll] [Ahead Software AG, 4, 2, 16, 0] [PID: 1188 / SERVICE RÉSEAU][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1292 / SERVICE LOCAL][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [PID: 1444 / SYSTEM][C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswCmnS.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswCmnOS.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Alwil Software\Avast4\aswCmnB.dll] [ALWIL Software, 4, 8, 1169, 0] [PID: 1528 / SYSTEM][C:\Program Files\Alwil Software\Avast4\ashServ.exe] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswAux.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Alwil Software\Avast4\aswCmnB.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswCmnOS.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswEngin.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswScan.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswCmnS.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\ashBase.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\ashTask.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswInteg.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswIdle.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\Aavm4h.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\French\Base.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\AhResMai.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\ahResMes.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\AhResNS.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\AhResOut.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\ahResP2P.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\AhResStd.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\AhResWS.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\ashSSqlt.dll] [ALWIL Software, 4, 8, 1169, 0] [PID: 1904 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\WINDOWS\system32\E_FLBBEE.DLL] [SEIKO EPSON CORPORATION, 1, 3, 0, 0] [C:\WINDOWS\system32\E_SL2302.DLL] [SEIKO EPSON CORPORATION, 2, 12, 0, 0] [C:\WINDOWS\system32\E_SL2352.DLL] [SEIKO EPSON CORPORATION, 2, 15, 0, 0] [PID: 636 / SYSTEM][C:\WINDOWS\system32\CTsvcCDA.EXE] [Creative Technology Ltd, 1.0.1.0] [PID: 648 / SYSTEM][C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe] [SEIKO EPSON CORPORATION, 1, 2, 0, 0] [C:\WINDOWS\system32\EBAPI2.DLL] [SEIKO EPSON CORPORATION, 1, 1, 0, 0] [C:\Program Files\Fichiers communs\EPSON\EBAPI\EBPLPT.DLL] [SEIKO EPSON CORPORATION, 2, 14, 0, 0] [PID: 900 / SYSTEM][C:\WINDOWS\System32\FTRTSVC.exe] [France Telecom, 11.0 (4)] [C:\WINDOWS\System32\IfHelper.dll] [France Télécom R&D, 11b.0 (3)] [PID: 1792 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 260 / SYSTEM][C:\Program Files\Canon\CAL\CALMAIN.exe] [Canon Inc., 8, 1, 0, 14] [PID: 552 / SYSTEM][C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\ashBase.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Alwil Software\Avast4\aswCmnOS.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswCmnB.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswCmnS.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\ashTask.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswAux.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\Aavm4h.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\AhResMai.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\French\Base.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswEngin.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswScan.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\French\Lang.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Alwil Software\Avast4\French\langmai.dll] [ALWIL Software, 4, 8, 1169, 0] [PID: 312 / SYSTEM][C:\Program Files\Alwil Software\Avast4\ashWebSv.exe] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\ashBase.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Alwil Software\Avast4\aswCmnOS.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswCmnB.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswCmnS.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\Aavm4h.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\ashTask.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswAux.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\French\Base.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\ashWsFtr.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswScan.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\PROGRA~1\ALWILS~1\Avast4\AhResWs.dll] [ALWIL Software, 4, 8, 1169, 0] [C:\Program Files\Alwil Software\Avast4\aswEngin.dll] [ALWIL Software, 4, 8, 1169, 0] [PID: 2076 / SERVICE LOCAL][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 2464 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 2180 / MARINE][C:\WINDOWS\system32\RunDll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system\cmicnfg.cpl] [C-Media Corporation, 1, 0, 42, 10] [C:\WINDOWS\System32\udaprop.dll] [C-Media Corporation, 1.0.2.3] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 2252 / MARINE][C:\Program Files\Ahead\InCD\InCD.exe] [Ahead Software AG, 4, 2, 16, 0] [C:\Program Files\Ahead\InCD\InCDapi.dll] [Ahead Software AG, 4, 2, 16, 0] [C:\Program Files\Fichiers communs\Ahead\Lib\DriveLocker.dll] [Ahead Software AG, 1, 0, 0, 13] [C:\Program Files\Ahead\InCD\incdshx.dll] [Ahead Software AG, 4, 2, 16, 0] [C:\Program Files\Fichiers communs\Ahead\Lib\AdvrCntr.dll] [Ahead Software AG, 1,0,13, 2126] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 2308 / MARINE][C:\Program Files\QuickTime\qttask.exe] [Apple Computer, Inc., 7.1.5a38] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 2332 / MARINE][C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe] [Sun Microsystems, Inc., 6.0.30.5] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [PID: 2344 / MARINE][C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe] [, 2.2.10.58] [C:\WINDOWS\system32\MFC71U.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Fichiers communs\Teleca Shared lib_log.dll] [Popwire AB, 1.1.1.139] [C:\Program Files\Fichiers communs\Teleca Shared\boost_log-vc71-mt-1_33.dll] [N/A, ] [C:\Program Files\Fichiers communs\Teleca Shared lib_cmndlgs.dll] [Popwire AB, 1.1.0.19] [C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application LauncherLg.dll] [, 2.0.6.1] [C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application LauncherBmp.dll] [, 2.0.5.1] [C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application LauncherMainDlg.dll] [Sony Ericsson Mobile Communications AB, 2.0.4.33] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\icm32.dll] [Microsoft Corporation, 5.1.2600.2709 (xpsp_sp2_gdr.050628-1518)] [C:\Program Files\Fichiers communs\Teleca Shared\TC Device Mgmt.dll] [Teleca AB, 1.5.0.87] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 2396 / MARINE][C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe] [RealNetworks, Inc., 0.1.0.4279] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 2644 / MARINE][C:\WINDOWS\system32 undll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 2692 / MARINE][C:\PROGRA~1\Wanadoo\TaskBarIcon.exe] [France Télécom R&D, 5.9 (1)] [C:\PROGRA~1\Wanadoo\OutilsFT.dll] [France Télécom R&D, 5.4 (36)] [C:\PROGRA~1\Wanadoo\MFC42.DLL] [Microsoft Corporation, 6.00.8168.0] [C:\PROGRA~1\Wanadoo\StyleIHM.dll] [France Télécom R&D, 11.0 (0)] [c:\progra~1\wanadoo\skin\default\main\ResourceStyle.dll] [, 5.9] [C:\PROGRA~1\Wanadoo\WooIHMF.dll] [France Télécom R&D, 5.9 (509)] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 2696 / MARINE][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 2708 / MARINE][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 2772 / MARINE][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] [Google Inc., 2, 0, 301, 1654] [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll] [Google Inc., 2, 0, 301, 7164] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164 es_fr.dll] [Google Inc., 2, 0, 301, 7164] [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 2780 / MARINE][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 2800 / MARINE][C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe] [Creative Technology Ltd, 3.0.2.0] [C:\Program Files\Creative\MediaSource\Detector\CTIntrfc.dll] [Creative Technology Ltd, 2.1.0.0] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\Program Files\Creative\MediaSource\Detector\CTDetect.Crl] [Creative Technology Ltd, 2.1.0.0] [C:\Program Files\Creative\MediaSource\Detector\DtctrMgr.det] [Creative Technology Ltd, 3.0.2.0] [C:\Program Files\Creative\MediaSource\Detector\MuVo.det] [Creative Technology Ltd, 3.0.3.0] [C:\Program Files\Creative\MediaSource\Detector\Muvo.Crl] [Creative Technology Ltd, 2.0.1.0] [C:\Program Files\Creative\Shared Files\ThmRes.DLL] [Creative Technology Ltd, 2.0.12.0] [C:\Program Files\Creative\Shared Files\CTIniF.dll] [Creative Technology Ltd, 1.1.0.0] [C:\Program Files\Creative\MediaSource\Detector\Hdd.det] [Creative Technology Ltd, 1.0.6.0] [C:\Program Files\Creative\MediaSource\Detector\Njb3.DET] [Creative Technology Ltd, 1.0.7.0] [C:\Program Files\Creative\MediaSource\Detector\Disc.det] [Creative Technology Ltd, 2.4.2.0] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 2812 / MARINE][C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe] [, 1.0] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 436 / MARINE][C:\Program Files\WiFiConnector\NintendoWFCReg.exe] [, 1, 0, 0, 31] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\Program Files\WiFiConnector\WIFICON.dll] [, 1, 0, 0, 3] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 2988 / MARINE][C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe] [France Télécom R&D, 5.9 (3)] [C:\PROGRA~1\Wanadoo\OutilsFT.dll] [France Télécom R&D, 5.4 (36)] [C:\PROGRA~1\Wanadoo\MFC42.DLL] [Microsoft Corporation, 6.00.8168.0] [C:\PROGRA~1\Wanadoo\StyleIHM.dll] [France Télécom R&D, 11.0 (0)] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\PROGRA~1\Wanadoo\WooIHMF.dll] [France Télécom R&D, 5.9 (509)] [c:\progra~1\wanadoo\skin\default\main\ResourceStyle.dll] [, 5.9] [C:\WINDOWS\System32\ALERTM~1\ALERTC~1.DLL] [, 1, 0, 0, 1] [C:\PROGRA~1\Wanadoo\DetectComponent.dll] [, 5.8 (10)] [C:\PROGRA~1\Wanadoo\Inactivity.dll] [, 1, 0, 0, 1] [C:\PROGRA~1\Wanadoo\SynchroDll.dll] [, 11.0 (21)] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 776 / MARINE][C:\PROGRA~1\Wanadoo\ComComp.exe] [France Télécom R&D, 11b.0 (8)] [C:\PROGRA~1\Wanadoo\OutilsFT.dll] [France Télécom R&D, 5.4 (36)] [C:\PROGRA~1\Wanadoo\MFC42.DLL] [Microsoft Corporation, 6.00.8168.0] [C:\PROGRA~1\Wanadoo\WLANManager.dll] [France Télécom R&D, 11b.0 (18)] [C:\PROGRA~1\Wanadoo\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0] [C:\PROGRA~1\Wanadoo\IfHelper.dll] [France Télécom R&D, 11b.0 (3)] [C:\WINDOWS\system32\W32N50.dll] [Printing Communications Assoc., Inc. (PCAUSA), 5.03.16.54] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\PROGRA~1\Wanadoo\GestAppFT.dll] [France Télécom R&D, 10.0 (227)] [C:\PROGRA~1\Wanadoo\ModifFT.dll] [France Télécom R&D, 10.0 (40)] [C:\PROGRA~1\Wanadoo\PMStub.dll] [, 11.0 (3)] [C:\PROGRA~1\Wanadoo\PhoneManager.dll] [, 10, 0, 0, 0] [C:\PROGRA~1\Wanadoo\DetectComponent.dll] [, 5.8 (10)] [C:\PROGRA~1\Wanadoo\NDIS_Gen.dll] [France Télécom R&D, 11b.0 (19)] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 3184 / MARINE][C:\PROGRA~1\Wanadoo\Toaster.exe] [France Telecom R&D, 1, 0, 0, 1] [C:\PROGRA~1\Wanadoo\StyleIHM.dll] [France Télécom R&D, 11.0 (0)] [C:\PROGRA~1\Wanadoo\MFC42.DLL] [Microsoft Corporation, 6.00.8168.0] [C:\PROGRA~1\Wanadoo\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\System32\ALERTM~1\ALERTC~1.DLL] [, 1, 0, 0, 1] [c:\progra~1\wanadoo\skin\default\main\ResourceStyle.dll] [, 5.9] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\msadp32.acm] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\PROGRA~1\Wanadoo\Inactivity.dll] [, 1, 0, 0, 1] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 1240 / MARINE][C:\PROGRA~1\Wanadoo\Inactivity.exe] [, 1, 0, 0, 1] [C:\PROGRA~1\Wanadoo\MFC42.DLL] [Microsoft Corporation, 6.00.8168.0] [C:\PROGRA~1\Wanadoo\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\System32\ALERTM~1\ALERTC~1.DLL] [, 1, 0, 0, 1] [C:\PROGRA~1\Wanadoo\Inactivity.dll] [, 1, 0, 0, 1] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 3280 / MARINE][C:\PROGRA~1\Wanadoo\PollingModule.exe] [, 1, 0, 0, 1] [C:\PROGRA~1\Wanadoo\OutilsFT.dll] [France Télécom R&D, 5.4 (36)] [C:\PROGRA~1\Wanadoo\MFC42.DLL] [Microsoft Corporation, 6.00.8168.0] [C:\PROGRA~1\Wanadoo\SynchroDll.dll] [, 11.0 (21)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\PROGRA~1\Wanadoo\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\System32\ALERTM~1\ALERTC~1.DLL] [, 1, 0, 0, 1] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 860 / MARINE][C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE] [, 1, 0, 0, 1] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 3592 / MARINE][C:\PROGRA~1\Wanadoo\Watch.exe] [France Télécom R&D, 11.0 (2)] [C:\PROGRA~1\Wanadoo\ModifFT.dll] [France Télécom R&D, 10.0 (40)] [C:\PROGRA~1\Wanadoo\IfHelper.dll] [France Télécom R&D, 11b.0 (3)] [C:\PROGRA~1\Wanadoo\MFC42.DLL] [Microsoft Corporation, 6.00.8168.0] [PID: 3356 / MARINE][C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe] [Teleca AB, 1.5.0.395] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Fichiers communs\Teleca Shared lib_log.dll] [Popwire AB, 1.1.1.139] [C:\Program Files\Fichiers communs\Teleca Shared\boost_log-vc71-mt-1_33.dll] [N/A, ] [C:\Program Files\Fichiers communs\Teleca Shared\TC Device Mgmt.dll] [Teleca AB, 1.5.0.87] [c:\WINDOWS\system32\msxml4.dll] [Microsoft Corporation, 4.20.9848.0] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\Program Files\Fichiers communs\Teleca Shared\HookStarter.dll] [Popwire AB, 1.0.3.11] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\Program Files\Fichiers communs\Sony Ericsson Shared\SpecificMPM.dll] [Sony Ericsson Mobile Communications AB, 1, 3, 0, 0] [C:\Program Files\Fichiers communs\Teleca Shared\SpecificUSB.dll] [Teleca AB, 1, 2, 2, 1] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 3868 / MARINE][C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe] [Sony Ericsson Mobile Communications AB, 1, 2, 0,1234] [C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\ShowMfcDialog.dll] [Sony Ericsson Mobile Communications AB, 1, 0, 0,166] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\Capires040c.DLL] [Popwire AB, 1, 0, 0,2048] [C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\msirsock_object.dll] [Sony Ericsson Mobile Communications AB, 1, 0, 0,1055] [c:\WINDOWS\system32\msxml4.dll] [Microsoft Corporation, 4.20.9848.0] [C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\cellphone_object.dll] [Sony Ericsson Mobile Communications AB, 1, 0, 0,1238] [C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\ecsmoddata.dll] [Sony Ericsson Mobile Communications AB, 1, 2, 0,354] [C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\cabmain.dll] [Sony Ericsson Mobile Communications AB, 1, 0, 0,1272] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 3864 / MARINE][C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe] [Microsoft Corporation, 4.200.520.1] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\msidcrl40.dll] [Microsoft Corporation, 4.200.520.1] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 1992 / MARINE][C:\WINDOWS\system32 undll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [PID: 140 / MARINE][C:\DOCUME~1\MARINE\LOCALS~1\Temp\Répertoire temporaire 1 pour pca[1].zip\pca.exe] [evosla, 1.0.2.19] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\ieframe.DLL] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\PROGRA~1\Wanadoo\Inactivity.dll] [, 1, 0, 0, 1] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [PID: 3464 / MARINE][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\PROGRA~1\Wanadoo\Inactivity.dll] [, 1, 0, 0, 1] [C:\WINDOWS\system32\WPDShServiceObj.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\PortableDeviceTypes.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200] [C:\WINDOWS\system32\yshnwnoa.dll] [N/A, ] [C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll] [SEIKO EPSON CORPORATION, 1, 1, 0, 0] [C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA] [Adobe Systems, Inc., 8.0.0.0] [C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 8.1.0.0] [PID: 2664 / MARINE][C:\Program Files\internet explorer\iexplore.exe] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32\IEFRAME.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)] [C:\WINDOWS\system32 vdpecjf.dll] [N/A, ] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\IEUI.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)] [C:\WINDOWS\system32\xmllite.dll] [Microsoft Corporation, 1.00.1018.0] [C:\Program Files\Internet Explorer\ieproxy.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)] [C:\WINDOWS\system32\vtutr.dll] [N/A, ] [C:\PROGRA~1\Wanadoo\Inactivity.dll] [, 1, 0, 0, 1] [c:\program files\google\googletoolbar3.dll] [Google Inc., 4, 0, 1601, 4978] [C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200] [C:\WINDOWS\system32\yshnwnoa.dll] [N/A, ] [C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll] [Sun Microsystems, Inc., 6.0.30.5] [C:\Program Files\Java\jre1.6.0_03\bin\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll] [Microsoft Corporation, 4.200.520.1] [C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\msidcrl40.dll] [Microsoft Corporation, 4.200.520.1] [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164] [C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll] [SEIKO EPSON CORPORATION, 1, 1, 0, 0] [C:\WINDOWS\system32\ieapfltr.dll] [Microsoft Corporation, 7.0.6000.16461] [C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx] [Adobe Systems, Inc., 9,0,115,0] [C:\WINDOWS\system32\msacm32.

esteban39 · Answer

telecharge avast mon père il l'a est il a plus de virus va sur le site https://www.avast.com/fr-fr/index clique sur telecharger i va te de mander la première foi que tu va le mettre en route une clée d'enrgistrement clique sur optenir une clée d'activation voila

marine · Answer

Merci esteban39 mais j'ai déjà avast et il ne peut pas régler ce problème. Je continue donc de suivre les conseils de FillPCA.

FillPCA · Answer

Salut esteban39, et laisse-moi traiter ce sujet s'il te plait. Avast n'a jamais de sa vie viré un Vundo !

1/     *  Sélectionne le texte suivant :

Killall::

Driver::
aaudstum

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BF13299-636F-4C88-9BCD-21B386A70033}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6f47fcaa-2f43-4b2c-9637-4a264683a75f}]

File::
C:\WINDOWS\system32\vtutr.dll
C:\WINDOWS\system32\yshnwnoa.dll
C:\WINDOWS\System32\kypxqxco.dll
C:\WINDOWS\System32\yejjuvsq.dll
C:\WINDOWS\System32\wftbisks.dll
C:\WINDOWS\System32\cpqrfcmn.dll
C:\WINDOWS\System32\jutjwrdi.dll
C:\WINDOWS\System32\sxcloiqd.dll
C:\WINDOWS\System32\rutuktfg.dll

    * Copie le texte sélectionné (CTRL+C).
    * Ouvre le bloc-note (programme>Accessoire>bloc-note).
    * Colle le texte copié dans ce bloc-note (CTRL+V).
    * Sauvegarde ce fichier sous le nom de CFScript.txt
    * Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture
http://img178.imageshack.us/img178/1060/cfscriptra9.gif
    * Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
    * Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal!
      Ne touche à rien tant que le scan n'est pas terminé.
    * Une fois le scan achevé, un rapport va s'afficher: Poste son contenu.
    * Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

2) Télécharge VirtumundoBeGone sur votre bureau : http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double-clique ensuite sur VirtumundoBeGone.exe et suis les instructions qui s'affichent à l'écran.

Une fois terminé, redémarre le PC.

PS : Ne t'inquiète pas si tu vois un écran bleu "Erreur fatale", c'est normal.

Poste le rapport généré par VirtumundoBeGone ^^ 

3/ Utilise et installe Malwarebyte's et utilise-le en suivant ce tuto : https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm

4/ Edite tous les rapports précédents et un rapport Hijackthis.

FillPCA

marine · Answer

1/
ComboFix 08-04-16.5 - MARINE 2008-04-17 18:49:07.5 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.295 [GMT 2:00]
Endroit: C:\Documents and Settings\MARINE\Bureau\combofix.exe
Command switches used :: C:\Documents and Settings\MARINE\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\WINDOWS\System32\cpqrfcmn.dll
C:\WINDOWS\System32\jutjwrdi.dll
C:\WINDOWS\System32\kypxqxco.dll
C:\WINDOWS\System32\rutuktfg.dll
C:\WINDOWS\System32\sxcloiqd.dll
C:\WINDOWS\system32\vtutr.dll
C:\WINDOWS\System32\wftbisks.dll
C:\WINDOWS\System32\yejjuvsq.dll
C:\WINDOWS\system32\yshnwnoa.dll
.
/wow section - STAGE 41
pv: No matching processes found
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\System32\cpqrfcmn.dll
C:\WINDOWS\system32\fjcepdvr.ini
C:\WINDOWS\System32\jutjwrdi.dll
C:\WINDOWS\System32\kypxqxco.dll
C:\WINDOWS\system32\rtutv.ini
C:\WINDOWS\system32\rtutv.ini2
C:\WINDOWS\System32\rutuktfg.dll
C:\WINDOWS\system32\rvdpecjf.dll
C:\WINDOWS\System32\sxcloiqd.dll
C:\WINDOWS\System32\wftbisks.dll
C:\WINDOWS\System32\yejjuvsq.dll
.
---- Previous Run -------
.
C:\Program Files\ContextTool
C:\Program Files\ContextTool\ContextHelper.dat
C:\Program Files\ContextTool\pcre3.dll
C:\Program Files\ContextTool\uninstall.exe
C:\Program Files\PlayMP3z
C:\Program Files\PlayMP3z\PlayMP3.exe
C:\Program Files\PlayMP3z\uninstall.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\abeeg.ini
C:\WINDOWS\system32\abeeg.ini2
C:\WINDOWS\system32\ainaovva.dll
C:\WINDOWS\system32\alxrhloo.dll
C:\WINDOWS\system32\ataarijp.ini
C:\WINDOWS\system32\bbiywltp.dll
C:\WINDOWS\system32\cdeeg.ini
C:\WINDOWS\system32\cdeeg.ini2
C:\WINDOWS\system32\cdwurrhu.ini
C:\WINDOWS\system32\coaqwuiq.ini
C:\WINDOWS\system32\cotjayka.ini
C:\WINDOWS\system32\dgjlm.ini
C:\WINDOWS\system32\dgjlm.ini2
C:\WINDOWS\system32\dlbyidxn.ini
C:\WINDOWS\system32\dtumgtho.dll
C:\WINDOWS\system32\duwaqlwq.dll
C:\WINDOWS\system32\ehkmp.ini
C:\WINDOWS\system32\ehkmp.ini2
C:\WINDOWS\system32\ewnxwufd.dll
C:\WINDOWS\system32\fbmvcyrw.dll
C:\WINDOWS\system32\ffhkj.ini
C:\WINDOWS\system32\ffhkj.ini2
C:\WINDOWS\system32\fvmdwvyt.dll
C:\WINDOWS\system32\gikftrdy.dll
C:\WINDOWS\system32\gjjlm.ini
C:\WINDOWS\system32\gjjlm.ini2
C:\WINDOWS\system32\gpgkgkix.dll
C:\WINDOWS\system32\gqxvejoc.dll
C:\WINDOWS\system32\hajuhhtq.dll
C:\WINDOWS\system32\hgcfjooi.dll
C:\WINDOWS\system32\hhhkj.ini
C:\WINDOWS\system32\hhhkj.ini2
C:\WINDOWS\system32\hsxyyabt.dll
C:\WINDOWS\system32\ijjlm.ini
C:\WINDOWS\system32\ijjlm.ini2
C:\WINDOWS\system32\ijkmp.ini
C:\WINDOWS\system32\ijkmp.ini2
C:\WINDOWS\system32\ikknkbqp.ini
C:\WINDOWS\system32\jfpgfgfu.ini
C:\WINDOWS\system32\kjjlm.ini
C:\WINDOWS\system32\kjjlm.ini2
C:\WINDOWS\system32\kjkkj.ini
C:\WINDOWS\system32\kjkkj.ini2
C:\WINDOWS\system32\kysfaejh.ini
C:\WINDOWS\system32\lofijjhh.dll
C:\WINDOWS\system32\luaqnskx.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\micyivbr.ini
C:\WINDOWS\system32\mjenflex.ini
C:\WINDOWS\system32\mpkqlast.dll
C:\WINDOWS\system32\nefodrbr.dll
C:\WINDOWS\system32\nfcwhmbc.dll
C:\WINDOWS\system32\nnvlnxeq.ini
C:\WINDOWS\system32\nsfetsjp.ini
C:\WINDOWS\system32\nyhwuogq.ini
C:\WINDOWS\system32\oddjkrhi.dll
C:\WINDOWS\system32\orqss.ini
C:\WINDOWS\system32\orqss.ini2
C:\WINDOWS\system32\pcthquyb.dll
C:\WINDOWS\system32\psqmvsum.dll
C:\WINDOWS\system32\puqblcyy.ini
C:\WINDOWS\system32\qexnlvnn.dll
C:\WINDOWS\system32\qstwa.ini
C:\WINDOWS\system32\qstwa.ini2
C:\WINDOWS\system32\qsvujjey.ini
C:\WINDOWS\system32\qtstv.ini
C:\WINDOWS\system32\qtstv.ini2
C:\WINDOWS\system32\qxmbsxtf.dll
C:\WINDOWS\system32\qxytifia.dll
C:\WINDOWS\system32\qyqcnpts.ini
C:\WINDOWS\system32\rbnoewub.dll
C:\WINDOWS\system32\rbviycim.dll
C:\WINDOWS\system32\rfmyycil.dll
C:\WINDOWS\system32\rllaviuf.ini
C:\WINDOWS\system32\rpnuwuuw.dll
C:\WINDOWS\system32\rqtss.ini
C:\WINDOWS\system32\rqtss.ini2
C:\WINDOWS\system32\rtutv.ini
C:\WINDOWS\system32\rtutv.ini2
C:\WINDOWS\system32\rwapcspx.ini
C:\WINDOWS\system32\ryphoece.dll
C:\WINDOWS\system32\sntrbhjd.dll
C:\WINDOWS\system32\srutv.ini
C:\WINDOWS\system32\srutv.ini2
C:\WINDOWS\system32\stpncqyq.dll
C:\WINDOWS\system32\ttstv.ini
C:\WINDOWS\system32\ttstv.ini2
C:\WINDOWS\system32\utiltoyl.ini
C:\WINDOWS\system32\veghqtfx.dll
C:\WINDOWS\system32\votprmxv.ini
C:\WINDOWS\system32\vtutr.dll
C:\WINDOWS\system32\vxmrptov.dll
C:\WINDOWS\system32\vybeg.ini
C:\WINDOWS\system32\vybeg.ini2
C:\WINDOWS\system32\vycdd.ini
C:\WINDOWS\system32\vycdd.ini2
C:\WINDOWS\system32\wkctwxag.ini
C:\WINDOWS\system32\wofegsvm.dll
C:\WINDOWS\system32\wpgwftvs.dll
C:\WINDOWS\system32\wrhgtjdy.dll
C:\WINDOWS\system32\xnisqwsa.dll
C:\WINDOWS\system32\xnpberyu.dll
C:\WINDOWS\system32\xqvsaqev.ini
C:\WINDOWS\system32\xvugpeyb.dll
C:\WINDOWS\system32\yshnwnoa.dll
C:\WINDOWS\system32\yvlnphok.dll
C:\WINDOWS\system32\yyclbqup.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-17 to 2008-04-17 ))))))))))))))))))))))))))))))))))))
.

2008-04-17 17:46 . 2008-04-17 17:46 237,710 --a------ C:\WINDOWS\system32\def.vpc
2008-04-17 17:31 . 2008-04-17 17:31 <REP> d-------- C:\_OTMoveIt
2008-04-17 13:54 . 2008-04-17 14:24 <REP> d-------- C:\VundoFix Backups
2008-04-17 13:39 . 2008-04-17 13:35 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-04-17 13:34 . 2008-04-17 13:41 <REP> d-------- C:\Documents and Settings\MARINE\.housecall6.6
2008-04-17 13:19 . 2008-04-17 13:19 <REP> d-------- C:\Program Files\Trend Micro
2008-04-10 08:45 . 2008-04-10 08:45 84,544 --a------ C:\WINDOWS\system32\ufgfgpfj.dll
2008-04-09 14:13 . 2008-04-09 14:13 90,688 --a------ C:\WINDOWS\system32\ploramnt.dll
2008-04-09 14:13 . 2008-04-09 14:13 3,648 --a------ C:\WINDOWS\system32\uklelrph.dll
2008-04-09 14:11 . 2008-04-09 14:11 87,616 --a------ C:\WINDOWS\system32\sroxkkap.dll
2008-04-09 14:10 . 2008-04-09 14:10 3,648 --a------ C:\WINDOWS\system32\ienevnex.dll
2008-04-09 14:08 . 2008-04-09 14:08 87,616 --a------ C:\WINDOWS\system32\phunytpd.dll
2008-04-06 17:50 . 2008-04-06 17:51 <REP> d-------- C:\Program Files\Attal
2008-04-06 17:29 . 2008-04-06 17:29 85,056 --a------ C:\WINDOWS\system32\pjiraata.dll
2008-04-06 17:27 . 2008-04-06 17:27 89,664 --a------ C:\WINDOWS\system32\ukeelawl.dll
2008-04-06 17:24 . 2008-04-06 17:24 87,104 --a------ C:\WINDOWS\system32\thxrneud.dll
2008-04-06 15:51 . 2008-04-06 15:51 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-06 15:51 . 2008-04-06 15:51 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-05 17:58 . 2008-04-05 17:58 85,056 --a------ C:\WINDOWS\system32\veqasvqx.dll
2008-04-05 17:55 . 2008-04-05 17:55 89,664 --a------ C:\WINDOWS\system32\ivyijxca.dll
2008-04-05 17:52 . 2008-04-05 17:52 87,104 --a------ C:\WINDOWS\system32\lodfdxea.dll
2008-04-05 17:50 . 2008-04-05 17:50 87,104 --a------ C:\WINDOWS\system32\swiqhqev.dll
2008-04-05 16:19 . 2008-04-05 16:19 <REP> d-------- C:\Program Files\Risk
2008-04-05 15:22 . 2008-04-05 15:23 <REP> d-------- C:\Program Files\MakeHuman 0.9.1 RC1
2008-04-05 15:19 . 2008-04-05 15:19 <REP> d-------- C:\Program Files\Terragen
2008-04-05 15:13 . 2008-04-05 15:14 <REP> d-------- C:\Program Files\Aqsis
2008-04-05 15:13 . 2008-04-05 15:16 <REP> d-------- C:\k3d
2008-04-05 15:04 . 2008-04-05 15:04 <REP> d-------- C:\Program Files\ANDROME NV
2008-04-05 14:59 . 2008-04-05 14:59 89,664 --a------ C:\WINDOWS\system32\cnfhftnw.dll
2008-04-05 14:59 . 2008-04-05 14:59 87,104 --a------ C:\WINDOWS\system32\xflpwhuo.dll
2008-04-05 09:54 . 2008-04-05 09:54 <REP> d-------- C:\Documents and Settings\NetworkService\Mes documents
2008-04-05 09:02 . 2008-04-17 14:55 101,147 --a------ C:\WINDOWS\BMb78dc4ae.xml
2008-04-02 17:03 . 2008-04-02 17:03 315,616 --a------ C:\WINDOWS\system32\awtsq.dll
2008-03-31 10:11 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-03-31 10:11 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-03-30 20:06 . 2008-03-30 20:06 315,664 --a------ C:\WINDOWS\system32\pmnnn.dll
2008-03-30 17:03 . 2008-03-30 17:03 315,664 --a------ C:\WINDOWS\system32\vtstt.dll
2008-03-30 12:48 . 2008-03-30 12:48 315,664 --a------ C:\WINDOWS\system32\awtqp.dll
2008-03-30 11:48 . 2008-03-30 11:48 315,664 --a------ C:\WINDOWS\system32\mljge.dll
2008-03-27 23:08 . 2008-03-27 23:08 92,224 --a------ C:\WINDOWS\system32\hoaapcln.dll
2008-03-27 21:39 . 2008-03-27 21:39 <REP> d-------- C:\Program Files\CleanUp!
2008-03-27 18:15 . 2008-03-27 18:15 315,568 --a------ C:\WINDOWS\system32\sstqr.dll
2008-03-26 19:44 . 2008-03-26 19:44 315,600 --a------ C:\WINDOWS\system32\geedc.dll
2008-03-19 19:17 . 2008-03-19 19:17 315,504 --a------ C:\WINDOWS\system32\pmkjj.dll
2008-03-18 19:31 . 2008-03-18 19:31 315,600 --a------ C:\WINDOWS\system32\ddcyv.dll
2008-03-18 19:23 . 2008-03-18 19:23 <REP> d-------- C:\Documents and Settings\LocalService\Bureau
2008-03-18 09:38 . 2008-03-18 09:38 315,632 --a------ C:\WINDOWS\system32\ssqro.dll
2008-03-18 09:33 . 2008-03-18 09:33 25,984 --------- C:\WINDOWS\system32\wvuroon.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-17 17:08 --------- d-----w C:\Program Files\Wanadoo
2008-04-05 08:07 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-29 17:35 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-29 17:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-29 17:27 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-29 17:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-27 19:33 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-03-18 08:39 --------- d-----w C:\Program Files\Slayers Online
2008-03-15 18:18 --------- d-----w C:\Documents and Settings\MARINE\Application Data\softboldcoal
2008-03-15 18:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\great coal love default
2008-03-15 18:16 --------- d-----w C:\Program Files\softboldcoal
2008-03-12 17:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst
2008-03-12 17:17 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2008-03-12 17:17 --------- d-----w C:\Program Files\Real
2008-03-12 17:17 --------- d-----w C:\Program Files\Fichiers communs\Real
2008-03-12 15:15 --------- d-----w C:\Program Files\SimpleOCR
2008-03-12 14:46 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2008-02-27 10:21 --------- d-----w C:\Program Files\Windows Live
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-01-22 08:33 690,136 ------w C:\installer-49814-845-office-french.exe
2006-10-10 10:07 92,368 ----a-w C:\Documents and Settings\MARINE\Application Data\errorsafescannerinstall_fr[1].exe
2006-10-09 09:38 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5EB1D26D-D841-4D98-94B5-243203A718EF}]
C:\WINDOWS\system32\vtutr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B55814B8-9530-4317-B298-399277821CFA}]
C:\WINDOWS\system32\vturs.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nurb win"="C:\DOCUME~1\MARINE\APPLIC~1\SOFTBO~1\ExtraBoltTime.exe" [2008-03-15 20:16 450048]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
"FlyAway"="" []
"ccleaner"="C:\Program Files\CCleaner\ccleaner.exe" [2008-03-25 11:48 906480]
"WOOKIT"="C:\Program Files\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-22 21:28 68856]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23 102400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-08-19 00:44 4554752]
"nwiz"="nwiz.exe" [2004-07-12 10:50 843776 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-08-19 00:44 86016]
"Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 17:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"Cmaudio"="cmicnfg.cpl" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-07-16 14:50 1409136]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-24 00:06 282624]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-05-28 10:14 528384]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-03-12 16:46 185896]
"Love default global mess"="C:\Documents and Settings\All Users\Application Data\great coal love default\Gpl Date.exe" [2008-04-17 19:11 9713664]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\Kyodai Mahjongg 2006\\kmj.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\\Program Files\\Warcraft III\\War3.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\java.exe"=
"C:\\Program Files\\Attal\\attal-client.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [2004-07-02 05:00]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
S2 OPTENET_FILTER;Control Parental;C:\Program Files\Controle Parental\bin\optproxy.exe [2006-03-02 17:10]
S3 aaudstum;aaudstum;C:\DOCUME~1\ALAIN\LOCALS~1\Temp\aaudstum.sys []
S3 s716bus;Sony Ericsson Device 716 driver (WDM);C:\WINDOWS\system32\DRIVERS\s716bus.sys [2007-06-29 10:59]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s716mdfl.sys [2007-06-29 10:59]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s716mdm.sys [2007-06-29 10:59]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s716mgmt.sys [2007-04-04 12:43]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);C:\WINDOWS\system32\DRIVERS\s716nd5.sys [2007-04-04 12:43]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s716obex.sys [2007-06-29 10:59]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);C:\WINDOWS\system32\DRIVERS\s716unic.sys [2007-04-04 12:43]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-04-17 16:00:04 C:\WINDOWS\Tasks\B3C406AF910FB46B.job"
- c:\docume~1\marine\applic~1\softbo~1\balmwebscr.exe
"2008-03-21 14:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-17 19:08:17
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 578

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\FTRTSVC.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-04-17 19:15:49 - machine was rebooted [MARINE]
ComboFix-quarantined-files.txt 2008-04-17 17:15:44

Pre-Run: 126,623,391,744 octets libres
Post-Run: 126,619,582,464 octets libres
.
2008-04-12 12:20:24 --- E O F ---

2/

[04/17/2008, 19:17:56] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\MARINE\Bureau\VirtumundoBeGone.exe" )
[04/17/2008, 19:17:58] - Detected System Information:
[04/17/2008, 19:17:58] - Windows Version: 5.1.2600, Service Pack 2
[04/17/2008, 19:17:58] - Current Username: MARINE (Admin)
[04/17/2008, 19:17:58] - Windows is in NORMAL mode.
[04/17/2008, 19:17:58] - Searching for Browser Helper Objects:
[04/17/2008, 19:17:58] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[04/17/2008, 19:17:58] - BHO 2: {5EB1D26D-D841-4D98-94B5-243203A718EF} ()
[04/17/2008, 19:17:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/17/2008, 19:17:58] - Checking for HKLM\...\Winlogon\Notify\vtutr
[04/17/2008, 19:17:58] - Key not found: HKLM\...\Winlogon\Notify\vtutr, continuing.
[04/17/2008, 19:17:58] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[04/17/2008, 19:17:58] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[04/17/2008, 19:17:58] - BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[04/17/2008, 19:17:58] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[04/17/2008, 19:17:58] - BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[04/17/2008, 19:17:59] - BHO 8: {B55814B8-9530-4317-B298-399277821CFA} ()
[04/17/2008, 19:17:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/17/2008, 19:17:59] - Checking for HKLM\...\Winlogon\Notify\vturs
[04/17/2008, 19:17:59] - Key not found: HKLM\...\Winlogon\Notify\vturs, continuing.
[04/17/2008, 19:17:59] - BHO 9: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[04/17/2008, 19:17:59] - BHO 10: {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} (EpsonToolBandKicker Class)
[04/17/2008, 19:17:59] - Finished Searching Browser Helper Objects
[04/17/2008, 19:17:59] - Finishing up...
[04/17/2008, 19:17:59] - Nothing found! Exiting...

3/
Malwarebytes' Anti-Malware 1.11
Version de la base de données: 642

Type de recherche: Examen complet (C:\|)
Eléments examinés: 192082
Temps écoulé: 1 hour(s), 8 minute(s), 29 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 13
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 61

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Interface\{1037b06c-84b7-4240-8d80-485810a0497d} (Adware.Mirar) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{54b287f9-fd90-4457-b65e-cb91560c021d} (Adware.Mirar) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6e4c7afc-9915-4036-b7f9-8b3f1710788f} (Adware.Mirar) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{566dede9-9ed8-45da-9be6-9b2eeab17f49} (Adware.Mirar) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{9a9c9b68-f908-4aab-8d0c-10ea8997f37e} (Adware.Mirar) -> No action taken.
HKEY_CURRENT_USER\Software\MediaHoldings (Adware.PlayMP3Z) -> No action taken.
HKEY_CURRENT_USER\Software\Mirar (AdWare.Mirar) -> No action taken.
HKEY_CURRENT_USER\Software\PlayMP3 (Adware.PlayMP3Z) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PlayMP3 (Adware.PlayMP3Z) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\poof (Rootkit.Agent) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\host-domain-lookup.com (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\www.host-domain-lookup.com (Malware.Trace) -> No action taken.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\QooBox\Quarantine\C\WINDOWS\system32\dtumgtho.dll.vir (Trojan.AVKiller) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\ewnxwufd.dll.vir (Trojan.AVKiller) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\gikftrdy.dll.vir (Trojan.Vundo) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\gpgkgkix.dll.vir (Trojan.Vundo) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\hsxyyabt.dll.vir (Trojan.AVKiller) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\lofijjhh.dll.vir (Trojan.Vundo) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\nefodrbr.dll.vir (Trojan.Vundo) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\qexnlvnn.dll.vir (Trojan.Vundo) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\qxmbsxtf.dll.vir (Trojan.Vundo) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\rfmyycil.dll.vir (Trojan.AVKiller) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\rpnuwuuw.dll.vir (Trojan.AVKiller) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\rvdpecjf.dll.vir (Trojan.Vundo) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\ryphoece.dll.vir (Trojan.AVKiller) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\stpncqyq.dll.vir (Trojan.Vundo) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\vxmrptov.dll.vir (Trojan.Vundo) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\wrhgtjdy.dll.vir (Trojan.Vundo) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\xnpberyu.dll.vir (Trojan.Vundo) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\xvugpeyb.dll.vir (Trojan.AVKiller) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\yshnwnoa.dll.vir (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP504\A0409133.exe (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP525\A0417901.exe (Adware.Mirar) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP530\A0421467.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP530\A0422467.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP534\A0425199.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP535\A0426293.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP535\A0428359.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP535\A0429360.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0430455.exe (Adware.Agent) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0431403.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433452.dll (Trojan.AVKiller) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433453.dll (Trojan.AVKiller) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433454.dll (Trojan.AVKiller) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433455.dll (Trojan.AVKiller) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433456.dll (Trojan.AVKiller) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433457.dll (Trojan.AVKiller) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433458.dll (Trojan.AVKiller) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433465.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433466.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433470.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433473.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433478.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433484.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP536\A0433487.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP537\A0434597.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP537\A0434598.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP539\A0435680.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP540\A0436676.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP540\A0437628.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP540\A0437630.dll (Trojan.AVKiller) -> No action taken.
C:\System Volume Information\_restore{154A94B0-E340-4850-84C8-8B31D93F3E4E}\RP540\A0437632.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\sstqr.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\pmkjj.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\mljge.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\awtqp.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\awtsq.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\geedc.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ssqro.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\vtstt.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ddcyv.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\pmnnn.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\wvuroon.dll (Trojan.Vundo) -> No action taken.

4/
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:50:45, on 17/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.skyrock.com/blog/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5EB1D26D-D841-4D98-94B5-243203A718EF} - C:\WINDOWS\system32\vtutr.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B55814B8-9530-4317-B298-399277821CFA} - C:\WINDOWS\system32\vturs.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Love default global mess] C:\Documents and Settings\All Users\Application Data\great coal love default\Gpl Date.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKCU\..\Run: [Nurb win] C:\DOCUME~1\MARINE\APPLIC~1\SOFTBO~1\ExtraBoltTime.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.selexium.fr
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Control Parental (OPTENET_FILTER) - Contrôle Parental - C:\Program Files\Controle Parental\bin\optproxy.exe

FillPCA · Answer

Re,

As-tu supprimé les objets trouvés avec malwarebyte's ?

1/     *  Sélectionne le texte suivant :

Driver::
aaudstum

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5EB1D26D-D841-4D98-94B5-243203A718EF}] 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B55814B8-9530-4317-B298-399277821CFA}] 

File::
C:\WINDOWS\system32\ufgfgpfj.dll
C:\WINDOWS\system32\ploramnt.dll
C:\WINDOWS\system32\uklelrph.dll
C:\WINDOWS\system32\sroxkkap.dll
C:\WINDOWS\system32\ienevnex.dll
C:\WINDOWS\system32\phunytpd.dll
C:\WINDOWS\system32\pjiraata.dll
C:\WINDOWS\system32\ukeelawl.dll
C:\WINDOWS\system32	hxrneud.dll
C:\WINDOWS\system32\veqasvqx.dll
C:\WINDOWS\system32\ivyijxca.dll
C:\WINDOWS\system32\lodfdxea.dll
C:\WINDOWS\system32\swiqhqev.dll
C:\WINDOWS\system32\cnfhftnw.dll
C:\WINDOWS\system32\xflpwhuo.dll
C:\WINDOWS\system32\awtsq.dll
C:\WINDOWS\system32\pmnnn.dll
C:\WINDOWS\system32\vtstt.dll
C:\WINDOWS\system32\awtqp.dll
C:\WINDOWS\system32\mljge.dll
C:\WINDOWS\system32\hoaapcln.dll
C:\WINDOWS\system32\sstqr.dll
C:\WINDOWS\system32\geedc.dll
C:\WINDOWS\system32\ddcyv.dll
C:\WINDOWS\system32\pmkjj.dll
C:\WINDOWS\system32\ssqro.dll
C:\Documents and Settings\MARINE\Application Data\errorsafescannerinstall_fr[1].exe
C:\WINDOWS\system32\wvuroon.dll


    * Copie le texte sélectionné (CTRL+C).
    * Ouvre le bloc-note (programme>Accessoire>bloc-note).
    * Colle le texte copié dans ce bloc-note (CTRL+V).
    * Sauvegarde ce fichier sous le nom de CFScript.txt
    * Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe.
    * Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
    * Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal!
      Ne touche à rien tant que le scan n'est pas terminé.
    * Une fois le scan achevé, un rapport va s'afficher: Poste son contenu.
    * Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

2/ Relance Vundofix et clique sur fix Vundo à la fin.
3/ Utilise lopS&D et utilise l'option 1 comme sur ce tuto : https://sites.google.com/site/eric71mespages/lop.sd.exe
4/ Edite ces rapports :
Combofix, Vundofix, LopS&D et un rapport Hijackthis.

FillPCA

marine · Answer

1/ oui j'ai bien supprimé les objets trouvés avec malwarebyte's, c'est juste que j'ai posté le rapport juste avant.

2/
ComboFix 08-04-16.5 - MARINE 2008-04-18 12:13:41.7 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.269 [GMT 2:00]
Endroit: C:\Documents and Settings\MARINE\Bureau\combofix.exe
Command switches used :: C:\Documents and Settings\MARINE\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\Documents and Settings\MARINE\Application Data\errorsafescannerinstall_fr[1].exe
C:\WINDOWS\system32\awtqp.dll
C:\WINDOWS\system32\awtsq.dll
C:\WINDOWS\system32\cnfhftnw.dll
C:\WINDOWS\system32\ddcyv.dll
C:\WINDOWS\system32\geedc.dll
C:\WINDOWS\system32\hoaapcln.dll
C:\WINDOWS\system32\ienevnex.dll
C:\WINDOWS\system32\ivyijxca.dll
C:\WINDOWS\system32\lodfdxea.dll
C:\WINDOWS\system32\mljge.dll
C:\WINDOWS\system32\phunytpd.dll
C:\WINDOWS\system32\pjiraata.dll
C:\WINDOWS\system32\ploramnt.dll
C:\WINDOWS\system32\pmkjj.dll
C:\WINDOWS\system32\pmnnn.dll
C:\WINDOWS\system32\sroxkkap.dll
C:\WINDOWS\system32\ssqro.dll
C:\WINDOWS\system32\sstqr.dll
C:\WINDOWS\system32\swiqhqev.dll
C:\WINDOWS\system32\thxrneud.dll
C:\WINDOWS\system32\ufgfgpfj.dll
C:\WINDOWS\system32\ukeelawl.dll
C:\WINDOWS\system32\uklelrph.dll
C:\WINDOWS\system32\veqasvqx.dll
C:\WINDOWS\system32\vtstt.dll
C:\WINDOWS\system32\wvuroon.dll
C:\WINDOWS\system32\xflpwhuo.dll
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Documents and Settings\MARINE\Application Data\errorsafescannerinstall_fr[1].exe
C:\WINDOWS\system32\cnfhftnw.dll
C:\WINDOWS\system32\hoaapcln.dll
C:\WINDOWS\system32\ienevnex.dll
C:\WINDOWS\system32\ivyijxca.dll
C:\WINDOWS\system32\lodfdxea.dll
C:\WINDOWS\system32\phunytpd.dll
C:\WINDOWS\system32\pjiraata.dll
C:\WINDOWS\system32\ploramnt.dll
C:\WINDOWS\system32\sroxkkap.dll
C:\WINDOWS\system32\swiqhqev.dll
C:\WINDOWS\system32\thxrneud.dll
C:\WINDOWS\system32\ufgfgpfj.dll
C:\WINDOWS\system32\ukeelawl.dll
C:\WINDOWS\system32\uklelrph.dll
C:\WINDOWS\system32\veqasvqx.dll
C:\WINDOWS\system32\xflpwhuo.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AAUDSTUM
-------\Service_aaudstum

((((((((((((((((((((((((((((( Fichiers créés 2008-03-18 to 2008-04-18 ))))))))))))))))))))))))))))))))))))
.

2008-04-17 19:19 . 2008-04-17 19:19 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-17 19:19 . 2008-04-17 19:19 <REP> d-------- C:\Documents and Settings\MARINE\Application Data\Malwarebytes
2008-04-17 19:19 . 2008-04-17 19:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-17 19:15 . 2008-04-17 19:15 <REP> d-------- C:\Documents and Settings\InvitÚ
2008-04-17 17:46 . 2008-04-17 17:46 237,710 --a------ C:\WINDOWS\system32\def.vpc
2008-04-17 17:31 . 2008-04-17 17:31 <REP> d-------- C:\_OTMoveIt
2008-04-17 13:54 . 2008-04-17 14:24 <REP> d-------- C:\VundoFix Backups
2008-04-17 13:39 . 2008-04-17 13:35 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-04-17 13:34 . 2008-04-17 13:41 <REP> d-------- C:\Documents and Settings\MARINE\.housecall6.6
2008-04-17 13:19 . 2008-04-17 13:19 <REP> d-------- C:\Program Files\Trend Micro
2008-04-06 17:50 . 2008-04-06 17:51 <REP> d-------- C:\Program Files\Attal
2008-04-06 15:51 . 2008-04-06 15:51 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-06 15:51 . 2008-04-06 15:51 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-05 16:19 . 2008-04-05 16:19 <REP> d-------- C:\Program Files\Risk
2008-04-05 15:22 . 2008-04-05 15:23 <REP> d-------- C:\Program Files\MakeHuman 0.9.1 RC1
2008-04-05 15:19 . 2008-04-05 15:19 <REP> d-------- C:\Program Files\Terragen
2008-04-05 15:13 . 2008-04-05 15:14 <REP> d-------- C:\Program Files\Aqsis
2008-04-05 15:13 . 2008-04-05 15:16 <REP> d-------- C:\k3d
2008-04-05 15:04 . 2008-04-05 15:04 <REP> d-------- C:\Program Files\ANDROME NV
2008-04-05 09:54 . 2008-04-05 09:54 <REP> d-------- C:\Documents and Settings\NetworkService\Mes documents
2008-04-05 09:02 . 2008-04-17 14:55 101,147 --a------ C:\WINDOWS\BMb78dc4ae.xml
2008-03-31 10:11 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-03-31 10:11 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-03-27 21:39 . 2008-03-27 21:39 <REP> d-------- C:\Program Files\CleanUp!
2008-03-18 19:23 . 2008-03-18 19:23 <REP> d-------- C:\Documents and Settings\LocalService\Bureau

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-18 10:13 --------- d-----w C:\Program Files\Wanadoo
2008-04-05 08:07 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-29 17:45 1,146,232 ----a-w C:\WINDOWS\system32\aswBoot.exe
2008-03-29 17:35 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-29 17:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-29 17:27 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-29 17:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-29 17:23 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2008-03-27 19:33 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-18 08:39 --------- d-----w C:\Program Files\Slayers Online
2008-03-15 18:18 --------- d-----w C:\Documents and Settings\MARINE\Application Data\softboldcoal
2008-03-15 18:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\great coal love default
2008-03-15 18:16 --------- d-----w C:\Program Files\softboldcoal
2008-03-12 17:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst
2008-03-12 17:17 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2008-03-12 17:17 --------- d-----w C:\Program Files\Real
2008-03-12 17:17 --------- d-----w C:\Program Files\Fichiers communs\Real
2008-03-12 15:15 --------- d-----w C:\Program Files\SimpleOCR
2008-03-12 14:46 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-27 10:21 --------- d-----w C:\Program Files\Windows Live
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-01-22 08:33 690,136 ------w C:\installer-49814-845-office-french.exe
2006-10-09 09:38 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
.

((((((((((((((((((((((((((((( snapshot@2008-04-17_19.15.30.39 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-17 17:07:24 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-18 10:07:39 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-18 10:04:37 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5fc.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nurb win"="C:\DOCUME~1\MARINE\APPLIC~1\SOFTBO~1\ExtraBoltTime.exe" [2008-03-15 20:16 450048]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
"FlyAway"="" []
"ccleaner"="C:\Program Files\CCleaner\ccleaner.exe" [2008-03-25 11:48 906480]
"WOOKIT"="C:\Program Files\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-22 21:28 68856]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23 102400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-08-19 00:44 4554752]
"nwiz"="nwiz.exe" [2004-07-12 10:50 843776 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-08-19 00:44 86016]
"Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 17:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"Cmaudio"="cmicnfg.cpl" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-07-16 14:50 1409136]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-24 00:06 282624]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-05-28 10:14 528384]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-03-12 16:46 185896]
"Love default global mess"="C:\Documents and Settings\All Users\Application Data\great coal love default\Gpl Date.exe" [2008-04-18 12:12 9821184]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2007-01-23 11:56:51 127488]
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2004-12-14 11:44:11 98304]
Lancer l'utilitaire d'enregistrement.lnk - C:\Program Files\WiFiConnector\NintendoWFCReg.exe [2006-10-17 21:18:10 1073152]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\Kyodai Mahjongg 2006\\kmj.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\\Program Files\\Warcraft III\\War3.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\java.exe"=
"C:\\Program Files\\Attal\\attal-client.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [2004-07-02 05:00]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
S2 OPTENET_FILTER;Control Parental;C:\Program Files\Controle Parental\bin\optproxy.exe [2006-03-02 17:10]
S3 s716bus;Sony Ericsson Device 716 driver (WDM);C:\WINDOWS\system32\DRIVERS\s716bus.sys [2007-06-29 10:59]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s716mdfl.sys [2007-06-29 10:59]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s716mdm.sys [2007-06-29 10:59]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s716mgmt.sys [2007-04-04 12:43]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);C:\WINDOWS\system32\DRIVERS\s716nd5.sys [2007-04-04 12:43]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s716obex.sys [2007-06-29 10:59]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);C:\WINDOWS\system32\DRIVERS\s716unic.sys [2007-04-04 12:43]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-04-18 10:00:02 C:\WINDOWS\Tasks\B3C406AF910FB46B.job"
- c:\docume~1\marine\applic~1\softbo~1\balmwebscr.exe
"2008-03-21 14:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-18 12:16:32
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-04-18 12:17:52
ComboFix-quarantined-files.txt 2008-04-18 10:17:44
ComboFix2.txt 2008-04-17 17:15:50

Pre-Run: 126,528,016,384 octets libres
Post-Run: 126,525,882,368 octets libres
.
2008-04-12 12:20:24 --- E O F ---

FillPCA · Answer

Salut,
Bien joué !
J'attends les autres rapports car il reste une infection visible.

FillPCA

Pc infecté : besoin d'aide (cheval de troie)

33 réponses

Newsletters