Problème important Win32 - Page 3

Précédent
  • 1
  • 2
  • 3
  1. Kid7 Messages postés 31 Date d'inscription   Statut Membre
     
    Ok , j'ai fais la même manip que la dernière fois.
    Le résultat :

    DiagHelp version v1.4 - http://www.malekal.com
    excute le 27/07/2008 à 22:55:06,34

    Liste des derniers fichies modifies/crees dans windir\system32 et prefetch

    C:\WINDOWS\System32\drivers\mbamswissarmy.sys -->23/07/2008 20:09:44
    C:\WINDOWS\System32\drivers\mbam.sys -->23/07/2008 20:09:38
    C:\WINDOWS\System32\drivers\nocashio.sys -->04/07/2008 07:56:19
    C:\WINDOWS\System32\drivers\fetnd5bv.sys -->25/06/2008 06:36:08
    C:\WINDOWS\System32\drivers\tcpip.sys -->20/06/2008 13:51:12
    C:\WINDOWS\System32\drivers\afd.sys -->20/06/2008 13:40:08
    C:\WINDOWS\System32\drivers\tcpip6.sys -->20/06/2008 13:08:27

    C:\WINDOWS\System32\FNTCACHE.DAT -->27/07/2008 21:42:54
    C:\WINDOWS\System32\perfh00C.dat -->27/07/2008 21:21:39
    C:\WINDOWS\System32\perfh009.dat -->27/07/2008 21:21:39
    C:\WINDOWS\System32\perfc00C.dat -->27/07/2008 21:21:39
    C:\WINDOWS\System32\perfc009.dat -->27/07/2008 21:21:39
    C:\WINDOWS\System32\PerfStringBackup.INI -->27/07/2008 21:21:38
    C:\WINDOWS\System32\nvapps.xml -->26/07/2008 21:32:20
    C:\WINDOWS\System32\MsiExec.exe.log -->26/07/2008 21:07:44
    C:\WINDOWS\System32\spupdwxp.log -->26/07/2008 19:36:10
    C:\WINDOWS\System32\wpa.dbl -->26/07/2008 19:35:38
    C:\WINDOWS\System32\CmdLineExt03.dll -->23/07/2008 12:18:14
    C:\WINDOWS\System32\jupdate-1.6.0_07-b06.log -->22/07/2008 16:11:02
    C:\WINDOWS\System32\rmoc3260.dll -->07/07/2008 05:00:00
    C:\WINDOWS\System32\pndx5032.dll -->07/07/2008 05:00:00
    C:\WINDOWS\System32\pndx5016.dll -->07/07/2008 05:00:00
    C:\WINDOWS\System32\pncrt.dll -->07/07/2008 05:00:00
    C:\WINDOWS\System32\lameACM.acm -->04/07/2008 08:34:14
    C:\WINDOWS\System32\jupdate-1.6.0_04-b12.log -->25/06/2008 23:51:40
    C:\WINDOWS\System32\MRT.exe -->25/06/2008 18:15:46
    C:\WINDOWS\System32\mswsock.dll -->20/06/2008 19:47:22
    C:\WINDOWS\System32\dnsapi.dll -->20/06/2008 19:47:22
    C:\WINDOWS\System32\x264vfw.dll -->18/06/2008 22:37:28
    C:\WINDOWS\System32\ff_vfw.dll -->12/06/2008 20:36:38
    C:\WINDOWS\System32\javaws.exe -->10/06/2008 02:32:34
    C:\WINDOWS\System32\javacpl.cpl -->10/06/2008 02:32:34

    C:\WINDOWS\setupapi.log -->27/07/2008 22:54:55
    C:\WINDOWS\WindowsUpdate.log -->27/07/2008 21:43:44
    C:\WINDOWS\wiadebug.log -->27/07/2008 21:43:44
    C:\WINDOWS\wiaservc.log -->27/07/2008 21:43:43
    C:\WINDOWS\bootstat.dat -->27/07/2008 21:43:19
    C:\WINDOWS\SchedLgU.Txt -->27/07/2008 21:41:32
    C:\WINDOWS\NeroDigital.ini -->27/07/2008 19:45:53
    C:\WINDOWS\system.ini -->27/07/2008 10:47:49
    C:\WINDOWS\UPGRADE.TXT -->26/07/2008 23:04:40
    C:\WINDOWS\win.ini -->26/07/2008 22:54:10
    C:\WINDOWS\Sti_Trace.log -->26/07/2008 17:27:50
    C:\WINDOWS\avisplitter.INI -->24/07/2008 23:29:58
    C:\WINDOWS\Dessinez, C'est Disney.INI -->20/07/2008 16:22:49
    C:\WINDOWS\QTFont.qfn -->12/07/2008 20:00:23
    C:\WINDOWS\Kit.ini -->09/07/2008 23:05:03

    winlogon.exe
    Verified: Signed
    svchost.exe
    Verified: Signed
    ws2_32.dll
    Verified: Signed
    user32.dll
    Verified: Signed
    tcpip.sys
    Verified: Signed
    ndis.sys
    Verified: Signed
    null.sys
    Verified: Signed

    ListDLLs v2.25 - DLL lister for Win9x/NT
    Copyright (C) 1997-2004 Mark Russinovich
    Sysinternals - www.sysinternals.com

    ------------------------------------------------------------------------------
    explorer.exe pid: 1532
    Command line: C:\WINDOWS\Explorer.EXE

    Base Size Version Path
    0x77be0000 0x58000 7.00.2600.5512 C:\WINDOWS\system32\msvcrt.dll
    0x779e0000 0x97000 5.131.2600.5512 C:\WINDOWS\system32\CRYPT32.dll
    0x76610000 0x84000 5.131.2600.5512 C:\WINDOWS\system32\CRYPTUI.dll
    0x44080000 0xd0000 7.00.6000.16674 C:\WINDOWS\system32\WININET.dll
    0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
    0x43e00000 0x45000 7.00.6000.16674 C:\WINDOWS\system32\iertutil.dll
    0x76be0000 0x2e000 5.131.2600.5512 C:\WINDOWS\system32\WINTRUST.dll
    0x753c0000 0x6b000 1.420.2600.5512 C:\WINDOWS\system32\USP10.dll
    0x58b50000 0x9a000 5.82.2900.5512 C:\WINDOWS\system32\comctl32.dll
    0x76f80000 0x7f000 2001.12.4414.0700 C:\WINDOWS\system32\CLBCATQ.DLL
    0x77000000 0xd4000 2001.12.4414.0700 C:\WINDOWS\system32\COMRes.dll
    0x76ac0000 0x11000 3.05.2284.0001 C:\WINDOWS\system32\ATL.DLL
    0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
    0x44360000 0x5cd000 7.00.6000.16674 C:\WINDOWS\system32\ieframe.dll
    0x44160000 0x127000 7.00.6000.16674 C:\WINDOWS\system32\urlmon.dll
    0x442b0000 0x3c000 7.00.6000.16674 C:\WINDOWS\system32\webcheck.dll
    0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\WPDShServiceObj.dll
    0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceTypes.dll
    0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll
    0x7d200000 0x2bc000 3.01.4001.5512 C:\WINDOWS\system32\msi.dll
    0x10000000 0x3c000 1.02.6950.0000 C:\Program Files\Orange\AntivirusFirewall\Spam Control\fsscoepl.dll
    0x021c0000 0xbf000 4.00.0016.0000 C:\Program Files\Creative\Creative Zen Micro\Zen Micro Media Explorer\CTJBNS2.dll
    0x019a0000 0x11000 2.01.0000.0000 C:\Program Files\Creative\Creative Zen Micro\Zen Micro Media Explorer\CTIntrfc.dll
    0x02280000 0xda000 4.00.0010.0000 C:\Program Files\Creative\Creative Zen Micro\Zen Micro Media Explorer\CTConfig.DLL
    0x73d20000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL
    0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL
    0x02500000 0x8a000 4.00.0010.0000 C:\Program Files\Creative\Creative Zen Micro\Zen Micro Media Explorer\JBNSRES.DLL
    0x00d80000 0x16000 6.16.0061.0000 C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdc.dll
    0x03060000 0x10000 C:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll
    0x030d0000 0xb000 C:\Program Files\Haali\MatroskaSplitter\mkunicode.dll
    0x03190000 0x4c000 8.00.0000.0000 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
    0x61310000 0x54000 2.00.0500.0000 C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
    0x4eb80000 0x1a6000 5.01.3102.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c\gdiplus.dll
    0x7c340000 0x56000 7.10.3052.0004 C:\Program Files\OpenOffice.org 2.4\program\MSVCR71.dll
    0x60e20000 0x8e000 4.05.2003.0120 C:\Program Files\OpenOffice.org 2.4\program\stlport_vc7145.dll
    0x7c3a0000 0x7b000 7.10.3077.0000 C:\Program Files\OpenOffice.org 2.4\program\MSVCP71.dll
    0x02e10000 0x5b000 8.01.0000.0000 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
    0x78130000 0x9b000 8.00.50727.1433 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCR80.dll
    0x74730000 0x3d000 3.525.1132.0000 C:\WINDOWS\system32\ODBC32.dll
    0x1f840000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
    0x03600000 0x40000 3.05.0003.0000 C:\Program Files\Nero\Nero8\Nero BackItUp\NBShell.dll
    0x782e0000 0x10f000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80U.DLL
    0x7c420000 0x87000 8.00.50727.1433 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCP80.dll
    0x5d360000 0xf000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\MFC80FRA.DLL
    0x037e0000 0x2e000 C:\Program Files\WinRAR\rarext.dll
    0x03780000 0x13000 4.57.0000.0000 C:\Program Files\7-Zip\7-zip.dll
    0x18000000 0x12000 7.50.10035.0000 C:\Program Files\Orange\AntivirusFirewall\Common\FSPMAPI.dll
    0x03590000 0xc000 7.00.12180.0000 C:\Program Files\Orange\AntivirusFirewall\Common\fpshx.eng
    0x03fb0000 0x9a000 6.86.0101.0002 C:\Program Files\Nokia\Nokia PC Suite 6\phonebrowser.dll
    0x04050000 0xc8000 6.86.0134.0006 C:\Program Files\Nokia\Nokia PC Suite 6\NGSCM.DLL
    0x03ce0000 0xa000 6.86.0063.0000 C:\Program Files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_fre.nlr
    0x04220000 0x8e000 6.86.0020.0000 C:\Program Files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
    0x037d0000 0xe000 C:\Program Files\ArcSoft\PhotoImpression 5\share\pihook.dll
    0x00ce0000 0x9000 7.00.12180.0000 C:\Program Files\Orange\AntivirusFirewall\Common\fpshx.dll
    0x17000000 0x1d000 7.50.10035.0000 C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.dll
    0x01480000 0x38000 7.02.3140.0000 C:\Program Files\Orange\AntivirusFirewall\Common\fslapi.dll
    0x02f70000 0x12000 1.01.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
    0x01980000 0x10000 8.00.0000.0456 C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    0x030e0000 0x5b000 1.01.0000.0000 C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    0x60990000 0x7000 3.01.4001.5512 C:\WINDOWS\system32\MSISIP.DLL
    0x7e6a0000 0x16000 5.07.0000.18066 C:\WINDOWS\System32\wshext.dll

    ListDLLs v2.25 - DLL lister for Win9x/NT
    Copyright (C) 1997-2004 Mark Russinovich
    Sysinternals - www.sysinternals.com

    ------------------------------------------------------------------------------
    winlogon.exe pid: 644
    Command line: winlogon.exe

    Base Size Version Path
    0x01000000 0x82000 \??\C:\WINDOWS\system32\winlogon.exe
    0x77be0000 0x58000 7.00.2600.5512 C:\WINDOWS\system32\msvcrt.dll
    0x779e0000 0x97000 5.131.2600.5512 C:\WINDOWS\system32\CRYPT32.dll
    0x76be0000 0x2e000 5.131.2600.5512 C:\WINDOWS\system32\WINTRUST.dll
    0x753c0000 0x6b000 1.420.2600.5512 C:\WINDOWS\system32\USP10.dll
    0x58b50000 0x9a000 5.82.2900.5512 C:\WINDOWS\system32\COMCTL32.dll
    0x74730000 0x3d000 3.525.1132.0000 C:\WINDOWS\system32\ODBC32.dll
    0x1f840000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
    0x76ac0000 0x11000 3.05.2284.0001 C:\WINDOWS\system32\ATL.DLL
    0x77000000 0xd4000 2001.12.4414.0700 C:\WINDOWS\system32\COMRes.dll
    0x76f80000 0x7f000 2001.12.4414.0700 C:\WINDOWS\system32\CLBCATQ.DLL
    0x10000000 0x16000 6.16.0061.0000 C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdc.dll

    Le volume dans le lecteur C n'a pas de nom.
    Le numéro de série du volume est 4C59-96B0

    Répertoire de C:\WINDOWS\system32

    14/04/2008 04:33 6 144 csrss.exe
    1 fichier(s) 6 144 octets
    0 Rép(s) 36 274 257 920 octets libres

    Contenu de Downloaded Program Files
    Le volume dans le lecteur C n'a pas de nom.
    Le numéro de série du volume est 4C59-96B0

    Répertoire de C:\WINDOWS\Downloaded Program Files

    09/07/2008 17:00 <REP> .
    09/07/2008 17:00 <REP> ..
    27/06/2008 16:47 289 as2stubie.inf
    08/06/2008 19:23 65 desktop.ini
    25/07/2002 17:13 24 576 dwusplay.dll
    25/07/2002 17:13 196 608 dwusplay.exe
    11/04/2007 14:55 1 292 erma.inf
    25/07/2002 17:05 172 032 isusweb.dll
    30/07/2007 19:24 293 wuweb.inf
    7 fichier(s) 395 155 octets

    Total des fichiers listés :
    7 fichier(s) 395 155 octets
    2 Rép(s) 36 274 257 920 octets libres

    Recherche de rootkit! (Merci S!Ri)

    Recherche d'infections connues

    Export des clefs sensibles..

    Liste des fichiers en exception sur le pare-feu XP SP2

    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Disabled:Logitech Desktop Messenger"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    Export de la clef SharedTaskScheduler

    [SharedTaskScheduler]
    "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
    "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

    exports des policies
    REGEDIT4

    [system]
    "dontdisplaylastusername"=dword:00000000
    "legalnoticecaption"=""
    "legalnoticetext"=""
    "shutdownwithoutlogon"=dword:00000001
    "undockwithoutlogon"=dword:00000001
    "DisableRegistryTools"=dword:00000000
    "HideLegacyLogonScripts"=dword:00000000
    "HideLogoffScripts"=dword:00000000
    "RunLogonScriptSync"=dword:00000001
    "RunStartupScriptSync"=dword:00000000
    "HideStartupScripts"=dword:00000000

    Export des clefs sensibles..
    Rechercher adresses sensibles dans le fichier HOSTS...
    catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-27 22:55:39
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:2df9c43f
    "s2"=dword:110480d0
    "h0"=dword:00000001

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:96,ee,69,fa,f0,c4,3d,d7,73,93,06,54,ed,66,59,73,19,98,01,7a,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,ed,87,7a,ea,ab,c9,6b,fa,3d,ad,1d,8c,7b,82,ba,13,13,..
    "khjeh"=hex:54,1c,40,d2,89,b8,69,ab,84,37,30,44,46,0b,0a,49,fa,d4,1f,be,6b,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:e9,c9,38,53,3b,00,84,b7,13,ac,80,2b,16,c5,97,d4,1a,e8,f5,fa,63,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:96,ee,69,fa,f0,c4,3d,d7,73,93,06,54,ed,66,59,73,19,98,01,7a,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,ed,87,7a,ea,ab,c9,6b,fa,3d,ad,1d,8c,7b,82,ba,13,13,..
    "khjeh"=hex:54,1c,40,d2,89,b8,69,ab,84,37,30,44,46,0b,0a,49,fa,d4,1f,be,6b,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:e9,c9,38,53,3b,00,84,b7,13,ac,80,2b,16,c5,97,d4,1a,e8,f5,fa,63,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:96,ee,69,fa,f0,c4,3d,d7,73,93,06,54,ed,66,59,73,19,98,01,7a,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,ed,87,7a,ea,ab,c9,6b,fa,3d,ad,1d,8c,7b,82,ba,13,13,..
    "khjeh"=hex:54,1c,40,d2,89,b8,69,ab,84,37,30,44,46,0b,0a,49,fa,d4,1f,be,6b,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:e9,c9,38,53,3b,00,84,b7,13,ac,80,2b,16,c5,97,d4,1a,e8,f5,fa,63,..

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
    "TracesProcessed"=dword:000001b6

    scanning hidden files ...

    scan completed successfully
    hidden services: 0
    hidden files: 0

    KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

    Process list by traversal of KiWaitListHead

    4 - System
    132 - svchost.exe
    332 - FCH32.EXE
    412 - FSM32.EXE
    456 - nvsvc32.exe
    468 - optproxy.exe
    576 - snmp.exe
    620 - csrss.exe
    644 - winlogon.exe
    688 - services.exe
    700 - lsass.exe
    864 - svchost.exe
    944 - svchost.exe
    1044 - fsguidll.exe
    1060 - svchost.exe
    1136 - svchost.exe
    1228 - FAMEH32.EXE
    1284 - E_FATIAME.EXE
    1288 - fsqh.exe
    1356 - svchost.exe
    1452 - spoolsv.exe
    1496 - fsav32.exe
    1512 - OPTGui.exe
    1532 - explorer.exe
    1604 - ctfmon.exe
    1756 - TaskBarIcon.exe
    1908 - mscorsvw.exe
    1968 - FSMA32.EXE
    1976 - fsgk32.exe
    2040 - FSMB32.EXE
    2340 - iexplore.exe
    2352 - fsaua.exe
    2364 - fssm32.exe
    2644 - fsdfwd.exe
    2976 - alg.exe
    3016 - fsus.exe
    3308 - cmd.exe
    3704 - taskmgr.exe

    Total number of processes = 38
    NOTE: Under WinXP, this will not show all processes.

    KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

    Driver/Module list by traversal of PsLoadedModuleList

    804D7000 - \WINDOWS\system32\ntkrnlpa.exe
    806D0000 - \WINDOWS\system32\hal.dll
    F7ADC000 - \WINDOWS\system32\KDCOM.DLL
    F79EC000 - \WINDOWS\system32\BOOTVID.dll
    F73DB000 - spll.sys
    F7ADE000 - \WINDOWS\System32\Drivers\WMILIB.SYS
    F73C3000 - \WINDOWS\System32\Drivers\SCSIPORT.SYS
    F7394000 - ACPI.sys
    F7383000 - pci.sys
    F75DC000 - isapnp.sys
    F7BA4000 - pciide.sys
    F785C000 - \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
    F7AE0000 - viaide.sys
    F75EC000 - MountMgr.sys
    F7364000 - ftdisk.sys
    F7864000 - PartMgr.sys
    F786C000 - pavboot.sys
    F75FC000 - VolSnap.sys
    F734C000 - atapi.sys
    F760C000 - disk.sys
    F761C000 - \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
    F732C000 - fltmgr.sys
    F731A000 - sr.sys
    F762C000 - PxHelp20.sys
    F7303000 - KSecDD.sys
    F72F0000 - WudfPf.sys
    F7263000 - Ntfs.sys
    F763C000 - fsdfw.sys
    F7236000 - \WINDOWS\System32\drivers\NDIS.SYS
    F7874000 - \WINDOWS\System32\drivers\fsndis5.sys
    F787C000 - viaagp1.sys
    F721C000 - Mup.sys
    F6516000 - \SystemRoot\System32\DRIVERS\nv4_mini.sys
    F6502000 - \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
    F77DC000 - \SystemRoot\system32\DRIVERS\imapi.sys
    F7914000 - \SystemRoot\system32\drivers\Afc.sys
    F791C000 - \SystemRoot\system32\drivers\pfc.sys
    F77EC000 - \SystemRoot\System32\DRIVERS\cdrom.sys
    F77FC000 - \SystemRoot\System32\DRIVERS\redbook.sys
    F64DF000 - \SystemRoot\System32\DRIVERS\ks.sys
    F7924000 - \SystemRoot\System32\DRIVERS\usbuhci.sys
    F64BB000 - \SystemRoot\System32\DRIVERS\USBPORT.SYS
    F792C000 - \SystemRoot\System32\DRIVERS\fdc.sys
    F64A7000 - \SystemRoot\System32\DRIVERS\parport.sys
    F7B14000 - \SystemRoot\System32\DRIVERS\ASACPI.sys
    F780C000 - \SystemRoot\System32\DRIVERS\i8042prt.sys
    F7934000 - \SystemRoot\System32\DRIVERS\kbdclass.sys
    F6496000 - \SystemRoot\System32\DRIVERS\serial.sys
    F6C62000 - \SystemRoot\System32\DRIVERS\serenum.sys
    F611C000 - \SystemRoot\system32\drivers\ALCXWDM.SYS
    F60F8000 - \SystemRoot\system32\drivers\portcls.sys
    F781C000 - \SystemRoot\system32\drivers\drmk.sys
    F6093000 - \SystemRoot\System32\Drivers\at08o35h.SYS
    F783C000 - \SystemRoot\System32\DRIVERS\AmdK8.sys
    F7C46000 - \SystemRoot\System32\DRIVERS\audstub.sys
    F784C000 - \SystemRoot\System32\DRIVERS\rasl2tp.sys
    F7AA0000 - \SystemRoot\System32\DRIVERS\ndistapi.sys
    F607C000 - \SystemRoot\System32\DRIVERS\ndiswan.sys
    F767C000 - \SystemRoot\System32\DRIVERS\raspppoe.sys
    F768C000 - \SystemRoot\System32\DRIVERS\raspptp.sys
    F7984000 - \SystemRoot\System32\DRIVERS\TDI.SYS
    F606B000 - \SystemRoot\System32\DRIVERS\psched.sys
    F769C000 - \SystemRoot\System32\DRIVERS\msgpc.sys
    F798C000 - \SystemRoot\System32\DRIVERS\ptilink.sys
    F7994000 - \SystemRoot\System32\DRIVERS\raspti.sys
    F76AC000 - \SystemRoot\System32\DRIVERS\termdd.sys
    F799C000 - \SystemRoot\System32\DRIVERS\mouclass.sys
    F7B26000 - \SystemRoot\System32\DRIVERS\swenum.sys
    F600D000 - \SystemRoot\System32\DRIVERS\update.sys
    F7AB4000 - \SystemRoot\System32\DRIVERS\mssmbios.sys
    F773C000 - \SystemRoot\System32\Drivers\NDProxy.SYS
    F775C000 - \SystemRoot\System32\DRIVERS\usbhub.sys
    F7B32000 - \SystemRoot\System32\DRIVERS\USBD.SYS
    F7884000 - \SystemRoot\System32\DRIVERS\flpydisk.sys
    F7B3C000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
    F7BC5000 - \SystemRoot\System32\Drivers\Null.SYS
    F7B3E000 - \SystemRoot\System32\Drivers\Beep.SYS
    F78F4000 - \SystemRoot\System32\drivers\vga.sys
    F7B40000 - \SystemRoot\System32\Drivers\mnmdd.SYS
    F7B42000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
    F78FC000 - \SystemRoot\System32\Drivers\Msfs.SYS
    F7904000 - \SystemRoot\System32\Drivers\Npfs.SYS
    F71D8000 - \SystemRoot\System32\DRIVERS\rasacd.sys
    F4865000 - \SystemRoot\System32\DRIVERS\ipsec.sys
    F480C000 - \SystemRoot\System32\DRIVERS\tcpip.sys
    F47E4000 - \SystemRoot\System32\DRIVERS\netbt.sys
    F47C2000 - \SystemRoot\System32\drivers\afd.sys
    F77AC000 - \SystemRoot\System32\DRIVERS\netbios.sys
    F4797000 - \SystemRoot\System32\DRIVERS\rdbss.sys
    F46FF000 - \SystemRoot\System32\DRIVERS\mrxsmb.sys
    F77BC000 - \SystemRoot\System32\Drivers\Fips.SYS
    F46D9000 - \SystemRoot\System32\DRIVERS\ipnat.sys
    F4DEC000 - \SystemRoot\System32\DRIVERS\wanarp.sys
    F6735000 - \??\C:\Program Files\Orange\AntivirusFirewall\HIPS\fshs.sys
    F7B96000 - \SystemRoot\system32\drivers\AsIO.sys
    F4B4A000 - \SystemRoot\System32\DRIVERS\usbccgp.sys
    F7AD8000 - \SystemRoot\System32\DRIVERS\hidusb.sys
    F4D9C000 - \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
    F4B3A000 - \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
    F4B2A000 - \SystemRoot\system32\DRIVERS\LHidKE.Sys
    F71F8000 - \SystemRoot\System32\DRIVERS\mouhid.sys
    F466B000 - \SystemRoot\system32\DRIVERS\LMouKE.Sys
    F6755000 - \SystemRoot\System32\Drivers\Cdfs.SYS
    F4653000 - \SystemRoot\System32\Drivers\dump_atapi.sys
    F7B30000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    BF800000 - \SystemRoot\System32\win32k.sys
    F4777000 - \SystemRoot\System32\drivers\Dxapi.sys
    F797C000 - \SystemRoot\System32\watchdog.sys
    BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
    F7C87000 - \SystemRoot\System32\drivers\dxgthk.sys
    F4DBC000 - \SystemRoot\System32\DRIVERS\STREAM.SYS
    F7AB0000 - \SystemRoot\System32\DRIVERS\NVxbar.sys
    BF9D5000 - \SystemRoot\System32\nv4_disp.dll
    F7AC4000 - \SystemRoot\System32\DRIVERS\ndisuio.sys
    F2535000 - \SystemRoot\System32\DRIVERS\mrxdav.sys
    F7B68000 - \SystemRoot\System32\Drivers\ParVdm.SYS
    F7CCD000 - \??\C:\WINDOWS\system32\drivers\AsInsHelp32.sys
    BFFA0000 - \SystemRoot\System32\ATMFD.DLL
    F23CB000 - \SystemRoot\System32\DRIVERS\srv.sys
    F22C6000 - \SystemRoot\system32\drivers\wdmaud.sys
    F2495000 - \SystemRoot\system32\drivers\sysaudio.sys
    F2156000 - \SystemRoot\System32\DRIVERS\nvcap.sys
    F1E3A000 - \SystemRoot\System32\Drivers\Fastfat.SYS
    F1B08000 - \??\C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys
    F11ED000 - \SystemRoot\System32\Drivers\HTTP.sys
    EFBC7000 - \SystemRoot\system32\drivers\kmixer.sys
    F7BCD000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

    Total number of drivers = 127

    Liste des programmes installes

    7-Zip 4.57
    AC3Filter (remove only)
    Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
    Adobe Flash Player ActiveX
    Adobe Reader 8.1.2 - Français
    Adobe Reader 8.1.2 Security Update 1 (KB403742)
    Adobe® Photoshop® Album Edition Découverte 3.2
    Adobe® Photoshop® Album Edition Découverte 3.2
    AntiVirus Firewall
    Apple Software Update
    Applian FLV Player
    Archiveur WinRAR
    ArcSoft PhotoImpression 5
    ArcSoft Software Suite
    Assistant de connexion Windows Live
    ASUS_Ai_Proactive_Screensaver (E)
    ASUSUpdate
    Athlon 64 Processor Driver
    AutoUpdate
    AviSynth 2.5
    Azureus Vuze
    CCleaner (remove only)
    Contrôle Parental
    Cool & Quiet
    CoreAAC Audio Decoder (remove only)
    Correctif pour Windows Internet Explorer 7 (KB947864)
    Creative Jukebox Driver
    Creative MediaSource
    Creative Removable Disk Manager
    Creative System Information
    Creative Zen Micro
    Direct Show Ogg Vorbis Filter (remove only)
    DivX Codec
    DivX Converter
    DivX Player
    DivX Web Player
    DS Legends of Aranna
    eMule
    encodeur Real Video Producer
    EPSON Attach To Email
    EPSON Attach To Email
    EPSON Copy Utility 3
    EPSON Easy Photo Print
    EPSON Event Manager
    EPSON File Manager
    EPSON Image Clip Palette
    EPSON Logiciel imprimante
    EPSON Print CD
    EPSON PRINT Image Framer Tool
    EPSON Scan
    EPSON Scan Assistant
    EPSON Web-To-Page
    ESPRX640 Guide d'utilisation
    Galerie de photos Windows Live
    Gestionnaire Internet
    Google Earth
    Haali Media Splitter
    Java(TM) 6 Update 7
    K-Lite Mega Codec Pack 4.0.0
    Lame ACM MP3 Codec
    Lecteur Windows Media 11
    livebox
    Logitech Desktop Messenger
    Logitech SetPoint
    LUMIX Simple Viewer
    Magellan POI File Editor
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 French Language Pack
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA
    Microsoft .NET Framework 3.0 Service Pack 1
    Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - FRA
    Microsoft .NET Framework 3.5
    Microsoft .NET Framework 3.5
    Microsoft .NET Framework 3.5 Language Pack - fra
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft National Language Support Downlevel APIs
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft User-Mode Driver Framework Feature Pack 1.5
    Microsoft Visual C++ 2005 Redistributable
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)
    MKVtoolnix 2.2.0
    Module linguistique Microsoft .NET Framework 3.5 - fra
    Mozilla Firefox (3.0.1)
    MSVC80_x86
    MSXML 4.0 SP2 (KB936181)
    Navigateur Orange
    Nero 8 Trial
    neroxml
    Nokia Connectivity Cable Driver
    Nokia PC Suite
    Nokia PC Suite
    NVIDIA WDM Drivers
    On2 VP7 Personal Edition
    OpenOffice.org 2.4
    Pack PSP - Ri4m - v1.0a
    Panda ActiveScan 2.0
    PC Connectivity Solution
    PC Probe II
    PhotoFiltre
    PHOTOfunSTUDIO -viewer-
    PIF DESIGNER
    Platform
    QuickTime
    Realtek AC'97 Audio
    Ri4m v5.0.1d
    RIAM Video Enhancer
    Ripp-It Codec Pack v 4.2.6
    SILKYPIX Developer Studio 2.1 SE
    SILKYPIX Developer Studio 2.1 SE
    Starcraft
    Uniblue RegistryBooster 2
    VCRedistSetup
    VIA Platform Device Manager
    VIA Rhine-Family Fast-Ethernet Adapter
    WebFldrs XP
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 7
    Windows Live installer
    Windows Live Mail
    Windows Live Messenger
    Windows Live OneCare safety scanner
    Windows Live Writer
    Windows Media Format 11 runtime
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Service Pack 3
    WinFast(R) Display Driver
    x264 Revision 573 x264.nl (remove only)
    XML Paper Specification Shared Components Language Pack 1.0
    XML Paper Specification Shared Components Pack 1.0
    Xvid 1.1.2 final uninstall

    Le volume dans le lecteur C n'a pas de nom.
    Le numéro de série du volume est 4C59-96B0

    Répertoire de C:\Program Files

    27/07/2008 21:19 <REP> .
    27/07/2008 21:19 <REP> ..
    09/06/2008 18:24 <REP> 7-Zip
    09/06/2008 15:55 <REP> AC3Filter
    01/07/2008 08:16 <REP> Adobe
    26/07/2008 18:31 <REP> ahead
    26/07/2008 18:28 <REP> AMD
    09/06/2008 20:02 <REP> Apple Software Update
    09/06/2008 20:05 <REP> ArcSoft
    08/06/2008 19:49 <REP> ASUS
    09/06/2008 15:48 <REP> AviSynth 2.5
    08/06/2008 19:45 <REP> AvRack
    03/07/2008 14:10 <REP> Azureus
    09/06/2008 15:04 <REP> CCleaner
    08/06/2008 19:20 <REP> ComPlus Applications
    09/06/2008 16:16 <REP> Controle Parental
    09/06/2008 19:39 <REP> Creative
    12/06/2008 14:38 <REP> DAEMON Tools Lite
    09/06/2008 16:00 <REP> DivX
    24/07/2008 20:20 <REP> eMule
    09/06/2008 11:57 <REP> epson
    09/06/2008 11:56 <REP> EPSON Print CD
    04/07/2008 08:53 <REP> fichier système
    27/07/2008 10:46 <REP> Fichiers communs
    16/06/2008 12:06 <REP> FLV Player
    09/06/2008 15:26 <REP> Google
    09/06/2008 16:01 <REP> Haali
    11/06/2008 14:50 <REP> Internet Explorer
    09/06/2008 20:12 <REP> ISL
    09/06/2008 16:02 <REP> IVCsoft
    27/07/2008 20:48 <REP> Java
    17/07/2008 15:27 <REP> K-Lite Codec Pack
    09/06/2008 11:33 <REP> Logitech
    09/06/2008 19:54 <REP> Magellan
    25/07/2008 11:47 <REP> Malwarebytes' Anti-Malware
    09/06/2008 09:17 <REP> Messenger
    08/06/2008 19:25 <REP> microsoft frontpage
    12/06/2008 14:43 <REP> Microsoft Games
    18/07/2008 22:40 <REP> Microsoft Silverlight
    09/06/2008 21:07 <REP> Microsoft SQL Server Compact Edition
    17/07/2008 17:05 <REP> MKVtoolnix
    09/06/2008 13:54 <REP> Movie Maker
    27/07/2008 22:53 <REP> Mozilla Firefox
    27/07/2008 21:19 <REP> MSBuild
    08/06/2008 19:19 <REP> MSN
    08/06/2008 19:18 <REP> MSN Gaming Zone
    28/06/2008 17:08 <REP> MSXML 4.0
    22/07/2008 17:20 <REP> Navilog1
    26/07/2008 20:49 <REP> Nero
    09/06/2008 09:13 <REP> NetMeeting
    26/07/2008 23:07 <REP> nLite
    09/06/2008 20:40 <REP> Nokia
    09/06/2008 16:01 <REP> On2 Technologies
    25/06/2008 23:56 <REP> OpenOffice.org 2.4
    09/06/2008 09:46 <REP> Orange
    09/06/2008 09:12 <REP> Outlook Express
    09/06/2008 15:49 <REP> Pack PSP - Ri4m
    09/06/2008 19:59 <REP> Panasonic
    21/06/2008 22:33 <REP> Panda Security
    09/06/2008 20:40 <REP> PC Connectivity Solution
    18/06/2008 19:23 <REP> PhotoFiltre
    09/06/2008 15:50 <REP> Producer
    09/06/2008 20:04 <REP> QuickTime
    08/06/2008 19:45 <REP> Realtek AC97
    08/06/2008 19:45 <REP> Realtek Sound Manager
    27/07/2008 21:18 <REP> Reference Assemblies
    09/06/2008 15:50 <REP> RIAM Video Enhancer
    09/06/2008 15:54 <REP> Ripp-It Codec Pack
    18/07/2008 11:07 <REP> Ripp-it_AM
    09/07/2008 22:36 <REP> SAGEM
    08/06/2008 19:19 <REP> Services en ligne
    16/07/2008 10:41 <REP> Starcraft
    25/07/2008 11:28 <REP> Trend Micro
    08/06/2008 20:21 <REP> Ulead Systems
    09/06/2008 13:04 <REP> Uniblue
    08/06/2008 19:44 <REP> VIA
    17/07/2008 15:22 <REP> VideoLAN
    27/07/2008 21:44 <REP> Wanadoo
    10/06/2008 09:16 <REP> Windows Live
    24/06/2008 21:13 <REP> Windows Live Safety Center
    09/06/2008 10:59 <REP> Windows Media Connect 2
    09/06/2008 10:59 <REP> Windows Media Player
    09/06/2008 09:12 <REP> Windows NT
    08/06/2008 20:21 <REP> WinFast
    09/06/2008 18:24 <REP> WinRAR
    09/06/2008 16:00 <REP> x264
    08/06/2008 19:25 <REP> xerox
    09/06/2008 16:00 <REP> Xvid
    0 fichier(s) 0 octets
    88 Rép(s) 36 274 405 376 octets libres
    Le volume dans le lecteur C n'a pas de nom.
    Le numéro de série du volume est 4C59-96B0

    Répertoire de C:\Program Files\fichiers communs

    27/07/2008 10:46 <REP> .
    27/07/2008 10:46 <REP> ..
    10/06/2008 17:21 <REP> Adobe
    09/06/2008 20:09 <REP> ArcSoft
    09/06/2008 12:06 <REP> InstallShield
    09/06/2008 13:01 <REP> Java
    09/06/2008 11:31 <REP> Logitech
    05/07/2008 19:02 <REP> Microsoft Shared
    08/06/2008 19:20 <REP> MSSoap
    26/07/2008 21:03 <REP> Nero
    09/06/2008 20:41 <REP> Nokia
    08/06/2008 19:55 <REP> ODBC
    09/06/2008 20:41 <REP> PCSuite
    08/06/2008 19:21 <REP> Services
    08/06/2008 19:54 <REP> SpeechEngines
    09/06/2008 09:12 <REP> System
    08/06/2008 20:21 <REP> Ulead Systems
    0 fichier(s) 0 octets
    17 Rép(s) 36 274 401 280 octets libres
    Le volume dans le lecteur C n'a pas de nom.
    Le numéro de série du volume est 4C59-96B0

    Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

    08/06/2008 19:38 <REP> .
    08/06/2008 19:38 <REP> ..
    18/05/2001 17:57 561 209 MSONSEXT.DLL
    03/06/1999 14:09 122 937 MSOWS409.DLL
    07/03/2001 09:00 127 033 MSOWS40c.DLL
    3 fichier(s) 811 179 octets
    2 Rép(s) 36 274 401 280 octets libres

    c:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\QuickTime 7.1.3.100\QuickTimeInstallerAdmin.exe
    c:\Documents and Settings\All Users\Application Data\Installations\{9C05FA75-0337-4523-AA57-9D3511018887}\Nokia_PC_Suite_rel_6_86_9_3_fre_web.exe
    c:\Documents and Settings\All Users\Application Data\Installations\{9C05FA75-0337-4523-AA57-9D3511018887}\Installer\CommonCustomActions\UninstCCD.exe
    c:\Documents and Settings\All Users\Application Data\Installations\{9C05FA75-0337-4523-AA57-9D3511018887}\Installer\CommonCustomActions\UninstPCS.exe
    c:\Documents and Settings\All Users\Application Data\Installations\{9C05FA75-0337-4523-AA57-9D3511018887}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
    c:\Documents and Settings\Anthony\Bureau\ComboFix.exe
    c:\Documents and Settings\Anthony\Bureau\HJTInstall.exe
    c:\Documents and Settings\Anthony\Bureau\OTMoveIt2.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\catchme.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\diff.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\dumphive.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\FilesInfoCmd.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\find2.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\Fport.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\grep.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\gzip.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\KProcCheck.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\LFiles.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\LISTDLLS.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\md5sums.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\pslist.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\sigcheck.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\streams.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\swreg.exe
    c:\Documents and Settings\Anthony\Bureau\DiagHelp\tar.exe
    c:\Documents and Settings\Anthony\Mes documents\My Games\neverend\Anthony\dotNetFx35setup.exe
    c:\Documents and Settings\Anthony\Mes documents\My Games\neverend\Anthony\invision.exe
    c:\Documents and Settings\Anthony\Mes documents\My Games\neverend\Anthony\OTMoveIt2.exe
    c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
    c:\Documents and Settings\All Users\Application Data\Nero\DrWeb\Drweb32.dll
    c:\Documents and Settings\Anthony\Application Data\Creative\Media Database\JetFileBackup\Expsrv.dll
    c:\Documents and Settings\Anthony\Application Data\Creative\Media Database\JetFileBackup\Msado15.dll
    c:\Documents and Settings\Anthony\Application Data\Creative\Media Database\JetFileBackup\Msadox.dll
    c:\Documents and Settings\Anthony\Application Data\Creative\Media Database\JetFileBackup\Msadrh15.dll
    c:\Documents and Settings\Anthony\Application Data\Creative\Media Database\JetFileBackup\Msjet40.dll
    c:\Documents and Settings\Anthony\Application Data\Creative\Media Database\JetFileBackup\Msjetoledb40.dll
    c:\Documents and Settings\Anthony\Application Data\Creative\Media Database\JetFileBackup\Msjint40.dll
    c:\Documents and Settings\Anthony\Application Data\Creative\Media Database\JetFileBackup\Msjro.dll
    c:\Documents and Settings\Anthony\Application Data\Creative\Media Database\JetFileBackup\Msjter40.dll
    c:\Documents and Settings\Anthony\Application Data\Creative\Media Database\JetFileBackup\Msjtes40.dll
    c:\Documents and Settings\Anthony\Application Data\Creative\Media Database\JetFileBackup\Mswstr10.dll
    c:\Documents and Settings\Anthony\Application Data\Creative\Media Database\JetFileBackup\vbajet32.dll
    c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

    ****** Fin du rapport DiagHelp
    Veuillez svp envoyer le fichier C:\upload_moi_STIVY.tar.gz a l'adresse http://upload.malekal.com
    0
  2. Kid7 Messages postés 31 Date d'inscription   Statut Membre
     
    Et le catchme.log :

    catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-27 22:55:39
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:2df9c43f
    "s2"=dword:110480d0
    "h0"=dword:00000001

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:96,ee,69,fa,f0,c4,3d,d7,73,93,06,54,ed,66,59,73,19,98,01,7a,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,ed,87,7a,ea,ab,c9,6b,fa,3d,ad,1d,8c,7b,82,ba,13,13,..
    "khjeh"=hex:54,1c,40,d2,89,b8,69,ab,84,37,30,44,46,0b,0a,49,fa,d4,1f,be,6b,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:e9,c9,38,53,3b,00,84,b7,13,ac,80,2b,16,c5,97,d4,1a,e8,f5,fa,63,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:96,ee,69,fa,f0,c4,3d,d7,73,93,06,54,ed,66,59,73,19,98,01,7a,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,ed,87,7a,ea,ab,c9,6b,fa,3d,ad,1d,8c,7b,82,ba,13,13,..
    "khjeh"=hex:54,1c,40,d2,89,b8,69,ab,84,37,30,44,46,0b,0a,49,fa,d4,1f,be,6b,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:e9,c9,38,53,3b,00,84,b7,13,ac,80,2b,16,c5,97,d4,1a,e8,f5,fa,63,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:96,ee,69,fa,f0,c4,3d,d7,73,93,06,54,ed,66,59,73,19,98,01,7a,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,ed,87,7a,ea,ab,c9,6b,fa,3d,ad,1d,8c,7b,82,ba,13,13,..
    "khjeh"=hex:54,1c,40,d2,89,b8,69,ab,84,37,30,44,46,0b,0a,49,fa,d4,1f,be,6b,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:e9,c9,38,53,3b,00,84,b7,13,ac,80,2b,16,c5,97,d4,1a,e8,f5,fa,63,..

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
    "TracesProcessed"=dword:000001b6

    scanning hidden files ...

    scan completed successfully
    hidden services: 0
    hidden files: 0
    0
  3. Utilisateur anonyme
     
    ouvre le menu demarrer dans rechercher copie/colle ce fichier : FSDC.EXE

    si present supprime le

    Vide tes fichiers temporaires avec ceci:

    ->Clean Up 40:

    http://pageperso.aol.fr/balltrap34/CleanUp40.exe

    ->aide en image:(merci a Balltrap34)

    http://perso.orange.fr/rginformatique/section%20virus/democleanup.htm
    0
  4. Kid7 Messages postés 31 Date d'inscription   Statut Membre
     
    C fait mais le problème est toujours la .
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Utilisateur anonyme
     
    a quel moment tu as ce message ?
    0
  7. Kid7 Messages postés 31 Date d'inscription   Statut Membre
     
    Des que je clique sur exécuter
    0
  8. Utilisateur anonyme
     
    sur n importe quel type de logiciel ou seulement ceux qui servent a nettoyer genre antivirus etc

    ton antivirus est actif ?
    0
  9. Kid7 Messages postés 31 Date d'inscription   Statut Membre
     
    Oui mon antivirus est actif et sa me fait ce problème qu'avec un logiciel pour l'instant mais je les est pas tous testé non plus. Et depuis un de mes jeu ne veut plus ce lancer et l'ordinateur rame beaucoup, et la restauration du système ne marche plus .
    0
  10. Utilisateur anonyme
     
    sa me fait ce problème qu'avec un logiciel pour l'instant

    désinstal le et réinstal le et test

    telecharge zeb retore :

    http://telechargement.zebulon.fr/zeb-restore.html

    dezippe le

    double clic sur zeb restore (la roue dentelé)

    coches restauration system

    clic sur restaurer
    0
  11. Kid7 Messages postés 31 Date d'inscription   Statut Membre
     
    Le logiciel qui me donne ce message n'est pas installer c justement en voulant l'installer qu'il me donne ce message .
    Et pour la restauration du système elle marche mais sa me met restauration incomplète à la fin et rien ne change.
    0
  12. Kid7 Messages postés 31 Date d'inscription   Statut Membre
     
    Quelqu'un peut-il m'aider à résoudre mon problème ?
    0
  13. Utilisateur anonyme
     
    tu pourrais etre plus precis quel est le logiciel ??
    0
  14. Kid7 Messages postés 31 Date d'inscription   Statut Membre
     
    Le logicel c Invision ( il sert a utiliser IRC ) mais il veut pas se lancer a cause de tu c quoi .
    0
  15. Utilisateur anonyme
     
    ton logiciel Invision tu l'a acheter ?
    0
  16. Kid7 Messages postés 31 Date d'inscription   Statut Membre
     
    Non je l'ai télécharger pourquoi ?
    0
Précédent
  • 1
  • 2
  • 3

Discussions similaires

Problème avec "PUADIManager:Win32/OfferCore
Knaki -
bazfile -

3 réponses
PUADlManager:Win32/OfferCore
tenmalade -
tenmalade -

2 réponses
PUADlManager:Win32/OfferCore
bernardarrad -
bazfile -

3 réponses
PUA:Win32/InstallCore detecté par windows sécurité
thetib -
bazfile -

11 réponses
Que fait le virus LPI Win32 Pup-Gen
Tristan Chrome -
Tristan Chrome -

2 réponses