Kdjfdssdl.com et fatma.exe
ndatte
Messages postés
20
Statut
Membre
-
Destrio5 Messages postés 99820 Statut Modérateur -
Destrio5 Messages postés 99820 Statut Modérateur -
Bonjour,
depuis ce matin, g des pbs pour me connecter sur le net. en fait la page web apparait mais elle est vide. en plus g remarqué deux nouveaux processus inhabituels dans le gestionnaire des taches: kdjfdssdl.com et fatma.exe.
est ce que qlq1 pourrait m'aider?
merci d'avance.
depuis ce matin, g des pbs pour me connecter sur le net. en fait la page web apparait mais elle est vide. en plus g remarqué deux nouveaux processus inhabituels dans le gestionnaire des taches: kdjfdssdl.com et fatma.exe.
est ce que qlq1 pourrait m'aider?
merci d'avance.
15 réponses
Salut,
- Télécharge HijackThis V 2.02 (HijackThis Installer) :
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
- Fais un double-clic sur HJTInstall.exe afin de lancer l'installation
- Clique sur Install ensuite sur I Accept
- Clique sur Do a scan system and save log file
- Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.
- Télécharge HijackThis V 2.02 (HijackThis Installer) :
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
- Fais un double-clic sur HJTInstall.exe afin de lancer l'installation
- Clique sur Install ensuite sur I Accept
- Clique sur Do a scan system and save log file
- Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.
Tu as deux antivirus, c'est pas bien.
- Télécharge MSNFix.zip (de !aur3n7) sur le bureau:
http://sosvirus.changelog.fr/MSNFix.zip
- Décompresse-le (clic droit >> Extraire ici).
- Double-clique sur le fichier MSNFix.bat.
- Exécute l'option R.
- Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage
- Note : Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal.
- Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.t, poste-le.
- Télécharge MSNFix.zip (de !aur3n7) sur le bureau:
http://sosvirus.changelog.fr/MSNFix.zip
- Décompresse-le (clic droit >> Extraire ici).
- Double-clique sur le fichier MSNFix.bat.
- Exécute l'option R.
- Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage
- Note : Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal.
- Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.t, poste-le.
* Télécharge SDFix (par Andy Manchesta) et sauvegarde-le sur ton bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
* Double-clique sur SDFix.exe et choisis Install pour l'extraire dans son dossier sur le bureau.
* Redémarre le PC en mode sans échec :
https://www.malekal.com/demarrer-windows-mode-sans-echec/
* Choisis ton compte.
Déroule la liste des instructions ci-dessous :
* Ouvre le dossier SDFix qui vient d'être créé sur le bureau et double-clique sur RunThis.bat pour lancer le script.
* Appuie sur Y pour commencer le nettoyage.
* Quand il te le demandera, appuie sur une touche pour redémarrer le PC.
* Ton système sera plus long à redémarrer car l'outil va continuer à s'exécuter et supprimer des fichiers.
* Après le chargement du bureau, l'outil aura terminé et affichera Finished.
* Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton bureau.
* Le rapport SDFix s'ouvrira et il sera enregistré dans le dossier SDFix sous le nom Report.txt.
* Enfin, copie/colle le rapport du fichier Report.txt.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
* Double-clique sur SDFix.exe et choisis Install pour l'extraire dans son dossier sur le bureau.
* Redémarre le PC en mode sans échec :
https://www.malekal.com/demarrer-windows-mode-sans-echec/
* Choisis ton compte.
Déroule la liste des instructions ci-dessous :
* Ouvre le dossier SDFix qui vient d'être créé sur le bureau et double-clique sur RunThis.bat pour lancer le script.
* Appuie sur Y pour commencer le nettoyage.
* Quand il te le demandera, appuie sur une touche pour redémarrer le PC.
* Ton système sera plus long à redémarrer car l'outil va continuer à s'exécuter et supprimer des fichiers.
* Après le chargement du bureau, l'outil aura terminé et affichera Finished.
* Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton bureau.
* Le rapport SDFix s'ouvrira et il sera enregistré dans le dossier SDFix sous le nom Report.txt.
* Enfin, copie/colle le rapport du fichier Report.txt.
voici le rapport
[b]SDFix: Version 1.209 [/b]
Run by mame on 28/07/2008 at 21:19
Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
[b]Checking Files [/b]:
Trojan Files Found:
C:\WINDOWS\wkssvr.exe - Deleted
mais n'empeche que g toujours le pb pourme connecter?!
[b]SDFix: Version 1.209 [/b]
Run by mame on 28/07/2008 at 21:19
Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
[b]Checking Files [/b]:
Trojan Files Found:
C:\WINDOWS\wkssvr.exe - Deleted
mais n'empeche que g toujours le pb pourme connecter?!
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
excuz moi javé pa vu le reste
[b]SDFix: Version 1.209 [/b]
Run by mame on 28/07/2008 at 21:19
Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
[b]Checking Files [/b]:
Trojan Files Found:
C:\WINDOWS\wkssvr.exe - Deleted
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-28 21:31:18
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
scanning hidden files ...
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\drivers\\thomson_st_330\\STHIW\\stInstall.exe"="D:\\drivers\\thomson_st_330\\STHIW\\stInstall.exe:*:Enabled:SpeedTouch Home Install Wizard"
"C:\\Program Files\\Thomson\\ST330\\service\\st330service.exe"="C:\\Program Files\\Thomson\\ST330\\service\\st330service.exe:*:Enabled:ST330 service"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"="C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe:*:Enabled:Kaspersky Anti-Virus"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\WINDOWS\\system32\\kdjfdssdl.com"="C:\\WINDOWS\\system32\\kdjfdssdl.com:*:Disabled:kdjfdssdl"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
[b]Remaining Files [/b]:
File Backups: - C:\SDFix\backups\backups.zip
[b]Files with Hidden Attributes [/b]:
Sun 27 Jul 2008 432,128 ..SHR --- "C:\WINDOWS\fatma.exe"
Sat 30 Jun 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Sat 30 Jun 2007 401 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv13.bak"
Wed 25 Jun 2008 200,704 ...H. --- "C:\Documents and Settings\mame\Bureau\~WRL0002.tmp"
Wed 12 Mar 2008 58,880 ...H. --- "C:\Documents and Settings\mame\Bureau\~WRL0041.tmp"
Sat 29 Sep 2007 19,968 ...H. --- "C:\Documents and Settings\mame\Bureau\~WRL0447.tmp"
Wed 4 Jun 2008 92,672 ...H. --- "C:\Documents and Settings\mame\Bureau\~WRL1475.tmp"
Sat 29 Sep 2007 20,992 ...H. --- "C:\Documents and Settings\mame\Bureau\~WRL3701.tmp"
Sun 25 Nov 2007 34,816 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL1582.tmp"
Sun 25 Nov 2007 27,648 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL1638.tmp"
Sun 25 Nov 2007 21,504 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL2381.tmp"
Sun 25 Nov 2007 34,304 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL3600.tmp"
Wed 23 Jul 2008 29,696 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL3793.tmp"
Sun 25 Nov 2007 25,600 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL3819.tmp"
Wed 23 Jul 2008 30,208 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL3993.tmp"
Sun 25 Nov 2007 33,792 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL4095.tmp"
Sun 22 Jun 2008 4 A..H. --- "C:\PL7\PL7SYS\SERVERS\SERVER.DLL"
Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\BIT1.tmp"
Wed 5 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5d8093d524ba38b2f4036bb4d3aa25e4\BIT1.tmp"
Wed 23 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT3.tmp"
Sun 15 Jun 2008 19,968 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL0087.tmp"
Sat 19 Jul 2008 26,624 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL0165.tmp"
Sat 19 Jul 2008 31,232 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL0338.tmp"
Sat 19 Jul 2008 25,600 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL0618.tmp"
Sat 19 Jul 2008 26,624 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL1840.tmp"
Sat 19 Jul 2008 26,112 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL1959.tmp"
Sat 19 Jul 2008 26,624 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL3518.tmp"
Sat 19 Jul 2008 31,232 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL3954.tmp"
Sat 30 Jun 2007 4,348 ...H. --- "C:\Documents and Settings\mame\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Sat 30 Jun 2007 401 A..H. --- "C:\Documents and Settings\mame\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Sat 30 Jun 2007 312 ...H. --- "C:\Documents and Settings\mame\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Sat 30 Jun 2007 1,536 A..H. --- "C:\Documents and Settings\mame\Mes documents\Ma musique\Sauvegarde de la licence\drmv2lic.bak"
Fri 18 Jul 2008 77,312 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\cours jules\dfb\~WRL0954.tmp"
Thu 26 Jun 2008 145,408 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0023.tmp"
Thu 26 Jun 2008 146,944 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0042.tmp"
Mon 21 Jul 2008 410,112 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0185.tmp"
Thu 26 Jun 2008 156,160 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0216.tmp"
Thu 26 Jun 2008 150,016 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0244.tmp"
Thu 26 Jun 2008 146,432 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0411.tmp"
Thu 26 Jun 2008 156,672 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0560.tmp"
Thu 26 Jun 2008 146,432 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0620.tmp"
Mon 21 Jul 2008 410,112 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0851.tmp"
Thu 26 Jun 2008 149,504 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0895.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0916.tmp"
Thu 26 Jun 2008 145,920 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1024.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1065.tmp"
Thu 26 Jun 2008 155,136 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1094.tmp"
Thu 26 Jun 2008 153,600 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1322.tmp"
Thu 26 Jun 2008 145,920 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1341.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1350.tmp"
Thu 26 Jun 2008 155,648 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1370.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1386.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1405.tmp"
Thu 26 Jun 2008 146,944 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1486.tmp"
Thu 26 Jun 2008 151,040 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1520.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1786.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1859.tmp"
Mon 21 Jul 2008 24,064 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1873.tmp"
Thu 26 Jun 2008 146,432 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1899.tmp"
Mon 21 Jul 2008 409,600 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1915.tmp"
Thu 26 Jun 2008 157,696 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1930.tmp"
Thu 26 Jun 2008 158,720 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2269.tmp"
Thu 26 Jun 2008 143,872 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2284.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2377.tmp"
Thu 26 Jun 2008 158,720 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2564.tmp"
Thu 26 Jun 2008 153,600 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2606.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2622.tmp"
Thu 26 Jun 2008 147,456 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2647.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2673.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2681.tmp"
Thu 26 Jun 2008 150,016 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2766.tmp"
Thu 26 Jun 2008 148,480 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2796.tmp"
Thu 26 Jun 2008 152,064 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2845.tmp"
Thu 26 Jun 2008 143,360 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2850.tmp"
Mon 21 Jul 2008 409,600 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2877.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2888.tmp"
Thu 26 Jun 2008 157,696 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3236.tmp"
Thu 26 Jun 2008 145,408 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3280.tmp"
Thu 26 Jun 2008 158,208 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3411.tmp"
Thu 26 Jun 2008 156,672 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3447.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3553.tmp"
Mon 21 Jul 2008 409,600 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3560.tmp"
Thu 26 Jun 2008 146,432 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3585.tmp"
Thu 26 Jun 2008 149,504 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3682.tmp"
Mon 21 Jul 2008 410,112 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3811.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3951.tmp"
Thu 26 Jun 2008 146,944 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL4057.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL4084.tmp"
Wed 16 Jul 2008 252,416 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0004.tmp"
Thu 17 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0061.tmp"
Fri 18 Jul 2008 519,680 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0115.tmp"
Fri 18 Jul 2008 508,416 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0153.tmp"
Fri 18 Jul 2008 514,560 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0167.tmp"
Fri 18 Jul 2008 509,952 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0191.tmp"
Thu 17 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0370.tmp"
Thu 17 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0425.tmp"
Thu 17 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0490.tmp"
Fri 18 Jul 2008 519,168 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0567.tmp"
Thu 17 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0585.tmp"
Fri 18 Jul 2008 519,680 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0722.tmp"
Fri 18 Jul 2008 472,064 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0780.tmp"
Fri 18 Jul 2008 518,656 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0818.tmp"
Thu 17 Jul 2008 304,128 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1018.tmp"
Fri 18 Jul 2008 440,832 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1122.tmp"
Fri 18 Jul 2008 491,520 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1293.tmp"
Fri 18 Jul 2008 519,680 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1577.tmp"
Fri 18 Jul 2008 508,416 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1593.tmp"
Fri 18 Jul 2008 380,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1733.tmp"
Fri 18 Jul 2008 440,832 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1803.tmp"
Fri 18 Jul 2008 472,064 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1848.tmp"
Fri 18 Jul 2008 519,680 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1865.tmp"
Fri 18 Jul 2008 518,144 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1875.tmp"
Fri 18 Jul 2008 380,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1943.tmp"
Thu 17 Jul 2008 304,128 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1981.tmp"
Fri 18 Jul 2008 491,520 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2196.tmp"
Fri 18 Jul 2008 380,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2512.tmp"
Thu 17 Jul 2008 309,760 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2690.tmp"
Fri 18 Jul 2008 491,520 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2699.tmp"
Fri 18 Jul 2008 491,520 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2710.tmp"
Fri 18 Jul 2008 401,920 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2715.tmp"
Fri 18 Jul 2008 509,952 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2732.tmp"
Fri 18 Jul 2008 491,520 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2777.tmp"
Thu 17 Jul 2008 304,128 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2819.tmp"
Fri 18 Jul 2008 518,144 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2879.tmp"
Fri 18 Jul 2008 402,432 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2889.tmp"
Fri 18 Jul 2008 472,064 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3021.tmp"
Thu 17 Jul 2008 252,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3215.tmp"
Fri 18 Jul 2008 508,416 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3222.tmp"
Fri 18 Jul 2008 518,144 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3479.tmp"
Thu 17 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3501.tmp"
Thu 17 Jul 2008 257,024 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3708.tmp"
Thu 17 Jul 2008 252,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3927.tmp"
Fri 18 Jul 2008 514,560 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3951.tmp"
Fri 18 Jul 2008 509,952 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3958.tmp"
Fri 18 Jul 2008 116,224 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0002.tmp"
Fri 18 Jul 2008 116,224 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0004.tmp"
Fri 18 Jul 2008 110,592 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0014.tmp"
Fri 18 Jul 2008 179,712 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0082.tmp"
Fri 18 Jul 2008 252,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0102.tmp"
Fri 18 Jul 2008 152,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0550.tmp"
Fri 18 Jul 2008 178,176 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0668.tmp"
Fri 18 Jul 2008 291,840 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0714.tmp"
Fri 18 Jul 2008 109,568 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0736.tmp"
Fri 18 Jul 2008 72,192 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0908.tmp"
Fri 18 Jul 2008 293,888 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL1169.tmp"
Fri 18 Jul 2008 111,104 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL1261.tmp"
Fri 18 Jul 2008 109,568 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL1342.tmp"
Fri 18 Jul 2008 113,152 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL1847.tmp"
Fri 18 Jul 2008 114,176 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL1993.tmp"
Fri 18 Jul 2008 113,664 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2036.tmp"
Fri 18 Jul 2008 111,104 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2117.tmp"
Fri 18 Jul 2008 180,736 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2185.tmp"
Fri 18 Jul 2008 113,152 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2319.tmp"
Fri 18 Jul 2008 112,640 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2379.tmp"
Fri 18 Jul 2008 225,280 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2605.tmp"
Fri 18 Jul 2008 120,832 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2787.tmp"
Fri 18 Jul 2008 109,568 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2791.tmp"
Fri 18 Jul 2008 113,152 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2856.tmp"
Fri 18 Jul 2008 180,736 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2887.tmp"
Fri 18 Jul 2008 72,704 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2907.tmp"
Fri 18 Jul 2008 224,768 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2974.tmp"
Fri 18 Jul 2008 120,832 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3037.tmp"
Fri 18 Jul 2008 291,840 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3111.tmp"
Fri 18 Jul 2008 252,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3120.tmp"
Fri 18 Jul 2008 166,912 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3157.tmp"
Fri 18 Jul 2008 114,176 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3177.tmp"
Fri 18 Jul 2008 115,200 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3211.tmp"
Fri 18 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3506.tmp"
Fri 18 Jul 2008 215,552 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3520.tmp"
Fri 18 Jul 2008 115,200 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3533.tmp"
Fri 18 Jul 2008 180,736 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3645.tmp"
Fri 18 Jul 2008 199,168 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3716.tmp"
Fri 18 Jul 2008 177,664 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL4000.tmp"
Fri 18 Jul 2008 116,736 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL4006.tmp"
Fri 18 Jul 2008 254,464 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL4058.tmp"
[b]Finished![/b]
[b]SDFix: Version 1.209 [/b]
Run by mame on 28/07/2008 at 21:19
Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
[b]Checking Files [/b]:
Trojan Files Found:
C:\WINDOWS\wkssvr.exe - Deleted
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-28 21:31:18
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
scanning hidden files ...
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\drivers\\thomson_st_330\\STHIW\\stInstall.exe"="D:\\drivers\\thomson_st_330\\STHIW\\stInstall.exe:*:Enabled:SpeedTouch Home Install Wizard"
"C:\\Program Files\\Thomson\\ST330\\service\\st330service.exe"="C:\\Program Files\\Thomson\\ST330\\service\\st330service.exe:*:Enabled:ST330 service"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"="C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe:*:Enabled:Kaspersky Anti-Virus"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\WINDOWS\\system32\\kdjfdssdl.com"="C:\\WINDOWS\\system32\\kdjfdssdl.com:*:Disabled:kdjfdssdl"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
[b]Remaining Files [/b]:
File Backups: - C:\SDFix\backups\backups.zip
[b]Files with Hidden Attributes [/b]:
Sun 27 Jul 2008 432,128 ..SHR --- "C:\WINDOWS\fatma.exe"
Sat 30 Jun 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Sat 30 Jun 2007 401 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv13.bak"
Wed 25 Jun 2008 200,704 ...H. --- "C:\Documents and Settings\mame\Bureau\~WRL0002.tmp"
Wed 12 Mar 2008 58,880 ...H. --- "C:\Documents and Settings\mame\Bureau\~WRL0041.tmp"
Sat 29 Sep 2007 19,968 ...H. --- "C:\Documents and Settings\mame\Bureau\~WRL0447.tmp"
Wed 4 Jun 2008 92,672 ...H. --- "C:\Documents and Settings\mame\Bureau\~WRL1475.tmp"
Sat 29 Sep 2007 20,992 ...H. --- "C:\Documents and Settings\mame\Bureau\~WRL3701.tmp"
Sun 25 Nov 2007 34,816 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL1582.tmp"
Sun 25 Nov 2007 27,648 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL1638.tmp"
Sun 25 Nov 2007 21,504 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL2381.tmp"
Sun 25 Nov 2007 34,304 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL3600.tmp"
Wed 23 Jul 2008 29,696 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL3793.tmp"
Sun 25 Nov 2007 25,600 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL3819.tmp"
Wed 23 Jul 2008 30,208 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL3993.tmp"
Sun 25 Nov 2007 33,792 ...H. --- "C:\Documents and Settings\mame\Mes documents\~WRL4095.tmp"
Sun 22 Jun 2008 4 A..H. --- "C:\PL7\PL7SYS\SERVERS\SERVER.DLL"
Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\BIT1.tmp"
Wed 5 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5d8093d524ba38b2f4036bb4d3aa25e4\BIT1.tmp"
Wed 23 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT3.tmp"
Sun 15 Jun 2008 19,968 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL0087.tmp"
Sat 19 Jul 2008 26,624 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL0165.tmp"
Sat 19 Jul 2008 31,232 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL0338.tmp"
Sat 19 Jul 2008 25,600 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL0618.tmp"
Sat 19 Jul 2008 26,624 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL1840.tmp"
Sat 19 Jul 2008 26,112 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL1959.tmp"
Sat 19 Jul 2008 26,624 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL3518.tmp"
Sat 19 Jul 2008 31,232 ...H. --- "C:\Documents and Settings\mame\Bureau\be_automatique\tp3\~WRL3954.tmp"
Sat 30 Jun 2007 4,348 ...H. --- "C:\Documents and Settings\mame\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Sat 30 Jun 2007 401 A..H. --- "C:\Documents and Settings\mame\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Sat 30 Jun 2007 312 ...H. --- "C:\Documents and Settings\mame\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Sat 30 Jun 2007 1,536 A..H. --- "C:\Documents and Settings\mame\Mes documents\Ma musique\Sauvegarde de la licence\drmv2lic.bak"
Fri 18 Jul 2008 77,312 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\cours jules\dfb\~WRL0954.tmp"
Thu 26 Jun 2008 145,408 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0023.tmp"
Thu 26 Jun 2008 146,944 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0042.tmp"
Mon 21 Jul 2008 410,112 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0185.tmp"
Thu 26 Jun 2008 156,160 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0216.tmp"
Thu 26 Jun 2008 150,016 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0244.tmp"
Thu 26 Jun 2008 146,432 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0411.tmp"
Thu 26 Jun 2008 156,672 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0560.tmp"
Thu 26 Jun 2008 146,432 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0620.tmp"
Mon 21 Jul 2008 410,112 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0851.tmp"
Thu 26 Jun 2008 149,504 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0895.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL0916.tmp"
Thu 26 Jun 2008 145,920 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1024.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1065.tmp"
Thu 26 Jun 2008 155,136 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1094.tmp"
Thu 26 Jun 2008 153,600 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1322.tmp"
Thu 26 Jun 2008 145,920 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1341.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1350.tmp"
Thu 26 Jun 2008 155,648 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1370.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1386.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1405.tmp"
Thu 26 Jun 2008 146,944 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1486.tmp"
Thu 26 Jun 2008 151,040 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1520.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1786.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1859.tmp"
Mon 21 Jul 2008 24,064 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1873.tmp"
Thu 26 Jun 2008 146,432 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1899.tmp"
Mon 21 Jul 2008 409,600 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1915.tmp"
Thu 26 Jun 2008 157,696 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL1930.tmp"
Thu 26 Jun 2008 158,720 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2269.tmp"
Thu 26 Jun 2008 143,872 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2284.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2377.tmp"
Thu 26 Jun 2008 158,720 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2564.tmp"
Thu 26 Jun 2008 153,600 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2606.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2622.tmp"
Thu 26 Jun 2008 147,456 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2647.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2673.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2681.tmp"
Thu 26 Jun 2008 150,016 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2766.tmp"
Thu 26 Jun 2008 148,480 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2796.tmp"
Thu 26 Jun 2008 152,064 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2845.tmp"
Thu 26 Jun 2008 143,360 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2850.tmp"
Mon 21 Jul 2008 409,600 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2877.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL2888.tmp"
Thu 26 Jun 2008 157,696 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3236.tmp"
Thu 26 Jun 2008 145,408 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3280.tmp"
Thu 26 Jun 2008 158,208 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3411.tmp"
Thu 26 Jun 2008 156,672 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3447.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3553.tmp"
Mon 21 Jul 2008 409,600 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3560.tmp"
Thu 26 Jun 2008 146,432 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3585.tmp"
Thu 26 Jun 2008 149,504 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3682.tmp"
Mon 21 Jul 2008 410,112 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3811.tmp"
Mon 21 Jul 2008 409,088 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL3951.tmp"
Thu 26 Jun 2008 146,944 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL4057.tmp"
Mon 21 Jul 2008 408,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\electronikanalogik\BE\umts\~WRL4084.tmp"
Wed 16 Jul 2008 252,416 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0004.tmp"
Thu 17 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0061.tmp"
Fri 18 Jul 2008 519,680 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0115.tmp"
Fri 18 Jul 2008 508,416 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0153.tmp"
Fri 18 Jul 2008 514,560 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0167.tmp"
Fri 18 Jul 2008 509,952 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0191.tmp"
Thu 17 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0370.tmp"
Thu 17 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0425.tmp"
Thu 17 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0490.tmp"
Fri 18 Jul 2008 519,168 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0567.tmp"
Thu 17 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0585.tmp"
Fri 18 Jul 2008 519,680 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0722.tmp"
Fri 18 Jul 2008 472,064 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0780.tmp"
Fri 18 Jul 2008 518,656 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL0818.tmp"
Thu 17 Jul 2008 304,128 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1018.tmp"
Fri 18 Jul 2008 440,832 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1122.tmp"
Fri 18 Jul 2008 491,520 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1293.tmp"
Fri 18 Jul 2008 519,680 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1577.tmp"
Fri 18 Jul 2008 508,416 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1593.tmp"
Fri 18 Jul 2008 380,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1733.tmp"
Fri 18 Jul 2008 440,832 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1803.tmp"
Fri 18 Jul 2008 472,064 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1848.tmp"
Fri 18 Jul 2008 519,680 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1865.tmp"
Fri 18 Jul 2008 518,144 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1875.tmp"
Fri 18 Jul 2008 380,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1943.tmp"
Thu 17 Jul 2008 304,128 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL1981.tmp"
Fri 18 Jul 2008 491,520 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2196.tmp"
Fri 18 Jul 2008 380,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2512.tmp"
Thu 17 Jul 2008 309,760 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2690.tmp"
Fri 18 Jul 2008 491,520 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2699.tmp"
Fri 18 Jul 2008 491,520 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2710.tmp"
Fri 18 Jul 2008 401,920 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2715.tmp"
Fri 18 Jul 2008 509,952 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2732.tmp"
Fri 18 Jul 2008 491,520 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2777.tmp"
Thu 17 Jul 2008 304,128 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2819.tmp"
Fri 18 Jul 2008 518,144 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2879.tmp"
Fri 18 Jul 2008 402,432 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL2889.tmp"
Fri 18 Jul 2008 472,064 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3021.tmp"
Thu 17 Jul 2008 252,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3215.tmp"
Fri 18 Jul 2008 508,416 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3222.tmp"
Fri 18 Jul 2008 518,144 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3479.tmp"
Thu 17 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3501.tmp"
Thu 17 Jul 2008 257,024 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3708.tmp"
Thu 17 Jul 2008 252,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3927.tmp"
Fri 18 Jul 2008 514,560 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3951.tmp"
Fri 18 Jul 2008 509,952 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\asi tp\~WRL3958.tmp"
Fri 18 Jul 2008 116,224 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0002.tmp"
Fri 18 Jul 2008 116,224 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0004.tmp"
Fri 18 Jul 2008 110,592 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0014.tmp"
Fri 18 Jul 2008 179,712 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0082.tmp"
Fri 18 Jul 2008 252,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0102.tmp"
Fri 18 Jul 2008 152,576 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0550.tmp"
Fri 18 Jul 2008 178,176 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0668.tmp"
Fri 18 Jul 2008 291,840 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0714.tmp"
Fri 18 Jul 2008 109,568 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0736.tmp"
Fri 18 Jul 2008 72,192 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL0908.tmp"
Fri 18 Jul 2008 293,888 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL1169.tmp"
Fri 18 Jul 2008 111,104 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL1261.tmp"
Fri 18 Jul 2008 109,568 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL1342.tmp"
Fri 18 Jul 2008 113,152 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL1847.tmp"
Fri 18 Jul 2008 114,176 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL1993.tmp"
Fri 18 Jul 2008 113,664 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2036.tmp"
Fri 18 Jul 2008 111,104 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2117.tmp"
Fri 18 Jul 2008 180,736 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2185.tmp"
Fri 18 Jul 2008 113,152 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2319.tmp"
Fri 18 Jul 2008 112,640 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2379.tmp"
Fri 18 Jul 2008 225,280 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2605.tmp"
Fri 18 Jul 2008 120,832 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2787.tmp"
Fri 18 Jul 2008 109,568 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2791.tmp"
Fri 18 Jul 2008 113,152 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2856.tmp"
Fri 18 Jul 2008 180,736 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2887.tmp"
Fri 18 Jul 2008 72,704 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2907.tmp"
Fri 18 Jul 2008 224,768 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL2974.tmp"
Fri 18 Jul 2008 120,832 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3037.tmp"
Fri 18 Jul 2008 291,840 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3111.tmp"
Fri 18 Jul 2008 252,928 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3120.tmp"
Fri 18 Jul 2008 166,912 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3157.tmp"
Fri 18 Jul 2008 114,176 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3177.tmp"
Fri 18 Jul 2008 115,200 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3211.tmp"
Fri 18 Jul 2008 253,440 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3506.tmp"
Fri 18 Jul 2008 215,552 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3520.tmp"
Fri 18 Jul 2008 115,200 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3533.tmp"
Fri 18 Jul 2008 180,736 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3645.tmp"
Fri 18 Jul 2008 199,168 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL3716.tmp"
Fri 18 Jul 2008 177,664 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL4000.tmp"
Fri 18 Jul 2008 116,736 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL4006.tmp"
Fri 18 Jul 2008 254,464 ...H. --- "C:\Documents and Settings\mame\Bureau\machinelect\regulation autom\be_automatism\ndatte\~WRL4058.tmp"
[b]Finished![/b]
- Télécharge et installe MalwareByte's Anti-Malware :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm
- Mets-le à jour
- Redémarre en mode sans échec (Recommandé) :
https://www.malekal.com/demarrer-windows-mode-sans-echec/
- Choisis ta session habituelle
- Fais un scan complet avec MalwareByte's Anti-Malware
- Supprime tout ce que le logiciel trouve, enregistre le rapport
- Redémarre en mode normal et poste le rapport ici
Tutorial :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm
- Mets-le à jour
- Redémarre en mode sans échec (Recommandé) :
https://www.malekal.com/demarrer-windows-mode-sans-echec/
- Choisis ta session habituelle
- Fais un scan complet avec MalwareByte's Anti-Malware
- Supprime tout ce que le logiciel trouve, enregistre le rapport
- Redémarre en mode normal et poste le rapport ici
Tutorial :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
voici le rapport (cette fois je me suis connecté sans pb)
Malwarebytes' Anti-Malware 1.23
Version de la base de données: 1002
Windows 5.1.2600 Service Pack 2
23:28:40 28/07/2008
mbam-log-7-28-2008 (23-28-40).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 124107
Temps écoulé: 48 minute(s), 12 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 5
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft hardmuscle (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft hardmuscle (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\microsoft hardmuscle (Backdoor.Bot) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kdjfdssdl.com (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\BM2f39896f.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM2f39896f.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
Malwarebytes' Anti-Malware 1.23
Version de la base de données: 1002
Windows 5.1.2600 Service Pack 2
23:28:40 28/07/2008
mbam-log-7-28-2008 (23-28-40).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 124107
Temps écoulé: 48 minute(s), 12 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 5
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft hardmuscle (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsoft hardmuscle (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\microsoft hardmuscle (Backdoor.Bot) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kdjfdssdl.com (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\BM2f39896f.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM2f39896f.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
Je pensais pas que tu étais infecté par Vundo/Virtumonde.
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
slt voici le rapport
ComboFix 08-07-28.4 - mame 2008-07-28 23:55:54.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.73 [GMT 0:00]
Endroit: C:\Documents and Settings\mame\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Invité.NDATTE\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\mame\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bpguqftc.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\ovikxkcc.ini
C:\WINDOWS\system32\rkhejgwn.ini
C:\WINDOWS\system32\sudkgvjq.ini
C:\WINDOWS\system32\UENqBccf.ini
C:\WINDOWS\system32\UENqBccf.ini2
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-28 to 2008-07-29 ))))))))))))))))))))))))))))))))))))
.
2008-07-28 22:34 . 2008-07-28 22:34 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-28 22:34 . 2008-07-28 22:34 <REP> d-------- C:\Documents and Settings\mame\Application Data\Malwarebytes
2008-07-28 22:34 . 2008-07-28 22:34 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-07-28 22:34 . 2008-07-23 20:09 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-07-28 22:34 . 2008-07-23 20:09 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-28 21:25 . 2008-07-28 21:25 <REP> d-------- C:\Program Files\microsoft frontpage
2008-07-28 21:09 . 2008-07-28 21:09 <REP> d-------- C:\WINDOWS\ERUNT
2008-07-28 21:01 . 2008-07-28 21:46 <REP> d-------- C:\SDFix
2008-07-28 17:01 . 2008-07-28 17:01 <REP> d-------- C:\Program Files\Fichiers communs\SWF Studio
2008-07-28 17:00 . 2008-07-28 17:02 <REP> d-------- C:\Documents and Settings\mame\Application Data\U3
2008-07-27 23:00 . 2008-07-27 23:00 <REP> d-------- C:\Program Files\Trend Micro
2008-07-27 14:52 . 2008-07-27 14:52 432,128 -r-hs---- C:\WINDOWS\fatma.exe
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-28 19:32 --------- d-----w C:\Documents and Settings\mame\Application Data\Skype
2008-07-28 16:33 --------- d-----w C:\Documents and Settings\mame\Application Data\skypePM
2008-07-15 23:30 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
2008-06-22 21:53 101,380 ----a-w C:\WINDOWS\system32\cnrqhytl.dll
2008-06-22 18:11 --------- d-----w C:\Program Files\AVG
2008-06-22 15:42 --------- d-----w C:\Program Files\Athan
2008-06-22 15:23 --------- d-----w C:\Program Files\CCleaner
2008-06-22 13:03 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-06-21 11:11 --------- d-----w C:\Program Files\Alwil Software
2008-06-21 11:04 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Avira
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 247,808 ------w C:\WINDOWS\system32\DllCache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\DllCache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\DllCache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\DllCache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\DllCache\tcpip6.sys
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\DllCache\bthport.sys
2008-06-13 18:49 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-06-12 03:40 --------- d-----w C:\Program Files\Java
2008-06-01 19:34 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-05-31 18:29 --------- d-----w C:\Program Files\PSIM
2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\DllCache\rmcast.sys
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:15 1,293,824 ------w C:\WINDOWS\system32\DllCache\quartz.dll
2007-11-30 18:21 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\ezsid.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-01 19:58 68856]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
"diagnostics"="C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" [2007-11-01 12:28 557149]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-01-09 21:59 115816]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogOff"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDElbyCDFL]
--a------ 2002-11-02 06:33 45056 C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a------ 2002-12-02 14:17 73728 C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-12-12 15:20 21686568 C:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-03-25 04:28 144784 C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Thomson\\ST330\\service\\st330service.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys [2002-11-28 10:43]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 23:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 23:16]
R3 Duntlw;UNTLW device;C:\WINDOWS\system32\Drivers\DuntlwNT.sys [2001-03-14 16:40]
S3 ST330;ST330;C:\WINDOWS\system32\drivers\st330.sys [2007-11-01 12:28]
S3 STBUS;STBUS;C:\WINDOWS\system32\drivers\stbus.sys [2007-11-01 12:28]
S3 STETH;SpeedTouch Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\steth.sys [2007-11-01 12:28]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d75ff99-6d01-11dc-8ff9-0002a5675065}]
\Shell\AutoRun\command - E:\fooool.exe
\Shell\explore\Command - E:\fooool.exe
\Shell\open\Command - E:\fooool.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47ff46f2-8f0d-11dc-905b-0018f6661518}]
\Shell\Auto\command - wscript "Sex City.jpg.wsf"
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript "Sex City.jpg.wsf"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{92987ad2-5cc4-11dd-a187-0018f6661518}]
\Shell\AutoRun\command - E:\LaunchU3.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ba129d16-3b6b-11dc-90ac-0002a5675065}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Setup.pif
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dc4e6692-072d-11dd-a057-0018f6661518}]
\Shell\AutoRun\command - h1dwg20.exe
\Shell\explore\Command - h1dwg20.exe
\Shell\open\Command - h1dwg20.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dc4e6693-072d-11dd-a057-0018f6661518}]
\Shell\AutoRun\command - h1dwg20.exe
\Shell\explore\Command - h1dwg20.exe
\Shell\open\Command - h1dwg20.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e41241d2-60ae-11dc-8fdf-0002a5675065}]
\Shell\AutoRun\command - E:\k6wkwon2.exe
\Shell\explore\Command - E:\k6wkwon2.exe
\Shell\open\Command - E:\k6wkwon2.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fb362979-5010-11dd-a159-0018f6661518}]
\Shell\Auto\command - wscript "Sex City.jpg.wsf"
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript "Sex City.jpg.wsf"
.
- - - - ORPHANS REMOVED - - - -
BHO-{0C988A18-A6EA-46D4-93E8-92B25D82B194} - C:\WINDOWS\system32\fccBqNEU.dll
HKU-Default-Run-MicroSoft HardMuscle - kdjfdssdl.com
HKU-Default-RunOnce-MicroSoft HardMuscle - kdjfdssdl.com
Notify-WgaLogon - (no file)
MSConfigStartUp-2c0abaf3 - C:\WINDOWS\system32\cckxkivo.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Search Page = hxxp://www.google.com
R0 -: HKCU-Main,Search Bar = hxxp://www.google.com/ie
R0 -: HKLM-Main,Default_Search_URL = hxxp://www.google.com/ie
R0 -: HKCU-Search,SearchAssistant = hxxp://www.google.com/ie
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
R0 -: HKLM-Search,SearchAssistant = hxxp://www.google.com/ie
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-29 00:05:33
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\st330service]
"ImagePath"="C:\Program Files/Thomson/ST330/service/st330service.exe -service"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Thomson\ST330\service\st330service.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-29 0:20:27 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-29 00:20:10
Pre-Run: 614,633,472 octets libres
Post-Run: 552,263,680 octets libres
186 --- E O F --- 2008-07-10 03:15:51
ps: l'icône d'avast n'est plus sur la barre des taches!
ComboFix 08-07-28.4 - mame 2008-07-28 23:55:54.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.73 [GMT 0:00]
Endroit: C:\Documents and Settings\mame\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Invité.NDATTE\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\mame\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bpguqftc.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\ovikxkcc.ini
C:\WINDOWS\system32\rkhejgwn.ini
C:\WINDOWS\system32\sudkgvjq.ini
C:\WINDOWS\system32\UENqBccf.ini
C:\WINDOWS\system32\UENqBccf.ini2
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-28 to 2008-07-29 ))))))))))))))))))))))))))))))))))))
.
2008-07-28 22:34 . 2008-07-28 22:34 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-28 22:34 . 2008-07-28 22:34 <REP> d-------- C:\Documents and Settings\mame\Application Data\Malwarebytes
2008-07-28 22:34 . 2008-07-28 22:34 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-07-28 22:34 . 2008-07-23 20:09 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-07-28 22:34 . 2008-07-23 20:09 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-28 21:25 . 2008-07-28 21:25 <REP> d-------- C:\Program Files\microsoft frontpage
2008-07-28 21:09 . 2008-07-28 21:09 <REP> d-------- C:\WINDOWS\ERUNT
2008-07-28 21:01 . 2008-07-28 21:46 <REP> d-------- C:\SDFix
2008-07-28 17:01 . 2008-07-28 17:01 <REP> d-------- C:\Program Files\Fichiers communs\SWF Studio
2008-07-28 17:00 . 2008-07-28 17:02 <REP> d-------- C:\Documents and Settings\mame\Application Data\U3
2008-07-27 23:00 . 2008-07-27 23:00 <REP> d-------- C:\Program Files\Trend Micro
2008-07-27 14:52 . 2008-07-27 14:52 432,128 -r-hs---- C:\WINDOWS\fatma.exe
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-28 19:32 --------- d-----w C:\Documents and Settings\mame\Application Data\Skype
2008-07-28 16:33 --------- d-----w C:\Documents and Settings\mame\Application Data\skypePM
2008-07-15 23:30 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
2008-06-22 21:53 101,380 ----a-w C:\WINDOWS\system32\cnrqhytl.dll
2008-06-22 18:11 --------- d-----w C:\Program Files\AVG
2008-06-22 15:42 --------- d-----w C:\Program Files\Athan
2008-06-22 15:23 --------- d-----w C:\Program Files\CCleaner
2008-06-22 13:03 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-06-21 11:11 --------- d-----w C:\Program Files\Alwil Software
2008-06-21 11:04 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Avira
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 247,808 ------w C:\WINDOWS\system32\DllCache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\DllCache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\DllCache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\DllCache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\DllCache\tcpip6.sys
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\DllCache\bthport.sys
2008-06-13 18:49 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-06-12 03:40 --------- d-----w C:\Program Files\Java
2008-06-01 19:34 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-05-31 18:29 --------- d-----w C:\Program Files\PSIM
2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\DllCache\rmcast.sys
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:15 1,293,824 ------w C:\WINDOWS\system32\DllCache\quartz.dll
2007-11-30 18:21 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\ezsid.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-01 19:58 68856]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
"diagnostics"="C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" [2007-11-01 12:28 557149]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-01-09 21:59 115816]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogOff"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDElbyCDFL]
--a------ 2002-11-02 06:33 45056 C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a------ 2002-12-02 14:17 73728 C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-12-12 15:20 21686568 C:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-03-25 04:28 144784 C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Thomson\\ST330\\service\\st330service.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys [2002-11-28 10:43]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 23:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 23:16]
R3 Duntlw;UNTLW device;C:\WINDOWS\system32\Drivers\DuntlwNT.sys [2001-03-14 16:40]
S3 ST330;ST330;C:\WINDOWS\system32\drivers\st330.sys [2007-11-01 12:28]
S3 STBUS;STBUS;C:\WINDOWS\system32\drivers\stbus.sys [2007-11-01 12:28]
S3 STETH;SpeedTouch Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\steth.sys [2007-11-01 12:28]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d75ff99-6d01-11dc-8ff9-0002a5675065}]
\Shell\AutoRun\command - E:\fooool.exe
\Shell\explore\Command - E:\fooool.exe
\Shell\open\Command - E:\fooool.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47ff46f2-8f0d-11dc-905b-0018f6661518}]
\Shell\Auto\command - wscript "Sex City.jpg.wsf"
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript "Sex City.jpg.wsf"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{92987ad2-5cc4-11dd-a187-0018f6661518}]
\Shell\AutoRun\command - E:\LaunchU3.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ba129d16-3b6b-11dc-90ac-0002a5675065}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Setup.pif
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dc4e6692-072d-11dd-a057-0018f6661518}]
\Shell\AutoRun\command - h1dwg20.exe
\Shell\explore\Command - h1dwg20.exe
\Shell\open\Command - h1dwg20.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dc4e6693-072d-11dd-a057-0018f6661518}]
\Shell\AutoRun\command - h1dwg20.exe
\Shell\explore\Command - h1dwg20.exe
\Shell\open\Command - h1dwg20.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e41241d2-60ae-11dc-8fdf-0002a5675065}]
\Shell\AutoRun\command - E:\k6wkwon2.exe
\Shell\explore\Command - E:\k6wkwon2.exe
\Shell\open\Command - E:\k6wkwon2.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fb362979-5010-11dd-a159-0018f6661518}]
\Shell\Auto\command - wscript "Sex City.jpg.wsf"
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript "Sex City.jpg.wsf"
.
- - - - ORPHANS REMOVED - - - -
BHO-{0C988A18-A6EA-46D4-93E8-92B25D82B194} - C:\WINDOWS\system32\fccBqNEU.dll
HKU-Default-Run-MicroSoft HardMuscle - kdjfdssdl.com
HKU-Default-RunOnce-MicroSoft HardMuscle - kdjfdssdl.com
Notify-WgaLogon - (no file)
MSConfigStartUp-2c0abaf3 - C:\WINDOWS\system32\cckxkivo.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Search Page = hxxp://www.google.com
R0 -: HKCU-Main,Search Bar = hxxp://www.google.com/ie
R0 -: HKLM-Main,Default_Search_URL = hxxp://www.google.com/ie
R0 -: HKCU-Search,SearchAssistant = hxxp://www.google.com/ie
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
R0 -: HKLM-Search,SearchAssistant = hxxp://www.google.com/ie
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-29 00:05:33
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\st330service]
"ImagePath"="C:\Program Files/Thomson/ST330/service/st330service.exe -service"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Thomson\ST330\service\st330service.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-29 0:20:27 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-29 00:20:10
Pre-Run: 614,633,472 octets libres
Post-Run: 552,263,680 octets libres
186 --- E O F --- 2008-07-10 03:15:51
ps: l'icône d'avast n'est plus sur la barre des taches!
Ton lecteur E, il correspond à quoi dans le poste de travail ?
Avast et Norton ne sont pas super comme antivirus. Déjà, à la base, il ne faut pas en avoir plusieurs.
Je te conseille de les désinstaller et d'installer Antivir à la place. Par contre, il est en anglais mais simple d'utilisation et très efficace.
Que décides-tu ?
Avast et Norton ne sont pas super comme antivirus. Déjà, à la base, il ne faut pas en avoir plusieurs.
Je te conseille de les désinstaller et d'installer Antivir à la place. Par contre, il est en anglais mais simple d'utilisation et très efficace.
Que décides-tu ?
Le rapport HijackThis montre que Norton est présent, ComboFix montre que le lecteur E a été infecté.
Pourquoi tu n'aimes pas Antivir ?
Pour l'icône, je pense qu'en redémarrant le PC, elle reviendra.
Pourquoi tu n'aimes pas Antivir ?
Pour l'icône, je pense qu'en redémarrant le PC, elle reviendra.
"par ailleurs pour Antivir c pas que j'aime pas mais pour moi il sont tous pareils suffit juste de les mettre à jour!"
---> Retire cette idée de ta tête :
https://forum.malekal.com/viewtopic.php?f=45&t=11659
---> Utilise ceci pour supprimer complètement Norton :
ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe
As-tu ta clé infectée ?
---> Retire cette idée de ta tête :
https://forum.malekal.com/viewtopic.php?f=45&t=11659
---> Utilise ceci pour supprimer complètement Norton :
ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe
As-tu ta clé infectée ?
---> Télécharge le fichier CFScript et enregistre-le sur ton bureau :
http://www.zshare.net/
---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
[*] Une fenêtre bleue va apparaître : au message qui apparaît (Type 1 to continue, or 2 to abort), tape 1 puis valide.
[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
[*] Une fois le scan achevé, un rapport va s'afficher : poste-le
[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt
http://www.zshare.net/
---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
[*] Une fenêtre bleue va apparaître : au message qui apparaît (Type 1 to continue, or 2 to abort), tape 1 puis valide.
[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
[*] Une fois le scan achevé, un rapport va s'afficher : poste-le
[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt
voici le rapport que tu m'as demandé:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:01:08, on 27/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Thomson\ST330\service\st330service.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\webserver\bin\win32\matlabserver.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe, explorer.exe
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0C988A18-A6EA-46D4-93E8-92B25D82B194} - C:\WINDOWS\system32\fccBqNEU.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {4E06327D-0415-475F-898B-6ACFB316073E} - C:\WINDOWS\system32\fccaAQHb.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MSN] C:\Windows\fatma.exe
O4 - HKLM\..\Run: [MicroSoft HardMuscle] kdjfdssdl.com
O4 - HKLM\..\RunServices: [MicroSoft HardMuscle] kdjfdssdl.com
O4 - HKLM\..\RunOnce: [MicroSoft HardMuscle] kdjfdssdl.com
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [MicroSoft HardMuscle] kdjfdssdl.com
O4 - HKCU\..\RunOnce: [MicroSoft HardMuscle] kdjfdssdl.com
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [MicroSoft HardMuscle] kdjfdssdl.com (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [MicroSoft HardMuscle] kdjfdssdl.com (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{E68A3AC3-58C5-44D4-86BD-D240F6DD6F9A}: NameServer = 213.154.64.13 213.154.95.126
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: fccaAQHb - fccaAQHb.dll (file missing)
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\\webserver\bin\win32\matlabserver.exe
O23 - Service: Moon Secure Antivirus Core (msav) - Unknown owner - C:\Program Files\Moon Secure Antivirus\msavcore.exe (file missing)
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe