Divers trojan b153, b152, b128

StereoSushi -  
Bonjour,

Désolé pour mon manque d'originalité, voila, je joue sur steam et à wow et pendant mes parties divers panneaux de pub internet me font sortir des jeux ( pénible) ces fenêtres intempestives ce manifestent aussi pendant mes cessions sur le net.

Je viens d'utiliser combofix, qui a retiré un certain nvcoi.exe plus 2 ou 3 truc en plus j 'ai gardé le log que je poste ci dessous un que le log d'hijackthis.

j'aurais besoin d'une aide didacticielle car perso je ne suis pas trés a l'aise avec la gestion et modification des clés de registre.

Merci d'avance.

ComboFix 08-06-20.4 - olivier 2008-06-25 16:56:39.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.859 [GMT 2:00]
Endroit: C:\Documents and Settings\olivier\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
* Resident AV is active

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\nvcoi
C:\Program Files\nvcoi\mst.stt
C:\Program Files\nvcoi\nvcoi.Vexe
C:\WINDOWS\system32\MSINET.oca

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-25 to 2008-06-25 ))))))))))))))))))))))))))))))))))))
.

2008-06-14 21:08 . 2008-06-14 21:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-14 21:08 . 2008-06-14 21:08 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-11 16:50 . 2008-06-11 16:50 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-06-11 07:35 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-25 12:23 --------- d-----w C:\Program Files\EsetOnlineScanner
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 14:11 27,840 ----a-w C:\Documents and Settings\olivier\Application Data\GDIPFONTCACHEV1.DAT
2008-06-05 18:24 27,840 ----a-w C:\Documents and Settings\deborah\Application Data\GDIPFONTCACHEV1.DAT
2008-05-19 20:46 --------- d-----w C:\Program Files\MSECache
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 21:29 --------- d-----w C:\Documents and Settings\olivier\Application Data\AdobeUM
2004-12-08 23:08 0 ----a-w C:\Documents and Settings\olivier\ut2k3mapsv3.dat
2004-12-08 23:08 0 ----a-w C:\Documents and Settings\olivier\sharedfiles.dat
2004-01-13 19:08 1,041 ----a-w C:\Program Files\INSTALL.LOG
2003-11-23 20:52 517 ----a-w C:\Program Files\STEREOSUSHI.plr
2003-11-23 20:52 32 ----a-w C:\Program Files\STEREOSUSHI.cfl
2003-11-23 20:52 0 ----a-w C:\Program Files\STEREOSUSHI.fav
2003-11-23 20:52 0 ----a-w C:\Program Files\STEREOSUSHI.chn
2003-11-23 20:52 0 ----a-w C:\Program Files\STEREOSUSHI.bud
2003-09-07 13:59 499,712 ----a-w C:\Program Files\cpuz.exe
2003-08-24 12:54 966 ----a-w C:\Program Files\cpuz-readme.txt
2003-07-09 23:45 243,223 ----a-w C:\Program Files\cd-client-3_3_1-en.exe
2003-06-09 13:41 34,451 ----a-w C:\Program Files\F55inf.EXE
2003-06-07 12:29 8,737,844 ----a-w C:\Program Files\QuickTimeInstallCache.qdat
2003-06-07 12:21 542,368 ----a-w C:\Program Files\QuickTimeInstaller.exe
2003-06-04 06:49 448,256 ----a-w C:\WINDOWS\inf\EL2K_N64.sys
2003-06-04 06:48 147,328 ----a-w C:\WINDOWS\inf\EL2K_XP.sys
2003-06-04 06:47 147,328 ----a-w C:\WINDOWS\inf\EL2K_2K.sys
2003-03-02 17:22 12,377 ----a-w C:\Program Files\cpuz.vxd
2003-03-01 15:52 4,084 ----a-w C:\Program Files\cpuz.sys
.

((((((((((((((((((((((((((((( snapshot@2008-03-07_18.04.14.84 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-20 07:56:50 1,846,016 ----a-w C:\WINDOWS\$hf_mig$\KB941693\SP2QFE\win32k.sys
+ 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB941693\spmsg.dll
+ 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB941693\spuninst.exe
+ 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB941693\update\spcustom.dll
+ 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB941693\update\update.exe
+ 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB941693\update\updspapi.dll
+ 2008-02-20 05:20:23 147,968 ----a-w C:\WINDOWS\$hf_mig$\KB945553\SP2QFE\dnsapi.dll
+ 2008-02-20 18:50:24 45,568 ----a-w C:\WINDOWS\$hf_mig$\KB945553\SP2QFE\dnsrslvr.dll
+ 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB945553\spmsg.dll
+ 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB945553\spuninst.exe
+ 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB945553\update\spcustom.dll
+ 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB945553\update\update.exe
+ 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB945553\update\updspapi.dll
+ 2008-03-01 12:34:26 124,928 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\advpack.dll
+ 2008-03-01 12:34:26 347,136 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\dxtmsft.dll
+ 2008-03-01 12:34:26 214,528 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\dxtrans.dll
+ 2008-03-01 12:34:27 132,608 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\extmgr.dll
+ 2008-03-01 12:34:27 63,488 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\icardie.dll
+ 2008-02-22 09:39:56 70,656 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\ie4uinit.exe
+ 2008-03-01 12:34:27 153,088 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\ieakeng.dll
+ 2008-03-01 12:34:27 230,400 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\ieaksie.dll
+ 2008-02-15 05:44:25 161,792 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\ieakui.dll
+ 2007-04-17 09:32:38 2,455,488 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\ieapfltr.dat
+ 2008-03-01 12:34:27 383,488 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\ieapfltr.dll
+ 2008-03-01 12:34:27 388,608 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\iedkcs32.dll
+ 2008-03-01 12:34:29 6,067,712 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\ieframe.dll
+ 2008-03-01 12:34:29 44,544 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\iernonce.dll
+ 2008-03-01 12:34:29 267,776 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\iertutil.dll
+ 2008-02-22 09:39:56 13,824 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\ieudinit.exe
+ 2008-02-22 09:40:22 625,664 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\iexplore.exe
+ 2008-03-01 12:34:30 27,648 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\jsproxy.dll
+ 2008-03-01 12:34:30 459,264 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\msfeeds.dll
+ 2008-03-01 12:34:30 52,224 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\msfeedsbs.dll
+ 2008-03-01 12:34:32 3,593,216 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\mshtml.dll
+ 2008-03-01 12:34:32 478,208 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\mshtmled.dll
+ 2008-03-01 12:34:32 193,024 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\msrating.dll
+ 2008-03-01 12:34:32 671,232 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\mstime.dll
+ 2008-03-01 12:34:32 102,912 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\occache.dll
+ 2008-03-01 12:34:32 44,544 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\pngfilt.dll
+ 2008-03-01 12:34:32 105,984 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\url.dll
+ 2008-03-01 12:34:33 1,162,752 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\urlmon.dll
+ 2008-03-01 12:34:33 233,472 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\webcheck.dll
+ 2008-03-01 12:34:33 827,392 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
+ 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\spmsg.dll
+ 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\spuninst.exe
+ 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\update\spcustom.dll
+ 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\update\update.exe
+ 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB947864-IE7\update\updspapi.dll
+ 2008-02-20 06:52:42 282,624 ----a-w C:\WINDOWS\$hf_mig$\KB948590\SP2QFE\gdi32.dll
+ 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB948590\spmsg.dll
+ 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB948590\spuninst.exe
+ 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB948590\update\spcustom.dll
+ 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB948590\update\update.exe
+ 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB948590\update\updspapi.dll
+ 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB948881\spmsg.dll
+ 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB948881\spuninst.exe
+ 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB948881\update\spcustom.dll
+ 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB948881\update\update.exe
+ 2007-03-06 01:35:47 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB948881\update\updspapi.dll
+ 2008-01-23 04:56:21 554,008 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\dao360.dll
+ 2007-12-10 12:41:11 518,944 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msexch40.dll
+ 2007-12-10 12:41:11 326,432 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msexcl40.dll
+ 2007-12-10 12:41:11 1,516,568 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjet40.dll
+ 2007-12-10 12:41:11 355,112 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjetol1.dll
+ 2008-03-25 06:56:31 194,144 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjint40.dll
+ 2007-12-10 12:41:12 60,192 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjter40.dll
+ 2007-12-10 12:41:12 248,608 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjtes40.dll
+ 2007-12-10 12:41:12 219,936 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msltus40.dll
+ 2007-12-10 12:41:12 355,104 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mspbde40.dll
+ 2007-12-10 12:41:13 432,928 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrd2x40.dll
+ 2007-12-10 12:41:13 322,336 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrd3x40.dll
+ 2007-12-10 12:41:13 559,904 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrepl40.dll
+ 2007-12-10 12:41:13 264,992 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mstext40.dll
+ 2007-12-10 12:41:13 838,432 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mswdat10.dll
+ 2007-11-01 05:15:27 621,344 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mswstr10.dll
+ 2007-12-10 12:41:14 355,104 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msxbde40.dll
+ 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB950749\spmsg.dll
+ 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB950749\spuninst.exe
+ 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB950749\update\spcustom.dll
+ 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB950749\update\update.exe
+ 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB950749\update\updspapi.dll
+ 2005-04-24 12:15:20 2,678 -c----w C:\WINDOWS\$NtServicePackUninstall$\bf7nd7jt.dat
+ 2002-08-30 12:00:00 1,740 -c----w C:\WINDOWS\$NtServicePackUninstall$\dcache.bin
+ 2002-08-30 12:00:00 2,816 -c----w C:\WINDOWS\$NtServicePackUninstall$\drmkaud.sys
+ 2005-04-24 12:15:20 2,678 -c----w C:\WINDOWS\$NtServicePackUninstall$\enntr3jl.dat
+ 2005-04-24 12:15:20 2,678 -c----w C:\WINDOWS\$NtServicePackUninstall$\oofn7fbv.dat
+ 2005-04-24 12:15:20 2,678 -c----w C:\WINDOWS\$NtServicePackUninstall$\ui2o9bnh.dat
+ 2005-04-24 12:15:22 2,678 -c----w C:\WINDOWS\$NtServicePackUninstall$\w7v1731f.dat
+ 2003-12-10 20:46:13 2,573 -c--a-w C:\WINDOWS\$NtUninstallKB810217$\spuninst\spuninst.bat
+ 2003-08-06 16:54:45 2,736 -c--a-w C:\WINDOWS\$NtUninstallKB817778$\spuninst\spuninst.bat
+ 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe
+ 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB941693$\spuninst\updspapi.dll
+ 2007-03-08 15:33:58 1,843,712 -c----w C:\WINDOWS\$NtUninstallKB941693$\win32k.sys
+ 2006-06-26 17:41:32 148,480 -c----w C:\WINDOWS\$NtUninstallKB945553$\dnsapi.dll
+ 2004-08-19 23:09:22 45,568 -c----w C:\WINDOWS\$NtUninstallKB945553$\dnsrslvr.dll
+ 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe
+ 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB945553$\spuninst\updspapi.dll
+ 2007-06-19 13:32:25 282,112 -c----w C:\WINDOWS\$NtUninstallKB948590$\gdi32.dll
+ 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe
+ 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB948590$\spuninst\updspapi.dll
+ 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe
+ 2007-03-06 01:35:47 394,976 -c----w C:\WINDOWS\$NtUninstallKB948881$\spuninst\updspapi.dll
+ 2004-08-19 23:09:22 561,179 -c----w C:\WINDOWS\$NtUninstallKB950749$\dao360.dll
+ 2004-08-19 23:09:33 512,029 -c----w C:\WINDOWS\$NtUninstallKB950749$\msexch40.dll
+ 2004-08-19 23:09:33 319,517 -c----w C:\WINDOWS\$NtUninstallKB950749$\msexcl40.dll
+ 2004-08-19 23:09:33 1,507,356 -c----w C:\WINDOWS\$NtUninstallKB950749$\msjet40.dll
+ 2004-03-01 18:52:15 358,976 -c----w C:\WINDOWS\$NtUninstallKB950749$\msjetoledb40.dll
+ 2004-08-19 23:09:33 184,351 -c----w C:\WINDOWS\$NtUninstallKB950749$\msjint40.dll
+ 2004-08-19 23:09:33 53,279 -c----w C:\WINDOWS\$NtUninstallKB950749$\msjter40.dll
+ 2004-08-19 23:09:33 241,693 -c----w C:\WINDOWS\$NtUninstallKB950749$\msjtes40.dll
+ 2004-08-19 23:09:33 213,023 -c----w C:\WINDOWS\$NtUninstallKB950749$\msltus40.dll
+ 2004-08-19 23:09:33 348,189 -c----w C:\WINDOWS\$NtUninstallKB950749$\mspbde40.dll
+ 2004-08-19 23:09:33 421,919 -c----w C:\WINDOWS\$NtUninstallKB950749$\msrd2x40.dll
+ 2004-08-19 23:09:33 315,423 -c----w C:\WINDOWS\$NtUninstallKB950749$\msrd3x40.dll
+ 2004-08-19 23:09:33 552,989 -c----w C:\WINDOWS\$NtUninstallKB950749$\msrepl40.dll
+ 2004-08-19 23:09:34 258,077 -c----w C:\WINDOWS\$NtUninstallKB950749$\mstext40.dll
+ 2004-08-19 23:09:34 831,519 -c----w C:\WINDOWS\$NtUninstallKB950749$\mswdat10.dll
+ 2004-08-19 23:09:34 614,429 -c----w C:\WINDOWS\$NtUninstallKB950749$\mswstr10.dll
+ 2004-08-19 23:09:34 348,189 -c----w C:\WINDOWS\$NtUninstallKB950749$\msxbde40.dll
+ 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe
+ 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB950749$\spuninst\updspapi.dll
+ 2003-06-26 21:56:49 2,177 -c--a-w C:\WINDOWS\$NtUninstallQ810565$\spuninst\spuninst.bat
+ 2007-09-18 19:06:55 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE
+ 2008-06-25 15:03:08 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-14 17:59:52 272,768 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys
- 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
+ 2000-08-31 06:00:00 89,504 ----a-w C:\WINDOWS\fdsv.exe
+ 2000-08-31 06:00:00 80,412 ----a-w C:\WINDOWS\grep.exe
+ 2007-12-07 02:08:32 124,928 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\advpack.dll
+ 2007-12-19 22:53:23 347,136 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\dxtmsft.dll
+ 2007-12-07 02:08:32 214,528 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\dxtrans.dll
+ 2007-12-07 02:08:32 133,120 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\extmgr.dll
+ 2007-12-07 02:08:32 63,488 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\icardie.dll
+ 2007-12-06 11:02:31 70,656 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ie4uinit.exe
+ 2007-12-07 02:08:32 153,088 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieakeng.dll
+ 2007-12-07 02:08:32 230,400 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieaksie.dll
+ 2007-12-06 04:59:51 161,792 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieakui.dll
+ 2007-12-07 02:08:32 383,488 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieapfltr.dll
+ 2007-12-07 02:08:32 384,512 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iedkcs32.dll
+ 2007-12-07 02:08:33 6,066,176 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieframe.dll
+ 2007-12-07 02:08:33 44,544 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iernonce.dll
+ 2007-12-07 02:08:33 267,776 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iertutil.dll
+ 2007-12-06 11:00:58 13,824 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieudinit.exe
+ 2007-12-06 11:03:16 625,664 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iexplore.exe
+ 2007-12-07 02:08:33 27,648 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\jsproxy.dll
+ 2007-12-07 02:08:33 459,264 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msfeeds.dll
+ 2007-12-07 02:08:33 52,224 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msfeedsbs.dll
+ 2007-12-08 05:08:36 3,592,192 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mshtml.dll
+ 2007-12-07 02:08:34 478,208 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mshtmled.dll
+ 2007-12-07 02:08:34 193,024 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msrating.dll
+ 2007-12-07 02:08:34 671,232 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mstime.dll
+ 2007-12-07 02:08:34 102,912 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\occache.dll
+ 2008-01-11 05:36:55 44,544 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\pngfilt.dll
+ 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\updspapi.dll
+ 2007-12-07 02:08:34 105,984 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\url.dll
+ 2007-12-07 02:08:34 1,159,680 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\urlmon.dll
+ 2007-12-07 02:08:34 233,472 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\webcheck.dll
+ 2007-12-07 02:08:34 824,832 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\wininet.dll
+ 2008-03-01 12:58:06 124,928 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\advpack.dll
+ 2008-03-01 12:58:06 347,136 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\dxtmsft.dll
+ 2008-03-01 12:58:06 214,528 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\dxtrans.dll
+ 2008-03-01 12:58:06 133,120 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\extmgr.dll
+ 2008-03-01 12:58:06 63,488 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\icardie.dll
+ 2008-02-29 08:56:41 70,656 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ie4uinit.exe
+ 2008-03-01 12:58:06 153,088 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieakeng.dll
+ 2008-03-01 12:58:06 230,400 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieaksie.dll
+ 2008-02-15 05:44:25 161,792 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieakui.dll
+ 2008-03-01 12:58:07 383,488 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieapfltr.dll
+ 2008-03-01 12:58:07 384,512 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iedkcs32.dll
+ 2008-03-01 12:58:08 6,066,176 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieframe.dll
+ 2008-03-01 12:58:08 44,544 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iernonce.dll
+ 2008-03-01 12:58:08 267,776 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iertutil.dll
+ 2008-02-22 10:00:51 13,824 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieudinit.exe
+ 2008-02-29 08:57:05 625,664 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iexplore.exe
+ 2008-03-01 12:58:08 27,648 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\jsproxy.dll
+ 2008-03-01 12:58:08 459,264 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msfeeds.dll
+ 2008-03-01 12:58:08 52,224 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msfeedsbs.dll
+ 2008-03-01 16:28:10 3,591,680 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mshtml.dll
+ 2008-03-01 12:58:09 478,208 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mshtmled.dll
+ 2008-03-01 12:58:10 193,024 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msrating.dll
+ 2008-03-01 12:58:10 671,232 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mstime.dll
+ 2008-03-01 12:58:10 102,912 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\occache.dll
+ 2008-03-01 12:58:10 44,544 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\pngfilt.dll
+ 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\updspapi.dll
+ 2008-03-01 12:58:10 105,984 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\url.dll
+ 2008-03-01 12:58:10 1,159,680 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\urlmon.dll
+ 2008-03-01 12:58:11 233,472 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\webcheck.dll
+ 2008-03-01 12:58:11 826,368 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll
+ 2007-03-21 16:58:40 4,145,520 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u00021090200C0400000000000F01FEC\12.0.6021\WRD12CNV.DLL
+ 2007-03-21 16:58:46 24,416 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u00021090200C0400000000000F01FEC\12.0.6021\WRD12EXE.EXE
+ 2007-05-10 08:25:40 14,677,368 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u00021090200C0400000000000F01FEC\12.0.6021\XL12CNV.EXE
+ 2005-01-17 18:16:23 2,238 ----a-r C:\WINDOWS\Installer\{21A127AE-2DAF-40B7-8374-34C3E629521C}\ARPPRODUCTICON.exe
+ 2004-01-02 12:09:18 2,238 ----a-r C:\WINDOWS\Installer\{5847474B-6E03-4C2F-8814-B990A1929700}\_18be6784.exe
+ 2004-01-02 12:09:18 2,238 ----a-r C:\WINDOWS\Installer\{5847474B-6E03-4C2F-8814-B990A1929700}\_2cd672ae.exe
+ 2004-01-02 12:09:18 2,238 ----a-r C:\WINDOWS\Installer\{5847474B-6E03-4C2F-8814-B990A1929700}\_4ae13d6c.exe
+ 2008-06-10 17:34:55 38,240 ----a-r C:\WINDOWS\Installer\{90120000-0020-040C-0000-0000000FF1CE}\O12ConvIcon.exe
- 2008-02-14 00:14:12 167,936 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\accicons.exe
+ 2002-01-01 02:02:43 167,936 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\accicons.exe
+ 2002-01-01 02:02:43 2,560 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\cagicon.exe
- 2008-02-14 00:14:12 34,304 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\misc.exe
+ 2002-01-01 02:02:43 34,304 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\misc.exe
- 2008-02-14 00:14:13 8,192 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\mspicons.exe
+ 2002-01-01 02:02:43 8,192 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\mspicons.exe
- 2008-02-14 00:14:13 3,584 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\opwicon.exe
+ 2002-01-01 02:02:43 3,584 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\opwicon.exe
- 2008-02-14 00:14:13 114,688 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\outicon.exe
+ 2002-01-01 02:02:43 114,688 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\outicon.exe
- 2008-02-14 00:14:12 16,384 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\PEicons.exe
+ 2002-01-01 02:02:43 16,384 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\PEicons.exe
- 2008-02-14 00:14:12 30,720 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\pptico.exe
+ 2002-01-01 02:02:43 30,720 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\pptico.exe
- 2008-02-14 00:14:13 22,528 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\unbndico.exe
+ 2002-01-01 02:02:43 22,528 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\unbndico.exe
- 2008-02-14 00:14:12 45,056 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\wordicon.exe
+ 2002-01-01 02:02:43 45,056 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\wordicon.exe
- 2008-02-14 00:14:12 90,112 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\xlicons.exe
+ 2002-01-01 02:02:43 90,112 ----a-r C:\WINDOWS\Installer\{9111040C-6000-11D3-8CFE-0050048383C9}\xlicons.exe
+ 2008-03-08 18:16:15 10,134 ----a-r C:\WINDOWS\Installer\{944F0F77-F26F-4D17-A440-6DA4CBE05B71}\callmsi.exe
+ 2008-03-08 18:16:15 136,448 ----a-r C:\WINDOWS\Installer\{944F0F77-F26F-4D17-A440-6DA4CBE05B71}\egui.exe
+ 2008-05-07 21:31:26 25,214 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-A71000000002}\SC_Reader.exe
+ 2005-01-14 17:33:21 2,238 ----a-r C:\WINDOWS\Installer\{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC}\ARPPRODUCTICON.exe
+ 2005-02-01 21:35:50 2,238 ----a-r C:\WINDOWS\Installer\{EE8592F6-FC2B-4AFD-B527-109D127C039F}\ARPPRODUCTICON.exe
+ 2005-04-24 12:15:20 2,678 ----a-w C:\WINDOWS\java\Packages\Data\BF7ND7JT.DAT
+ 2005-04-24 12:15:20 2,678 ----a-w C:\WINDOWS\java\Packages\Data\ENNTR3JL.DAT
+ 2005-04-24 12:15:20 2,678 ----a-w C:\WINDOWS\java\Packages\Data\OOFN7FBV.DAT
+ 2005-04-24 12:15:20 2,678 ----a-w C:\WINDOWS\java\Packages\Data\UI2O9BNH.DAT
+ 2005-04-24 12:15:22 2,678 ----a-w C:\WINDOWS\java\Packages\Data\W7V1731F.DAT
- 2000-08-31 07:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe
+ 2000-08-31 06:00:00 28,672 ----a-w C:\WINDOWS\Nircmd.exe
+ 2004-04-16 08:06:48 2,010 ----a-w C:\WINDOWS\Plaxo\Users\376317834\Outlook\store.dat
+ 2000-08-31 06:00:00 98,816 ----a-w C:\WINDOWS\sed.exe
+ 2004-08-19 23:23:25 1,788 ------w C:\WINDOWS\ServicePackFiles\i386\dcache.bin
+ 2004-08-04 06:07:57 2,944 ------w C:\WINDOWS\ServicePackFiles\i386\drmkaud.sys
+ 2000-08-31 06:00:00 161,792 ----a-w C:\WINDOWS\swreg.exe
+ 2000-08-31 06:00:00 136,704 ----a-w C:\WINDOWS\swsc.exe
+ 2000-08-31 06:00:00 212,480 ----a-w C:\WINDOWS\swxcacls.exe
+ 2002-08-30 12:00:00 2,000 ----a-w C:\WINDOWS\system\KEYBOARD.DRV
+ 2002-08-30 12:00:00 2,032 ----a-w C:\WINDOWS\system\MOUSE.DRV
+ 2002-08-30 12:00:00 1,744 ----a-w C:\WINDOWS\system\SOUND.DRV
+ 2002-08-30 12:00:00 2,176 ----a-w C:\WINDOWS\system\VGA.DRV
- 2007-12-07 02:08:32 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
+ 2008-04-23 04:16:39 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
+ 2004-01-02 12:12:59 1,648 ----a-w C:\WINDOWS\system32\d3d8caps.dat
+ 2004-08-19 23:23:25 1,788 ----a-w C:\WINDOWS\system32\dcache.bin
- 2007-12-07 02:08:32 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-04-23 04:16:39 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-03-25 04:50:25 554,008 -c----w C:\WINDOWS\system32\dllcache\dao360.dll
- 2006-06-26 17:41:32 148,480 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2008-02-20 05:35:05 148,992 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2008-02-20 05:35:05 45,568 -c----w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
- 2007-12-19 22:53:23 347,136 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-04-23 04:16:39 347,136 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2007-12-07 02:08:32 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-04-23 04:16:39 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2007-12-07 02:08:32 133,120 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-04-23 04:16:39 133,120 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2007-06-19 13:32:25 282,112 -c----w C:\WINDOWS\system32\dllcache\gdi32.dll
+ 2008-02-20 06:51:00 282,624 -c----w C:\WINDOWS\system32\dllcache\gdi32.dll
- 2007-12-07 02:08:32 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
+ 2008-04-23 04:16:39 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
- 2007-12-06 11:02:31 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2008-04-22 07:41:08 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2007-12-07 02:08:32 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2008-04-23 04:16:39 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2007-12-07 02:08:32 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2008-04-23 04:16:39 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2007-12-06 04:59:51 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2008-04-20 05:07:51 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll
- 2007-12-07 02:08:32 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
+ 2008-04-23 04:16:39 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2007-12-07 02:08:32 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-04-23 04:16:39 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2007-12-07 02:08:33 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
+ 2008-04-23 04:16:39 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
- 2007-12-07 02:08:33 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-04-23 04:16:39 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2007-12-07 02:08:33 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
+ 2008-04-23 04:16:39 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
- 2007-12-06 11:00:58 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
+ 2008-04-22 07:39:58 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
- 2007-12-06 11:03:16 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2008-04-22 07:41:30 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
- 2007-12-07 02:08:33 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-04-23 04:16:40 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2002-08-30 12:00:00 2,000 -c--a-w C:\WINDOWS\system32\dllcache\keyboard.drv
+ 2002-08-30 12:00:00 2,560 -c--a-w C:\WINDOWS\system32\dllcache\lz32.dll
+ 2002-08-30 12:00:00 2,032 -c--a-w C:\WINDOWS\system32\dllcache\mouse.drv
+ 2008-02-26 12:00:31 294,912 -c----w C:\WINDOWS\system32\dllcache\msctf.dll
+ 2008-03-25 04:50:28 518,944 -c----w C:\WINDOWS\system32\dllcache\msexch40.dll
+ 2008-03-25 04:50:30 326,432 -c----w C:\WINDOWS\system32\dllcache\msexcl40.dll
- 2007-12-07 02:08:33 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2008-04-23 04:16:40 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
- 2007-12-07 02:08:33 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
+ 2008-04-23 04:16:40 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
- 2007-12-08 05:08:36 3,592,192 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-04-23 20:16:42 3,591,680 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2007-12-07 02:08:34 478,208 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-04-23 04:16:40 478,208 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-03-25 04:50:34 1,516,568 -c----w C:\WINDOWS\system32\dllcache\msjet40.dll
+ 2008-03-25 04:50:40 355,112 -c----w C:\WINDOWS\system32\dllcache\msjetol1.dll
+ 2008-03-25 04:51:08 194,144 -c----w C:\WINDOWS\system32\dllcache\msjint40.dll
+ 2008-03-25 04:50:42 60,192 -c----w C:\WINDOWS\system32\dllcache\msjter40.dll
+ 2008-03-25 04:50:42 248,608 -c----w C:\WINDOWS\system32\dllcache\msjtes40.dll
+ 2008-03-25 04:50:44 219,936 -c----w C:\WINDOWS\system32\dllcache\msltus40.dll
+ 2008-03-25 04:50:45 355,104 -c----w C:\WINDOWS\system32\dllcache\mspbde40.dll
- 2007-12-07 02:08:34 193,024 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-04-23 04:16:40 193,024 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-03-25 04:50:47 432,928 -c----w C:\WINDOWS\system32\dllcache\msrd2x40.dll
+ 2008-03-25 04:50:49 322,336 -c----w C:\WINDOWS\system32\dllcache\msrd3x40.dll
+ 2008-03-25 04:50:52 559,904 -c----w C:\WINDOWS\system32\dllcache\msrepl40.dll
+ 2008-03-25 04:50:55 264,992 -c----w C:\WINDOWS\system32\dllcache\mstext40.dll
- 2007-12-07 02:08:34 671,232 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-04-23 04:16:40 671,232 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-03-25 04:50:57 838,432 -c----w C:\WINDOWS\system32\dllcache\mswdat10.dll
+ 2008-03-25 04:51:09 621,344 -c----w C:\WINDOWS\system32\dllcache\mswstr10.dll
+ 2008-03-25 04:50:58 355,104 -c----w C:\WINDOWS\system32\dllcache\msxbde40.dll
+ 2002-08-30 12:00:00 2,944 -c--a-w C:\WINDOWS\system32\dllcache\null.sys
- 2007-12-07 02:08:34 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
+ 2008-04-23 04:16:40 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
- 2008-01-11 05:36:55 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-04-23 04:16:40 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2007-10-29 22:43:32 1,293,824 -c----w C:\WINDOWS\system32\dllcache\quartz.dll
+ 2008-05-07 05:15:36 1,293,824 -c----w C:\WINDOWS\system32\dllcache\quartz.dll
- 2006-07-13 08:48:58 202,240 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
+ 2008-05-08 12:28:49 202,752 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
+ 2002-08-30 12:00:00 1,744 -c--a-w C:\WINDOWS\system32\dllcache\sound.drv
- 2007-12-07 02:08:34 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
+ 2008-04-23 04:16:40 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
- 2007-12-07 02:08:34 1,159,680 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-04-23 04:16:40 1,159,680 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2002-08-30 12:00:00 2,176 -c--a-w C:\WINDOWS\system32\dllcache\vga.drv
- 2007-12-07 02:08:34 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2008-04-23 04:16:40 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2007-03-08 15:33:58 1,843,712 -c----w C:\WINDOWS\system32\dllcache\win32k.sys
+ 2008-03-20 08:09:22 1,845,376 -c----w C:\WINDOWS\system32\dllcache\win32k.sys
- 2007-12-07 02:08:34 824,832 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-04-23 04:16:40 826,368 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2002-08-30 12:00:00 2,864 -c--a-w C:\WINDOWS\system32\dllcache\winsock.dll
+ 2002-08-30 12:00:00 2,112 -c--a-w C:\WINDOWS\system32\dllcache\winspool.exe
+ 2002-08-30 12:00:00 2,736 -c--a-w C:\WINDOWS\system32\dllcache\wowdeb.exe
- 2006-06-26 17:41:32 148,480 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2008-02-20 05:35:05 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
- 2004-08-19 23:09:22 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
+ 2008-02-20 05:35:05 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
+ 2004-08-04 06:07:57 2,944 ----a-w C:\WINDOWS\system32\drivers\drmkaud.sys
+ 2008-02-20 10:01:30 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys
+ 2008-02-20 10:02:22 29,704 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys
+ 2008-02-20 10:11:16 33,800 ----a-w C:\WINDOWS\system32\drivers\epfwtdir.sys
- 2003-03-06 17:45:32 178,948 ----a-r C:\WINDOWS\system32\drivers\Fasttx2k.sys
+ 2003-08-06 08:43:04 159,744 ----a-r C:\WINDOWS\system32\drivers\Fasttx2k.sys
+ 2001-08-17 20:00:04 2,944 ----a-w C:\WINDOWS\system32\drivers\msmpu401.sys
+ 2002-08-30 12:00:00 2,944 ----a-w C:\WINDOWS\system32\drivers\null.sys
+ 2005-08-10 12:44:04 50,688 ----a-w C:\WINDOWS\system32\drivers\sfdrv01.sys
+ 2005-05-16 13:20:39 6,656 ----a-w C:\WINDOWS\system32\drivers\sfhlp02.sys
+ 2005-11-03 14:40:07 63,488 ----a-w C:\WINDOWS\system32\drivers\sfvfs02.sys
- 2007-12-19 22:53:23 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-04-23 04:16:39 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2007-12-07 02:08:32 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-04-23 04:16:39 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2007-12-07 02:08:32 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
+ 2008-04-23 04:16:39 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
- 2007-09-02 08:32:33 1,443,480 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2001-12-31 22:01:28 1,461,240 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2007-06-19 13:32:25 282,112 ----a-w C:\WINDOWS\system32\gdi32.dll
+ 2008-02-20 06:51:00 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
- 2007-12-07 02:08:32 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
+ 2008-04-23 04:16:39 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
- 2007-12-06 11:02:31 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe
+ 2008-04-22 07:41:08 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe
- 2007-12-07 02:08:32 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
+ 2008-04-23 04:16:39 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
- 2007-12-07 02:08:32 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
+ 2008-04-23 04:16:39 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
- 2007-12-06 04:59:51 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
+ 2008-04-20 05:07:51 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
- 2007-12-07 02:08:32 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
+ 2008-04-23 04:16:39 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
- 2007-12-07 02:08:32 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
+ 2008-04-23 04:16:39 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
- 2007-12-07 02:08:33 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
+ 2008-04-23 04:16:39 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
- 2007-12-07 02:08:33 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
+ 2008-04-23 04:16:39 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
- 2007-12-07 02:08:33 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
+ 2008-04-23 04:16:39 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
- 2007-12-06 11:00:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-04-22 07:39:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2007-12-07 02:08:33 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
+ 2008-04-23 04:16:40 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
+ 2002-08-30 12:00:00 2,000 ----a-w C:\WINDOWS\system32\keyboard.drv
+ 2007-07-27 13:49:02 196,683 ----a-w C:\WINDOWS\system32\lnod32apiA.dll
+ 2007-07-27 13:49:02 225,355 ----a-w C:\WINDOWS\system32\lnod32apiW.dll
+ 2005-12-05 18:25:22 139,264 ----a-w C:\WINDOWS\system32\lnod32umc.dll
+ 2005-12-05 11:37:10 106,496 ----a-w C:\WINDOWS\system32\lnod32upd.dll
+ 2002-08-30 12:00:00 2,560 ----a-w C:\WINDOWS\system32\lz32.dll
+ 2008-03-25 02:32:44 218,496 ----a-r C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe
+ 2008-06-23 16:58:33 74,137 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
+ 2002-08-30 12:00:00 2,032 ----a-w C:\WINDOWS\system32\mouse.drv
- 2008-02-04 23:09:46 18,214,008 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-05-29 23:35:11 17,486,968 ----a-w C:\WINDOWS\system32\MRT.exe
- 2004-08-19 23:09:33 294,400 ----a-w C:\WINDOWS\system32\msctf.dll
+ 2008-02-26 12:00:31 294,912 ----a-w C:\WINDOWS\system32\msctf.dll
- 2004-08-19 23:09:33 512,029 ----a-w C:\WINDOWS\system32\msexch40.dll
+ 2008-03-25 04:50:28 518,944 ----a-w C:\WINDOWS\system32\msexch40.dll
- 2004-08-19 23:09:33 319,517 ----a-w C:\WINDOWS\system32\msexcl40.dll
+ 2008-03-25 04:50:30 326,432 ----a-w C:\WINDOWS\system32\msexcl40.dll
- 2007-12-07 02:08:33 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
+ 2008-04-23 04:16:40 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
- 2007-12-07 02:08:33 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-04-23 04:16:40 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2007-12-08 05:08:36 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-04-23 20:16:42 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2007-12-07 02:08:34 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-04-23 04:16:40 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2004-08-19 23:09:33 1,507,356 ----a-w C:\WINDOWS\system32\msjet40.dll
+ 2008-03-25 04:50:34 1,516,568 ----a-w C:\WINDOWS\system32\msjet40.dll
- 2004-03-01 18:52:15 358,976 ----a-w C:\WINDOWS\system32\msjetoledb40.dll
+ 2008-03-25 04:50:40 355,112 ----a-w C:\WINDOWS\system32\msjetoledb40.dll
- 2004-08-19 23:09:33 184,351 ----a-w C:\WINDOWS\system32\msjint40.dll
+ 2008-03-25 04:51:08 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
- 2004-08-19 23:09:33 53,279 ----a-w C:\WINDOWS\system32\msjter40.dll
+ 2008-03-25 04:50:42 60,192 ----a-w C:\WINDOWS\system32\msjter40.dll
- 2004-08-19 23:09:33 241,693 ----a-w C:\WINDOWS\system32\msjtes40.dll
+ 2008-03-25 04:50:42 248,608 ----a-w C:\WINDOWS\system32\msjtes40.dll
- 2004-08-19 23:09:33 213,023 ----a-w C:\WINDOWS\system32\msltus40.dll
+ 2008-03-25 04:50:44 219,936 ----a-w C:\WINDOWS\system32\msltus40.dll
- 2004-08-19 23:09:33 348,189 ----a-w C:\WINDOWS\system32\mspbde40.dll
+ 2008-03-25 04:50:45 355,104 ----a-w C:\WINDOWS\system32\mspbde40.dll
- 2007-12-07 02:08:34 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
+ 2008-04-23 04:16:40 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
- 2004-08-19 23:09:33 421,919 ----a-w C:\WINDOWS\system32\msrd2x40.dll
+ 2008-03-25 04:50:47 432,928 ----a-w C:\WINDOWS\system32\msrd2x40.dll
- 2004-08-19 23:09:33 315,423 ----a-w C:\WINDOWS\system32\msrd3x40.dll
+ 2008-03-25 04:50:49 322,336 ----a-w C:\WINDOWS\system32\msrd3x40.dll
- 2004-08-19 23:09:33 552,989 ----a-w C:\WINDOWS\system32\msrepl40.dll
+ 2008-03-25 04:50:52 559,904 ----a-w C:\WINDOWS\system32\msrepl40.dll
- 2004-08-19 23:09:34 258,077 ----a-w C:\WINDOWS\system32\mstext40.dll
+ 2008-03-25 04:50:55 264,992 ----a-w C:\WINDOWS\system32\mstext40.dll
- 2007-12-07 02:08:34 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
+ 2008-04-23 04:16:40 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
- 2004-08-19 23:09:34 831,519 ----a-w C:\WINDOWS\system32\mswdat10.dll
+ 2008-03-25 04:50:57 838,432 ----a-w C:\WINDOWS\system32\mswdat10.dll
- 2004-08-19 23:09:34 614,429 ----a-w C:\WINDOWS\system32\mswstr10.dll
+ 2008-03-25 04:51:09 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
- 2004-08-19 23:09:34 348,189 ----a-w C:\WINDOWS\system32\msxbde40.dll
+ 2008-03-25 04:50:58 355,104 ----a-w C:\WINDOWS\system32\msxbde40.dll
+ 2002-08-30 12:00:00 2,656 ----a-w C:\WINDOWS\system32\netware.drv
- 2007-12-07 02:08:34 102,912 ----a-w C:\WINDOWS\system32\occache.dll
+ 2008-04-23 04:16:40 102,912 ----a-w C:\WINDOWS\system32\occache.dll
+ 2008-02-11 08:39:26 253,952 ----a-w C:\WINDOWS\system32\OnlineScannerDLLA.dll
+ 2008-02-11 08:39:18 237,568 ----a-w C:\WINDOWS\system32\OnlineScannerDLLW.dll
+ 2008-02-08 12:53:46 110,592 ----a-w C:\WINDOWS\system32\OnlineScannerLang.dll
+ 2007-06-13 09:10:34 77,824 ----a-w C:\WINDOWS\system32\OnlineScannerUninstaller.exe
- 2008-03-04 12:34:16 50,532 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-06-04 12:17:46 50,532 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-03-04 12:34:16 60,864 ----a-w C:\WINDOWS\system32\perfc00C.dat
+ 2008-06-04 12:17:46 60,864 ----a-w C:\WINDOWS\system32\perfc00C.dat
- 2008-03-04 12:34:16 374,064 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-06-04 12:17:46 374,064 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-03-04 12:34:16 438,498 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2008-06-04 12:17:46 438,498 ----a-w C:\WINDOWS\system32\perfh00C.dat
- 2008-01-11 05:36:55 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-04-23 04:16:40 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2003-01-24 00:45:42 114,688 ----a-r C:\WINDOWS\system32\ptipbmf.dll
+ 2003-06-20 13:06:56 118,784 ----a-r C:\WINDOWS\system32\ptipbmf.dll
- 2007-10-29 22:43:32 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
+ 2008-05-07 05:15:36 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
+ 1999-05-03 16:16:00 1,022,976 ----a-w C:\WINDOWS\system32\SierraNW.dll
+ 1999-05-03 16:16:00 231,936 ----a-w C:\WINDOWS\system32\SNWValid.dll
+ 2002-08-30 12:00:00 1,744 ----a-w C:\WINDOWS\system32\sound.drv
- 2006-10-16 15:10:58 14,640 ------w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 11:19:06 18,296 ------w C:\WINDOWS\system32\spmsg.dll
- 2007-12-07 02:08:34 105,984 ----a-w C:\WINDOWS\system32\url.dll
+ 2008-04-23 04:16:40 105,984 ----a-w C:\WINDOWS\system32\url.dll
- 2007-12-07 02:08:34 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-04-23 04:16:40 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2002-08-30 12:00:00 2,176 ----a-w C:\WINDOWS\system32\vga.drv
- 2007-12-07 02:08:34 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2008-04-23 04:16:40 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
- 2007-03-08 15:33:58 1,843,712 ----a-w C:\WINDOWS\system32\win32k.sys
+ 2008-03-20 08:09:22 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
- 2007-12-07 02:08:34 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
+ 2008-04-23 04:16:40 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
+ 2002-08-30 12:00:00 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
+ 2002-08-30 12:00:00 2,112 ----a-w C:\WINDOWS\system32\winspool.exe
+ 2002-08-30 12:00:00 2,736 ----a-w C:\WINDOWS\system32\wowdeb.exe
+ 2000-08-31 06:00:00 49,152 ----a-w C:\WINDOWS\VFind.exe
+ 2000-08-31 06:00:00 68,096 ----a-w C:\WINDOWS\zip.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-28 10:03 67128]
"Steam"="f:\program files\steam\steam.exe" [2008-03-28 18:39 1271032]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 13:06 196608]
"AtiTrayTools"="C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [2004-12-14 22:13 1071104]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-24 22:19 68856]
"LightScribe Control Panel"="C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe" [2007-12-05 13:30 2295072]
"H/PC Connection Agent"="G:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-21 02:20 1211176]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]
"kernel"="C:\Program Files\kernel\kernel.exe" [ ]
"Router"="C:\Program Files\Router\Router.exe" [ ]
"Dot1XCfg"="C:\Program Files\Dot1XCfg\Dot1XCfg.exe" [ ]
"nvcoi"="C:\Program Files\nvcoi\nvcoi.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-07-22 02:10 577602]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-04-04 13:38 774144]
"TCASUTIEXE"="TCAUDIAG.exe" [2003-02-13 02:55 1334784 C:\WINDOWS\system32\TCAUDIAG.EXE]
"PtiuPbmd"="ptipbm.dll" [2003-01-15 13:41 24576 C:\WINDOWS\system32\ptipbm.dll]
"aa"="rundll32.exe,ptipbmf.dll,Optimize" []
"zb"="rundll32.exe,ptipbmf.dll,SetWriteCacheMode" []
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2004-08-18 20:25 180269]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-04-26 07:06 29696 C:\WINDOWS\KHALMNPR.Exe]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 12:52 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 13:31 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 13:24 217088]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-12-01 01:19 32768]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-31 21:32 155648]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 12:06 1443072]
"Ptipbmf"="ptipbmf.dll" [2003-06-20 15:06 118784 C:\WINDOWS\system32\ptipbmf.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]
"Microsoft DirectX"="PDSched.exe" []
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-12-01 01:19 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll
"vidc.ffds"= C:\Program Files\ffdshow\ffdshow.ax

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"F:\\Program Files\\Steam\\Steam.exe"=
"F:\\Program Files\\Steam\\SteamApps\\capitainetarace@hotmail.com\\counter-strike\\hl.exe"=
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\softnyx\\GunBound\\GunBound.gme"=
"C:\\Program Files\\softnyx\\GunBound\\GunBound.exe"=
"G:\\UT2004\\System\\UT2004.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"G:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"G:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"G:\Program Files\Microsoft ActiveSync\rapimgr.exe"= G:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"G:\Program Files\Microsoft ActiveSync\wcescomm.exe"= G:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"G:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= G:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 12:11]
R1 NPPTNT;NPPTNT;C:\WINDOWS\system32\npptNT.sys [2003-07-22 08:14]
R1 SandBox;Outpost Firewall Sandbox Driver;C:\Program Files\Agnitum\Outpost Firewall\kernel\Sandbox.SYS [2006-09-26 18:24]
R1 VFILT;Outpost Firewall Kernel Driver;C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS [2006-08-30 10:46]
R2 tcaicchg;tcaicchg;C:\WINDOWS\System32\tcaicchg.sys [2000-06-07 11:08]
R2 TCAITDI;TCAITDI Protocol;C:\WINDOWS\system32\DRIVERS\TCAITDI.sys [2001-09-05 04:22]
R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL [2006-08-30 10:46]
R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\ARP.DLL [2006-08-30 10:47]
R3 atitray;atitray;C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2004-10-25 22:12]
R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL [2006-08-30 10:46]
R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL [2006-08-30 10:46]
R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL [2006-08-30 10:46]
R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL [2006-08-30 10:46]
R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL [2006-08-30 10:46]
R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL [2006-08-30 10:46]
R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL [2006-08-30 10:46]
R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL [2006-08-30 10:46]
R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL [2006-08-30 10:46]
R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL [2006-08-30 10:47]
R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\SECRET.DLL [2006-08-30 10:47]
S3 adiusbae;USB ADSL LAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbae.sys []
S3 ASUSHWIO;ASUSHWIO;C:\WINDOWS\System32\drivers\ASUSHWIO.sys [2000-03-29 08:17]
S3 CrystalCpuInfo;CrystalCpuInfo;K:\OCCT\CpuInfo.sys []
S3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\drivers\lccfltr.sys [2002-07-09 11:50]
S3 SOCKFILT.DLL;Outpost Firewall PlugIn (SOCKFILT.DLL);C:\PROGRA~1\Agnitum\OUTPOS~1\kernel\SOCKFILT.DLL [2006-08-30 10:47]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 18:57]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 18:58]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 18:59]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f6af4d11-2273-11dd-9c81-000c6e33e4c0}]
\Shell\Auto\command - M:\Start.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Fichiers communs\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-25 17:04:39
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\Ray Adams\ATI Tray Tools\raphook.dll
-> C:\Program Files\Logitech\SetPoint\lgscroll.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
G:\PROGRA~1\MICROS~1\rapimgr.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-25 17:09:26 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-25 15:09:21
ComboFix2.txt 2008-03-07 17:04:35

Pre-Run: 1,670,471,680 octets libres
Post-Run: 1,817,690,112 octets libres

692 --- E O F --- 2008-06-20 11:00:33

et voici le rapport d'hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:13:23, on 25/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\TCAUDIAG.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
G:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
G:\PROGRA~1\MICROS~1\rapimgr.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -on
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [aa] rundll32.exe,ptipbmf.dll,Optimize
O4 - HKLM\..\Run: [zb] rundll32.exe,ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\

56 réponses

Résumé de la discussion

Des fenêtres publicitaires intrusives apparaissent durant les jeux et la navigation, indiquant une infection potentielle et la présence du fichier nvcoi.exe après l'analyse avec ComboFix. Plusieurs réponses préconisent une désinfection approfondie sans modifications manuelles des clés de registre, la création d’un point de restauration et l’utilisation d’outils anti-malware à jour. Le diagnostic repose sur l’examen des journaux et des éléments système suspectés, notamment des fichiers et drivers visibles dans les listes Find3M et les entrées de démarrage. D'autres conseils suggèrent de vérifier les navigateurs et les plug-ins, puis de réaliser un balayage complet hors ligne pour éviter les interactions avec des programmes en cours d’exécution.

Bobot (l’IA à votre service)
  1. g!rly Contributeur
    salut,

    post ton rapport hijack this en entier, la derniere ligne doit etre 023...

    @+
    1. StereoSushi Auteur
      désolé

      voici le post en entier

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 22:52:39, on 25/06/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16674)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      C:\WINDOWS\system32\drivers\KodakCCS.exe
      C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
      C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
      C:\WINDOWS\System32\ScsiAccess.EXE
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\Program Files\Logitech\iTouch\iTouch.exe
      C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
      C:\WINDOWS\system32\TCAUDIAG.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\WINDOWS\system32\LVCOMSX.EXE
      C:\Program Files\Logitech\Video\LogiTray.exe
      C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
      C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
      C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
      G:\Program Files\Microsoft ActiveSync\wcescomm.exe
      C:\Program Files\Logitech\Video\FxSvr2.exe
      C:\Program Files\Logitech\SetPoint\KEM.exe
      G:\PROGRA~1\MICROS~1\rapimgr.exe
      C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
      C:\WINDOWS\explorer.exe
      F:\Program Files\Steam\Steam.exe
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
      O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
      O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
      O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
      O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
      O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -on
      O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
      O4 - HKLM\..\Run: [aa] rundll32.exe,ptipbmf.dll,Optimize
      O4 - HKLM\..\Run: [zb] rundll32.exe,ptipbmf.dll,SetWriteCacheMode
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
      O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
      O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
      O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
      O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
      O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
      O4 - HKCU\..\Run: [Steam] "f:\program files\steam\steam.exe" -silent
      O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
      O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
      O4 - HKCU\..\Run: [H/PC Connection Agent] "G:\Program Files\Microsoft ActiveSync\wcescomm.exe"
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
      O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
      O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - G:\PROGRA~1\MICROS~1\INetRepl.dll
      O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - G:\PROGRA~1\MICROS~1\INetRepl.dll
      O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - G:\PROGRA~1\MICROS~1\INetRepl.dll
      O9 - Extra button: Réglage rapide de Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
      O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab
      O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france.exe
      O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://downloads.winwise.fr/Common/npwwg.cab
      O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - http://down.plaxo.com/down/release/PlaxoInstall.cab
      O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
      O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cab
      O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - https://www.fileplanet.com/
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
      O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/18d695057b660be93e18/netzip/RdxIE601_fr.cab
      O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1094161209406
      O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - https://worldofwarcraft.com/en-gb/error/410
      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
      O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
      O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - http://www.gamespy.com
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
      O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - https://www.pandasecurity.com/?ref=www.pandasoftware.com/activescan/as5/asinst.cab
      O16 - DPF: {A40ED8B3-F960-11D4-8DF3-89955D701717} (TestLABCPUContrôle) - http://users.skynet.be/sky37131/TestLABCPU_proj.ocx
      O16 - DPF: {ABB08127-7417-11D4-8566-00500448008D} (Chat Class) - http://downloads.winwise.fr/Common/npchatlax.cab
      O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - https://live365.com/
      O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cab
      O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - http://guard.gunbound.net/nProtect/keyCrypt/npkcx.cab
      O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
      O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
      O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
      O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
      O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe (file missing)
      O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
      O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      1. g!rly Contributeur
        salut,

        la suite :

        Copie le texte ci-dessous :

        File::
        C:\WINDOWS\system32\ptipbmf.dll
        C:\WINDOWS\system32\npkcsvc.exe

        Folder::
        C:\Program Files\kernel
        C:\Program Files\Router
        C:\Program Files\nvcoi

        Registry::
        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "kernel"=-
        "nvcoi"=-
        "Router"=-
        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "aa"=-
        "zb"=-
        "Ptipbmf"=-

        Driver::
        npkcsvc

        Ouvre le Bloc-Notes puis colle le texte copié.
        (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
        Sauvegarde ce fichier sous le nom de CFScript.txt.

        Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

        http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

        Cela va relancer Combofix,

        Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

        Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

        Ne touche à rien tant que le scan n'est pas terminé.

        Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

        S'il n'y a pas de rédémarrage, poste quand même les rapports.

        @+
        1. StereoSushi
          bonsoir girly

          voici les posts combofix en premier et hijackthis en dernier.

          petites questions: spybot ce manifeste tout le temps lors des tests, perso je le ferme pour éviter les cinquantes fenetres me demandant si j'autorise ou pas.
          et l'antivirus est aussi connecté, dois je les fermer avant toutes manip de combofix et hijackthis ?

          et encore merci de ton aide précieuse

          ComboFix 08-06-20.4 - olivier 2008-06-26 22:57:53.3 - NTFSx86
          Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1021 [GMT 2:00]
          Endroit: C:\Documents and Settings\olivier\Bureau\ComboFix.exe
          Command switches used :: C:\Documents and Settings\olivier\Bureau\CFScript.txt
          * Création d'un nouveau point de restauration
          * Resident AV is active

          [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

          FILE ::
          C:\WINDOWS\system32\npkcsvc.exe
          C:\WINDOWS\system32\ptipbmf.dll
          .

          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
          .

          C:\WINDOWS\system32\npkcsvc.exe
          C:\WINDOWS\system32\ptipbmf.dll

          .
          ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
          .

          -------\Legacy_NPKCSVC
          -------\Service_npkcsvc

          ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-26 to 2008-06-26 ))))))))))))))))))))))))))))))))))))
          .

          2008-06-26 00:12 . 2008-06-26 01:17 <REP> d-------- C:\Documents and Settings\olivier\Application Data\FileZilla
          2008-06-25 17:12 . 2008-06-25 17:12 <REP> d-------- C:\Program Files\Trend Micro
          2008-06-14 21:08 . 2008-06-25 18:01 54,156 --ah----- C:\WINDOWS\QTFont.qfn
          2008-06-14 21:08 . 2008-06-14 21:08 1,409 --a------ C:\WINDOWS\QTFont.for
          2008-06-11 16:50 . 2008-06-11 16:50 118 --a------ C:\WINDOWS\system32\MRT.INI
          2008-06-11 07:35 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

          .
          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2008-06-25 12:23 --------- d-----w C:\Program Files\EsetOnlineScanner
          2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
          2008-06-11 14:11 27,840 ----a-w C:\Documents and Settings\olivier\Application Data\GDIPFONTCACHEV1.DAT
          2008-06-05 18:24 27,840 ----a-w C:\Documents and Settings\deborah\Application Data\GDIPFONTCACHEV1.DAT
          2008-05-19 20:46 --------- d-----w C:\Program Files\MSECache
          2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
          2008-05-07 21:29 --------- d-----w C:\Documents and Settings\olivier\Application Data\AdobeUM
          2004-12-08 23:08 0 ----a-w C:\Documents and Settings\olivier\ut2k3mapsv3.dat
          2004-12-08 23:08 0 ----a-w C:\Documents and Settings\olivier\sharedfiles.dat
          2004-01-13 19:08 1,041 ----a-w C:\Program Files\INSTALL.LOG
          2003-11-23 20:52 517 ----a-w C:\Program Files\STEREOSUSHI.plr
          2003-11-23 20:52 32 ----a-w C:\Program Files\STEREOSUSHI.cfl
          2003-11-23 20:52 0 ----a-w C:\Program Files\STEREOSUSHI.fav
          2003-11-23 20:52 0 ----a-w C:\Program Files\STEREOSUSHI.chn
          2003-11-23 20:52 0 ----a-w C:\Program Files\STEREOSUSHI.bud
          2003-09-07 13:59 499,712 ----a-w C:\Program Files\cpuz.exe
          2003-08-24 12:54 966 ----a-w C:\Program Files\cpuz-readme.txt
          2003-07-09 23:45 243,223 ----a-w C:\Program Files\cd-client-3_3_1-en.exe
          2003-06-09 13:41 34,451 ----a-w C:\Program Files\F55inf.EXE
          2003-06-07 12:29 8,737,844 ----a-w C:\Program Files\QuickTimeInstallCache.qdat
          2003-06-07 12:21 542,368 ----a-w C:\Program Files\QuickTimeInstaller.exe
          2003-03-02 17:22 12,377 ----a-w C:\Program Files\cpuz.vxd
          2003-03-01 15:52 4,084 ----a-w C:\Program Files\cpuz.sys
          .

          ((((((((((((((((((((((((((((( snapshot_2008-06-25_17.08.55.85 )))))))))))))))))))))))))))))))))))))))))
          .
          - 2008-06-25 15:03:08 2,048 --s-a-w C:\WINDOWS\bootstat.dat
          + 2008-06-26 21:03:37 2,048 --s-a-w C:\WINDOWS\bootstat.dat
          - 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
          + 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
          .
          ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          REGEDIT4
          *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
          "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-28 10:03 67128]
          "Steam"="f:\program files\steam\steam.exe" [2008-03-28 18:39 1271032]
          "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 13:06 196608]
          "AtiTrayTools"="C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [2004-12-14 22:13 1071104]
          "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-24 22:19 68856]
          "LightScribe Control Panel"="C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe" [2007-12-05 13:30 2295072]
          "H/PC Connection Agent"="G:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-21 02:20 1211176]
          "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]
          "kernel"="C:\Program Files\kernel\kernel.exe" [ ]
          "Router"="C:\Program Files\Router\Router.exe" [ ]
          "Dot1XCfg"="C:\Program Files\Dot1XCfg\Dot1XCfg.exe" [ ]
          "nvcoi"="C:\Program Files\nvcoi\nvcoi.exe" [ ]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-07-22 02:10 577602]
          "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-04-04 13:38 774144]
          "TCASUTIEXE"="TCAUDIAG.exe" [2003-02-13 02:55 1334784 C:\WINDOWS\system32\TCAUDIAG.EXE]
          "PtiuPbmd"="ptipbm.dll" [2003-01-15 13:41 24576 C:\WINDOWS\system32\ptipbm.dll]
          "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-04-26 07:06 29696 C:\WINDOWS\KHALMNPR.Exe]
          "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 12:52 221184]
          "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 13:31 458752]
          "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 13:24 217088]
          "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-12-01 01:19 32768]
          "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-31 21:32 155648]
          "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648]
          "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 12:06 1443072]

          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
          "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]
          "Microsoft DirectX"="PDSched.exe" []
          "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-12-01 01:19 32768]

          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
          "vidc.xvid"= xvid.dll
          "vidc.ffds"= C:\Program Files\ffdshow\ffdshow.ax

          [HKEY_LOCAL_MACHINE\software\microsoft\security center]
          "AntiVirusOverride"=dword:00000001

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
          "EnableFirewall"= 0 (0x0)

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
          "%windir%\\system32\\sessmgr.exe"=
          "F:\\Program Files\\Steam\\Steam.exe"=
          "F:\\Program Files\\Steam\\SteamApps\\capitainetarace@hotmail.com\\counter-strike\\hl.exe"=
          "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
          "C:\\WINDOWS\\system32\\dpvsetup.exe"=
          "C:\\Program Files\\softnyx\\GunBound\\GunBound.gme"=
          "C:\\Program Files\\softnyx\\GunBound\\GunBound.exe"=
          "G:\\UT2004\\System\\UT2004.exe"=
          "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
          "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
          "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
          "G:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
          "G:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
          "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
          "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
          "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
          "C:\\Program Files\\Messenger\\msmsgs.exe"=
          "G:\Program Files\Microsoft ActiveSync\rapimgr.exe"= G:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
          "G:\Program Files\Microsoft ActiveSync\wcescomm.exe"= G:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
          "G:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= G:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
          "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

          R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 12:11]
          R1 NPPTNT;NPPTNT;C:\WINDOWS\system32\npptNT.sys [2003-07-22 08:14]
          R1 SandBox;Outpost Firewall Sandbox Driver;C:\Program Files\Agnitum\Outpost Firewall\kernel\Sandbox.SYS [2006-09-26 18:24]
          R1 VFILT;Outpost Firewall Kernel Driver;C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS [2006-08-30 10:46]
          R2 tcaicchg;tcaicchg;C:\WINDOWS\System32\tcaicchg.sys [2000-06-07 11:08]
          R2 TCAITDI;TCAITDI Protocol;C:\WINDOWS\system32\DRIVERS\TCAITDI.sys [2001-09-05 04:22]
          R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL [2006-08-30 10:46]
          R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\ARP.DLL [2006-08-30 10:47]
          R3 atitray;atitray;C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2004-10-25 22:12]
          R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL [2006-08-30 10:46]
          R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL [2006-08-30 10:46]
          R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL [2006-08-30 10:46]
          R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL [2006-08-30 10:46]
          R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL [2006-08-30 10:46]
          R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL [2006-08-30 10:46]
          R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL [2006-08-30 10:46]
          R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL [2006-08-30 10:46]
          R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL [2006-08-30 10:46]
          R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL [2006-08-30 10:47]
          R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\SECRET.DLL [2006-08-30 10:47]
          S3 adiusbae;USB ADSL LAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbae.sys []
          S3 ASUSHWIO;ASUSHWIO;C:\WINDOWS\System32\drivers\ASUSHWIO.sys [2000-03-29 08:17]
          S3 CrystalCpuInfo;CrystalCpuInfo;K:\OCCT\CpuInfo.sys []
          S3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\drivers\lccfltr.sys [2002-07-09 11:50]
          S3 SOCKFILT.DLL;Outpost Firewall PlugIn (SOCKFILT.DLL);C:\PROGRA~1\Agnitum\OUTPOS~1\kernel\SOCKFILT.DLL [2006-08-30 10:47]
          S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 18:57]
          S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 18:58]
          S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 18:59]

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f6af4d11-2273-11dd-9c81-000c6e33e4c0}]
          \Shell\Auto\command - M:\Start.exe
          \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
          "C:\Program Files\Fichiers communs\LightScribe\LSRunOnce.exe"
          .
          **************************************************************************

          catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-06-26 23:09:22
          Windows 5.1.2600 Service Pack 2 NTFS

          Balayage processus cach‚s ...

          Balayage cach‚ autostart entries ...

          Balayage des fichiers cach‚s ...

          Scan termin‚ avec succŠs
          Les fichiers cach‚s: 0

          **************************************************************************
          .
          --------------------- DLLs a charg‚ sous des processus courants ---------------------

          PROCESS: C:\WINDOWS\explorer.exe
          -> C:\Program Files\Ray Adams\ATI Tray Tools\raphook.dll
          -> C:\Program Files\Logitech\SetPoint\lgscroll.dll
          .
          ------------------------ Other Running Processes ------------------------
          .
          C:\WINDOWS\system32\ati2evxx.exe
          C:\Program Files\Bonjour\mDNSResponder.exe
          C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
          C:\WINDOWS\system32\drivers\KodakCCS.exe
          C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
          C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
          C:\WINDOWS\system32\ScsiAccess.EXE
          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          C:\WINDOWS\system32\ati2evxx.exe
          C:\Program Files\Logitech\Video\FxSvr2.exe
          G:\PROGRA~1\MICROS~1\rapimgr.exe
          C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
          C:\Program Files\Logitech\SetPoint\KEM.exe
          C:\Program Files\Logitech\SetPoint\KHALMNPR.exe
          .
          **************************************************************************
          .
          Temps d'accomplissement: 2008-06-26 23:13:14 - machine was rebooted
          ComboFix-quarantined-files.txt 2008-06-26 21:13:07
          ComboFix2.txt 2008-06-25 15:09:28
          ComboFix3.txt 2008-03-07 17:04:35

          Pre-Run: 4,336,140,288 octets libres
          Post-Run: 4,337,991,680 octets libres

          205 --- E O F --- 2008-06-20 11:00:33

          HijackThis

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 23:16:11, on 26/06/2008
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16674)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\Ati2evxx.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Bonjour\mDNSResponder.exe
          C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
          C:\WINDOWS\system32\drivers\KodakCCS.exe
          C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
          C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
          C:\WINDOWS\System32\ScsiAccess.EXE
          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\Ati2evxx.exe
          C:\Program Files\Logitech\iTouch\iTouch.exe
          C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
          C:\WINDOWS\system32\TCAUDIAG.exe
          C:\WINDOWS\system32\LVCOMSX.EXE
          C:\Program Files\Logitech\Video\LogiTray.exe
          C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
          C:\Program Files\QuickTime\qttask.exe
          C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
          C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
          C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
          G:\Program Files\Microsoft ActiveSync\wcescomm.exe
          C:\Program Files\Logitech\Video\FxSvr2.exe
          G:\PROGRA~1\MICROS~1\rapimgr.exe
          C:\Program Files\Logitech\SetPoint\KEM.exe
          C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
          C:\WINDOWS\explorer.exe
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
          O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
          O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
          O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
          O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
          O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -on
          O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
          O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
          O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
          O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
          O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
          O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
          O4 - HKCU\..\Run: [Steam] "f:\program files\steam\steam.exe" -silent
          O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
          O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
          O4 - HKCU\..\Run: [H/PC Connection Agent] "G:\Program Files\Microsoft ActiveSync\wcescomm.exe"
          O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
          O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
          O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
          O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
          O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
          O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
          O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
          O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - G:\PROGRA~1\MICROS~1\INetRepl.dll
          O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - G:\PROGRA~1\MICROS~1\INetRepl.dll
          O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - G:\PROGRA~1\MICROS~1\INetRepl.dll
          O9 - Extra button: Réglage rapide de Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
          O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab
          O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france.exe
          O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://downloads.winwise.fr/Common/npwwg.cab
          O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - http://down.plaxo.com/down/release/PlaxoInstall.cab
          O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
          O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cab
          O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - https://www.fileplanet.com/
          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
          O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/18d695057b660be93e18/netzip/RdxIE601_fr.cab
          O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1094161209406
          O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - https://worldofwarcraft.com/en-gb/error/410
          O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
          O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
          O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - http://www.gamespy.com
          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
          O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - https://www.pandasecurity.com/?ref=www.pandasoftware.com/activescan/as5/asinst.cab
          O16 - DPF: {A40ED8B3-F960-11D4-8DF3-89955D701717} (TestLABCPUContrôle) - http://users.skynet.be/sky37131/TestLABCPU_proj.ocx
          O16 - DPF: {ABB08127-7417-11D4-8566-00500448008D} (Chat Class) - http://downloads.winwise.fr/Common/npchatlax.cab
          O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - https://live365.com/
          O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cab
          O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - http://guard.gunbound.net/nProtect/keyCrypt/npkcx.cab
          O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
          O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
          O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
          O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
          O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
          O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
          O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
          O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
          O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
          O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
          O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe (file missing)
          O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
          O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          2. g!rly Contributeur
            Salut,

            fais ceci stp :

            Télécharge OAD http://sosvirus.changelog.fr/OAD.exe
            - Enregistre le sur ton bureau

            Double clique sur le OAD pour le lancer

            - nom de fichier à rechercher tape ou fais un copier coller de :

            kernel

            - Type de recherche : sélectionne l'option 6 puis valide

            OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ait terminé.
            Le rapport de recherche s'affichera automatiquement à l’écran dès qu'il aura terminé.

            - Fais un copier / coller de ce rapport dans ton prochain post.

            Note importante : Suivant la taille des disques durs cette recherche peut prendre plusieurs minutes. Sois patient

            fais la même chose pour ceux ci

            nvcoi

            et

            Router

            Post donc les trois rapports stp

            @+
            1. StereoSushi Auteur
              bonjour girly

              je vais téléchager oad et te faire parvenir le résultat

              je ferai aussi une recherche sur ce fichier Dot1xcfg.exe car spybot m'a indiqué qu'il voulait être modifier.

              sur ce à tout
              2. StereoSushi Auteur
                voici les résultats

                27/06/2008 ---- 19:28:01,12

                ----------------------------------
                §§§§§§ [kernel] §§§§§§
                ----------------------------------
                [X] Registre

                -------------- [ ] rapide
                -- Fichier --- [ ] disque systeme
                ------------- [X] complete

                ********************
                [Registre]
                ********************

                [HKEY_LOCAL_MACHINE\SOFTWARE\Agnitum\Outpost Firewall\KernelPlugIns]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.acf]
                @="Photoshop.CustomFilterKernel"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D458BE8-D99D-11D3-A92B-00105A088FAC}\ProgID]
                @="Setup.SetupKernelWrapper.1"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D458BE8-D99D-11D3-A92B-00105A088FAC}\VersionIndependentProgID]
                @="Setup.SetupKernelWrapper"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22D84EC7-E201-4432-B3ED-A9DCA3604594}\LocalServer32]
                @="C:\\PROGRA~1\\FICHIE~1\\INSTAL~1\\engine\\6\\INTEL3~1\\iKernel.exe"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C3C1B17-E59D-11D2-B40B-00A024B9DDDD}\LocalServer32]
                @="C:\\PROGRA~1\\FICHIE~1\\INSTAL~1\\engine\\6\\INTEL3~1\\ikernel.exe"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91814EC0-B5F0-11D2-80B9-00104B1F6CEA}]
                @="InstallShield setup kernel"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91814EC0-B5F0-11D2-80B9-00104B1F6CEA}\LocalServer32]
                @="C:\\PROGRA~1\\FICHIE~1\\INSTAL~1\\engine\\6\\INTEL3~1\\iKernel.exe"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91814EC0-B5F0-11D2-80B9-00104B1F6CEA}\ProgID]
                @="Setup.Kernel.1"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91814EC0-B5F0-11D2-80B9-00104B1F6CEA}\VersionIndependentProgID]
                @="Setup.Kernel"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9877D8A7-FDA1-43F9-AEEA-F90747EA66B0}]
                @="KernelTraceProvider Class"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9877D8A7-FDA1-43F9-AEEA-F90747EA66B0}\ProgID]
                @="Krnlprov.KernelTraceProvider.1"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9877D8A7-FDA1-43F9-AEEA-F90747EA66B0}\VersionIndependentProgID]
                @="Krnlprov.KernelTraceProvider"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0D458BE7-D99D-11D3-A92B-00105A088FAC}]
                @="ISetupKernelWrapper"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{648A8420-964B-11D4-AB71-00B0D02332EB}]
                @="ISetupKernelWrapper2"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Krnlprov.KernelTraceProvider]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Krnlprov.KernelTraceProvider]
                @="KernelTraceProvider Class"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Krnlprov.KernelTraceProvider\CLSID]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Krnlprov.KernelTraceProvider\CurVer]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Krnlprov.KernelTraceProvider\CurVer]
                @="Krnlprov.KernelTraceProvider.1"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Krnlprov.KernelTraceProvider.1]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Krnlprov.KernelTraceProvider.1]
                @="KernelTraceProvider Class"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Krnlprov.KernelTraceProvider.1\CLSID]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Photoshop.CustomFilterKernel]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Photoshop.CustomFilterKernel\DefaultIcon]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Photoshop.CustomFilterKernel\shell]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Photoshop.CustomFilterKernel\shell\open]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Photoshop.CustomFilterKernel\shell\open\command]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Setup.Kernel]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Setup.Kernel]
                @="InstallShield setup kernel"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Setup.Kernel\CLSID]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Setup.Kernel.1]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Setup.Kernel.1]
                @="InstallShield setup kernel"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Setup.Kernel.1\CLSID]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Setup.SetupKernelWrapper]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Setup.SetupKernelWrapper\CLSID]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Setup.SetupKernelWrapper.1]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Setup.SetupKernelWrapper.1\CLSID]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Multimedia\Components\Installed\playback_WMP\CriticalTo\File0]
                @="C:\\WINDOWS\\System32\\kernel32.dll"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3147B9F7-D11F-11D4-AB83-00B0D02332EB}\1.0]
                @="InstallShield Windows Installer Setup Kernel 1.0 Type Library"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{58F69ADC-13E2-449D-94B1-3D8E94E90584}\1.0]
                @="InstallShield Professional Setup Kernel D9.0"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}\1.0]
                @="Setup Kernel 1.0 Type Library"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}\1.0\0\win32]
                @="C:\\Program Files\\Fichiers communs\\InstallShield\\engine\\6\\Intel 32\\iKernel.exe"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{94636247-BC39-4B8B-A728-2D1FBEBFA76A}\1.0]
                @="InstallShield Setup Kernel"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C17E7E12-9C20-4B9C-A225-F79292C58BC9}\1.0]
                @="InstallShield Professional Setup Kernel D9.0"

                [HKEY_LOCAL_MACHINE\SOFTWARE\CyberLink\PowerDVD\BuildInfo]
                "Kernel"="2417(2424)"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting]
                "IncludeKernelFaults"=dword:00000001

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting\KernelFaults]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB917422\Filelist\0]
                "FileName"="kernel32.dll"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB917422\Filelist\1]
                "FileName"="kernel32.dll"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB917422\Filelist\2]
                "FileName"="kernel32.dll"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB935839\Filelist\0]
                "FileName"="kernel32.dll"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB935839\Filelist\1]
                "FileName"="kernel32.dll"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB935839\Filelist\2]
                "FileName"="kernel32.dll"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]
                "C:\\Program Files\\Fichiers communs\\InstallShield\\engine\\6\\Intel 32\\iKernel.exe"=dword:00000048

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]
                "C:\\Program Files\\Fichiers communs\\InstallShield\\Professional\\RunTime\\0701\\Intel32\\iKernel.dll"=dword:00000003

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]
                "C:\\Program Files\\Fichiers communs\\InstallShield\\Professional\\RunTime\\09\\00\\Intel32\\iKernel.dll"=dword:00000001

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]
                "C:\\Program Files\\Fichiers communs\\InstallShield\\Professional\\RunTime\\10\\50\\Intel32\\iKernel.dll"=dword:00000001

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit\Reg Values\MACHINE/System/CurrentControlSet/Control/Session Manager/Kernel/ObCaseInsensitive]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{2eb07ea0-7e70-11d0-a5d6-28db04c10000}\##?#Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000}\#{b0c2eba2-1099-4e80-a7f1-984910eb435e}&MidiSyn\Device Parameters]
                "FriendlyName"="Analog Devices Kernel wavetable Synth"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#{b0c2eba2-1099-4e80-a7f1-984910eb435e}&MidiSyn\Device Parameters]
                "FriendlyName"="Analog Devices Kernel wavetable Synth"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{dff220f3-f70f-11d0-b917-00a0c9223196}\##?#Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196}\#{b0c2eba2-1099-4e80-a7f1-984910eb435e}&MidiSyn\Device Parameters]
                "FriendlyName"="Analog Devices Kernel wavetable Synth"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\kernel]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\KnownDLLs]
                "kernel32"="kernel32.dll"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\GlobalLogger]
                "EnableKernelFlags"=hex:07,23,00,00,16,00,00,00,00,00,00,00,00,00,00,00,00,00,\

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{2eb07ea0-7e70-11d0-a5d6-28db04c10000}\##?#Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000}\#{b0c2eba2-1099-4e80-a7f1-984910eb435e}&MidiSyn\Device Parameters]
                "FriendlyName"="Analog Devices Kernel wavetable Synth"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#{b0c2eba2-1099-4e80-a7f1-984910eb435e}&MidiSyn\Device Parameters]
                "FriendlyName"="Analog Devices Kernel wavetable Synth"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{dff220f3-f70f-11d0-b917-00a0c9223196}\##?#Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196}\#{b0c2eba2-1099-4e80-a7f1-984910eb435e}&MidiSyn\Device Parameters]
                "FriendlyName"="Analog Devices Kernel wavetable Synth"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager\kernel]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs]
                "kernel32"="kernel32.dll"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\WMI\GlobalLogger]
                "EnableKernelFlags"=hex:07,23,00,00,16,00,00,00,00,00,00,00,00,00,00,00,00,00,\

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_NOD32KRN\0000]
                "DeviceDesc"="NOD32 Kernel Service"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_VFILT\0000]
                "DeviceDesc"="Outpost Firewall Kernel Driver"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SandBox\Parameters]
                "ConfigPath"="C:\\Program Files\\Agnitum\\Outpost Firewall\\kernel"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\VFILT]
                "DisplayName"="Outpost Firewall Kernel Driver"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\DeviceClasses\{2eb07ea0-7e70-11d0-a5d6-28db04c10000}\##?#Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000}\#{b0c2eba2-1099-4e80-a7f1-984910eb435e}&MidiSyn\Device Parameters]
                "FriendlyName"="Analog Devices Kernel wavetable Synth"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#{b0c2eba2-1099-4e80-a7f1-984910eb435e}&MidiSyn\Device Parameters]
                "FriendlyName"="Analog Devices Kernel wavetable Synth"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\DeviceClasses\{dff220f3-f70f-11d0-b917-00a0c9223196}\##?#Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196}\#{b0c2eba2-1099-4e80-a7f1-984910eb435e}&MidiSyn\Device Parameters]
                "FriendlyName"="Analog Devices Kernel wavetable Synth"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Session Manager\kernel]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Session Manager\KnownDLLs]
                "kernel32"="kernel32.dll"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\WMI\GlobalLogger]
                "EnableKernelFlags"=hex:07,23,00,00,16,00,00,00,00,00,00,00,00,00,00,00,00,00,\

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_NOD32KRN\0000]
                "DeviceDesc"="NOD32 Kernel Service"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VFILT\0000]
                "DeviceDesc"="Outpost Firewall Kernel Driver"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SandBox\Parameters]
                "ConfigPath"="C:\\Program Files\\Agnitum\\Outpost Firewall\\kernel"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\VFILT]
                "DisplayName"="Outpost Firewall Kernel Driver"

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{2eb07ea0-7e70-11d0-a5d6-28db04c10000}\##?#Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000}\#{b0c2eba2-1099-4e80-a7f1-984910eb435e}&MidiSyn\Device Parameters]
                "FriendlyName"="Analog Devices Kernel wavetable Synth"

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#{b0c2eba2-1099-4e80-a7f1-984910eb435e}&MidiSyn\Device Parameters]
                "FriendlyName"="Analog Devices Kernel wavetable Synth"

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{dff220f3-f70f-11d0-b917-00a0c9223196}\##?#Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196}\#{b0c2eba2-1099-4e80-a7f1-984910eb435e}&MidiSyn\Device Parameters]
                "FriendlyName"="Analog Devices Kernel wavetable Synth"

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel]

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs]
                "kernel32"="kernel32.dll"

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\GlobalLogger]
                "EnableKernelFlags"=hex:07,23,00,00,16,00,00,00,00,00,00,00,00,00,00,00,00,00,\

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NOD32KRN\0000]
                "DeviceDesc"="NOD32 Kernel Service"

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VFILT\0000]
                "DeviceDesc"="Outpost Firewall Kernel Driver"

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SandBox\Parameters]
                "ConfigPath"="C:\\Program Files\\Agnitum\\Outpost Firewall\\kernel"

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VFILT]
                "DisplayName"="Outpost Firewall Kernel Driver"

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\GNU\ffdshow\default]
                "kernelDeintThreshold"=dword:0000000a

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\GNU\ffdshow\default]
                "kernelDeintSharp"=dword:00000000

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\GNU\ffdshow\default]
                "kernelDeintTwoway"=dword:00000000

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\GNU\ffdshow\default]
                "kernelDeintMap"=dword:00000000

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\kernel]

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Uninstall\kernel]

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Uninstall\kernel]
                "DisplayName"="kernel"

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Uninstall\kernel]
                "UninstallString"="\"C:\\Program Files\\kernel\\kernel.exe\" -uninstall"

                *******************
                [Fichier]
                *******************

                c:\Program Files\Agnitum\Outpost Firewall\Kernel

                *********************
                [Même date]
                *********************

                [R‚pertoire ] --- REP ---> C:\Program Files\Files

                Outil Aide Diagnostic By !aur3n7 Version 1.1
                ----------------------------------
                §§§§§ Fin Rapport §§§§§
                ----------------------------------

                27/06/2008 ---- 19:33:42,51

                ----------------------------------
                §§§§§§ [Router] §§§§§§
                ----------------------------------
                [X] Registre

                -------------- [ ] rapide
                -- Fichier --- [ ] disque systeme
                ------------- [X] complete

                ********************
                [Registre]
                ********************

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6E65CBC5-926D-11D0-8E27-00C04FC99DCF}]
                @="Steelhead Router Configuration Notify Object"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BA05971-F6A8-11CF-A442-00A0C90A8F39}]
                @="Microsoft Shell Folder View Router"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shell.FolderView]
                @="Microsoft Shell Folder View Router"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shell.FolderView.1]
                @="Microsoft Shell Folder View Router"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Router]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Router\CurrentVersion]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Router\CurrentVersion\RouterManagers]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Router\CurrentVersion\RouterManagers\Ip]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Router\CurrentVersion\RouterManagers\Ip\AUTODHCP]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Router\CurrentVersion\RouterManagers\Ip\DNSPROXY]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Router\CurrentVersion\RouterManagers\Ip\FTP]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Router\CurrentVersion\RouterManagers\Ip\H323]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Router\CurrentVersion\RouterManagers\Ip\IPNAT]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Router\CurrentVersion\RouterManagers\Ipx]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Router\CurrentVersion\RouterManagers\Ipx\IPXRIP]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Router\CurrentVersion\RouterManagers\Ipx\IPXSAP]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Router\CurrentVersion\UiConfigDlls]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print]
                "RouterCacheSize"=dword:00000010

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\System\IPRouterManager]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\System\IPXRouterManager]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess\Parameters]
                "RouterType"=dword:00000001

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess\RouterManagers]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess\RouterManagers\Ip]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters]
                "IPEnableRouter"=dword:00000000

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Print]
                "RouterCacheSize"=dword:00000010

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\System\IPRouterManager]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\System\IPXRouterManager]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\RemoteAccess\Parameters]
                "RouterType"=dword:00000001

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\RemoteAccess\RouterManagers]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\RemoteAccess\RouterManagers\Ip]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters]
                "IPEnableRouter"=dword:00000000

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Print]
                "RouterCacheSize"=dword:00000010

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\System\IPRouterManager]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\System\IPXRouterManager]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RemoteAccess\Parameters]
                "RouterType"=dword:00000001

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RemoteAccess\RouterManagers]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RemoteAccess\RouterManagers\Ip]

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters]
                "IPEnableRouter"=dword:00000000

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print]
                "RouterCacheSize"=dword:00000010

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IPRouterManager]

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\IPXRouterManager]

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters]
                "RouterType"=dword:00000001

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\RouterManagers]

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\RouterManagers\Ip]

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
                "IPEnableRouter"=dword:00000000

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Tracing\LccMedia\Crossbar\AdvancedTracing\Group]
                "ROUTER"=dword:00000000

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Router]

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run]
                "Router"="C:\\Program Files\\Router\\Router.exe"

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Uninstall\Router]

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Uninstall\Router]
                "DisplayName"="Router"

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Uninstall\Router]
                "UninstallString"="C:\\Program Files\\Router\\UnInstall.exe"

                *******************
                [Fichier]
                *******************

                *********************
                [Même date]
                *********************

                Aucun fichier créé à la même date détecté

                Outil Aide Diagnostic By !aur3n7 Version 1.1
                ----------------------------------
                §§§§§ Fin Rapport §§§§§
                ----------------------------------

                27/06/2008 ---- 19:35:55,53

                ----------------------------------
                §§§§§§ [nvcoi] §§§§§§
                ----------------------------------
                [X] Registre

                -------------- [ ] rapide
                -- Fichier --- [ ] disque systeme
                ------------- [X] complete

                ********************
                [Registre]
                ********************

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\nvcoi]

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run]
                "nvcoi"="C:\\Program Files\\nvcoi\\nvcoi.exe"

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache]
                "C:\\Program Files\\nvcoi\\nvcoi.exe"="nvcoi"

                *******************
                [Fichier]
                *******************

                c:\QooBox\Quarantine\C\Program Files\nvcoi
                c:\QooBox\Quarantine\C\Program Files\nvcoi\nvcoi.Vexe.vir
                c:\WINDOWS\Prefetch\NVCOI.EXE-20D4DD60.pf

                *********************
                [Même date]
                *********************

                [08/03/2008 ] --- REP ---> C:\Program Files\EsetOnlineScanner
                [25/06/2008 ] --- REP ---> C:\Program Files\Trend Micro
                [25/06/2008 ] ---> C:\WINDOWS\fdsv.exe
                [25/06/2008 ] ---> C:\WINDOWS\grep.exe
                [25/06/2008 ] ---> C:\WINDOWS\sed.exe
                [25/06/2008 ] ---> C:\WINDOWS\swreg.exe
                [25/06/2008 ] ---> C:\WINDOWS\swsc.exe
                [25/06/2008 ] ---> C:\WINDOWS\swxcacls.exe
                [25/06/2008 ] ---> C:\WINDOWS\VFind.exe
                [25/06/2008 ] ---> C:\WINDOWS\zip.exe
                [R‚pertoire ] --- REP ---> C:\Program Files\Files

                Outil Aide Diagnostic By !aur3n7 Version 1.1
                ----------------------------------
                §§§§§ Fin Rapport §§§§§
                ----------------------------------

                et pour finir

                27/06/2008 ---- 19:37:54,21

                ----------------------------------
                §§§§§§ [Dot1xcfg] §§§§§§
                ----------------------------------
                [X] Registre

                -------------- [ ] rapide
                -- Fichier --- [ ] disque systeme
                ------------- [X] complete

                ********************
                [Registre]
                ********************

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Dot1XCfg]

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Uninstall\Dot1XCfg]

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Uninstall\Dot1XCfg]
                "DisplayName"="Dot1XCfg"

                [HKEY_USERS\S-1-5-21-1614895754-606747145-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Uninstall\Dot1XCfg]
                "UninstallString"="\"C:\\Program Files\\Dot1XCfg\\Dot1XCfg.exe\" -uninstall"

                *******************
                [Fichier]
                *******************

                *********************
                [Même date]
                *********************

                Aucun fichier créé à la même date détecté

                Outil Aide Diagnostic By !aur3n7 Version 1.1
                ----------------------------------
                §§§§§ Fin Rapport §§§§§
                ----------------------------------
                1. g!rly Contributeur
                  ok

                  tu sais ce que l´on va faire?

                  on va les faire analyser sur ce site :

                  kernel.exe
                  Router.exe
                  Dot1XCfg.exe
                  nvcoi.exe

                  le site :

                  https://www.virustotal.com/gui/

                  moi c´est sur qu´il me paraissent suspect, mais....

                  @+
                  1. StereoSushi Auteur
                    je suis perplexe, ca n'a rien trouvé

                    Fichier resultat_Router.txt reçu le 2008.06.27 20:17:59 (CET)
                    Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE

                    Résultat: 0/33 (0%)
                    en train de charger les informations du serveur...
                    Votre fichier est dans la file d'attente, en position: ___.
                    L'heure estimée de démarrage est entre ___ et ___ .
                    Ne fermez pas la fenêtre avant la fin de l'analyse.
                    L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
                    Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
                    Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
                    les résultats seront affichés au fur et à mesure de leur génération.
                    Formaté Impression des résultats
                    Votre fichier a expiré ou n'existe pas.
                    Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

                    Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
                    Email:

                    Antivirus Version Dernière mise à jour Résultat
                    AhnLab-V3 2008.6.27.1 2008.06.27 -
                    AntiVir 7.8.0.59 2008.06.27 -
                    Authentium 5.1.0.4 2008.06.27 -
                    Avast 4.8.1195.0 2008.06.27 -
                    AVG 7.5.0.516 2008.06.27 -
                    BitDefender 7.2 2008.06.27 -
                    CAT-QuickHeal 9.50 2008.06.26 -
                    ClamAV 0.93.1 2008.06.27 -
                    DrWeb 4.44.0.09170 2008.06.27 -
                    eSafe 7.0.17.0 2008.06.26 -
                    eTrust-Vet 31.6.5911 2008.06.27 -
                    Ewido 4.0 2008.06.27 -
                    F-Prot 4.4.4.56 2008.06.27 -
                    F-Secure 7.60.13501.0 2008.06.26 -
                    Fortinet 3.14.0.0 2008.06.27 -
                    GData 2.0.7306.1023 2008.06.27 -
                    Ikarus T3.1.1.26.0 2008.06.27 -
                    Kaspersky 7.0.0.125 2008.06.27 -
                    McAfee 5327 2008.06.27 -
                    Microsoft 1.3704 2008.06.27 -
                    NOD32v2 3224 2008.06.27 -
                    Norman 5.80.02 2008.06.26 -
                    Panda 9.0.0.4 2008.06.26 -
                    Prevx1 V2 2008.06.27 -
                    Rising 20.50.42.00 2008.06.27 -
                    Sophos 4.30.0 2008.06.27 -
                    Sunbelt 3.0.1176.1 2008.06.26 -
                    Symantec 10 2008.06.27 -
                    TheHacker 6.2.96.362 2008.06.27 -
                    TrendMicro 8.700.0.1004 2008.06.27 -
                    VBA32 3.12.6.8 2008.06.27 -
                    VirusBuster 4.5.11.0 2008.06.23 -
                    Webwasher-Gateway 6.6.2 2008.06.27 -
                    Information additionnelle
                    File size: 5667 bytes
                    MD5...: e273ee980ef553f4e79fb771cc241002
                    SHA1..: 94588b78d1702b534ce863c68ca7c840205624fe
                    SHA256: 838f8f74684808dc1763ba9fb45a95060961c0b94bbf974b12a30ebbb336a869
                    SHA512: f1a2ec285cfa10d76be62b2f58676c22677833c2fb61988133868dedb7c3fafa
                    962f3bf6ddb048bdf735ef963859445d57996e98cb7b85f1d7e1a80b1e301e5a
                    PEiD..: -
                    PEInfo: -

                    Fichier resultat_nvcoi.txt reçu le 2008.06.27 20:16:25 (CET)
                    Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE

                    Résultat: 0/33 (0%)
                    en train de charger les informations du serveur...
                    Votre fichier est dans la file d'attente, en position: ___.
                    L'heure estimée de démarrage est entre ___ et ___ .
                    Ne fermez pas la fenêtre avant la fin de l'analyse.
                    L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
                    Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
                    Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
                    les résultats seront affichés au fur et à mesure de leur génération.
                    Formaté Impression des résultats
                    Votre fichier a expiré ou n'existe pas.
                    Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

                    Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
                    Email:

                    Antivirus Version Dernière mise à jour Résultat
                    AhnLab-V3 2008.6.27.1 2008.06.27 -
                    AntiVir 7.8.0.59 2008.06.27 -
                    Authentium 5.1.0.4 2008.06.27 -
                    Avast 4.8.1195.0 2008.06.27 -
                    AVG 7.5.0.516 2008.06.27 -
                    BitDefender 7.2 2008.06.27 -
                    CAT-QuickHeal 9.50 2008.06.26 -
                    ClamAV 0.93.1 2008.06.27 -
                    DrWeb 4.44.0.09170 2008.06.27 -
                    eSafe 7.0.17.0 2008.06.26 -
                    eTrust-Vet 31.6.5911 2008.06.27 -
                    Ewido 4.0 2008.06.27 -
                    F-Prot 4.4.4.56 2008.06.27 -
                    F-Secure 7.60.13501.0 2008.06.26 -
                    Fortinet 3.14.0.0 2008.06.27 -
                    GData 2.0.7306.1023 2008.06.27 -
                    Ikarus T3.1.1.26.0 2008.06.27 -
                    Kaspersky 7.0.0.125 2008.06.27 -
                    McAfee 5327 2008.06.27 -
                    Microsoft 1.3704 2008.06.27 -
                    NOD32v2 3224 2008.06.27 -
                    Norman 5.80.02 2008.06.26 -
                    Panda 9.0.0.4 2008.06.26 -
                    Prevx1 V2 2008.06.27 -
                    Rising 20.50.42.00 2008.06.27 -
                    Sophos 4.30.0 2008.06.27 -
                    Sunbelt 3.0.1176.1 2008.06.26 -
                    Symantec 10 2008.06.27 -
                    TheHacker 6.2.96.362 2008.06.27 -
                    TrendMicro 8.700.0.1004 2008.06.27 -
                    VBA32 3.12.6.8 2008.06.27 -
                    VirusBuster 4.5.11.0 2008.06.23 -
                    Webwasher-Gateway 6.6.2 2008.06.27 -
                    Information additionnelle
                    File size: 1714 bytes
                    MD5...: d38ec75dd470ac7cf1749c9337e4e804
                    SHA1..: ce41978898de6175ab3e22985a525d53c2b49390
                    SHA256: 12467aebd6120312c75b6e0df7c24d1b1e1bd84eb7cc7f5c980e67bd2fe23eb6
                    SHA512: e4dfb890e37636997ccf58bedb601ffcfc4bd4ad8a0b9d5bf42bfc54955d6e16
                    17fe804eee40a899c8c7770d71bb02f42e137a4a254022ce15f5e8a4d88609a4
                    PEiD..: -
                    PEInfo: -

                    ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

                    VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy

                    Fichier resultat_dot1xcfg.txt reçu le 2008.06.27 20:12:58 (CET)
                    Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE

                    Résultat: 0/33 (0%)
                    en train de charger les informations du serveur...
                    Votre fichier est dans la file d'attente, en position: 2.
                    L'heure estimée de démarrage est entre 42 et 60 secondes.
                    Ne fermez pas la fenêtre avant la fin de l'analyse.
                    L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
                    Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
                    Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
                    les résultats seront affichés au fur et à mesure de leur génération.
                    Formaté Impression des résultats
                    Votre fichier a expiré ou n'existe pas.
                    Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

                    Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
                    Email:

                    Antivirus Version Dernière mise à jour Résultat
                    AhnLab-V3 2008.6.27.1 2008.06.27 -
                    AntiVir 7.8.0.59 2008.06.27 -
                    Authentium 5.1.0.4 2008.06.27 -
                    Avast 4.8.1195.0 2008.06.27 -
                    AVG 7.5.0.516 2008.06.27 -
                    BitDefender 7.2 2008.06.27 -
                    CAT-QuickHeal 9.50 2008.06.26 -
                    ClamAV 0.93.1 2008.06.27 -
                    DrWeb 4.44.0.09170 2008.06.27 -
                    eSafe 7.0.17.0 2008.06.26 -
                    eTrust-Vet 31.6.5911 2008.06.27 -
                    Ewido 4.0 2008.06.27 -
                    F-Prot 4.4.4.56 2008.06.27 -
                    F-Secure 7.60.13501.0 2008.06.26 -
                    Fortinet 3.14.0.0 2008.06.27 -
                    GData 2.0.7306.1023 2008.06.27 -
                    Ikarus T3.1.1.26.0 2008.06.27 -
                    Kaspersky 7.0.0.125 2008.06.27 -
                    McAfee 5327 2008.06.27 -
                    Microsoft 1.3704 2008.06.27 -
                    NOD32v2 3224 2008.06.27 -
                    Norman 5.80.02 2008.06.26 -
                    Panda 9.0.0.4 2008.06.26 -
                    Prevx1 V2 2008.06.27 -
                    Rising 20.50.42.00 2008.06.27 -
                    Sophos 4.30.0 2008.06.27 -
                    Sunbelt 3.0.1176.1 2008.06.26 -
                    Symantec 10 2008.06.27 -
                    TheHacker 6.2.96.362 2008.06.27 -
                    TrendMicro 8.700.0.1004 2008.06.27 -
                    VBA32 3.12.6.8 2008.06.27 -
                    VirusBuster 4.5.11.0 2008.06.23 -
                    Webwasher-Gateway 6.6.2 2008.06.27 -
                    Information additionnelle
                    File size: 1249 bytes
                    MD5...: 1154cf15abe1cd5d61e63597494efb43
                    SHA1..: fcdfb1d42b1901bf38d2dbe704174805619bc122
                    SHA256: b80e41432af4e9594ff6cfa82c86763c5b801d73427c687fdafab522656f16a4
                    SHA512: 5112fc94ce049e7e6a8d952fc56cd9d8ecc333e6010f4a53e3238f5ab2ce8b4c
                    a0a5f2b5d015af799aa7f77e86bdd90b09a7e4df6e2356571930cc883b912294
                    PEiD..: -
                    PEInfo: -

                    Fichier resultat_kernel.txt reçu le 2008.06.27 20:10:22 (CET)
                    Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE

                    Résultat: 0/33 (0%)
                    en train de charger les informations du serveur...
                    Votre fichier est dans la file d'attente, en position: ___.
                    L'heure estimée de démarrage est entre ___ et ___ .
                    Ne fermez pas la fenêtre avant la fin de l'analyse.
                    L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
                    Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
                    Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
                    les résultats seront affichés au fur et à mesure de leur génération.
                    Formaté Impression des résultats
                    Votre fichier a expiré ou n'existe pas.
                    Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

                    Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
                    Email:

                    Antivirus Version Dernière mise à jour Résultat
                    AhnLab-V3 2008.6.27.1 2008.06.27 -
                    AntiVir 7.8.0.59 2008.06.27 -
                    Authentium 5.1.0.4 2008.06.27 -
                    Avast 4.8.1195.0 2008.06.27 -
                    AVG 7.5.0.516 2008.06.27 -
                    BitDefender 7.2 2008.06.27 -
                    CAT-QuickHeal 9.50 2008.06.26 -
                    ClamAV 0.93.1 2008.06.27 -
                    DrWeb 4.44.0.09170 2008.06.27 -
                    eSafe 7.0.17.0 2008.06.26 -
                    eTrust-Vet 31.6.5911 2008.06.27 -
                    Ewido 4.0 2008.06.27 -
                    F-Prot 4.4.4.56 2008.06.27 -
                    F-Secure 7.60.13501.0 2008.06.26 -
                    Fortinet 3.14.0.0 2008.06.27 -
                    GData 2.0.7306.1023 2008.06.27 -
                    Ikarus T3.1.1.26.0 2008.06.27 -
                    Kaspersky 7.0.0.125 2008.06.27 -
                    McAfee 5327 2008.06.27 -
                    Microsoft 1.3704 2008.06.27 -
                    NOD32v2 3224 2008.06.27 -
                    Norman 5.80.02 2008.06.26 -
                    Panda 9.0.0.4 2008.06.26 -
                    Prevx1 V2 2008.06.27 -
                    Rising 20.50.42.00 2008.06.27 -
                    Sophos 4.30.0 2008.06.27 -
                    Sunbelt 3.0.1176.1 2008.06.26 -
                    Symantec 10 2008.06.27 -
                    TheHacker 6.2.96.362 2008.06.27 -
                    TrendMicro 8.700.0.1004 2008.06.27 -
                    VBA32 3.12.6.8 2008.06.27 -
                    VirusBuster 4.5.11.0 2008.06.23 -
                    Webwasher-Gateway 6.6.2 2008.06.27 -
                    Information additionnelle
                    File size: 14710 bytes
                    MD5...: 7a25907abe4d4cc4f6b4c44ece4914e0
                    SHA1..: 70cf993a4d4b8a11723f2be9a88e5ccabe48515b
                    SHA256: 7f47f3acfff5f1dbd89c85d29742a9026c765351d830d044e5b935aad2e17bec
                    SHA512: c9162885da12f1587ae19c96265a15c00b61d9f091e9ca71ed3536e4b5104216
                    bcb5fac8d6953f7600a6ba2475b9b7a16c2af8d1b656c5bf503dd684b3460212
                    PEiD..: -

                    j'ai pas du analyser les bons fichiers.

                    j'ai analysé les fichiers résultats de aod, est ce qu'il fallait faire ?
                    2. StereoSushi Auteur
                      résultat de ce site

                      Service load: 0% 100%

                      File: resultat_dot1xcfg.txt
                      Status: OK
                      MD5: 1154cf15abe1cd5d61e63597494efb43
                      Packers detected: -

                      Scanner results
                      Scan taken on 27 Jun 2008 18:41:35 (GMT)
                      A-Squared Found nothing
                      AntiVir Found nothing
                      ArcaVir Found nothing
                      Avast Found nothing
                      AVG Antivirus Found nothing
                      BitDefender Found nothing
                      ClamAV Found nothing
                      CPsecure Found nothing
                      Dr.Web Found nothing
                      F-Prot Antivirus Found nothing
                      F-Secure Anti-Virus Found nothing
                      Fortinet Found nothing
                      Ikarus Found nothing
                      Kaspersky Anti-Virus Found nothing
                      NOD32 Found nothing
                      Norman Virus Control Found nothing
                      Panda Antivirus Found nothing
                      Sophos Antivirus Found nothing
                      VirusBuster Found nothing
                      VBA32 Found nothing

                      Service load: 0% 100%

                      File: resultat_kernel.txt
                      Status: OK
                      MD5: 7a25907abe4d4cc4f6b4c44ece4914e0
                      Packers detected: -

                      Scanner results
                      Scan taken on 27 Jun 2008 19:07:46 (GMT)
                      A-Squared Found nothing
                      AntiVir Found nothing
                      ArcaVir Found nothing
                      Avast Found nothing
                      AVG Antivirus Found nothing
                      BitDefender Found nothing
                      ClamAV Found nothing
                      CPsecure Found nothing
                      Dr.Web Found nothing
                      F-Prot Antivirus Found nothing
                      F-Secure Anti-Virus Found nothing
                      Fortinet Found nothing
                      Ikarus Found nothing
                      Kaspersky Anti-Virus Found nothing
                      NOD32 Found nothing
                      Norman Virus Control Found nothing
                      Panda Antivirus Found nothing
                      Sophos Antivirus Found nothing
                      VirusBuster Found nothing
                      VBA32 Found nothing

                      Service load: 0% 100%

                      File: resultat_nvcoi.txt
                      Status: OK
                      MD5: d38ec75dd470ac7cf1749c9337e4e804
                      Packers detected: -

                      Scanner results
                      Scan taken on 27 Jun 2008 19:09:53 (GMT)
                      A-Squared Found nothing
                      AntiVir Found nothing
                      ArcaVir Found nothing
                      Avast Found nothing
                      AVG Antivirus Found nothing
                      BitDefender Found nothing
                      ClamAV Found nothing
                      CPsecure Found nothing
                      Dr.Web Found nothing
                      F-Prot Antivirus Found nothing
                      F-Secure Anti-Virus Found nothing
                      Fortinet Found nothing
                      Ikarus Found nothing
                      Kaspersky Anti-Virus Found nothing
                      NOD32 Found nothing
                      Norman Virus Control Found nothing
                      Panda Antivirus Found nothing
                      Sophos Antivirus Found nothing
                      VirusBuster Found nothing
                      VBA32 Found nothing

                      Service load: 0% 100%

                      File: resultat_Router.txt
                      Status: OK
                      MD5: e273ee980ef553f4e79fb771cc241002
                      Packers detected: -

                      Scanner results
                      Scan taken on 27 Jun 2008 19:13:06 (GMT)
                      A-Squared Found nothing
                      AntiVir Found nothing
                      ArcaVir Found nothing
                      Avast Found nothing
                      AVG Antivirus Found nothing
                      BitDefender Found nothing
                      ClamAV Found nothing
                      CPsecure Found nothing
                      Dr.Web Found nothing
                      F-Prot Antivirus Found nothing
                      F-Secure Anti-Virus Found nothing
                      Fortinet Found nothing
                      Ikarus Found nothing
                      Kaspersky Anti-Virus Found nothing
                      NOD32 Found nothing
                      Norman Virus Control Found nothing
                      Panda Antivirus Found nothing
                      Sophos Antivirus Found nothing
                      VirusBuster Found nothing
                      VBA32 Found nothing

                      bon je suis encore plus perplexe comme si mon pc était nickel crome
                      1. g!rly Contributeur
                        re,

                        tu as bien analysé :

                        kernel.exe
                        Router.exe
                        Dot1XCfg.exe
                        nvcoi.exe

                        je veux dire les .exe ?
                        1. StereoSushi Auteur
                          non je suis une vrai quiche , j ai analyseé les fichiers .txt

                          désolé de te faire perdre ton temps ainsi

                          je recommence
                          1. g!rly Contributeur
                            c´ets bien ce que je me disais : .txt...

                            c´est pas grave...

                            @+
                            1. StereoSushi Auteur
                              pour kernel.exe

                              Le fichier a déjà été analysé:

                              MD5: b3fd01873bd5fd163ab465779271c58f
                              First received: -
                              Date 2008.03.13 23:41:53 (CET) [>105D]
                              Résultats

                              Fichier nvcoi.Vexe.vir reçu le 2008.06.27 21:40:26 (CET)
                              Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE

                              Résultat: 4/33 (12.13%)
                              en train de charger les informations du serveur...
                              Votre fichier est dans la file d'attente, en position: 1.
                              L'heure estimée de démarrage est entre 37 et 53 secondes.
                              Ne fermez pas la fenêtre avant la fin de l'analyse.
                              L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
                              Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
                              Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
                              les résultats seront affichés au fur et à mesure de leur génération.
                              Formaté Impression des résultats
                              Votre fichier a expiré ou n'existe pas.
                              Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

                              Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
                              Email:

                              Antivirus Version Dernière mise à jour Résultat
                              AhnLab-V3 2008.6.27.1 2008.06.27 -
                              AntiVir 7.8.0.59 2008.06.27 TR/Killav.28714
                              Authentium 5.1.0.4 2008.06.27 -
                              Avast 4.8.1195.0 2008.06.27 Win32:Agent-UNZ
                              AVG 7.5.0.516 2008.06.27 -
                              BitDefender 7.2 2008.06.27 -
                              CAT-QuickHeal 9.50 2008.06.26 -
                              ClamAV 0.93.1 2008.06.27 -
                              DrWeb 4.44.0.09170 2008.06.27 -
                              eSafe 7.0.17.0 2008.06.26 -
                              eTrust-Vet 31.6.5911 2008.06.27 -
                              Ewido 4.0 2008.06.27 -
                              F-Prot 4.4.4.56 2008.06.27 -
                              F-Secure 7.60.13501.0 2008.06.26 -
                              Fortinet 3.14.0.0 2008.06.27 -
                              GData 2.0.7306.1023 2008.06.27 Win32:Agent-UNZ
                              Ikarus T3.1.1.26.0 2008.06.27 -
                              Kaspersky 7.0.0.125 2008.06.27 -
                              McAfee 5327 2008.06.27 -
                              Microsoft 1.3704 2008.06.27 -
                              NOD32v2 3224 2008.06.27 -
                              Norman 5.80.02 2008.06.26 -
                              Panda 9.0.0.4 2008.06.27 -
                              Prevx1 V2 2008.06.27 -
                              Rising 20.50.42.00 2008.06.27 -
                              Sophos 4.30.0 2008.06.27 -
                              Sunbelt 3.0.1176.1 2008.06.26 -
                              Symantec 10 2008.06.27 -
                              TheHacker 6.2.96.362 2008.06.27 -
                              TrendMicro 8.700.0.1004 2008.06.27 -
                              VBA32 3.12.6.8 2008.06.27 -
                              VirusBuster 4.5.11.0 2008.06.23 -
                              Webwasher-Gateway 6.6.2 2008.06.27 Trojan.Killav.28714
                              Information additionnelle
                              File size: 57344 bytes
                              MD5...: 0e3c366c843c7b197f0ef977d9787542
                              SHA1..: 51cd1c6188b7d9700bbc81acd9d3aecb8159b5e5
                              SHA256: 37a63b2fda46667be7bf72c03eb7f0b208078d03663caa6a861e5d67014ac721
                              SHA512: 0b205fe7b91427b024cfdd46e79c5d44c2a82d31ab5bea58cf82141c07f4299c
                              0f28cd4219ddde92c16d8e069e5ef55b3c40f4a93b3b84adf5a3f002fe217b73
                              PEiD..: -
                              PEInfo: -

                              je retrouve pas dot1xcfg.exe ainsi que router.exe

                              j ai lancé un scan en ligne sur eset je te tiens au courant y en a pour au moins 1h 30 alors a tout ou a demain
                              1. g!rly Contributeur
                                re,

                                le scan ne va pas vraiment les supprimer...

                                télécharge ce fichier :

                                http://sd-1.archive-host.com/membres/up/1366464061/cfscrip_138.rar

                                dezip le sur ton bureau pour en sortir le fichier .txt qu´il renferme puis,

                                Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

                                http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

                                Cela va relancer Combofix,

                                Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                                Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                                Ne touche à rien tant que le scan n'est pas terminé.

                                Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

                                S'il n'y a pas de rédémarrage, poste quand même les rapports.

                                ps : Dot1XCfg.exe me semble ok...

                                @+
                                1. StereoSushi Auteur
                                  Désolé, mais combofix ne démarre pas il me dit que le nom du fichier semble etre incorrecte.

                                  j'ai tenté de le renomer comme dans le mail c-a-d- CFScript.txt mais meme sanction

                                  je fais une pause spaghetti et je recherche la solution a dans 30 minutes
                                  1. g!rly Contributeur
                                    re,

                                    appel le comme tu veux tant qu´il a l´attribut .txt

                                    bon app`
                                    1. StereoSushi Auteur
                                      bon en faite le message d'erreur
                                      c'est que le fichier est incorrectement écrit
                                      donc rien avoir avec le nom du fichier mais plutot avec le contenu
                                      • 1
                                      • 2
                                      • 3

                                      Discussions similaires

                                      Aide pour un virus
                                      cerise92700

                                      41 réponses
                                      Trojan impossible à supprimer!
                                      Gridouu

                                      12 réponses
                                      Comment supprimer le virus Trojan
                                      vitsou

                                      18 réponses
                                      Cheval de Troie- e.tre456.worm.windows
                                      Ninou037

                                      13 réponses
                                      trojan-spy.win32@mx
                                      caramel79

                                      3 réponses