Win32-fraudtool-gi-tool

perchette -  
 perchette -
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:32:13, on 23/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\program files\orange\media player\Media Player.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamtrayctrl.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KiweeHook] "C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [PlatriumWeather] "C:\Program Files\Platrium\bin\1.2.103.0\Weather.exe" -auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [OrangePlayer] c:\program files\orange\media player\Media Player.exe /systray
O4 - HKCU\..\Run: [DriverUpdaterPro] C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [OrangePlayer] c:\program files\orange\media player\Media Player.exe /systray (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Iomega Product Registration.lnk = C:\Program Files\Iomega\Registration\Register.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - E:\JEUX\pocker\PACIFI~1\pacificpoker.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://ak.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/flashax.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://ww38.instantaction.com/download/iaplayer.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 8163 bytes
Configuration: Windows XP
Internet Explorer 7.0

52 réponses

  • 1
  • 2
  • 3
Résumé de la discussion

Logfile de Trend Micro HijackThis v2.0.2 révèle plusieurs éléments potentiellement indésirables et une nécessité de désinfection guidée, avec des modules tiers et des barres d'outils démarrés. Des éléments de réponse privilégient l'emploi d'outils dédiés, tels que ToolsCleaner puis CCleaner, la suppression des barres d'outils et des éléments d'amorçage indésirables, et la désactivation temporaire de points de restauration. D'autres conseils rappellent d'éviter toute désinfection non coordonnée et de privilégier une approche pas à pas, incluant la vérification des programmes lancés au démarrage et la régression des composants non fiables. De plus, l'utilisation coordonnée de plusieurs antivirus comme Avast, Avira et Malwarebytes est suggérée, avec l'accent sur le redémarrage après chaque étape de suppression et des mises à jour régulières.

Généré automatiquement par IA
sur la base des meilleures réponses
  1. chimay8 Messages postés 7947 Statut Contributeur sécurité 60
     
    oups sorry
    clic sur fix checked

    olala pardon!!
    1
  2. chimay8 Messages postés 7947 Statut Contributeur sécurité 60
     
    naon missssiou
    1
  3. chimay8 Messages postés 7947 Statut Contributeur sécurité 60
     
    Ca veut dire que nos ordi se sépares?
    hé oui!

    Télécharge ToolsCleaner sur ton bureau.
    -->
    http://www.commentcamarche.net/telecharger/telechargement 34055291 toolscleaner

    # Clique sur "Recherche" et laisse le scan agir ...
    # Clique sur "Suppression" pour finaliser.
    # Tu peux, si tu le souhaites, te servir des Options facultatives.
    # Clique sur Quitter pour obtenir le rapport.
    # Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

    ensuite

    RE CCleaner

    ! déconnectes toi et fermes toutes applications en cours !
    * vas dans "nettoyeur" : fait analyse puis nettoyage
    * vas dans "registre" : fait chercher les erreurs et réparer ( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) .

    ***très important***

    Suppression des points de restauration :
    1.Ouvre le Menu Démarrer
    2.Clique-droit sur Poste de travail
    3.Clique sur Propriétés
    4.Positionne-toi dans l'onglet Restauration du système
    5.Coche "Désactiver la restauration système"
    6.Valide par Ok
    7.Redémarre ton pc
    8.Reproduis les manipulations 1 à 3
    9.Décoche "Désactiver la restauration système"
    10.Valide par Ok

    bin voila!!

    finish la désinfec

    quelques conseils
    fais gaffe aux toolbars,elles sont souvent inutiles et dangereuses...
    mmmmm!!!...les cracks!!
    évite...sont souvent vérolés.
    si tu veux installer un prog;regarde sur google si il est pas pourri...

    voili,voila
    1
  4. chimay8 Messages postés 7947 Statut Contributeur sécurité 60
     
    re,
    j'avais oublié(pfff l'alzheïmer est proche!!)

    pour désinstaller Combofix

    Menu Démarrer>Exécuter>
    tape ou copie/colle
    ComboFix /u
    dans le champ
    clic sur ok
    1

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. chimay8 Messages postés 7947 Statut Contributeur sécurité 60
     
    malgré mon impolitesse.
    mouarfff
    1
    1. perchette
       
      Eh bien après une nuit sans mon attention, je pense que nôtre malade est guéri.
      Bonne continuation dans vôtre guerre contre les malveillant.
      0
  7. perchette
     
    Que dois-je faire après ce rapport hijackthis.log? J'envois le rapport de SmitrtfraudFix derrière
    0
  8. perchette
     
    Bonjour, comme dans un message que j'ai lu il était marqué ne pas ajouter de ligne quand on poste un rapport et que je suis en train de me faire jetter par le propriétaire de l'ordi, j'ai oublié la politesse. Désolée
    0
  9. perchette
     
    SmitFraudFix v2.353

    Rapport fait à 14:19:21,84, 23/09/2008
    Executé à partir de C:\Documents and Settings\wilgett\Bureau\SmitfraudFix
    OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
    Le type du système de fichiers est NTFS
    Fix executé en mode normal

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\program files\orange\media player\Media Player.exe
    C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
    C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamtrayctrl.exe
    C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    »»»»»»»»»»»»»»»»»»»»»»»» C:\

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\wilgett

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\wilgett\Application Data

    »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\wilgett\Favoris

    »»»»»»»»»»»»»»»»»»»»»»»» Bureau

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

    »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

    »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

    »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    o4Patch
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    404Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    AntiXPVSTFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» RK

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Carte Fast Ethernet compatible VIA - Miniport d'ordonnancement de paquets
    DNS Server Search Order: 192.168.0.1

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{6810C940-A481-41B1-BF4C-556702C71F75}: DhcpNameServer=192.168.0.1
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{6810C940-A481-41B1-BF4C-556702C71F75}: DhcpNameServer=192.168.0.1
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{6810C940-A481-41B1-BF4C-556702C71F75}: DhcpNameServer=192.168.0.1
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

    »»»»»»»»»»»»»»»»»»»»»»»» Fin
    0
  10. perchette
     
    Si ça peu aider la connerie que j'ai fait, quand le message d'alerte s'est mis en route s'était internet et il m'ont demandé si je voulais télécharger antivirus XP2008 et j'ai dit oui, vous connaissait la suite.
    0
  11. perchette
     
    [b]SDFix: Version 1.228 [/b]
    Run by wilgett on 23/09/2008 at 15:51

    Microsoft Windows XP [version 5.1.2600]
    Running From: C:\SDFix

    [b]Checking Services [/b]:

    Restoring Default Security Values
    Restoring Default Hosts File

    Rebooting

    [b]Checking Files [/b]:

    Trojan Files Found:

    C:\WINDOWS\system32\20.tmp - Deleted
    C:\WINDOWS\system32\200.tmp - Deleted
    C:\WINDOWS\system32\201.tmp - Deleted
    C:\WINDOWS\system32\202.tmp - Deleted
    C:\WINDOWS\system32\203.tmp - Deleted
    C:\WINDOWS\system32\204.tmp - Deleted
    C:\WINDOWS\system32\205.tmp - Deleted
    C:\WINDOWS\system32\206.tmp - Deleted
    C:\WINDOWS\system32\207.tmp - Deleted
    C:\WINDOWS\system32\208.tmp - Deleted
    C:\WINDOWS\system32\209.tmp - Deleted
    C:\WINDOWS\system32\20A.tmp - Deleted
    C:\WINDOWS\system32\20B.tmp - Deleted
    C:\WINDOWS\system32\20C.tmp - Deleted
    C:\WINDOWS\system32\20D.tmp - Deleted
    C:\WINDOWS\system32\20E.tmp - Deleted
    C:\WINDOWS\system32\20F.tmp - Deleted
    C:\WINDOWS\system32\21.tmp - Deleted
    C:\WINDOWS\system32\210.tmp - Deleted
    C:\WINDOWS\system32\211.tmp - Deleted
    C:\WINDOWS\system32\212.tmp - Deleted
    C:\WINDOWS\system32\213.tmp - Deleted
    C:\WINDOWS\system32\214.tmp - Deleted
    C:\WINDOWS\system32\215.tmp - Deleted
    C:\WINDOWS\system32\216.tmp - Deleted
    C:\WINDOWS\system32\217.tmp - Deleted
    C:\WINDOWS\system32\218.tmp - Deleted
    C:\WINDOWS\system32\219.tmp - Deleted
    C:\WINDOWS\system32\21A.tmp - Deleted
    C:\WINDOWS\system32\21B.tmp - Deleted
    C:\WINDOWS\system32\21C.tmp - Deleted
    C:\WINDOWS\system32\21D.tmp - Deleted
    C:\WINDOWS\system32\21E.tmp - Deleted
    C:\WINDOWS\system32\21F.tmp - Deleted
    C:\WINDOWS\system32\22.tmp - Deleted
    C:\WINDOWS\system32\220.tmp - Deleted
    C:\WINDOWS\system32\221.tmp - Deleted
    C:\WINDOWS\system32\222.tmp - Deleted
    C:\WINDOWS\system32\223.tmp - Deleted
    C:\WINDOWS\system32\224.tmp - Deleted
    C:\WINDOWS\system32\225.tmp - Deleted
    C:\WINDOWS\system32\226.tmp - Deleted
    C:\WINDOWS\system32\227.tmp - Deleted
    C:\WINDOWS\system32\228.tmp - Deleted
    C:\WINDOWS\system32\229.tmp - Deleted
    C:\WINDOWS\system32\22A.tmp - Deleted
    C:\WINDOWS\system32\22B.tmp - Deleted
    C:\WINDOWS\system32\22C.tmp - Deleted
    C:\WINDOWS\system32\22D.tmp - Deleted
    C:\WINDOWS\system32\22E.tmp - Deleted
    C:\WINDOWS\system32\22F.tmp - Deleted
    C:\WINDOWS\system32\23.tmp - Deleted
    C:\WINDOWS\system32\230.tmp - Deleted
    C:\WINDOWS\system32\231.tmp - Deleted
    C:\WINDOWS\system32\232.tmp - Deleted
    C:\WINDOWS\system32\233.tmp - Deleted
    C:\WINDOWS\system32\234.tmp - Deleted
    C:\WINDOWS\system32\235.tmp - Deleted
    C:\WINDOWS\system32\236.tmp - Deleted
    C:\WINDOWS\system32\237.tmp - Deleted
    C:\WINDOWS\system32\238.tmp - Deleted
    C:\WINDOWS\system32\239.tmp - Deleted
    C:\WINDOWS\system32\23A.tmp - Deleted
    C:\WINDOWS\system32\23B.tmp - Deleted
    C:\WINDOWS\system32\23C.tmp - Deleted
    C:\WINDOWS\system32\23D.tmp - Deleted
    C:\WINDOWS\system32\23E.tmp - Deleted
    C:\WINDOWS\system32\23F.tmp - Deleted
    C:\WINDOWS\system32\24.tmp - Deleted
    C:\WINDOWS\system32\240.tmp - Deleted
    C:\WINDOWS\system32\241.tmp - Deleted
    C:\WINDOWS\system32\242.tmp - Deleted
    C:\WINDOWS\system32\243.tmp - Deleted
    C:\WINDOWS\system32\244.tmp - Deleted
    C:\WINDOWS\system32\245.tmp - Deleted
    C:\WINDOWS\system32\246.tmp - Deleted
    C:\WINDOWS\system32\247.tmp - Deleted
    C:\WINDOWS\system32\248.tmp - Deleted
    C:\WINDOWS\system32\249.tmp - Deleted
    C:\WINDOWS\system32\24A.tmp - Deleted
    C:\WINDOWS\system32\24B.tmp - Deleted
    C:\WINDOWS\system32\24C.tmp - Deleted
    C:\WINDOWS\system32\24D.tmp - Deleted
    C:\WINDOWS\system32\24E.tmp - Deleted
    C:\WINDOWS\system32\24F.tmp - Deleted
    C:\WINDOWS\system32\25.tmp - Deleted
    C:\WINDOWS\system32\250.tmp - Deleted
    C:\WINDOWS\system32\251.tmp - Deleted
    C:\WINDOWS\system32\252.tmp - Deleted
    C:\WINDOWS\system32\253.tmp - Deleted
    C:\WINDOWS\system32\254.tmp - Deleted
    C:\WINDOWS\system32\255.tmp - Deleted
    C:\WINDOWS\system32\256.tmp - Deleted
    C:\WINDOWS\system32\257.tmp - Deleted
    C:\WINDOWS\system32\258.tmp - Deleted
    C:\WINDOWS\system32\25C.tmp - Deleted
    C:\WINDOWS\system32\25D.tmp - Deleted
    C:\WINDOWS\system32\25E.tmp - Deleted
    C:\WINDOWS\system32\25F.tmp - Deleted
    C:\WINDOWS\system32\26.tmp - Deleted
    C:\WINDOWS\system32\260.tmp - Deleted
    C:\WINDOWS\system32\261.tmp - Deleted
    C:\WINDOWS\system32\262.tmp - Deleted
    C:\WINDOWS\system32\265.tmp - Deleted
    C:\WINDOWS\system32\266.tmp - Deleted
    C:\WINDOWS\system32\267.tmp - Deleted
    C:\WINDOWS\system32\268.tmp - Deleted
    C:\WINDOWS\system32\269.tmp - Deleted
    C:\WINDOWS\system32\26A.tmp - Deleted
    C:\WINDOWS\system32\26B.tmp - Deleted
    C:\WINDOWS\system32\26C.tmp - Deleted
    C:\WINDOWS\system32\26D.tmp - Deleted
    C:\WINDOWS\system32\26E.tmp - Deleted
    C:\WINDOWS\system32\26F.tmp - Deleted
    C:\WINDOWS\system32\27.tmp - Deleted
    C:\WINDOWS\system32\270.tmp - Deleted
    C:\WINDOWS\system32\271.tmp - Deleted
    C:\WINDOWS\system32\272.tmp - Deleted
    C:\WINDOWS\system32\273.tmp - Deleted
    C:\WINDOWS\system32\274.tmp - Deleted
    C:\WINDOWS\system32\275.tmp - Deleted
    C:\WINDOWS\system32\276.tmp - Deleted
    C:\WINDOWS\system32\277.tmp - Deleted
    C:\WINDOWS\system32\278.tmp - Deleted
    C:\WINDOWS\system32\279.tmp - Deleted
    C:\WINDOWS\system32\27A.tmp - Deleted
    C:\WINDOWS\system32\27B.tmp - Deleted
    C:\WINDOWS\system32\27C.tmp - Deleted
    C:\WINDOWS\system32\27D.tmp - Deleted
    C:\WINDOWS\system32\27E.tmp - Deleted
    C:\WINDOWS\system32\27F.tmp - Deleted
    C:\WINDOWS\system32\28.tmp - Deleted
    C:\WINDOWS\system32\280.tmp - Deleted
    C:\WINDOWS\system32\281.tmp - Deleted
    C:\WINDOWS\system32\282.tmp - Deleted
    C:\WINDOWS\system32\283.tmp - Deleted
    C:\WINDOWS\system32\284.tmp - Deleted
    C:\WINDOWS\system32\285.tmp - Deleted
    C:\WINDOWS\system32\286.tmp - Deleted
    C:\WINDOWS\system32\287.tmp - Deleted
    C:\WINDOWS\system32\288.tmp - Deleted
    C:\WINDOWS\system32\289.tmp - Deleted
    C:\WINDOWS\system32\28A.tmp - Deleted
    C:\WINDOWS\system32\28B.tmp - Deleted
    C:\WINDOWS\system32\28C.tmp - Deleted
    C:\WINDOWS\system32\28D.tmp - Deleted
    C:\WINDOWS\system32\28E.tmp - Deleted
    C:\WINDOWS\system32\28F.tmp - Deleted
    C:\WINDOWS\system32\29.tmp - Deleted
    C:\WINDOWS\system32\290.tmp - Deleted
    C:\WINDOWS\system32\291.tmp - Deleted
    C:\WINDOWS\system32\292.tmp - Deleted
    C:\WINDOWS\system32\293.tmp - Deleted
    C:\WINDOWS\system32\294.tmp - Deleted
    C:\WINDOWS\system32\295.tmp - Deleted
    C:\WINDOWS\system32\296.tmp - Deleted
    C:\WINDOWS\system32\297.tmp - Deleted
    C:\WINDOWS\system32\298.tmp - Deleted
    C:\WINDOWS\system32\299.tmp - Deleted
    C:\WINDOWS\system32\29A.tmp - Deleted
    C:\WINDOWS\system32\29B.tmp - Deleted
    C:\WINDOWS\system32\29C.tmp - Deleted
    C:\WINDOWS\system32\29D.tmp - Deleted
    C:\WINDOWS\system32\29E.tmp - Deleted
    C:\WINDOWS\system32\29F.tmp - Deleted
    C:\WINDOWS\system32\2A.tmp - Deleted
    C:\WINDOWS\system32\2A0.tmp - Deleted
    C:\WINDOWS\system32\2A1.tmp - Deleted
    C:\WINDOWS\system32\2A2.tmp - Deleted
    C:\WINDOWS\system32\2A3.tmp - Deleted
    C:\WINDOWS\system32\2A4.tmp - Deleted
    C:\WINDOWS\system32\2A5.tmp - Deleted
    C:\WINDOWS\system32\2A6.tmp - Deleted
    C:\WINDOWS\system32\2A7.tmp - Deleted
    C:\WINDOWS\system32\2A8.tmp - Deleted
    C:\WINDOWS\system32\2A9.tmp - Deleted
    C:\WINDOWS\system32\2AA.tmp - Deleted
    C:\WINDOWS\system32\2AB.tmp - Deleted
    C:\WINDOWS\system32\2AC.tmp - Deleted
    C:\WINDOWS\system32\2AD.tmp - Deleted
    C:\WINDOWS\system32\2AE.tmp - Deleted
    C:\WINDOWS\system32\2AF.tmp - Deleted
    C:\WINDOWS\system32\2B.tmp - Deleted
    C:\WINDOWS\system32\2B0.tmp - Deleted
    C:\WINDOWS\system32\2B1.tmp - Deleted
    C:\WINDOWS\system32\2B2.tmp - Deleted
    C:\WINDOWS\system32\2B3.tmp - Deleted
    C:\WINDOWS\system32\2B4.tmp - Deleted
    C:\WINDOWS\system32\2B5.tmp - Deleted
    C:\WINDOWS\system32\2B6.tmp - Deleted
    C:\WINDOWS\system32\2B7.tmp - Deleted
    C:\WINDOWS\system32\2B8.tmp - Deleted
    C:\WINDOWS\system32\2B9.tmp - Deleted
    C:\WINDOWS\system32\2BA.tmp - Deleted
    C:\WINDOWS\system32\2BB.tmp - Deleted
    C:\WINDOWS\system32\2BC.tmp - Deleted
    C:\WINDOWS\system32\2BD.tmp - Deleted
    C:\WINDOWS\system32\2BE.tmp - Deleted
    C:\WINDOWS\system32\2BF.tmp - Deleted
    C:\WINDOWS\system32\2C.tmp - Deleted
    C:\WINDOWS\system32\2C0.tmp - Deleted
    C:\WINDOWS\system32\2C1.tmp - Deleted
    C:\WINDOWS\system32\2C2.tmp - Deleted
    C:\WINDOWS\system32\2C3.tmp - Deleted
    C:\WINDOWS\system32\2C4.tmp - Deleted
    C:\WINDOWS\system32\2C5.tmp - Deleted
    C:\WINDOWS\system32\2C8.tmp - Deleted
    C:\WINDOWS\system32\2C9.tmp - Deleted
    C:\WINDOWS\system32\2CA.tmp - Deleted
    C:\WINDOWS\system32\2CB.tmp - Deleted
    C:\WINDOWS\system32\2CC.tmp - Deleted
    C:\WINDOWS\system32\2CD.tmp - Deleted
    C:\WINDOWS\system32\2CE.tmp - Deleted
    C:\WINDOWS\system32\2CF.tmp - Deleted
    C:\WINDOWS\system32\2D.tmp - Deleted
    C:\WINDOWS\system32\2D0.tmp - Deleted
    C:\WINDOWS\system32\2D1.tmp - Deleted
    C:\WINDOWS\system32\2D2.tmp - Deleted
    C:\WINDOWS\system32\2D3.tmp - Deleted
    C:\WINDOWS\system32\2D4.tmp - Deleted
    C:\WINDOWS\system32\2D5.tmp - Deleted
    C:\WINDOWS\system32\2D6.tmp - Deleted
    C:\WINDOWS\system32\2D7.tmp - Deleted
    C:\WINDOWS\system32\2D8.tmp - Deleted
    C:\WINDOWS\system32\2D9.tmp - Deleted
    C:\WINDOWS\system32\2DA.tmp - Deleted
    C:\WINDOWS\system32\2DB.tmp - Deleted
    C:\WINDOWS\system32\2DC.tmp - Deleted
    C:\WINDOWS\system32\2DD.tmp - Deleted
    C:\WINDOWS\system32\2DE.tmp - Deleted
    C:\WINDOWS\system32\2DF.tmp - Deleted
    C:\WINDOWS\system32\2E.tmp - Deleted
    C:\WINDOWS\system32\2E0.tmp - Deleted
    C:\WINDOWS\system32\2E1.tmp - Deleted
    C:\WINDOWS\system32\2E2.tmp - Deleted
    C:\WINDOWS\system32\2E3.tmp - Deleted
    C:\WINDOWS\system32\2E4.tmp - Deleted
    C:\WINDOWS\system32\2E5.tmp - Deleted
    C:\WINDOWS\system32\2E6.tmp - Deleted
    C:\WINDOWS\system32\2E7.tmp - Deleted
    C:\WINDOWS\system32\2E8.tmp - Deleted
    C:\WINDOWS\system32\2E9.tmp - Deleted
    C:\WINDOWS\system32\2EA.tmp - Deleted
    C:\WINDOWS\system32\2EB.tmp - Deleted
    C:\WINDOWS\system32\2EC.tmp - Deleted
    C:\WINDOWS\system32\2ED.tmp - Deleted
    C:\WINDOWS\system32\2EE.tmp - Deleted
    C:\WINDOWS\system32\2EF.tmp - Deleted
    C:\WINDOWS\system32\2F.tmp - Deleted
    C:\WINDOWS\system32\2F0.tmp - Deleted
    C:\WINDOWS\system32\2F1.tmp - Deleted
    C:\WINDOWS\system32\2F2.tmp - Deleted
    C:\WINDOWS\system32\2F3.tmp - Deleted
    C:\WINDOWS\system32\2F4.tmp - Deleted
    C:\WINDOWS\system32\2F5.tmp - Deleted
    C:\WINDOWS\system32\2F6.tmp - Deleted
    C:\WINDOWS\system32\2F7.tmp - Deleted
    C:\WINDOWS\system32\2F8.tmp - Deleted
    C:\WINDOWS\system32\2F9.tmp - Deleted
    C:\WINDOWS\system32\2FA.tmp - Deleted
    C:\WINDOWS\system32\2FB.tmp - Deleted
    C:\WINDOWS\system32\2FC.tmp - Deleted
    C:\WINDOWS\system32\2FD.tmp - Deleted
    C:\WINDOWS\system32\2FE.tmp - Deleted
    C:\WINDOWS\system32\2FF.tmp - Deleted
    C:\WINDOWS\system32\13B.tmp - Deleted
    C:\WINDOWS\system32\13C.tmp - Deleted
    C:\WINDOWS\system32\13D.tmp - Deleted
    C:\WINDOWS\system32\13E.tmp - Deleted
    C:\WINDOWS\system32\13F.tmp - Deleted
    C:\WINDOWS\system32\14.tmp - Deleted
    C:\WINDOWS\system32\140.tmp - Deleted
    C:\WINDOWS\system32\141.tmp - Deleted
    C:\WINDOWS\system32\142.tmp - Deleted
    C:\WINDOWS\system32\143.tmp - Deleted
    C:\WINDOWS\system32\144.tmp - Deleted
    C:\WINDOWS\system32\145.tmp - Deleted
    C:\WINDOWS\system32\146.tmp - Deleted
    C:\WINDOWS\system32\147.tmp - Deleted
    C:\WINDOWS\system32\148.tmp - Deleted
    C:\WINDOWS\system32\149.tmp - Deleted
    C:\WINDOWS\system32\14A.tmp - Deleted
    C:\WINDOWS\system32\14B.tmp - Deleted
    C:\WINDOWS\system32\14C.tmp - Deleted
    C:\WINDOWS\system32\14D.tmp - Deleted
    C:\WINDOWS\system32\14E.tmp - Deleted
    C:\WINDOWS\system32\14F.tmp - Deleted
    C:\WINDOWS\system32\15.tmp - Deleted
    C:\WINDOWS\system32\150.tmp - Deleted
    C:\WINDOWS\system32\151.tmp - Deleted
    C:\WINDOWS\system32\152.tmp - Deleted
    C:\WINDOWS\system32\153.tmp - Deleted
    C:\WINDOWS\system32\154.tmp - Deleted
    C:\WINDOWS\system32\155.tmp - Deleted
    C:\WINDOWS\system32\156.tmp - Deleted
    C:\WINDOWS\system32\157.tmp - Deleted
    C:\WINDOWS\system32\158.tmp - Deleted
    C:\WINDOWS\system32\159.tmp - Deleted
    C:\WINDOWS\system32\15A.tmp - Deleted
    C:\WINDOWS\system32\15B.tmp - Deleted
    C:\WINDOWS\system32\15C.tmp - Deleted
    C:\WINDOWS\system32\15D.tmp - Deleted
    C:\WINDOWS\system32\15E.tmp - Deleted
    C:\WINDOWS\system32\15F.tmp - Deleted
    C:\WINDOWS\system32\16.tmp - Deleted
    C:\WINDOWS\system32\160.tmp - Deleted
    C:\WINDOWS\system32\161.tmp - Deleted
    C:\WINDOWS\system32\162.tmp - Deleted
    C:\WINDOWS\system32\163.tmp - Deleted
    C:\WINDOWS\system32\164.tmp - Deleted
    C:\WINDOWS\system32\165.tmp - Deleted
    C:\WINDOWS\system32\166.tmp - Deleted
    C:\WINDOWS\system32\167.tmp - Deleted
    C:\WINDOWS\system32\168.tmp - Deleted
    C:\WINDOWS\system32\16B.tmp - Deleted
    C:\WINDOWS\system32\16C.tmp - Deleted
    C:\WINDOWS\system32\16D.tmp - Deleted
    C:\WINDOWS\system32\16E.tmp - Deleted
    C:\WINDOWS\system32\16F.tmp - Deleted
    C:\WINDOWS\system32\17.tmp - Deleted
    C:\WINDOWS\system32\170.tmp - Deleted
    C:\WINDOWS\system32\171.tmp - Deleted
    C:\WINDOWS\system32\172.tmp - Deleted
    C:\WINDOWS\system32\173.tmp - Deleted
    C:\WINDOWS\system32\174.tmp - Deleted
    C:\WINDOWS\system32\175.tmp - Deleted
    C:\WINDOWS\system32\176.tmp - Deleted
    C:\WINDOWS\system32\177.tmp - Deleted
    C:\WINDOWS\system32\178.tmp - Deleted
    C:\WINDOWS\system32\179.tmp - Deleted
    C:\WINDOWS\system32\17A.tmp - Deleted
    C:\WINDOWS\system32\17B.tmp - Deleted
    C:\WINDOWS\system32\17C.tmp - Deleted
    C:\WINDOWS\system32\17D.tmp - Deleted
    C:\WINDOWS\system32\17E.tmp - Deleted
    C:\WINDOWS\system32\17F.tmp - Deleted
    C:\WINDOWS\system32\18.tmp - Deleted
    C:\WINDOWS\system32\180.tmp - Deleted
    C:\WINDOWS\system32\181.tmp - Deleted
    C:\WINDOWS\system32\182.tmp - Deleted
    C:\WINDOWS\system32\183.tmp - Deleted
    C:\WINDOWS\system32\184.tmp - Deleted
    C:\WINDOWS\system32\185.tmp - Deleted
    C:\WINDOWS\system32\186.tmp - Deleted
    C:\WINDOWS\system32\187.tmp - Deleted
    C:\WINDOWS\system32\188.tmp - Deleted
    C:\WINDOWS\system32\189.tmp - Deleted
    C:\WINDOWS\system32\18A.tmp - Deleted
    C:\WINDOWS\system32\18B.tmp - Deleted
    C:\WINDOWS\system32\18C.tmp - Deleted
    C:\WINDOWS\system32\18D.tmp - Deleted
    C:\WINDOWS\system32\18E.tmp - Deleted
    C:\WINDOWS\system32\18F.tmp - Deleted
    C:\WINDOWS\system32\19.tmp - Deleted
    C:\WINDOWS\system32\190.tmp - Deleted
    C:\WINDOWS\system32\191.tmp - Deleted
    C:\WINDOWS\system32\194.tmp - Deleted
    C:\WINDOWS\system32\195.tmp - Deleted
    C:\WINDOWS\system32\196.tmp - Deleted
    C:\WINDOWS\system32\197.tmp - Deleted
    C:\WINDOWS\system32\198.tmp - Deleted
    C:\WINDOWS\system32\199.tmp - Deleted
    C:\WINDOWS\system32\19A.tmp - Deleted
    C:\WINDOWS\system32\19B.tmp - Deleted
    C:\WINDOWS\system32\19C.tmp - Deleted
    C:\WINDOWS\system32\19D.tmp - Deleted
    C:\WINDOWS\system32\19E.tmp - Deleted
    C:\WINDOWS\system32\19F.tmp - Deleted
    C:\WINDOWS\system32\1A.tmp - Deleted
    C:\WINDOWS\system32\1A0.tmp - Deleted
    C:\WINDOWS\system32\1A1.tmp - Deleted
    C:\WINDOWS\system32\1A2.tmp - Deleted
    C:\WINDOWS\system32\1A3.tmp - Deleted
    C:\WINDOWS\system32\1A4.tmp - Deleted
    C:\WINDOWS\system32\1A5.tmp - Deleted
    C:\WINDOWS\system32\1A6.tmp - Deleted
    C:\WINDOWS\system32\1A7.tmp - Deleted
    C:\WINDOWS\system32\1A8.tmp - Deleted
    C:\WINDOWS\system32\1A9.tmp - Deleted
    C:\WINDOWS\system32\1AA.tmp - Deleted
    C:\WINDOWS\system32\1AB.tmp - Deleted
    C:\WINDOWS\system32\1AC.tmp - Deleted
    C:\WINDOWS\system32\1AD.tmp - Deleted
    C:\WINDOWS\system32\1AE.tmp - Deleted
    C:\WINDOWS\system32\1AF.tmp - Deleted
    C:\WINDOWS\system32\1B.tmp - Deleted
    C:\WINDOWS\system32\1B0.tmp - Deleted
    C:\WINDOWS\system32\1B1.tmp - Deleted
    C:\WINDOWS\system32\1B2.tmp - Deleted
    C:\WINDOWS\system32\1B3.tmp - Deleted
    C:\WINDOWS\system32\1B4.tmp - Deleted
    C:\WINDOWS\system32\1B5.tmp - Deleted
    C:\WINDOWS\system32\1B6.tmp - Deleted
    C:\WINDOWS\system32\1B7.tmp - Deleted
    C:\WINDOWS\system32\1B8.tmp - Deleted
    C:\WINDOWS\system32\1B9.tmp - Deleted
    C:\WINDOWS\system32\1BA.tmp - Deleted
    C:\WINDOWS\system32\1BB.tmp - Deleted
    C:\WINDOWS\system32\1BC.tmp - Deleted
    C:\WINDOWS\system32\1BD.tmp - Deleted
    C:\WINDOWS\system32\1BE.tmp - Deleted
    C:\WINDOWS\system32\1BF.tmp - Deleted
    C:\WINDOWS\system32\1C.tmp - Deleted
    C:\WINDOWS\system32\1C0.tmp - Deleted
    C:\WINDOWS\system32\1C1.tmp - Deleted
    C:\WINDOWS\system32\1C2.tmp - Deleted
    C:\WINDOWS\system32\1C3.tmp - Deleted
    C:\WINDOWS\system32\1C4.tmp - Deleted
    C:\WINDOWS\system32\1C5.tmp - Deleted
    C:\WINDOWS\system32\1C6.tmp - Deleted
    C:\WINDOWS\system32\1C7.tmp - Deleted
    C:\WINDOWS\system32\1C8.tmp - Deleted
    C:\WINDOWS\system32\1C9.tmp - Deleted
    C:\WINDOWS\system32\1CA.tmp - Deleted
    C:\WINDOWS\system32\1CB.tmp - Deleted
    C:\WINDOWS\system32\1CC.tmp - Deleted
    C:\WINDOWS\system32\1CD.tmp - Deleted
    C:\WINDOWS\system32\1CE.tmp - Deleted
    C:\WINDOWS\system32\1CF.tmp - Deleted
    C:\WINDOWS\system32\1D.tmp - Deleted
    C:\WINDOWS\system32\1D0.tmp - Deleted
    C:\WINDOWS\system32\1D1.tmp - Deleted
    C:\WINDOWS\system32\1D2.tmp - Deleted
    C:\WINDOWS\system32\1D3.tmp - Deleted
    C:\WINDOWS\system32\1D4.tmp - Deleted
    C:\WINDOWS\system32\1D5.tmp - Deleted
    C:\WINDOWS\system32\1D6.tmp - Deleted
    C:\WINDOWS\system32\1D7.tmp - Deleted
    C:\WINDOWS\system32\1D8.tmp - Deleted
    C:\WINDOWS\system32\1D9.tmp - Deleted
    C:\WINDOWS\system32\1DA.tmp - Deleted
    C:\WINDOWS\system32\1DB.tmp - Deleted
    C:\WINDOWS\system32\1DC.tmp - Deleted
    C:\WINDOWS\system32\1DD.tmp - Deleted
    C:\WINDOWS\system32\1DE.tmp - Deleted
    C:\WINDOWS\system32\1DF.tmp - Deleted
    C:\WINDOWS\system32\1E.tmp - Deleted
    C:\WINDOWS\system32\1E0.tmp - Deleted
    C:\WINDOWS\system32\1E1.tmp - Deleted
    C:\WINDOWS\system32\1E2.tmp - Deleted
    C:\WINDOWS\system32\1E3.tmp - Deleted
    C:\WINDOWS\system32\1E4.tmp - Deleted
    C:\WINDOWS\system32\1E5.tmp - Deleted
    C:\WINDOWS\system32\1E6.tmp - Deleted
    C:\WINDOWS\system32\1E7.tmp - Deleted
    C:\WINDOWS\system32\1E8.tmp - Deleted
    C:\WINDOWS\system32\1E9.tmp - Deleted
    C:\WINDOWS\system32\1EA.tmp - Deleted
    C:\WINDOWS\system32\1EB.tmp - Deleted
    C:\WINDOWS\system32\1EC.tmp - Deleted
    C:\WINDOWS\system32\1ED.tmp - Deleted
    C:\WINDOWS\system32\1EE.tmp - Deleted
    C:\WINDOWS\system32\1EF.tmp - Deleted
    C:\WINDOWS\system32\1F.tmp - Deleted
    C:\WINDOWS\system32\1F0.tmp - Deleted
    C:\WINDOWS\system32\1F1.tmp - Deleted
    C:\WINDOWS\system32\1F2.tmp - Deleted
    C:\WINDOWS\system32\1F3.tmp - Deleted
    C:\WINDOWS\system32\1F4.tmp - Deleted
    C:\WINDOWS\system32\1F5.tmp - Deleted
    C:\WINDOWS\system32\1F6.tmp - Deleted
    C:\WINDOWS\system32\1F8.tmp - Deleted
    C:\WINDOWS\system32\1FA.tmp - Deleted
    C:\WINDOWS\system32\1FB.tmp - Deleted
    C:\WINDOWS\system32\1FC.tmp - Deleted
    C:\WINDOWS\system32\1FD.tmp - Deleted
    C:\WINDOWS\system32\1FE.tmp - Deleted
    C:\WINDOWS\system32\1FF.tmp - Deleted

    Removing Temp Files

    [b]ADS Check [/b]:

    [b]Final Check [/b]:

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

    http://www.gmer.net
    Rootkit scan 2008-09-23 16:00:48
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s0"=dword:634149a2
    "s1"=dword:df23f847
    "s2"=dword:921396f1
    "h0"=dword:00000001

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53

    EA4]
    "p0"="C:\Program Files\DAEMON Tools\"
    "h0"=dword:00000000
    "khjeh"=hex:4a,99,91,4b,60,21,b9,ec,63,4c,12,89,bc,a6,32,fe,65,85,88,15,c5,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53

    EA4\00000001]
    "a0"=hex:20,01,00,00,94,e3,34,f9,85,f6,68,20,e4,38,fe,5a,68,d7,0e,ed,7a,..
    "khjeh"=hex:6b,af,66,8f,65,b5,b1,e4,b8,d4,c0,13,98,b4,cc,da,d2,90,ee,70,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53

    EA4\00000001\0Jf40]
    "khjeh"=hex:d7,5f,03,c0,95,7c,5f,85,1b,3c,e1,f7,72,1e,48,54,ee,3f,3f,16,d9,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools\"
    "h0"=dword:00000000
    "khjeh"=hex:4a,99,91,4b,60,21,b9,ec,63,4c,12,89,bc,a6,32,fe,65,85,88,15,c5,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\

    00000001]
    "a0"=hex:20,01,00,00,94,e3,34,f9,85,f6,68,20,e4,38,fe,5a,68,d7,0e,ed,7a,..
    "khjeh"=hex:6b,af,66,8f,65,b5,b1,e4,b8,d4,c0,13,98,b4,cc,da,d2,90,ee,70,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\

    00000001\0Jf40]
    "khjeh"=hex:d7,5f,03,c0,95,7c,5f,85,1b,3c,e1,f7,72,1e,48,54,ee,3f,3f,16,d9,..

    scanning hidden registry entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0

    [b]Remaining Services [/b]:

    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy

    \standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-

    22019"
    "C:\\Documents and Settings\\wilgett\\Mes documents\\My Games\\Counter-Strike

    Source\\hl2.exe"="C:\\Documents and Settings\\wilgett\\Mes documents\\My

    Games\\Counter-Strike Source\\hl2.exe:*:Disabled:hl2"
    "C:\\NeverwinterNights\\NWN\\nwmain.exe"="C:\\NeverwinterNights\\NWN\\nwmain.exe:*:Disabled:

    Neverwinter Nights"
    "C:\\Program Files\\NAMCO BANDAI Games\\Warhammer© Mark of

    Chaos\\Warhammer.exe"="C:\\Program Files\\NAMCO BANDAI Games\\Warhammer© Mark of

    Chaos\\Warhammer.exe:*:Enabled:Warhammer©: Mark of ChaosT"
    "C:\\Program Files\\Electronic Arts\\La Bataille pour la Terre du Milieu

    II\\game.dat"="C:\\Program Files\\Electronic Arts\\La Bataille pour la Terre du Milieu

    II\\game.dat:*:Enabled:La Bataille pour la Terre du Milieu T II"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program

    Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
    "C:\\Program Files\\Soulseek-Test\\slsk.exe"="C:\\Program

    Files\\Soulseek-Test\\slsk.exe:*:Enabled:SoulSeek"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows

    Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows

    Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "E:\\Applications\\eMule\\emule.exe"="E:\\Applications\\eMule\\emule.exe:*:Enabled:eMule"
    "C:\\Program Files\\Ubisoft\\Heroes of Might and Magic V\\bin\\H5_Game.exe"="C:\\Program

    Files\\Ubisoft\\Heroes of Might and Magic V\\bin\\H5_Game.exe:*:Enabled:Heroes of Might and

    Magic V"
    "C:\\Program Files\\IncrediMail\\bin\\ImApp.exe"="C:\\Program

    Files\\IncrediMail\\bin\\ImApp.exe:*:Enabled:IncrediMail"
    "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"="C:\\Program

    Files\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail"
    "C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"="C:\\Program

    Files\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail"
    "E:\\JEUX\\heros5maps\\Heroes of Might and Magic V - Tribes of the

    East\\bin\\H5_Game.exe"="E:\\JEUX\\heros5maps\\Heroes of Might and Magic V - Tribes of the

    East\\bin\\H5_Game.exe:*:Enabled:Heroes of Might and Magic V"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy

    \domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-

    22019"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows

    Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows

    Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    [b]Remaining Files [/b]:

    File Backups: - C:\SDFix\backups\backups.zip

    [b]Files with Hidden Attributes [/b]:

    Fri 26 Jan 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Fri 29 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All

    Users\DRM\Cache\Indiv01.tmp"
    Fri 8 Sep 2006 0 A..H. ---

    "C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\c7c7a391754ccb26fa038f9569884d16\BIT34.tm

    p"

    [b]Finished![/b]
    0
  12. perchette
     
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:06:28, on 23/09/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamtrayctrl.exe
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\program files\orange\media player\Media Player.exe
    C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
    C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
    C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Sony Ericsson\Mobile2\File Manager\SendToDevice.exe
    C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
    C:\Program Files\OpenOffice.org 2.4\program\stclient_wrapper.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
    O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [KiweeHook] "C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
    O4 - HKLM\..\Run: [PlatriumWeather] "C:\Program Files\Platrium\bin\1.2.103.0\Weather.exe" -auto
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [OrangePlayer] c:\program files\orange\media player\Media Player.exe /systray
    O4 - HKCU\..\Run: [DriverUpdaterPro] C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [OrangePlayer] c:\program files\orange\media player\Media Player.exe /systray (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Iomega Product Registration.lnk = C:\Program Files\Iomega\Registration\Register.exe
    O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
    O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - E:\JEUX\pocker\PACIFI~1\pacificpoker.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: CabBuilder - http://ak.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/flashax.cab
    O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
    O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://ww38.instantaction.com/download/iaplayer.cab
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    0
  14. perchette
     
    ComboFix 08-09-22.06 - wilgett 2008-09-24 12:48:13.1 - NTFSx86
    Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.590 [GMT 2:00]
    Lancé depuis: C:\Documents and Settings\wilgett\Bureau\ComboFix.exe
    * Un nouveau point de restauration a été créé

    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\MSINET.oca

    .
    ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-24 au 2008-09-24 ))))))))))))))))))))))))))))))))))))
    .

    2008-09-23 15:47 . 2008-09-23 15:47 <REP> d-------- C:\WINDOWS\ERUNT
    2008-09-23 15:39 . 2008-09-23 16:04 <REP> d-------- C:\SDFix
    2008-09-23 13:31 . 2008-09-23 13:31 <REP> d-------- C:\Program Files\Trend Micro
    2008-09-22 21:57 . 2008-09-23 13:29 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-22 21:57 . 2008-09-22 21:57 <REP> d-------- C:\Documents and Settings\wilgett\Application Data\Malwarebytes
    2008-09-22 21:57 . 2008-09-22 21:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-22 21:57 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-09-22 21:57 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-09-22 21:22 . 2008-09-23 15:05 1,246 --a------ C:\WINDOWS\system32\tmp.reg
    2008-09-17 14:48 . 2008-09-17 14:48 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-09-17 14:48 . 2008-09-17 14:48 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-09-11 11:29 . 2008-09-11 11:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Last.fm
    2008-09-11 11:28 . 2008-09-11 11:28 <REP> d-------- C:\Program Files\Last.fm
    2008-09-10 13:08 . 2008-09-21 18:01 <REP> d-------- C:\Program Files\Fichiers communs\Symantec Shared
    2008-09-09 16:20 . 2008-09-21 18:00 <REP> d-------- C:\Program Files\Norton Security Scan
    2008-09-09 13:31 . 2008-09-09 13:31 <REP> d-------- C:\Program Files\Fichiers communs\BOONTY Shared
    2008-09-09 13:31 . 2008-09-09 13:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\BOONTY
    2008-09-07 12:56 . 2008-09-07 13:00 37 --a------ C:\WINDOWS\marscam.ini
    2008-09-07 12:55 . 2008-09-07 12:55 <REP> d-------- C:\Program Files\DC505
    2008-09-07 12:55 . 2002-06-05 19:25 352,256 --a------ C:\WINDOWS\system32\ijl15.dll
    2008-09-07 12:55 . 2002-06-05 19:25 205,824 --a------ C:\WINDOWS\system32\Vic32.dll
    2008-09-07 12:55 . 2002-06-21 18:34 135,168 --a------ C:\WINDOWS\system32\mr310ipv.dll
    2008-09-07 12:55 . 2002-07-03 18:01 115,790 --a------ C:\WINDOWS\system32\drivers\MR97310v.sys
    2008-09-07 12:55 . 2002-07-01 08:14 61,440 --a------ C:\WINDOWS\system32\mr310ifv.dll
    2008-09-07 12:55 . 2002-06-09 11:51 49,152 --a------ C:\WINDOWS\system32\mr310exv.dll
    2008-09-07 12:55 . 2002-06-09 11:57 28,672 --a------ C:\WINDOWS\system32\mr310exd.dll
    2008-09-07 12:55 . 2002-06-05 19:25 15,164 --a------ C:\WINDOWS\Mr310twv.ini
    2008-09-07 12:55 . 2002-06-05 19:25 12,106 --a------ C:\WINDOWS\Mr310twv.src
    2008-09-06 22:08 . 2008-09-06 23:09 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2008-09-04 21:35 . 2008-09-08 17:14 <REP> d-------- C:\Documents and Settings\wilgett\Application Data\Zylom
    2008-09-04 21:35 . 2008-09-04 21:35 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Zylom
    2008-09-02 16:04 . 2008-09-24 12:44 <REP> d-------- C:\Documents and Settings\wilgett\Application Data\OpenOffice.org2
    2008-09-02 15:59 . 2008-09-02 15:59 <REP> d-------- C:\Program Files\OpenOffice.org 2.4
    2008-08-31 14:50 . 2008-08-31 14:50 <REP> d-------- C:\Documents and Settings\wilgett\Application Data\Leadertech
    2008-08-31 14:48 . 2008-08-31 14:56 <REP> d-------- C:\Program Files\Iomega

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-22 18:41 106,496 ----a-w C:\WINDOWS\system32\5C0.tmp
    2008-09-22 18:41 106,496 ----a-w C:\WINDOWS\system32\5BF.tmp
    2008-09-22 18:41 106,496 ----a-w C:\WINDOWS\system32\5BE.tmp
    2008-09-22 18:40 106,496 ----a-w C:\WINDOWS\system32\5BD.tmp
    2008-09-22 18:40 106,496 ----a-w C:\WINDOWS\system32\5BC.tmp
    2008-09-22 18:40 106,496 ----a-w C:\WINDOWS\system32\5BB.tmp
    2008-09-22 18:40 106,496 ----a-w C:\WINDOWS\system32\5BA.tmp
    2008-09-22 18:40 106,496 ----a-w C:\WINDOWS\system32\5B9.tmp
    2008-09-22 18:40 106,496 ----a-w C:\WINDOWS\system32\5B8.tmp
    2008-09-22 18:40 106,496 ----a-w C:\WINDOWS\system32\5B7.tmp
    2008-09-22 18:40 106,496 ----a-w C:\WINDOWS\system32\5B6.tmp
    2008-09-22 18:40 106,496 ----a-w C:\WINDOWS\system32\5B5.tmp
    2008-09-22 18:40 106,496 ----a-w C:\WINDOWS\system32\5B4.tmp
    2008-09-22 18:39 106,496 ----a-w C:\WINDOWS\system32\5B3.tmp
    2008-09-22 18:39 106,496 ----a-w C:\WINDOWS\system32\5B2.tmp
    2008-09-22 18:39 106,496 ----a-w C:\WINDOWS\system32\5B1.tmp
    2008-09-22 18:39 106,496 ----a-w C:\WINDOWS\system32\5B0.tmp
    2008-09-22 18:39 106,496 ----a-w C:\WINDOWS\system32\5AF.tmp
    2008-09-22 18:39 106,496 ----a-w C:\WINDOWS\system32\5AE.tmp
    2008-09-22 18:39 106,496 ----a-w C:\WINDOWS\system32\5AD.tmp
    2008-09-22 18:39 106,496 ----a-w C:\WINDOWS\system32\5AC.tmp
    2008-09-22 18:39 106,496 ----a-w C:\WINDOWS\system32\5AB.tmp
    2008-09-22 18:39 106,496 ----a-w C:\WINDOWS\system32\5AA.tmp
    2008-09-22 18:38 106,496 ----a-w C:\WINDOWS\system32\5A9.tmp
    2008-09-22 18:38 106,496 ----a-w C:\WINDOWS\system32\5A8.tmp
    2008-09-22 18:38 106,496 ----a-w C:\WINDOWS\system32\5A7.tmp
    2008-09-22 18:38 106,496 ----a-w C:\WINDOWS\system32\5A6.tmp
    2008-09-22 18:38 106,496 ----a-w C:\WINDOWS\system32\5A5.tmp
    2008-09-22 18:38 106,496 ----a-w C:\WINDOWS\system32\5A4.tmp
    2008-09-22 18:38 106,496 ----a-w C:\WINDOWS\system32\5A3.tmp
    2008-09-22 18:38 106,496 ----a-w C:\WINDOWS\system32\5A2.tmp
    2008-09-22 18:38 106,496 ----a-w C:\WINDOWS\system32\5A1.tmp
    2008-09-22 18:38 106,496 ----a-w C:\WINDOWS\system32\5A0.tmp
    2008-09-22 18:37 106,496 ----a-w C:\WINDOWS\system32\59F.tmp
    2008-09-22 18:37 106,496 ----a-w C:\WINDOWS\system32\59E.tmp
    2008-09-22 18:37 106,496 ----a-w C:\WINDOWS\system32\59D.tmp
    2008-09-22 18:37 106,496 ----a-w C:\WINDOWS\system32\59C.tmp
    2008-09-22 18:37 106,496 ----a-w C:\WINDOWS\system32\59B.tmp
    2008-09-22 18:37 106,496 ----a-w C:\WINDOWS\system32\59A.tmp
    2008-09-22 18:37 106,496 ----a-w C:\WINDOWS\system32\599.tmp
    2008-09-22 18:37 106,496 ----a-w C:\WINDOWS\system32\598.tmp
    2008-09-22 18:37 106,496 ----a-w C:\WINDOWS\system32\597.tmp
    2008-09-22 18:36 106,496 ----a-w C:\WINDOWS\system32\596.tmp
    2008-09-22 18:36 106,496 ----a-w C:\WINDOWS\system32\595.tmp
    2008-09-22 18:36 106,496 ----a-w C:\WINDOWS\system32\594.tmp
    2008-09-22 18:36 106,496 ----a-w C:\WINDOWS\system32\593.tmp
    2008-09-22 18:36 106,496 ----a-w C:\WINDOWS\system32\592.tmp
    2008-09-22 18:36 106,496 ----a-w C:\WINDOWS\system32\591.tmp
    2008-09-22 18:36 106,496 ----a-w C:\WINDOWS\system32\590.tmp
    2008-09-22 18:36 106,496 ----a-w C:\WINDOWS\system32\58F.tmp
    2008-09-22 18:36 106,496 ----a-w C:\WINDOWS\system32\58E.tmp
    2008-09-22 18:36 106,496 ----a-w C:\WINDOWS\system32\58D.tmp
    2008-09-22 18:35 106,496 ----a-w C:\WINDOWS\system32\58C.tmp
    2008-09-22 18:35 106,496 ----a-w C:\WINDOWS\system32\589.tmp
    2008-09-22 18:35 106,496 ----a-w C:\WINDOWS\system32\588.tmp
    2008-09-22 18:35 106,496 ----a-w C:\WINDOWS\system32\587.tmp
    2008-09-22 18:35 106,496 ----a-w C:\WINDOWS\system32\586.tmp
    2008-09-22 18:35 106,496 ----a-w C:\WINDOWS\system32\585.tmp
    2008-09-22 18:35 106,496 ----a-w C:\WINDOWS\system32\584.tmp
    2008-09-22 18:35 106,496 ----a-w C:\WINDOWS\system32\583.tmp
    2008-09-22 18:35 106,496 ----a-w C:\WINDOWS\system32\582.tmp
    2008-09-22 18:35 106,496 ----a-w C:\WINDOWS\system32\581.tmp
    2008-09-22 18:34 106,496 ----a-w C:\WINDOWS\system32\580.tmp
    2008-09-22 18:34 106,496 ----a-w C:\WINDOWS\system32\57F.tmp
    2008-09-22 18:34 106,496 ----a-w C:\WINDOWS\system32\57E.tmp
    2008-09-22 18:34 106,496 ----a-w C:\WINDOWS\system32\57D.tmp
    2008-09-22 18:34 106,496 ----a-w C:\WINDOWS\system32\57C.tmp
    2008-09-22 18:34 106,496 ----a-w C:\WINDOWS\system32\57B.tmp
    2008-09-22 18:34 106,496 ----a-w C:\WINDOWS\system32\57A.tmp
    2008-09-22 18:34 106,496 ----a-w C:\WINDOWS\system32\579.tmp
    2008-09-22 18:34 106,496 ----a-w C:\WINDOWS\system32\578.tmp
    2008-09-22 18:34 106,496 ----a-w C:\WINDOWS\system32\577.tmp
    2008-09-22 18:33 106,496 ----a-w C:\WINDOWS\system32\576.tmp
    2008-09-22 18:33 106,496 ----a-w C:\WINDOWS\system32\575.tmp
    2008-09-22 18:33 106,496 ----a-w C:\WINDOWS\system32\574.tmp
    2008-09-22 18:33 106,496 ----a-w C:\WINDOWS\system32\573.tmp
    2008-09-22 18:33 106,496 ----a-w C:\WINDOWS\system32\572.tmp
    2008-09-22 18:33 106,496 ----a-w C:\WINDOWS\system32\571.tmp
    2008-09-22 18:33 106,496 ----a-w C:\WINDOWS\system32\570.tmp
    2008-09-22 18:33 106,496 ----a-w C:\WINDOWS\system32\56F.tmp
    2008-09-22 18:33 106,496 ----a-w C:\WINDOWS\system32\56E.tmp
    2008-09-22 18:32 106,496 ----a-w C:\WINDOWS\system32\56D.tmp
    2008-09-22 18:32 106,496 ----a-w C:\WINDOWS\system32\56C.tmp
    2008-09-22 18:32 106,496 ----a-w C:\WINDOWS\system32\56B.tmp
    2008-09-22 18:32 106,496 ----a-w C:\WINDOWS\system32\56A.tmp
    2008-09-22 18:32 106,496 ----a-w C:\WINDOWS\system32\569.tmp
    2008-09-22 18:32 106,496 ----a-w C:\WINDOWS\system32\568.tmp
    2008-09-22 18:32 106,496 ----a-w C:\WINDOWS\system32\567.tmp
    2008-09-22 18:32 106,496 ----a-w C:\WINDOWS\system32\566.tmp
    2008-09-22 18:32 106,496 ----a-w C:\WINDOWS\system32\565.tmp
    2008-09-22 18:32 106,496 ----a-w C:\WINDOWS\system32\564.tmp
    2008-09-22 18:31 106,496 ----a-w C:\WINDOWS\system32\563.tmp
    2008-09-22 18:31 106,496 ----a-w C:\WINDOWS\system32\562.tmp
    2008-09-22 18:31 106,496 ----a-w C:\WINDOWS\system32\561.tmp
    2008-09-22 18:31 106,496 ----a-w C:\WINDOWS\system32\560.tmp
    2008-09-22 18:31 106,496 ----a-w C:\WINDOWS\system32\55F.tmp
    2008-09-22 18:31 106,496 ----a-w C:\WINDOWS\system32\55E.tmp
    2008-09-22 18:31 106,496 ----a-w C:\WINDOWS\system32\55D.tmp
    2008-09-22 18:31 106,496 ----a-w C:\WINDOWS\system32\55C.tmp
    2008-09-22 18:31 106,496 ----a-w C:\WINDOWS\system32\55B.tmp
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll" [2008-01-24 248976]

    [HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
    [HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
    [HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
    [HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}]
    2008-01-24 17:09 248976 --a------ C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll" [2008-01-24 248976]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{6638A9DE-0745-4292-8A2E-AE530E7B9B3F}"= "C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll" [2008-01-24 248976]

    [HKEY_CLASSES_ROOT\clsid\{6638a9de-0745-4292-8a2e-ae530e7b9b3f}]
    [HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar.1]
    [HKEY_CLASSES_ROOT\TypeLib\{259EEB17-79AA-44DF-8410-8E55F82A902A}]
    [HKEY_CLASSES_ROOT\KiweeIEToolbar.KiweeToolbar]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-18 68856]
    "OrangePlayer"="c:\program files\orange\media player\Media Player.exe" [2008-06-05 319488]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 8491008]
    "KiweeHook"="C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe" [2008-01-24 48264]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-01 98304]
    "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-03-28 593920]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 15360]
    "OrangePlayer"="c:\program files\orange\media player\Media Player.exe" [2008-06-05 319488]

    C:\Documents and Settings\wilgett\Menu D‚marrer\Programmes\D‚marrage\
    Iomega Product Registration.lnk - C:\Program Files\Iomega\Registration\Register.exe [2004-02-04 16175104]
    OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.VP40"= vp4vfw.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^NkbMonitor.exe.lnk]
    path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\NkbMonitor.exe.lnk
    backup=C:\WINDOWS\pss\NkbMonitor.exe.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
    --a--c--- 2005-12-10 16:57 133016 C:\Program Files\DAEMON Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --------- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2006-12-01 17:54 98304 C:\Program Files\QuickTime\qttask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
    --a--c--- 2006-06-21 19:14 35328 C:\Program Files\Winamp\winampa.exe

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Documents and Settings\\wilgett\\Mes documents\\My Games\\Counter-Strike Source\\hl2.exe"=
    "C:\\Program Files\\Electronic Arts\\La Bataille pour la Terre du Milieu II\\game.dat"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Soulseek-Test\\slsk.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "E:\\Applications\\eMule\\emule.exe"=
    "C:\\Program Files\\Ubisoft\\Heroes of Might and Magic V\\bin\\H5_Game.exe"=
    "E:\\JEUX\\heros5maps\\Heroes of Might and Magic V - Tribes of the East\\bin\\H5_Game.exe"=

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
    S2 MBAMService;MBAMService;C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-09-10 110256]
    S3 Boonty Games;Boonty Games;C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2008-09-09 69120]
    S3 se59bus;Sony Ericsson Device 089 driver (WDM);C:\WINDOWS\system32\DRIVERS\se59bus.sys [2006-09-05 61536]
    S3 se59mdfl;Sony Ericsson Device 089 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se59mdfl.sys [2006-09-05 9360]
    S3 se59mdm;Sony Ericsson Device 089 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se59mdm.sys [2006-09-05 97088]
    S3 se59mgmt;Sony Ericsson Device 089 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se59mgmt.sys [2006-09-05 88624]
    S3 se59nd5;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (NDIS);C:\WINDOWS\system32\DRIVERS\se59nd5.sys [2006-09-05 18704]
    S3 se59obex;Sony Ericsson Device 089 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se59obex.sys [2006-09-05 86432]
    S3 se59unic;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (WDM);C:\WINDOWS\system32\DRIVERS\se59unic.sys [2006-09-05 90800]

    *Newly Created Service* - PROCEXP90
    .
    Contenu du dossier 'Tâches planifiées'
    .
    - - - - ORPHELINS SUPPRIMES - - - -

    HKCU-Run-DriverUpdaterPro - C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe
    HKLM-Run-PlatriumWeather - C:\Program Files\Platrium\bin\1.2.103.0\Weather.exe

    .
    ------- Examen supplémentaire -------
    .
    FireFox -: Profile - C:\Documents and Settings\wilgett\Application Data\Mozilla\Firefox\Profiles\q1bvvzze.default\
    FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-24 12:51:04
    Windows 5.1.2600 Service Pack 2 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    Recherche de fichiers cachés ...

    Scan terminé avec succès
    Fichiers cachés: 0

    **************************************************************************
    .
    Heure de fin: 2008-09-24 12:56:41
    ComboFix-quarantined-files.txt 2008-09-24 10:55:46

    Avant-CF: 2ÿ148ÿ130ÿ816 octets libres
    Après-CF: 2,646,171,648 octets libres

    252 --- E O F --- 2008-09-11 06:31:32
    0
  15. perchette
     
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:57:20, on 24/09/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\program files\orange\media player\Media Player.exe
    C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
    C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
    C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
    C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
    O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\1.2.116\KiweeIEToolbar.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [KiweeHook] "C:\Program Files\Kiwee Toolbar2\1.2.116\kwtbaim.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [OrangePlayer] c:\program files\orange\media player\Media Player.exe /systray
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [OrangePlayer] c:\program files\orange\media player\Media Player.exe /systray (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Iomega Product Registration.lnk = C:\Program Files\Iomega\Registration\Register.exe
    O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
    O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - E:\JEUX\pocker\PACIFI~1\pacificpoker.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: CabBuilder - http://ak.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/flashax.cab
    O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
    O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://ww38.instantaction.com/download/iaplayer.cab
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    0
  16. perchette
     
    Merci de m'aider, j'étais perdu sans vous, lol, enfin ma tête allée tomber
    0
  17. perchette
     
    ok mais j'ai tellement paniqué que avant de vous contacter j'ai installé MBAM, mais la version payante

    Pas de moqueries, ou de grondements, c'est la peur qui l'a fait, pas moi, lol
    0
  18. perchette
     
    C:\Program Files\Fichiers communs\BOONTY Shared\Service moved successfully.
    C:\Program Files\Fichiers communs\BOONTY Shared moved successfully.
    File/Folder C:\Program Files\Boonty not found.
    File/Folder C:\Program Files\BoontyGames not found.
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY\Licenses moved successfully.
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY moved successfully.

    OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09242008_150352

    ouf
    0
  19. perchette
     
    Malwarebytes' Anti-Malware 1.28
    Version de la base de données: 1194
    Windows 5.1.2600 Service Pack 2

    24/09/2008 17:09:19
    mbam-log-2008-09-24 (17-09-19).txt

    Type de recherche: Examen complet (C:\|E:\|)
    Eléments examinés: 134117
    Temps écoulé: 1 hour(s), 47 minute(s), 26 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 0
    Valeur(s) du Registre infectée(s): 0
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 0

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Valeur(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    (Aucun élément nuisible détecté)
    0
  20. chimay8 Messages postés 7947 Statut Contributeur sécurité 60
     
    ok,

    Mon avis est Avast!, McAfee et Norton sont loin de ce que l'on a fait de mieux en matière de protection, ce sont des antivirus que je déconseille :
    Avast! VS Antivir (Mai 2007): https://forum.malekal.com/viewtopic.php?f=45&t=3528
    Avast! VS Antivir VS AVG 8 (Mai 2008): https://forum.malekal.com/viewtopic.php?f=45&t=11659
    Si vous avez Avast!, Norton ou McAfee: A lire: http://forum.malekal.com/viewtopic.php?f=3&t=9631

    Graph : http://winnow.oitc.com/AntiVirusPerformance.html
    Stats : http://winnow.oitc.com/avmalwarestats.php

    Pour moi, Antivir et AVG 8 sont beaucoup plus performants : C'est pourquoi, je te conseille TRES VIVEMENT de désinstaller ton antivirus et installer Antivir ou AVG 8 à la place (selon ton choix) .... ce n'est bien sûr pas une obligation mais un conseil.

    Tu trouveras un tutorial Antivir depuis ce lien : https://www.malekal.com/avira-free-security-antivirus-gratuit/
    et une page qui explique comment migrer d'Avast! à Antivir : http://forum.malekal.com/ftopic4192.php

    peux-tu me faire un scan complet avec et le poster stp
    0
    1. perchette
       
      J'ai pas bien compris le message, alors MABM en version payante n'est plus valable?
      0
  • 1
  • 2
  • 3

Discussions similaires

Problème avec "PUADIManager:Win32/OfferCore
Knaki -
bazfile -

3 réponses