Trojan-Spy.Win32.KeyLogger.aa

Question

Bonjour,

Je possède avast comme antivirus et apparemment il ne détecte pas ces virus car c'est le centre de sécurité de Windows qui me les a notifiés. Voici les noms que j'ai notés:

Trojan-Spy.Win32.KeyLogger.aa
Trojan-Spy.win32.Greenscreen
Trojan-Spy.HTML.Bankfrau.dq

Je n'arrive donc pas à m'en débarasser puisque avast ne les détecte pas... Quelqu'un pourrait m'aider? Je panique un peu au vu de la description donnée par le portail de sécurité windows: envoi d'informations à un PC distant comme mots de passe, paiements sécurisés, transactions bancaires.

Merci pour votre aide.

Utilisateur anonyme · Answer

lu,

fait un scan en ligne avec internet explore, si tu as firefox fait: 
démarrer -> executer -> tape : iexplore (puis valide) 

(coche toutes les cases à chaque fois) : 
https://www.eset.com/ 

à la fin colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt 

si ta besoin d'aide tu as un tutoriel ici : 
http://bibou0007.com/scans-en-ligne-f75/tutorial-nod32-online-scanner-t128.htm

andy8 · Answer

Merci d'avoir répondu et de m'aider, voici le rapport:

# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3350 (20080812)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=823ec1e57318964190edb3d7ec8c5a86
# end=finished
# remove_checked=true
# unwanted_checked=true
# utc_time=2008-08-12 08:21:50
# local_time=2008-08-12 10:21:50 (+0100, Paris, Madrid (heure d'été))
# country="France"
# osver=5.1.2600 NT Service Pack 2
# scanned=253489
# found=23
# scan_time=1462
C:\WINDOWS	fnslopk.dll	Win32/Adware.Vapsup.AS application (unable to clean - deleted)	00000000000000000000000000000000
C:\WINDOWS\system32	gnwhgvs.exe	a variant of Win32/TrojanDownloader.FakeAlert.BP trojan (unable to clean - deleted (after the next restart))	00000000000000000000000000000000
C:\Documents and Settings\All Users\Application Datawhknejo\futcjkvg.exe	a variant of Win32/TrojanDownloader.FakeAlert.BP trojan (unable to clean - deleted (after the next restart))	00000000000000000000000000000000
C:\Documents and Settingsolando\Local Settings\Temp\WINXP_~1.EXE.bak	a variant of Win32/TrojanDownloader.FakeAlert.BP trojan (unable to clean - deleted)	00000000000000000000000000000000
C:\Documents and Settingsolando\Local Settings\Tempemovalfile.bat	Win32/Adware.Virtumonde application (unable to clean - deleted)	00000000000000000000000000000000
C:\Documents and Settingsolando\Local Settings\Temporary Internet Files\Content.IE5\CD1QW99X\WJUob2HVd5[1].exe	a variant of Win32/TrojanDownloader.FakeAlert.BP trojan (unable to clean - deleted)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-15e51117.zip	multiple infiltrations (deleted)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-15e51117.zip »ZIP »BaaaaBaa.class	a variant of Java/ClassLoader trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-15e51117.zip »ZIP »VaaaaaaaBaa.class	a variant of Java/ClassLoader trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-15e51117.zip »ZIP »Dvnny.class	Java/Exploit.Bytverify trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-15e51117.zip »ZIP »Baaaaa.class	Java/ClassLoader.AO trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-15e51117.zip »ZIP »Dex.class	Java/Exploit.Bytverify trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-15e51117.zip »ZIP »Dix.class	Java/Exploit.Bytverify trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-15e51117.zip »ZIP »Dux.class	Java/Exploit.Bytverify trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\6.0\20\7328ad54-5d366951	multiple infiltrations (deleted)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\6.0\20\7328ad54-5d366951 »ZIP »BaaaaBaa.class	a variant of Java/ClassLoader trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\6.0\20\7328ad54-5d366951 »ZIP »VaaaaaaaBaa.class	a variant of Java/ClassLoader trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\6.0\20\7328ad54-5d366951 »ZIP »Dvnny.class	Java/Exploit.Bytverify trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\6.0\20\7328ad54-5d366951 »ZIP »Baaaaa.class	Java/ClassLoader.AO trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\6.0\20\7328ad54-5d366951 »ZIP »Dex.class	Java/Exploit.Bytverify trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\6.0\20\7328ad54-5d366951 »ZIP »Dix.class	Java/Exploit.Bytverify trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Documents and Settingsolando\Application Data\Sun\Java\Deployment\cache\6.0\20\7328ad54-5d366951 »ZIP »Dux.class	Java/Exploit.Bytverify trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object)	00000000000000000000000000000000
C:\Program Files\WinAntiSpyware 2006 Scanner\uwasffNT.exe	Win32/Adware.WinAntiSpyware application (unable to clean - deleted)	00000000000000000000000000000000

andy8 · Answer

Dans le rapport, je ne vois pas qu'il a détecté le virus qui a été posté en objet, ni les autres dans mon message initial.
Est-ce normal?

mido · Answer

andy8,

Pour continuer la vérification.
Télécharger HijackThis v2.0.2 : http://www.trendsecure.com/portal/en-US/tools/security_tools­/hijackthis/download
Créez et poster un rapport HijackThis.

Tutoriel HijackThis : http://www.infos-du-net.com/forum/271838-11-tuto-utiliser-hi­jackthis

mido · Answer

re,


EDIT:

Le lien pour télécharger HijackTjhis sur le post précédant semble ne pas fonctionner.

Télécharger Hijacthis : http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

andy8 · Answer

Voici ce que me donne Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:38:03, on 13/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Belgacom\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.be/0SEFRBE/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr-be\msntb.dll
O3 - Toolbar: bgrqfetx - {892B88A3-DC94-4A1F-A75A-9AA50061A683} - C:\WINDOWS\bgrqfetx.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Belgacom] "C:\Program Files\Belgacom\bin\sprtcmd.exe" /P Belgacom
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [\Win54.exe] C:\Windows\system32\Win54.exe
O4 - HKLM\..\Run: [\Win55.exe] C:\Windows\system32\Win55.exe
O4 - HKLM\..\Run: [\Win56.exe] C:\Windows\system32\Win56.exe
O4 - HKLM\..\Run: [\Win57.exe] C:\Windows\system32\Win57.exe
O4 - HKLM\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKLM\..\Run: [1b71125a] rundll32.exe "C:\WINDOWS\system32\sppmrehc.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [\Win54.exe] C:\Windows\system32\Win54.exe
O4 - HKCU\..\Run: [\Win55.exe] C:\Windows\system32\Win55.exe
O4 - HKCU\..\Run: [\Win56.exe] C:\Windows\system32\Win56.exe
O4 - HKCU\..\Run: [\Win57.exe] C:\Windows\system32\Win57.exe
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKCU\..\Run: [sysdsc] C:\WINDOWS\system32	gnwhgvs.exe
O4 - HKLM\..\Policies\Explorer\Run: [MHKiJZQ5m8] C:\Documents and Settings\All Users\Application Datawhknejo\futcjkvg.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
O16 - DPF: {56E4B9EB-4C79-4568-A19E-72794FA70060} (PatsShellOCX Control) - http://www.futuresplatform.com/SunJVMPatsFiles6_1/pats.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://belgacom.extrafilm.be/ImageUploader4.cab
O16 - DPF: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} (Image Uploader) - http://belgacom.extrafilm.be/ImageUploader4.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A8CE9664-67EB-4B2F-AA6B-A72E4128EEC4}: NameServer = 195.238.2.22 195.238.2.21
O22 - SharedTaskScheduler: articulation - {8dc1f789-e073-4363-b40d-07376bc5ecc5} - C:\WINDOWS\system32\hzclqhc.dll (file missing)
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Password Validation (ccPwdSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Unknown owner - C:\Program Files\Norton AntiVirus
avapsvc.exe (file missing)
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Unknown owner - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Unknown owner - C:\Program Files\Norton AntiVirus\SAVScan.exe (file missing)
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)

andy8 · Answer

C'est bon ce que j'ai fait? Parce que ca a été assez vite quand même. 

En plus, maintenant j'ai toujours une fenêtre antivirus 2009 qui apparaît... pour me demander d'installer l'antivirus. J'avais déjà eu avant vista antivirus 2008 que j'avais réussi à enlever...

mido · Answer

andy8,

Telecharger malwarebytes :  http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Installer / màj, lancer un scan complet et supprimer toute les infections trouvés.
Afficher le rapport

Tutoriel malwarebytes : http://www.pcinfo-web.com/...

___________________________________

Désactiver votre antivirus.
Télécharger ComboFix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Cliquez sur le bouton Enregistrer, puis lorsqu'il vous est demandé à quel emplacement l'enregistrer, assurez-vous de l'enregistrer directement sur votre Bureau Windows.

Déconnecter vous d'internet et fermez tous les programme et fenêtres.

Faites un double clic sur l'icône de ComboFix située sur le Bureau. Notez bien que, une fois que vous avez lancé ComboFix, vous ne devez pas cliquer dans la fenêtre de ComboFix car cela pourrait entraîner un plantage du programme. En fait, lorsque ComboFix tourne, ne touchez plus du tout à votre ordinateur; reposez-vous pendant qu'il travaille, cela pourrait prendre un certain temps avant qu'il ait fini.

ComboFix va ensuite commencer à balayer votre ordinateur à la recherche d'infections connues. Cette procédure peut prendre un certain temps, soyez patient.

Si vous voyez votre Bureau Windows disparaître, ne vous inquiétez pas. C'est normal, et ComboFix restaurera votre Bureau avant de se terminer. Finalement, vous verrez un nouvel affichage déclarant que le programme a presque fini et vous annonçant que le fichier rapport, ou log, se trouvera dans C:\ComboFix.txt.

Lorsque ComboFix aura terminé il affichera automatiquement le fichier log .

Afficher ce rapport dans votre prochain post.

Réactiver votre antivirus.

Tutoriel ComboFix : 
Ne vous occupez pas de l'Installation de la console de récupération, continuer le tuto
(ne pas tenir compte de l'installation de la console de récupération)

mido · Answer

re,

Si nécessaire.
Tutoriel ComboFix : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

andy8 · Answer

En tout cas merci pour votre aide!

Voici le rapport pour Malwarebytes:

Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1047
Windows 5.1.2600 Service Pack 2

11:02:22 13/08/2008
mbam-log-8-13-2008 (11-02-22).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 97823
Temps écoulé: 22 minute(s), 17 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 4
Clé(s) du Registre infectée(s): 55
Valeur(s) du Registre infectée(s): 14
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 7
Fichier(s) infecté(s): 108

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\opnnoljJ.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\sppmrehc.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32	uvSjKAp.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\kdtixv.dll (Trojan.Vundo) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87872511-41bf-4933-8247-d4a6af692e9b} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{87872511-41bf-4933-8247-d4a6af692e9b} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e305b34e-ec6b-4517-a8c4-671c9b3e319b} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e305b34e-ec6b-4517-a8c4-671c9b3e319b} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6d24f3a0-a7b9-4482-9b3b-b57ec75dace6} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d24f3a0-a7b9-4482-9b3b-b57ec75dace6} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	uvsjkap (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{54645654-2225-4455-44a1-9f4543d34545} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c7f15e1-f31a-44fd-aa1a-2ec63aaffd3a} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{73364d99-1240-4dff-b12a-67e448373148} (Spyware.Bzub) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{73364d99-1240-4dff-b12a-67e448373148} (Spyware.Bzub) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	dssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE	dss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services	dssserv (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER	ypelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Servicesdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{20e1148b-a9db-4678-82ab-e3e72b0f2959} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4c6b1408-fc27-4864-9b5d-f70a93a789c4} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{892b88a3-dc94-4a1f-a75a-9aa50061a683} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bgrqfetx.bolb (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bgrqfetx.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1b71125a (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d24f3a0-a7b9-4482-9b3b-b57ec75dace6} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win54.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win55.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win56.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win57.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win54.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win55.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win56.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win57.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{892b88a3-dc94-4a1f-a75a-9aa50061a683} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\opnnoljj -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\opnnoljj  -> Delete on reboot.

Dossier(s) infecté(s):
C:\Program Files\WinAntiSpyware 2006 Scanner (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.
C:\Program Files\WinAntiSpyware 2006 Scanner\database (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.
C:\WINDOWS\mslagent (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Program Files\akl (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\Inet Delivery (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\opnnoljJ.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\Jjlonnpo.ini (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\Jjlonnpo.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kdtixv.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\sppmrehc.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\chermpps.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	uvSjKAp.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\lthxdate.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\urqRkHyy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\eetqdwkf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vxhtma.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settingsolando\Local Settings\Temporary Internet Files\Content.IE5\594E21S9\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settingsolando\Local Settings\Temporary Internet Files\Content.IE5\10GV78B1\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settingsolando\Local Settings\Temporary Internet Files\Content.IE5\F6A6Q8G9\cntr[1].gif (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settingsolando\Local Settings\Temporary Internet Files\Content.IE5\F7YWBCOU\ico[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\0.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\3.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\4.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\5.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\7.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\WinAntiSpyware 2006 Scanner\database\quaratine.dat (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.
C:\Program Files\WinAntiSpyware 2006 Scanner\database\RTMonitor.dat (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.
C:\WINDOWS\mslagent\2_mslagent.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\mslagent\mslagent.exe (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\mslagent\uninstall.exe (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Program Files\akl\akl.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\akl\akl.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\akl\uninstall.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\akl\unsetup.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\1.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sex1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sex2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\Inet Delivery\inetdl.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Program Files\Inet Delivery\intdel.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sex2.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sex1.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vav.cpl (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	dssl.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssmain.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	dssinit.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	dsslog.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	dssservers.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers	dssserv.sys (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\a.bat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\base64.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\FVProtect.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\userconfig9x.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\winsystem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zip1.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zip2.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zip3.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\zipped.tmp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\iTunesMusic.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\akttzn.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\anticipator.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\awtoolb.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bsva-egihsg52.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dpcproxy.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\emesx.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hoproxy.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hxiwlgpm.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hxiwlgpm.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\medup012.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\medup020.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msgp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msnbho.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mtr2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mwin32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
etode.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
ewsd32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ps1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\psof1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\psoft1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32egc64.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32egm64.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Rundl1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sncntr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssurf022.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssvchost.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sysreq.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	aack.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	aack.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	emp#01.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	hun.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	hun32.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\VBIEWER.OCX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vcatchpi.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winlogonpc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winsystem.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WINWGPX.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Default Useresults.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vbsys2.dll (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\WINDOWS\bgrqfetx.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settingsolandoesults.txt (Malware.Trace) -> Quarantined and deleted successfully.


Maintenant je m'occupe de combofix...

andy8 · Answer

Et voici maintenant le rapport de combofix:

ComboFix 08-08-12.01 - rolando 2008-08-13 11:26:59.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.200 [GMT 2:00]
Endroit: C:\Documents and Settings\rolando\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\erwfkakj.ini
C:\WINDOWS\system32\Jjlonnpo.ini
C:\WINDOWS\system32\Jjlonnpo.ini2
C:\WINDOWS\system32\opnnoljJ.dll
C:\WINDOWS\system32\tuvSjKAp.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-13 to 2008-08-13 ))))))))))))))))))))))))))))))))))))
.

2008-08-13 10:32 . 2008-08-13 10:32 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-13 10:32 . 2008-08-13 10:32 <REP> d-------- C:\Documents and Settings\rolando\Application Data\Malwarebytes
2008-08-13 10:32 . 2008-08-13 10:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-13 10:32 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-13 10:32 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-13 09:36 . 2008-08-13 09:36 <REP> d-------- C:\Program Files\Trend Micro
2008-08-12 21:52 . 2008-08-12 21:52 <REP> d-------- C:\Program Files\EsetOnlineScanner
2008-08-12 15:55 . 2008-08-12 15:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\rwhknejo

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:45 360,320 ------w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-20 09:52 225,920 ------w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-14 16:03 --------- d-----w C:\Program Files\Apple Software Update
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 05:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"preload"="C:\Windows\RUNXMLPL.exe" [2005-05-19 17:09 32768]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-23 10:36 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-23 10:31 126976]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-04 11:12 102490]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-04 11:11 708698]
"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-06-01 14:17 192512]
"ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-03-15 10:03 2893824]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 05:00 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 05:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 05:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 05:00 455168]
"PCMService"="C:\Program Files\Arcade\PCMService.exe" [2005-03-09 18:59 49152]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-07-25 13:36 32768]
"PowerKey"="C:\Program Files\Launch Manager\PowerKey.exe" [2002-08-30 15:02 94208]
"LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2005-06-06 11:52 69632]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 14:28 20480]
"LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2005-07-25 10:45 241664]
"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2005-07-25 13:34 81920]
"eRecoveryService"="C:\Program Files\Acer\eRecovery\Monitor.exe" [2005-06-29 17:26 352256]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
"Belgacom"="C:\Program Files\Belgacom\bin\sprtcmd.exe" [2006-06-22 09:34 192512]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 05:00 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\MSMSGS.EXE"=
"C:\\Program Files\\HP\\Digital Imaging\\BIN\\hpqSTE08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\BIN\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\BIN\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\BIN\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\BIN\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\BIN\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\BIN\\hpoews01.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 11:27]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2004-07-19 13:10]
R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-07 18:08]
R2 int15.sys;int15.sys;C:\Program Files\Acer\eRecovery\int15.sys [2005-01-13 14:46]
R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-03-04 16:37]
R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14 15:57]
R3 POWERKEY;POWERKEY;C:\Program Files\Launch Manager\POWERKEY.sys [2000-12-19 18:29]
S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

2008-08-08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-msnmsgr - C:\Program Files\MSN Messenger\msnmsgr.exe
HKCU-Run-sysdsc - C:\WINDOWS\system32\tgnwhgvs.exe
HKLM-Run-Antivirus - C:\Program Files\VAV\vav.exe
HKLM-Explorer_Run-MHKiJZQ5m8 - C:\Documents and Settings\All Users\Application Data\rwhknejo\futcjkvg.exe
SharedTaskScheduler-{8dc1f789-e073-4363-b40d-07376bc5ecc5} - C:\WINDOWS\system32\hzclqhc.dll

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.be/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

O16 -: {56E4B9EB-4C79-4568-A19E-72794FA70060} - hxxp://www.futuresplatform.com/SunJVMPatsFiles6_1/pats.cab
C:\WINDOWS\Downloaded Program Files\PatsShellOCXProj.ocx

O16 -: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} - hxxp://belgacom.extrafilm.be/ImageUploader4.cab
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ImageUploader4.inf
C:\WINDOWS\system32\unicows.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ImageUploader4.ocx

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-13 11:34:28
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\ACER\EMANAGER\ANBMSERV.EXE
C:\PROGRAM FILES\FICHIERS COMMUNS\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE
C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE
C:\WINDOWS\SYSTEM32\HPZIPM12.EXE
C:\WINDOWS\SYSTEM32\WDFMGR.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\PROGRAM FILES\SONY CORPORATION\IMAGE TRANSFER\SONYTRAY.EXE
C:\PROGRAM FILES\ADOBE\ACROBAT 7.0\READER\READER_SL.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-13 11:37:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-13 09:37:22

Pre-Run: 4,293,361,664 octets libres
Post-Run: 5,346,639,872 octets libres

162 --- E O F --- 2008-07-23 21:15:58

andy8 · Answer

Le problème est résolu? Je ne dois plus rien faire maintenant?

andy8 · Answer

Il n'y a plus personne pour m'aider??  :-(

En tout cas le centre de sécurité windows ne fait plus d'annonce d'infection... C'est bon signe, non? Comment être sûr qu'il n'y a plus rien?

andy8 · Answer

J'ai téléchargé en plus spybot, voici le rapport, est-ce que cela veut dire qu'il n'y a plus d'infection?


--- Search result list ---
Hint of the Day: Click the bar at the right of this to see more information! ()
  

Félicitations!: Aucun mouchard n'a été trouvé. ()
  


--- Spybot - Search & Destroy version: 1.6.0  (build: 20080707) ---

2006-06-18 unins000.exe (51.41.0.0)
2008-08-13 unins001.exe (51.49.0.0)
2008-07-07 blindman.exe (1.0.0.8)
2008-07-07 SDMain.exe (1.0.0.6)
2008-07-07 SDWinSec.exe (1.0.0.12)
2008-07-07 Update.exe (1.6.0.7)
2008-07-07 SDUpdate.exe (1.6.0.8)
2008-07-07 SpybotSD.exe (1.6.0.30)
2008-07-07 TeaTimer.exe (1.6.0.20)
2008-07-07 SDFiles.exe (1.6.0.4)
2008-07-07 SDShred.exe (1.0.2.3)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2008-07-07 advcheck.dll (1.6.1.12)
2008-07-07 SDHelper.dll (1.6.0.12)
2008-07-07 Tools.dll (2.1.5.7)
2008-06-14 DelZip179.dll (1.79.11.1)
2007-04-02 aports.dll (2.1.0.0)
2008-06-19 sqlite3.dll
2007-11-07 Includes\Revision.sbi (*)
2008-06-03 Includes\Cookies.sbi (*)
2008-06-03 Includes\Dialer.sbi (*)
2008-07-23 Includes\HeavyDuty.sbi (*)
2008-07-30 Includes\Hijackers.sbi (*)
2008-08-05 Includes\Keyloggers.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2008-08-05 Includes\Malware.sbi (*)
2008-08-05 Includes\PUPS.sbi (*)
2008-06-18 Includes\Security.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-08-12 Includes\Spyware.sbi (*)
2008-08-05 Includes\Adware.sbi (*)
2008-06-03 Includes\Tracks.uti
2008-08-05 Includes\Trojans.sbi (*)
2008-08-05 Includes\DialerC.sbi (*)
2008-08-12 Includes\HijackersC.sbi (*)
2008-08-12 Includes\KeyloggersC.sbi (*)
2008-08-12 Includes\MalwareC.sbi (*)
2008-08-12 Includes\PUPSC.sbi (*)
2008-08-12 Includes\SecurityC.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2008-08-12 Includes\SpywareC.sbi (*)
2008-08-12 Includes\AdwareC.sbi (*)
2008-08-12 Includes\TrojansC.sbi (*)
2007-12-24 Plugins\TCPIPAddress.dll
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll



--- System information ---
Windows XP (Build: 2600) Service Pack 2 (5.1.2600)
 / .NETFramework / 1.1: Microsoft .NET Framework 1.1 Hotfix (KB928366)
 / .NETFramework / 1.1: Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
 / MSXML4SP2: FIX: ASP stops responding when calling Response.Redirect to another server using msxml4 sp2
 / MSXML4SP2: Security update for MSXML4 SP2 (KB936181)
 / Windows / SP1: Microsoft Internationalized Domain Names Mitigation APIs
 / Windows / SP1: Microsoft National Language Support Downlevel APIs
 / Windows Media Player 10: Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)
 / Windows Media Player 10: Mise à jour de sécurité pour Lecteur Windows Media 10 (KB936782)
 / Windows Media Player 6.4: Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)
 / Windows XP: Mise à jour de sécurité pour Windows XP (KB923689)
 / Windows XP: Mise à jour de sécurité pour Windows XP (KB941569)
 / Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)
 / Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)
 / Windows XP / SP0: Correctif pour Windows Internet Explorer 7 (KB947864)
 / Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)
 / Windows XP / SP3: Correctif Windows XP - KB873339
 / Windows XP / SP3: Correctif Windows XP - KB885835
 / Windows XP / SP3: Correctif Windows XP - KB885836
 / Windows XP / SP3: Correctif Windows XP - KB886185
 / Windows XP / SP3: Correctif Windows XP - KB887472
 / Windows XP / SP3: Correctif Windows XP - KB888302
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB890046)
 / Windows XP / SP3: Correctif Windows XP - KB890859
 / Windows XP / SP3: Correctif Windows XP - KB891781
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB893756)
 / Windows XP / SP3: Windows Installer 3.1 (KB893803)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB894391)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896358)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896423)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896428)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB898461)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB899587)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB899591)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB900485)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB900725)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB901017)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB901190)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB901214)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB902400)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB904706)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB904942)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB905414)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB905749)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB908519)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB908531)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB910437)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB911280)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB911562)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB911927)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB913580)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB914388)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB914389)
 / Windows XP / SP3: Correctif pour Windows XP (KB914440)
 / Windows XP / SP3: Hotfix for Windows XP (KB915865)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB916595)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB917344)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB917953)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB918118)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB918439)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB919007)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB920213)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB920670)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB920683)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB920685)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB920872)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB921503)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB922582)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB922819)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB923191)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB923414)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB923980)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB924191)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB924270)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB924496)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB924667)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB925902)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB926255)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB926436)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB927779)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB927802)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB927891)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB928255)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB928843)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB929123)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB929969)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB930178)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB930916)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB931261)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB931784)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB931836)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB932168)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB932823-v3)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB933360)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB933566)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB933729)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB935839)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB935840)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB936021)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB936357)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB937143)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB938127)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB938828)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB938829)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB939653)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB941202)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB941568)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB941644)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB941693)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB942615)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB942763)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB942840)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB943055)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB943460)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB943485)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB944338)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB944533)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB944653)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB945553)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB946026)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB946627)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB947864)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB948590)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB948881)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB950749)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB950760)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB950762)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB951376)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB951376-v2)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB951698)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB951748)


--- Startup entries list ---
Located: HK_LM:Run, Belgacom
command: "C:\Program Files\Belgacom\bin\sprtcmd.exe" /P Belgacom
   file: C:\Program Files\Belgacom\bin\sprtcmd.exe
   size: 192512
    MD5: D1AFE3F4ABFF8A6210D71265EE213CF5

Located: HK_LM:Run, CtrlVol
command: "C:\Program Files\Launch Manager\CtrlVol.exe"
   file: C:\Program Files\Launch Manager\CtrlVol.exe
   size: 20480
    MD5: 9660245A1D3D56DF388F7F68A19CFE14

Located: HK_LM:Run, EPM-DM
command: c:\acer\epm\epm-dm.exe
   file: c:\acer\epm\epm-dm.exe
   size: 192512
    MD5: C1CCD2C438A18C40CD634468757AF1B7

Located: HK_LM:Run, ePowerManagement
command: C:\Acer\ePM\ePM.exe boot
   file: C:\Acer\ePM\ePM.exe
   size: 2893824
    MD5: 5BD7AC79525975A097196891B4FD7170

Located: HK_LM:Run, eRecoveryService
command: C:\Program Files\Acer\eRecovery\Monitor.exe
   file: C:\Program Files\Acer\eRecovery\Monitor.exe
   size: 352256
    MD5: A9DD91AACAC785A357E1616A5E8BFD1C

Located: HK_LM:Run, HotKeysCmds
command: C:\WINDOWS\system32\hkcmd.exe
   file: C:\WINDOWS\system32\hkcmd.exe
   size: 126976
    MD5: E278BA143188E6029555D70F291DDB6B

Located: HK_LM:Run, HP Software Update
command: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
   file: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
   size: 49152
    MD5: AC116F16A7716A720A45D7EA47CFD983

Located: HK_LM:Run, IgfxTray
command: C:\WINDOWS\system32\igfxtray.exe
   file: C:\WINDOWS\system32\igfxtray.exe
   size: 155648
    MD5: DFCBA58A26C6540CB398418A050FFFC3

Located: HK_LM:Run, IMJPMIG8.1
command: "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
   file: C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE
   size: 208952
    MD5: 7BBE4CF421AECC7F0226EDD75F12079F

Located: HK_LM:Run, iTunesHelper
command: "C:\Program Files\iTunes\iTunesHelper.exe"
   file: C:\Program Files\iTunes\iTunesHelper.exe
   size: 267048
    MD5: 04A9F0C58B170F30445BCC0683EF9FFC

Located: HK_LM:Run, LaunchAp
command: "C:\Program Files\Launch Manager\LaunchAp.exe"
   file: C:\Program Files\Launch Manager\LaunchAp.exe
   size: 32768
    MD5: AB4B38078636325D076080ADD4F27727

Located: HK_LM:Run, LManager
command: "C:\Program Files\Launch Manager\HotkeyApp.exe"
   file: C:\Program Files\Launch Manager\HotkeyApp.exe
   size: 69632
    MD5: B010BE710607359A5F763759563E27FF

Located: HK_LM:Run, LMgrOSD
command: "C:\Program Files\Launch Manager\OSDCtrl.exe"
   file: C:\Program Files\Launch Manager\OSDCtrl.exe
   size: 241664
    MD5: D6236303D3B07127B3F13CCF012B3C39

Located: HK_LM:Run, MSPY2002
command: C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
   file: C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe
   size: 59392
    MD5: 1B17E09C1223F6D17336D2DD7A1AF4F4

Located: HK_LM:Run, NeroFilterCheck
command: C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
   file: C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
   size: 155648
    MD5: C93AB037A8C792D5F8A1A9FC88A7C7C5

Located: HK_LM:Run, PCMService
command: "C:\Program Files\Arcade\PCMService.exe"
   file: C:\Program Files\Arcade\PCMService.exe
   size: 49152
    MD5: 46695588DB7A33DD7CA9D57E364311B3

Located: HK_LM:Run, PHIME2002A
command: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
   file: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
   size: 455168
    MD5: 024DC0F68DF5FD6AE9DD82DFBAF479D6

Located: HK_LM:Run, PHIME2002ASync
command: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
   file: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
   size: 455168
    MD5: 024DC0F68DF5FD6AE9DD82DFBAF479D6

Located: HK_LM:Run, PowerKey
command: "C:\Program Files\Launch Manager\PowerKey.exe"
   file: C:\Program Files\Launch Manager\PowerKey.exe
   size: 94208
    MD5: 288C5AD21FAB073B8BD8D1A825AEF85D

Located: HK_LM:Run, preload
command: C:\Windows\RUNXMLPL.exe
   file: C:\Windows\RUNXMLPL.exe
   size: 32768
    MD5: B097A1BB009E5F9D63B036D8873D9072

Located: HK_LM:Run, QuickTime Task
command: "C:\Program Files\QuickTime\qttask.exe" -atboottime
   file: C:\Program Files\QuickTime\qttask.exe
   size: 413696
    MD5: 6DF76965A0FB8237E9C3B3CAB9815EC2

Located: HK_LM:Run, SpeedTouch USB Diagnostics
command: "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
   file: C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
   size: 866816
    MD5: D40191AA225638AB20E59524CDD74030

Located: HK_LM:Run, SunJavaUpdateSched
command: "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
   file: C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
   size: 132496
    MD5: 896E712A34D654A337C8CBB9DEB07200

Located: HK_LM:Run, SynTPEnh
command: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
   file: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
   size: 708698
    MD5: 347CF0EE182A56914E783FFE9E1B2371

Located: HK_LM:Run, SynTPLpr
command: C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
   file: C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
   size: 102490
    MD5: 2E106877210B59A6A63756D004B7850A

Located: HK_LM:Run, Wbutton
command: "C:\Program Files\Launch Manager\Wbutton.exe"
   file: C:\Program Files\Launch Manager\Wbutton.exe
   size: 81920
    MD5: 78D5858FA5213F37DBC7D797B84DFA60

Located: HK_CU:Run, CTFMON.EXE
  where: .DEFAULT...
command: C:\WINDOWS\system32\CTFMON.EXE
   file: C:\WINDOWS\system32\CTFMON.EXE
   size: 15360
    MD5: 5584247B568C2E53934873F4B655FE6A

Located: HK_CU:Run, CTFMON.EXE
  where: S-1-5-19...
command: C:\WINDOWS\system32\CTFMON.EXE
   file: C:\WINDOWS\system32\CTFMON.EXE
   size: 15360
    MD5: 5584247B568C2E53934873F4B655FE6A

Located: HK_CU:Run, CTFMON.EXE
  where: S-1-5-20...
command: C:\WINDOWS\system32\CTFMON.EXE
   file: C:\WINDOWS\system32\CTFMON.EXE
   size: 15360
    MD5: 5584247B568C2E53934873F4B655FE6A

Located: HK_CU:Run, ctfmon.exe
  where: S-1-5-21-1882407548-1316713077-2592620698-1005...
command: C:\WINDOWS\system32\ctfmon.exe
   file: C:\WINDOWS\system32\ctfmon.exe
   size: 15360
    MD5: 5584247B568C2E53934873F4B655FE6A

Located: HK_CU:Run, MSMSGS
  where: S-1-5-21-1882407548-1316713077-2592620698-1005...
command: "C:\Program Files\Messenger\msmsgs.exe" /background
   file: C:\Program Files\Messenger\msmsgs.exe
   size: 1694208
    MD5: 74E6E96C6F0E2ECA4EDBB7F7A468F259

Located: HK_CU:Run, SpybotSD TeaTimer
  where: S-1-5-21-1882407548-1316713077-2592620698-1005...
command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
   file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
   size: 2156368
    MD5: 08FC1FAD357F053043016597B6559BDC

Located: HK_CU:RunOnce, SpybotDeletingB2424
  where: S-1-5-21-1882407548-1316713077-2592620698-1005...
command: command /c del "C:\Program Files\Everest Poker\gvcrt.dll"
   file: command /c del "C:\Program Files\Everest Poker\gvcrt.dll"
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_CU:RunOnce, SpybotDeletingB3708
  where: S-1-5-21-1882407548-1316713077-2592620698-1005...
command: command /c del "C:\Program Files\Everest Poker\casino.exe"
   file: command /c del "C:\Program Files\Everest Poker\casino.exe
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_CU:RunOnce, SpybotDeletingB5189
  where: S-1-5-21-1882407548-1316713077-2592620698-1005...
command: command /c del "C:\Program Files\Everest Poker\gvmain.exe"
   file: command /c del "C:\Program Files\Everest Poker\gvmain.exe
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_CU:RunOnce, SpybotDeletingD2654
  where: S-1-5-21-1882407548-1316713077-2592620698-1005...
command: cmd /c del "C:\Program Files\Everest Poker\casino.exe"
   file: cmd /c del "C:\Program Files\Everest Poker\casino.exe
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_CU:RunOnce, SpybotDeletingD4654
  where: S-1-5-21-1882407548-1316713077-2592620698-1005...
command: cmd /c del "C:\Program Files\Everest Poker\gvcrt.dll"
   file: cmd /c del "C:\Program Files\Everest Poker\gvcrt.dll"
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_CU:RunOnce, SpybotDeletingD8846
  where: S-1-5-21-1882407548-1316713077-2592620698-1005...
command: cmd /c del "C:\Program Files\Everest Poker\gvmain.exe"
   file: cmd /c del "C:\Program Files\Everest Poker\gvmain.exe
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_CU:Run, CTFMON.EXE
  where: S-1-5-18...
command: C:\WINDOWS\system32\CTFMON.EXE
   file: C:\WINDOWS\system32\CTFMON.EXE
   size: 15360
    MD5: 5584247B568C2E53934873F4B655FE6A

Located: Démarrage (tous utilisateurs), Démarrage rapide du logiciel HP Image Zone.lnk
  where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage...
command: C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
   file: C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
   size: 73728
    MD5: 806EE198284D569253EB6A1D1180B37D

Located: Démarrage (tous utilisateurs), Image Transfer.lnk
  where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage...
command: C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
   file: C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
   size: 73728
    MD5: 2D7B847DA5E569ED4E0B15FEEFB8FCC4

Located: Démarrage (tous utilisateurs), Lancement rapide d'Adobe Reader.lnk
  where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage...
command: C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
   file: C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
   size: 29696
    MD5: DFCB9ADE94A4F8A7C42EEF41101A30AD

Located: Démarrage (tous utilisateurs), Microsoft Office.lnk
  where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage...
command: C:\Program Files\Microsoft Office\Office\OSA9.EXE
   file: C:\Program Files\Microsoft Office\Office\OSA9.EXE
   size: 65588
    MD5: E4D6038CB8ABAAFEA299B84CDD4BAF4D

Located: WinLogon, crypt32chain
command: crypt32.dll
   file: crypt32.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, cryptnet
command: cryptnet.dll
   file: cryptnet.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, cscdll
command: cscdll.dll
   file: cscdll.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, igfxcui
command: igfxsrvc.dll
   file: igfxsrvc.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, ScCertProp
command: wlnotify.dll
   file: wlnotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, Schedule
command: wlnotify.dll
   file: wlnotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, sclgntfy
command: sclgntfy.dll
   file: sclgntfy.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, SensLogn
command: WlNotify.dll
   file: WlNotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, termsrv
command: wlnotify.dll
   file: wlnotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, WgaLogon
command: WgaLogon.dll
   file: WgaLogon.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, wlballoon
command: wlnotify.dll
   file: wlnotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!



--- Browser helper object list ---
{53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
          location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
          BHO name: 
        CLSID name: Spybot-S&D IE Protection
       description: Spybot-S&D IE Browser plugin
    classification: Legitimate
    known filename: SDhelper.dll
         info link: http://spybot.eon.net.au/
       info source: Patrick M. Kolla
              Path: C:\PROGRA~1\SPYBOT~1\
         Long name:       SDHelper.dll
        Short name:       SDHELPER.DLL
    Date (created): 18/06/2006 14:39:38
Date (last access):         13/08/2008
 Date (last write): 07/07/2008 09:41:58
          Filesize:            1562448
        Attributes:           archive 
               MD5: 32981ADE44D01EC2A9EBC2E311291707
             CRC32:           C2F522E6
           Version:           1.6.0.12

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
          location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
          BHO name: 
        CLSID name: SSVHelper Class
              Path: C:\Program Files\Java\jre1.6.0_02\bin\
         Long name:            ssv.dll
        Short name:                   
    Date (created): 12/09/2007 09:55:00
Date (last access):         13/08/2008
 Date (last write): 12/07/2007 04:00:36
          Filesize:             501136
        Attributes:           archive 
               MD5: D6137540BDF0F9F9B9055C60ADD8007A
             CRC32:           29E910AF
           Version:           6.0.20.6

{9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
          location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
          BHO name: 
        CLSID name: Programme d'aide de l'Assistant de connexion Windows Live
              Path: C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\
         Long name: WindowsLiveLogin.dll
        Short name:       WINDOW~1.DLL
    Date (created): 20/09/2007 10:30:18
Date (last access):         13/08/2008
 Date (last write): 20/09/2007 10:30:18
          Filesize:             328752
        Attributes:           archive 
               MD5: 59CF5BF6684AFCF906CADAD39B4214DE
             CRC32:           C363813C
           Version:        4.200.520.1

{9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
          location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
          BHO name: 
        CLSID name: ST
              Path: C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\
         Long name:         stmain.dll
        Short name:                   
    Date (created): 23/07/2006 20:11:40
Date (last access):         13/08/2008
 Date (last write): 13/08/2004 17:42:00
          Filesize:             155648
        Attributes:           archive 
               MD5: 0DA1349495955CB41A5899047C5A1267
             CRC32:           C050EECD
           Version:      1.2.3000.1001

{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
          location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
          BHO name: 
        CLSID name: MSNToolBandBHO
              Path: C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr-be\
         Long name:          msntb.dll
        Short name:                   
    Date (created): 23/07/2006 20:10:06
Date (last access):         13/08/2008
 Date (last write): 17/01/2006 16:04:16
          Filesize:             282624
        Attributes:           archive 
               MD5: 6B3B0C6657B3DFEAD7ABC5BFEE45B347
             CRC32:           1DF31317
           Version:      1.2.5000.1021



--- ActiveX list ---
{56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control)
          DPF name: 
        CLSID name: OnlineScanner Control
         Installer: C:\WINDOWS\Downloaded Program Files\OnlineScanner.inf
          Codebase: https://www.eset.com/
              Path: C:\WINDOWS\system32\
         Long name:  OnlineScanner.ocx
        Short name:       ONLINE~1.OCX
    Date (created): 06/08/2007 13:18:16
Date (last access):         13/08/2008
 Date (last write): 06/08/2007 13:18:16
          Filesize:            2707456
        Attributes:                   
               MD5: 41B8A44F69C6C5C2F9DAFEA1ED184D20
             CRC32:           E1F281AC
           Version:          1.0.0.337

{56E4B9EB-4C79-4568-A19E-72794FA70060} (PatsShellOCX Control)
          DPF name: 
        CLSID name: PatsShellOCX Control
         Installer: 
          Codebase: http://www.futuresplatform.com/SunJVMPatsFiles6_1/pats.cab
              Path: C:\WINDOWS\DOWNLO~1\
         Long name: PatsShellOCXProj.ocx
        Short name:       PATSSH~1.OCX
    Date (created): 12/11/2003 12:23:02
Date (last access):         13/08/2008
 Date (last write): 12/11/2003 12:23:02
          Filesize:             379904
        Attributes:           archive 
               MD5: 25A00BB25B0C9980A88B6441DCA41E1D
             CRC32:           F3AA4120
           Version:            1.0.0.6

{6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control)
          DPF name: 
        CLSID name: Image Uploader Control
         Installer: C:\WINDOWS\Downloaded Program Files\ImageUploader4.inf
          Codebase: http://belgacom.extrafilm.be/ImageUploader4.cab
              Path: C:\WINDOWS\Downloaded Program Files\
         Long name: ImageUploader4.ocx
        Short name:       IMAGEU~1.OCX
    Date (created): 27/12/2006 18:46:44
Date (last access):         13/08/2008
 Date (last write): 30/06/2008 12:27:22
          Filesize:            3126800
        Attributes:           archive 
               MD5: E65DD6CB09C1C7056147840D88FD53F6
             CRC32:           40EC12F9
           Version:           4.7.22.0

{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0)
          DPF name: Java Runtime Environment 1.6.0
        CLSID name: Java Plug-in 1.6.0_02
         Installer: 
          Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
       description: Sun Java
    classification: Legitimate
    known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin
pjava131.dll
         info link: 
       info source: Patrick M. Kolla
              Path: C:\Program Files\Java\jre1.6.0_02\bin\
         Long name:    npjpi160_02.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 12/07/2007 02:22:38
Date (last access):         13/08/2008
 Date (last write): 12/07/2007 04:00:36
          Filesize:             132496
        Attributes:           archive 
               MD5: E3811F1A1C5063C941EC0E2766C3EA39
             CRC32:           AEFD3747
           Version:           6.0.20.6

{A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} (Image Uploader)
          DPF name: 
        CLSID name: Image Uploader
         Installer: C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ImageUploader4.inf
          Codebase: http://belgacom.extrafilm.be/ImageUploader4.cab
              Path: C:\WINDOWS\Downloaded Program Files\CONFLICT.1\
         Long name: ImageUploader4.ocx
        Short name:       IMAGEU~1.OCX
    Date (created): 20/09/2007 12:03:02
Date (last access):         13/08/2008
 Date (last write): 20/09/2007 12:03:02
          Filesize:            2289664
        Attributes:           archive 
               MD5: 307E631F0B4FC9B9697E968FFBC5537A
             CRC32:           2CF1642A
           Version:           4.5.53.0

{B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class)
          DPF name: 
        CLSID name: MsnMessengerSetupDownloadControl Class
         Installer: C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.inf
          Codebase: http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
              Path: C:\WINDOWS\Downloaded Program Files\
         Long name: MsnMessengerSetupDownloader.ocx
        Short name:       MSNMES~1.OCX
    Date (created): 14/08/2005 00:26:04
Date (last access):         13/08/2008
 Date (last write): 14/08/2005 00:26:04
          Filesize:             113664
        Attributes:           archive 
               MD5: C403792A3FF639C215067D5AA680C482
             CRC32:           7CD0769A
           Version:            1.0.0.3

{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.2)
          DPF name: Java Runtime Environment 1.4.2
        CLSID name: Java Plug-in 1.4.2_03
         Installer: 
          Codebase: https://www.oracle.com/java/technologies/
              Path: C:\Program Files\Java\j2re1.4.2_03\bin\
         Long name:    NPJPI142_03.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 19/11/2003 17:48:18
Date (last access):         13/08/2008
 Date (last write): 19/11/2003 17:48:12
          Filesize:              65650
        Attributes:           archive 
               MD5: 2AD31341BE41AC9B086128AD86A2B53F
             CRC32:           081CFB35
           Version:           1.4.2.30

{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0)
          DPF name: Java Runtime Environment 1.5.0
        CLSID name: Java Plug-in 1.5.0_10
         Installer: 
          Codebase: http://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
              Path: C:\Program Files\Java\jre1.5.0_10\bin\
         Long name:    NPJPI150_10.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 09/11/2006 15:07:34
Date (last access):         13/08/2008
 Date (last write): 09/11/2006 15:21:54
          Filesize:              75528
        Attributes:           archive 
               MD5: 635F4B3A0F1C661B5CEDE628BA85E46B
             CRC32:           0C9B7145
           Version:          5.0.100.3

{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
          DPF name: Java Runtime Environment 1.6.0
        CLSID name: Java Plug-in 1.6.0_01
         Installer: 
          Codebase: https://www.oracle.com/java/technologies/
              Path: C:\Program Files\Java\jre1.6.0_01\bin\
         Long name:    npjpi160_01.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 14/03/2007 02:04:46
Date (last access):         13/08/2008
 Date (last write): 14/03/2007 03:43:42
          Filesize:             132760
        Attributes:           archive 
               MD5: F112FB2FD2EF66D439799E3F834DF000
             CRC32:           D2B09219
           Version:            6.0.0.6

{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
          DPF name: Java Runtime Environment 1.6.0
        CLSID name: Java Plug-in 1.6.0_02
         Installer: 
          Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
              Path: C:\Program Files\Java\jre1.6.0_02\bin\
         Long name:    npjpi160_02.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 12/07/2007 02:22:38
Date (last access):         13/08/2008
 Date (last write): 12/07/2007 04:00:36
          Filesize:             132496
        Attributes:           archive 
               MD5: E3811F1A1C5063C941EC0E2766C3EA39
             CRC32:           AEFD3747
           Version:           6.0.20.6

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
          DPF name: Java Runtime Environment 1.6.0
        CLSID name: Java Plug-in 1.6.0_02
         Installer: 
          Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
              Path: C:\Program Files\Java\jre1.6.0_02\bin\
         Long name:    npjpi160_02.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 12/07/2007 02:22:38
Date (last access):         13/08/2008
 Date (last write): 12/07/2007 04:00:36
          Filesize:             132496
        Attributes:           archive 
               MD5: E3811F1A1C5063C941EC0E2766C3EA39
             CRC32:           AEFD3747
           Version:           6.0.20.6

{CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class)
          DPF name: 
        CLSID name: PB_Uploader Class
         Installer: 
          Codebase: http://www.photoways.com/clients/uploader_v2.2.0.6.cab
              Path: C:\WINDOWS\Downloaded Program Files\
         Long name:   uploader_uni.ocx
        Short name:       UPLOAD~1.OCX
    Date (created): 04/04/2007 08:45:44
Date (last access):         13/08/2008
 Date (last write): 04/04/2007 08:45:44
          Filesize:            1072368
        Attributes:           archive 
               MD5: 606A6929F259B2A49B9CAABB1528ACF1
             CRC32:           F9CDF746
           Version:            2.2.0.6

{D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object)
          DPF name: 
        CLSID name: Shockwave Flash Object
         Installer: C:\WINDOWS\Downloaded Program Files\swflash.inf
          Codebase: https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
       description: Macromedia Shockwave Flash Player
    classification: Legitimate
    known filename: 
         info link: 
       info source: Patrick M. Kolla
              Path: C:\WINDOWS\system32\Macromed\Flash\
         Long name:        Flash9f.ocx
        Short name:        FLASH9F.OCX
    Date (created): 25/03/2008 04:32:42
Date (last access):         13/08/2008
 Date (last write): 25/03/2008 04:32:42
          Filesize:            2991488
        Attributes:  readonly archive 
               MD5: 48FDF435B8595604E54125B321924510
             CRC32:           12335E29
           Version:          9.0.124.0



--- Process list ---
PID:    0 (   0) [System]
PID:  408 (   4) \SystemRoot\System32\smss.exe
 size: 50688
PID:  476 ( 408) \??\C:\WINDOWS\system32\csrss.exe
 size: 6144
PID:  500 ( 408) \??\C:\WINDOWS\system32\winlogon.exe
 size: 506368
PID:  544 ( 500) C:\WINDOWS\system32\services.exe
 size: 108544
  MD5: 732E0B1ABAACE15D80EC19056B0A2AF9
PID:  556 ( 500) C:\WINDOWS\system32\lsass.exe
 size: 13312
  MD5: 9F3744A5C6F49291A7A685040A013399
PID:  700 ( 544) C:\WINDOWS\system32\svchost.exe
 size: 14336
  MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA
PID:  748 ( 544) C:\WINDOWS\system32\svchost.exe
 size: 14336
  MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA
PID:  788 ( 544) C:\WINDOWS\System32\svchost.exe
 size: 14336
  MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA
PID:  844 ( 544) C:\WINDOWS\system32\svchost.exe
 size: 14336
  MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA
PID:  980 ( 544) C:\WINDOWS\system32\svchost.exe
 size: 14336
  MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA
PID: 1144 ( 544) C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
 size: 16056
  MD5: E2323AD197689D607EBC52137B4DFB2E
PID: 1192 ( 544) C:\Program Files\Alwil Software\Avast4\ashServ.exe
 size: 147640
  MD5: 58E57D723BD437049F74408016E1735D
PID: 1208 (1080) C:\WINDOWS\Explorer.EXE
 size: 1037312
  MD5: D0288319660EDCFED07C7E74C4EA38A5
PID: 1508 ( 544) C:\WINDOWS\system32\spoolsv.exe
 size: 57856
  MD5: DA81EC57ACD4CDC3D4C51CF3D409AF9F
PID: 1556 (1208) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
 size: 4891472
  MD5: 3B1B5D09D3C9C4CD39D4DB06ED7A0855
PID: 1632 ( 544) C:\Acer\eManager\anbmServ.exe
 size: 1273344
  MD5: 9493A96D44CC1B9127917E40F2C83F4E
PID: 1724 ( 544) C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
 size: 110592
  MD5: 1961CB10BB48EB4D97E37DB6373E9E63
PID: 1752 ( 544) C:\Program Files\Bonjour\mDNSResponder.exe
 size: 229376
  MD5: CFD4C3352E29A8B729536648466E8DF5
PID: 1816 ( 544) C:\WINDOWS\system32\HPZipm12.exe
 size: 69632
  MD5: 9D84376931440F3679BEEF2A414FA493
PID: 1892 ( 544) C:\WINDOWS\system32\svchost.exe
 size: 14336
  MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA
PID: 1924 ( 544) C:\WINDOWS\system32\wdfmgr.exe
 size: 38912
  MD5: C81B8635DEE0D3EF5F64B3DD643023A5
PID:  812 ( 544) C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
 size: 250040
  MD5: BCEA9A5EEF52351E1632DD417D3E7308
PID:  904 ( 544) C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
 size: 348344
  MD5: B2203D1A09CAC8232780BFCF01A9B853
PID: 1316 ( 544) C:\WINDOWS\System32\alg.exe
 size: 44544
  MD5: 2FE681D10C5FC343DBBC0610B8DD4D24
PID:    4 (   0) System


--- Browser start & search pages list ---
Spybot - Search & Destroy browser pages report, 13/08/2008 20:05:37

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
  C:\WINDOWS\system32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
  http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
  https://www.google.be/?gws_rd=ssl
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@
  http://home.microsoft.com/access/autosearch.asp?p=%s
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
  %SystemRoot%\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
  https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
  https://www.msn.com/fr-fr/?ocid=iehp
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
  https://www.msn.com/fr-fr/?ocid=iehp
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
  https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
  https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
  https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm


--- Winsock Layered Service Provider list ---
Protocol  0: MSAFD Tcpip [TCP/IP]
        GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP IP protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD Tcpip [*]

Protocol  1: MSAFD Tcpip [UDP/IP]
        GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP IP protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD Tcpip [*]

Protocol  2: MSAFD Tcpip [RAW/IP]
        GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP IP protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD Tcpip [*]

Protocol  3: RSVP UDP Service Provider
        GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
    Filename: %SystemRoot%\system32svpsp.dll
 Description: Microsoft Windows NT/2k/XP RVSP
 DB filename: %SystemRoot%\system32svpsp.dll
 DB protocol: RSVP * Service Provider

Protocol  4: RSVP TCP Service Provider
        GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
    Filename: %SystemRoot%\system32svpsp.dll
 Description: Microsoft Windows NT/2k/XP RVSP
 DB filename: %SystemRoot%\system32svpsp.dll
 DB protocol: RSVP * Service Provider

Protocol  5: MSAFD NetBIOS [\Device\NetBT_Tcpip_{05FAE3FE-DF70-4360-8A0A-DEE1E5CC5943}] SEQPACKET 1
        GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP NetBios protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD NetBIOS *

Protocol  6: MSAFD NetBIOS [\Device\NetBT_Tcpip_{05FAE3FE-DF70-4360-8A0A-DEE1E5CC5943}] DATAGRAM 1
        GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP NetBios protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD NetBIOS *

Protocol  7: MSAFD NetBIOS [\Device\NetBT_Tcpip_{85A39B96-C392-4F9E-88D1-165B496F0093}] SEQPACKET 0
        GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP NetBios protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD NetBIOS *

Protocol  8: MSAFD NetBIOS [\Device\NetBT_Tcpip_{85A39B96-C392-4F9E-88D1-165B496F0093}] DATAGRAM 0
        GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP NetBios protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD NetBIOS *

Protocol  9: MSAFD NetBIOS [\Device\NetBT_Tcpip_{327362A7-6150-4C5E-9F4E-21144FD23282}] SEQPACKET 2
        GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP NetBios protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD NetBIOS *

Protocol 10: MSAFD NetBIOS [\Device\NetBT_Tcpip_{327362A7-6150-4C5E-9F4E-21144FD23282}] DATAGRAM 2
        GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP NetBios protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD NetBIOS *

Protocol 11: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D57CF42E-8C19-433F-9B5E-CC4679FA1942}] SEQPACKET 3
        GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP NetBios protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD NetBIOS *

Protocol 12: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D57CF42E-8C19-433F-9B5E-CC4679FA1942}] DATAGRAM 3
        GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP NetBios protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD NetBIOS *

Protocol 13: MSAFD NetBIOS [\Device\NetBT_Tcpip_{02B5150A-5A78-4A14-A7F2-B9660F54F71A}] SEQPACKET 4
        GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP NetBios protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD NetBIOS *

Protocol 14: MSAFD NetBIOS [\Device\NetBT_Tcpip_{02B5150A-5A78-4A14-A7F2-B9660F54F71A}] DATAGRAM 4
        GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP NetBios protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD NetBIOS *

Protocol 15: MSAFD NetBIOS [\Device\NetBT_Tcpip_{A8CE9664-67EB-4B2F-AA6B-A72E4128EEC4}] SEQPACKET 5
        GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP NetBios protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD NetBIOS *

Protocol 16: MSAFD NetBIOS [\Device\NetBT_Tcpip_{A8CE9664-67EB-4B2F-AA6B-A72E4128EEC4}] DATAGRAM 5
        GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
    Filename: %SystemRoot%\system32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP NetBios protocol
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: MSAFD NetBIOS *

Namespace Provider  0: TCP/IP
        GUID: {22059D40-7E9E-11CF-AE5A-00AA00A7112B}
    Filename: %SystemRoot%\System32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP TCP/IP name space provider
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: TCP/IP

Namespace Provider  1: NTDS
        GUID: {3B2637EE-E580-11CF-A555-00C04FD8D4AC}
    Filename: %SystemRoot%\System32\winrnr.dll
 Description: Microsoft Windows NT/2k/XP name space provider
 DB filename: %SystemRoot%\system32\winrnr.dll
 DB protocol: NTDS

Namespace Provider  2: Espace de noms NLA (Network Location Awareness)
        GUID: {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83}
    Filename: %SystemRoot%\System32\mswsock.dll
 Description: Microsoft Windows NT/2k/XP name space provider
 DB filename: %SystemRoot%\system32\mswsock.dll
 DB protocol: NLA-Namespace

Namespace Provider  3: mdnsNSP
        GUID: {B600E6E9-553B-4A19-8696-335E5C896153}
    Filename: C:\Program Files\Bonjour\mdnsNSP.dll
 Description: Apple Rendezvous protocol
 DB filename: %ProgramFiles%\Rendezvous\bin\mdnsNSP.dll
 DB protocol: mdnsNSP

Trojan-Spy.Win32.KeyLogger.aa

14 réponses

Discussions similaires

Newsletters