shbdchk13 persistant Fermé

Question

Bonjour,

depuis un certain temps, j'ai antivir qui me dit plusieur fois par jours que j'ai des virus dont voici le nom de celui de la derniere alerte: shbdchk13 .

Je n'arrive pas à les supprimer, que ce soit avec antivir, spybot, ad aware etc... 
Alors un petit coup de main de votre part serait vraiment sympa.
Merci d'avance

Lyonnais92 · Accepted Answer

Salut,

Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions).

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

savatage · Answer

personne ?

^^Marie^^ · Answer

Bonsoir

pour suivre ;))

savatage · Answer

bonsoir marie,

merci de ton attention, voici les rapports 

Logfile of random's system information tool 1.04 (written by random/random)
Run by nicolas at 2008-11-25 21:59:39
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 30 GB (13%) free of 231 GB
Total RAM: 2046 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:59:52, on 25/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Users
icolas\LOCALS~1\APPLIC~1\ieudinit.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32undll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Steam\Steam.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users
icolas\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis
icolas.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = SOS Connexion - Le web en toute simplicité
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F3 - REG:win.ini: load=C:\Users
icolas\LOCALS~1\APPLIC~1\ieudinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {E51B6382-1B9A-4627-BE54-0046B1D268DD} - (no file)
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O13 - Gopher Prefix: 
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A91359C-8B83-42AA-BEC7-1DE18CE82297}: NameServer = 192.168.1.1
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

savatage · Answer

et le second

info.txt logfile of random's system information tool 1.04 2008-11-25 21:56:12

======Uninstall list======

-->C:\Program Files\InstallShield Installation Information\{36C41D70-56F5-4E2B-81DA-6BEB7502D7A1}\setup.exe -runfromtemp -l0x040c -removeonly
-->C:\Program Files\InstallShield Installation Information\{B2C4A8C4-AA20-425D-9FEE-C78039238C81}\setup.exe -runfromtemp -l0x040c -removeonly
-->C:\Program Files\Nero\Nero 7
ero\uninstall\UNNERO.exe /UNINSTALL
-->C:\Windows\UNNeroMediaHome.exe /UNINSTALL
-->C:\Windows\UNNeroShowTime.exe /UNINSTALL
-->C:\Windows\UNNeroVision.exe /UNINSTALL
-->C:\Windows\UNRecode.exe /UNINSTALL
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Apple Mobile Device Support-->MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
Apple Software Update-->MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
Architecte 3D Platinium-->C:\PROGRA~1\ARCHIT~1\UNWISE.EXE C:\PROGRA~1\ARCHIT~1\INSTALL.LOG
Architecture 3D - 2.0 (version gratuite)-->"C:\Program Files\LiveCAD\Architecture 3D - 2.0 (version gratuite)\unins000.exe"
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
a-squared Anti-Malware 3.5-->"C:\Program Files\a-squared Anti-Malware\unins000.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
Blazing Angels 2 : Secret Missions of WWII-->C:\Program Files\InstallShield Installation Information\{D8768524-DE8D-40D3-904B-B1FCC31CF9F9}\Setup.exe -runfromtemp -l0x040c -removeonly
bwin Poker (remove only)-->"C:\Program Files\bwin\uninstall.exe"
Call of Duty(R) 2-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{D0A05794-48C2-4424-A15A-9F20FCFDD374} 
Call of Duty(R) 4 - Modern Warfare(TM)-->C:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x040c
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CleanUp!-->C:\Program Files\CleanUp!\uninstall.exe
Condition Zero-->"C:\Program Files\Steam\steam.exe" steam://uninstall/80
DH Driver Cleaner Professional Edition-->C:\Program Files\Driver Cleaner Pro\Uninstall.exe
DivX 3.11a-->C:\Program Files\DivX3.11a\uninst.exe
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
EasyCleaner-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F5346614-B7C4-4E94-826A-E2363155233D}\setup.exe" -l0x9  -removeonly
eMule-->"C:\Program Files\eMule\Uninstall.exe"
EVEREST Ultimate Edition v4.00-->"C:\Program Files\Lavalys\EVEREST Ultimate Edition\unins000.exe"
Free Video Converter V 1.1-->"C:\Program Files\Free Video Converter\unins000.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Holdem Manager-->MsiExec.exe /I{89B38025-05A0-4958-92C3-70882AE8553A}
iTunes-->MsiExec.exe /I{9F70BF98-003C-491D-81FC-FF9792206AF0}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Lame ACM MP3 Codec-->C:\Windows\system32undll32.exe setupapi,InstallHinfSection Remove_LameMP3 132 C:\Windows\INF\LameACM.inf
LimeWire 4.18.8-->"C:\Program Files\LimeWire\uninstall.exe"
livebox-->C:\Program Files\InstallShield Installation Information\{17342E3B-0818-4A6F-BFF8-99476605ADD6}\Setup.exe -runfromtemp -l0x040c -removeonly
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Messenger Plus! Live & Sponsor (CiD)-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.0.4)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mpeg Layer3 Codec FHG-Radium v1.263-->C:\Windows\UNWISE.EXE C:\audio\L3CODE~1\INSTALL.LOG
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Mumble and Murmur-->C:\Program Files\Mumble\Uninstall.exe
Nero 7 Essentials-->MsiExec.exe /I{D34D82E0-4600-407B-9478-8506C1DD1036}
OCCT Perestroika 1.0.1-->"C:\Program Files\OCCT\unins000.exe"
OpenAL-->"C:\Program Files\OpenAL\OalinstGridRelease.exe" /U
OpenOffice.org 2.3-->MsiExec.exe /I{FADB55D0-403F-4413-A268-CF0A6F1185C2}
Photo et imagerie HP 2.0 - All-in-One Pilote-->MsiExec.exe /X{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}
Photo et imagerie HP 2.0 - All-in-One-->MsiExec.exe /X{9867A917-5D17-40DE-83BA-BEA5293194B1}
Pokerbility 1.10.25-->"C:\Program Files\Pokerbility\unins000.exe"
PokerStars.net-->"C:\Program Files\PokerStars.NET\PokerStarsUninstall.exe" /u:PokerStars.net
PunkBuster Services-->C:\Windows\system32\pbsvc.exe -u
Pure-->C:\Program Files\InstallShield Installation Information\{FF3C203A-2F19-43A2-9C7C-EC1B5A0FC873}\setup.exe -runfromtemp -l0x0c0c Pure -removeonly
QuickTime-->MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Revolution Script CZ-->C:\Windows\Revolution Script CZ Uninstaller.exe
SLD Codec Pack-->C:\Program Files\SLD Codec Pack\uninstall.exe
Sony Picture Utility-->C:\Program Files\InstallShield Installation Information\{D5068583-D569-468B-9755-5FBF5848F46F}\setup.exe -runfromtemp -l0x040c uninstall -removeonly
SPORE™-->"C:\Program Files\InstallShield Installation Information\{9DF0196F-B6B8-4C3A-8790-DE42AA530101}\SPORESetup.exe" -runfromtemp -l0x040c -removeonly
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
TeamSpeak 3-->C:\Program Files\TeamSpeak 3\uninstall.exe
TerraExplorer-->C:\Program Files\Skyline\TerraExplorer\Setup.exe [OP]/U
TrackMania Nations ESWC 1.8.0-->"C:\Program Files\TrackMania Nations ESWC\unins000.exe"
TuneUp Utilities 2007-->MsiExec.exe /I{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}
VD Codec Pack 1.8-->C:\Program Files\VDCodecPack1.8\uninst.exe
VideoLAN VLC media player 0.8.6f-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Visual C++ 8.0 CRT (x86) WinSXS MSM-->MsiExec.exe /I{98CB24AD-52FB-DB5F-FF1F-C8B3B9A1E18E}
Visual C++ 8.0 CRT.Policy (x86) WinSXS MSM-->MsiExec.exe /I{63E949F6-03BC-5C40-FF1F-C8B3B9A1E18E}
Visual C++ 8.0 MFC (x86) WinSXS MSM-->MsiExec.exe /I{9BAE13A2-E7AF-D6C3-FF1F-C8B3B9A1E18E}
Visual C++ 8.0 MFC.Policy (x86) WinSXS MSM-->MsiExec.exe /I{68B7C6D9-1DF2-54C1-FF1F-C8B3B9A1E18E}
Winamax Poker (remove only)-->"C:\Program Files\WinamaxPoker\uninst.exe"
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinPcap 3.1 beta4-->"C:\Program Files\WinPcap\Uninstall.exe" "C:\Program Files\WinPcap\install.log"
Wow Cartographe 1.09-->C:\Program Files\WowCartographe\uninst.exe
x264 Revision 366 x264.nl (remove only)-->"C:\Program Files\x264\x264-uninstall.exe"
XviD MPEG-4 Video Codec-->"C:\Program Files\XviD\unins000.exe"

=====HijackThis Backups=====

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

======Security center information======

AV: Avira AntiVir PersonalEdition
AS: AVG Anti-Spyware (disabled) (outdated)
AS: Windows Defender (disabled)

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Samsung\Samsung PC Studio 3\;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 75 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=4b02
"NUMBER_OF_PROCESSORS"=2
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip

-----------------EOF-----------------

Lyonnais92 · Answer

Re,

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier : C:\Users
icolas\LOCALS~1\APPLIC~1\ieudinit.exe

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse. 

Si VirusTotal indique que le fichier a déjà été analysé, cliquer sur le bouton Reanalyse le fichier maintenant 

==================

    Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

    - Va dans démarrer puis panneau de configuration
    - Double Clique sur l'icône "Comptes d'utilisateurs"
    - Clique ensuite sur désactiver et valide.

 
supprime (si il existe Combofix.exe sur ton Bureau ainsi que le répertoire Qoobox à la racine du disque, en général C:\Qoobox).

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le Bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

 

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

savatage · Answer

salut lyonnais,

voici le rapport. pour la désinfection je la ferai demain.

Antivirus  	Version  	Dernière mise à jour  	Résultat
AhnLab-V3	2008.11.24.3	2008.11.25	-
AntiVir	7.9.0.35	2008.11.25	-
Authentium	5.1.0.4	2008.11.25	-
Avast	4.8.1281.0	2008.11.25	-
AVG	8.0.0.199	2008.11.25	-
BitDefender	7.2	2008.11.25	-
CAT-QuickHeal	10.00	2008.11.25	-
ClamAV	0.94.1	2008.11.25	-
DrWeb	4.44.0.09170	2008.11.25	-
eSafe	7.0.17.0	2008.11.25	-
eTrust-Vet	31.6.6227	2008.11.25	-
Ewido	4.0	2008.11.25	-
F-Prot	4.4.4.56	2008.11.25	-
F-Secure	8.0.14332.0	2008.11.25	-
Fortinet	3.117.0.0	2008.11.25	-
GData	19	2008.11.25	-
Ikarus	T3.1.1.45.0	2008.11.25	-
K7AntiVirus	7.10.533	2008.11.25	-
Kaspersky	7.0.0.125	2008.11.25	Heur.Trojan.Generic
McAfee	5445	2008.11.25	-
McAfee+Artemis	5445	2008.11.25	-
Microsoft	1.4104	2008.11.25	-
NOD32	3640	2008.11.25	-
Norman	5.80.02	2008.11.25	-
Panda	9.0.0.4	2008.11.25	Suspicious file
PCTools	4.4.2.0	2008.11.25	-
Prevx1	V2	2008.11.25	-
Rising	21.05.12.00	2008.11.25	-
SecureWeb-Gateway	6.7.6	2008.11.25	-
Sophos	4.35.0	2008.11.25	-
Sunbelt	3.1.1823.2	2008.11.22	BehavesLike.Win32.Malware (v)
Symantec	10	2008.11.25	-
TheHacker	6.3.1.1.163	2008.11.25	-
TrendMicro	8.700.0.1004	2008.11.25	-
VBA32	3.12.8.9	2008.11.25	-
ViRobot	2008.11.25.1485	2008.11.25	-
VirusBuster	4.5.11.0	2008.11.25	-
Information additionnelle
File size: 81920 bytes
MD5...: a66e1b04691a5b894d6d48206b5269af
SHA1..: 5f86097823d4f4d4f5eb6ebe34ee3973081be3c2
SHA256: 0cdb641fe46739b18a72acd3a8385dfc68c94c25fc3cc24b917a1f0a936e1427
SHA512: b3f23bcca035f459008aad9dcc845499ddb4d1f3e187a4848998c3a68fe24eac
93eb765b8338d032dde6ff46817b821a51b122db27e03b612926d503056ce49c
ssdeep: 1536:5OjsuBJ640kra0AAymEY6P4RqFGGTZB7zA6Feoat:ZuBJ6B0qm24Ux/0oat
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40acc6
timedatestamp.....: 0x4920ac5d (Sun Nov 16 23:27:25 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf55f 0x10000 6.22 8c1c59199ad9b53b32c7dd43b6f78620
.rdata 0x11000 0x1fe2 0x2000 5.49 2ac5bb73b8e691b589df3070c2c61367
.data 0x13000 0x3798 0x1000 1.47 6c71fa172fe3d98dcc83fdd01e106407

( 6 imports )
> USER32.dll: LoadImageA
> ADVAPI32.dll: RegCloseKey, RegEnumValueA, RegGetKeySecurity, RegOpenKeyExA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, LookupAccountSidA, GetTokenInformation, OpenProcessToken
> WS2_32.dll: -, -
> WININET.dll: InternetReadFile, HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlA, InternetOpenA
> NETAPI32.dll: NetUserGetInfo, NetApiBufferFree
> KERNEL32.dll: SetEnvironmentVariableA, GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, SetStdHandle, GetCPInfo, GetOEMCP, GetACP, GetVolumeInformationA, CreateDirectoryA, GetFileTime, GetSystemDirectoryA, OpenProcess, GetProcessPriorityBoost, GetFileType, GetStartupInfoA, OpenMutexA, CreateMutexA, CloseHandle, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLastError, GetLocalTime, GetShortPathNameA, GetEnvironmentVariableA, ExitProcess, SetFileAttributesA, CreateFileA, CreateProcessA, GlobalFree, CreateThread, GlobalAlloc, MultiByteToWideChar, GetModuleFileNameA, GetCurrentProcess, CopyFileA, WriteFile, RtlUnwind, GetSystemTimeAsFileTime, GetProcAddress, GetModuleHandleA, TerminateProcess, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, HeapReAlloc, HeapAlloc, HeapSize, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, HeapDestroy, HeapCreate, VirtualFree, HeapFree, LoadLibraryA, InterlockedExchange, VirtualQuery, SetFilePointer, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, VirtualAlloc

( 0 exports )

savatage · Answer

bonjour, voici le rapport de combofix. Je te remercie de m'aider lyonnais ;) ComboFix 08-11-26.01 - nicolas 2008-11-26 3:27:28.1 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1353 [GMT 1:00] Lancé depuis: c:\users icolas\Desktop\ComboFix.exe * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\users\émilie\AppData\Local\Microsoft\Windows\Temporary Internet Files mpE9C3.tmp c:\windows\system32\drivers pf.sys c:\windows\system32\k4 c:\windows\system32\packet.dll c:\windows\system32\pthreadVC.dll c:\windows\system32 Ma18yy c:\windows\system32\wanpacket.dll c:\windows\system32\wpcap.dll . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_NPF ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-26 au 2008-11-26 )))))))))))))))))))))))))))))))))))) . 2008-11-26 03:30 . 2008-11-17 00:34 81,920 --a------ c:\users icolas\AppData\Roaming\mstsc.exe 2008-11-26 03:20 . 2008-11-17 00:34 81,920 --a------ c:\windows\System32\drivers\mqtgsvc.exe 2008-11-26 03:20 . 2008-11-17 00:34 81,920 --a------ c:\windows\System32\drivers\logman.exe 2008-11-25 21:55 . 2008-11-25 21:56 d-------- C: sit 2008-11-24 23:35 . 2008-11-24 23:42 d-------- c:\program files\WowCartographe 2008-11-24 14:02 . 2008-11-24 19:42 d-------- c:\users icolas\WoW-2.3.0.7561-frFR 2008-11-18 14:06 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll 2008-11-18 14:06 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll 2008-11-18 14:06 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll 2008-11-18 14:06 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll 2008-11-18 14:06 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll 2008-11-18 14:06 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe 2008-11-18 14:06 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll 2008-11-18 14:06 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll 2008-11-18 14:06 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe 2008-11-16 22:16 . 2008-11-16 22:16 404,250 --a------ c:\windows\Revolution Script CZ Uninstaller.exe 2008-11-16 15:32 . 2008-11-26 03:32 d-------- c:\program files\Steam 2008-11-16 13:59 . 2008-11-23 15:05 d-------- c:\program files\Common Files\Steam 2008-11-15 13:50 . 2002-08-18 19:43 794,624 --a------ c:\windows\System32\spr32d35.dll 2008-11-15 04:24 . 2008-11-15 04:25 d-------- c:\users icolas\AppData\Roaming\LiveCAD2 2008-11-15 04:23 . 2007-03-12 16:42 3,495,784 --a------ c:\windows\System32\d3dx9_33.dll 2008-11-15 04:22 . 2008-11-15 04:22 d-------- c:\program files\LiveCAD 2008-11-14 01:44 . 2008-11-14 01:44 d-------- c:\program files\RVG Software 2008-11-12 13:37 . 2008-11-12 13:37 dr-h----- C:\AHCache 2008-11-12 05:01 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll 2008-11-12 05:01 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll 2008-11-12 05:01 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys 2008-11-12 01:19 . 2008-11-12 01:19 d-------- c:\program files\LimeWire 2008-11-11 02:13 . 2008-11-17 01:08 d-------- c:\users\All Users kfree 2008-11-11 02:13 . 2008-11-17 01:08 d-------- c:\programdata kfree 2008-10-31 23:30 . 2008-08-05 10:49 428,544 --a------ c:\windows\System32\EncDec.dll 2008-10-31 23:30 . 2008-08-05 10:49 293,376 --a------ c:\windows\System32\psisdecd.dll 2008-10-31 23:30 . 2008-08-05 10:48 217,088 --a------ c:\windows\System32\psisrndr.ax 2008-10-31 23:30 . 2008-08-05 10:48 177,664 --a------ c:\windows\System32\mpg2splt.ax 2008-10-31 23:30 . 2008-08-05 10:48 80,896 --a------ c:\windows\System32\MSNP.ax 2008-10-29 14:23 . 2008-08-12 04:39 443,392 --a------ c:\windows\System32\win32spl.dll 2008-10-29 14:23 . 2008-09-18 05:56 147,456 --a------ c:\windows\System32\Faultrep.dll 2008-10-29 14:23 . 2008-09-18 05:56 125,952 --a------ c:\windows\System32\wersvc.dll 2008-10-27 02:15 . 2008-10-27 02:15 d-------- c:\program files\Pokerbility . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-26 02:27 23,068,672 ----a-w c:\users\émilie\NTUSER.DAT 2008-11-26 02:27 23,068,672 ----a-w c:\users\émilie\NTUSER.DAT 2008-11-23 02:48 --------- d-----w c:\users icolas\AppData\Roaming\OpenOffice.org2 2008-11-21 00:21 --------- d-----w c:\program files\bwin 2008-11-19 22:20 --------- d-----w c:\users icolas\AppData\Roaming eamspeak2 2008-11-17 16:58 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2008-11-17 16:46 --------- d-----w c:\program files\Lavasoft 2008-11-17 16:46 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-11-16 23:51 --------- d-----w c:\program files\Spybot - Search & Destroy 2008-11-16 14:13 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-16 14:13 --------- d-----w c:\programdata\Codemasters 2008-11-14 18:38 --------- d-----w c:\program files\WinamaxPoker 2008-11-14 01:22 --------- d-----w c:\programdata\NVIDIA 2008-11-12 00:25 --------- d-----w c:\users icolas\AppData\Roaming\LimeWire 2008-10-27 20:53 --------- d-----w c:\program files\Activision 2008-10-25 14:39 --------- d-----w c:\users icolas\AppData\Roaming\Mumble 2008-10-22 15:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2008-10-22 15:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2008-10-22 11:33 --------- d-----w c:\program files\OpenAL 2008-10-20 12:11 --------- d-----w c:\users icolas\AppData\Roaming\Paltalk 2008-10-20 12:11 --------- d-----w c:\program files\Paltalk Messenger 2008-10-19 16:08 --------- d-----w c:\program files\PokerStars.NET 2008-10-18 13:04 --------- d-----w c:\programdata\Media Center Programs 2008-10-18 11:43 --------- d-----w c:\program files\GameSpy 2008-10-18 11:39 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-10-18 11:39 22,328 ----a-w c:\users icolas\AppData\Roaming\PnkBstrK.sys 2008-10-18 11:26 --------- d-----w c:\program files\Electronic Arts 2008-10-17 23:12 --------- d-s---w c:\users\émilie\AppData\Roaming\Microsoft 2008-10-17 23:11 --------- d-----w c:\programdata\Avg7 2008-10-17 23:10 --------- d-----w c:\programdata\Grisoft 2008-10-17 19:36 --------- d-----w c:\users icolas\AppData\Roaming\AVG7 2008-10-17 18:59 --------- d-----w c:\programdata\Spybot - Search & Destroy 2008-10-15 22:14 --------- d-----w c:\program files\Windows Mail 2008-10-15 09:19 --------- d-----w c:\program files\PokerRewardsCalculator 2008-10-15 09:18 --------- d-----w c:\program files\Image-Line 2008-10-14 17:56 --------- d-----w c:\program files\Common Files\InstallShield 2008-10-14 17:53 --------- d--h--r c:\users icolas\AppData\Roaming\SecuROM 2008-10-14 17:50 --------- d-----w c:\programdata\Electronic Arts 2008-10-10 11:14 --------- d-----w c:\programdata\ma-config.com 2008-10-10 11:14 --------- d-----w c:\program files\ma-config.com 2008-10-08 14:43 --------- d-----w c:\program files\eMule 2008-10-07 12:21 --------- d-----w c:\users icolas\AppData\Roaming\Disney Interactive Studios 2008-10-07 12:05 --------- d-----w c:\program files\Disney Interactive Studios 2008-10-07 12:02 --------- d-----w c:\program files\DAEMON Tools Lite 2008-10-06 22:15 --------- d-----w c:\program files\Mumble 2008-09-30 12:06 --------- d-----w c:\program files\Sony 2008-09-30 11:37 --------- d-----w c:\users icolas\AppData\Roaming\dvdcss 2008-09-28 13:00 --------- d-----w c:\users icolas\AppData\Roaming\Sony Corporation 2008-09-28 12:53 --------- d-----w c:\programdata\Sony Corporation 2008-08-31 12:07 56 ---ha-w c:\users\All Users\ezsidmv.dat 2008-08-31 12:07 56 ---ha-w c:\programdata\ezsidmv.dat 2008-08-27 22:14 174 --sha-w c:\program files\desktop.ini 2007-12-31 19:36 147,456 ----a-w c:\users icolas\vbzip10.dll 2007-12-07 14:37 44 ----a-w c:\users icolas\addresses.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] "Steam"="c:\program files\steam\steam.exe" [2008-11-16 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSConfig"="c:\windows\System32\msconfig.exe" [2008-01-19 227840] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 266497] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13535776] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 92704] "RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 c:\windows\RtHDVCpl.exe] [HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run] "MqtgSVC"="c:\windows\System32\drivers\mqtgsvc.exe" [2008-11-17 81920] [HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run] "Logman"="c:\windows\System32\drivers\logman.exe" [2008-11-17 81920] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows] "load"=c:\users icolas\AppData\Local\Temp\comrepl.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "msacm.l3acm"= l3codecp.acm "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm "vidc.X264"= x264vfw.dll "msacm.l3codec"= l3codecp.acm [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^hpoddt01.exe.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\hpoddt01.exe.lnk backup=c:\windows\pss\hpoddt01.exe.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader eader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe] --a------ 2008-01-19 08:33 125952 c:\windows\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-06-02 10:13 267048 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 15:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] --a------ 2008-01-19 08:38 1008184 c:\program files\Windows Defender\MSASCui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] --a------ 2008-01-19 08:33 202240 c:\program files\Windows Media Player\wmpnscfg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl] --a------ 2006-12-01 13:37 4186112 c:\windows\RtHDVCpl.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{ED529C9F-5CB9-4A9B-890F-FAD69EB8621B}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule "UDP Query User{46B144C2-E876-4240-BABC-37FCA70E5C54}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule "TCP Query User{5C9ECA7F-D381-4D76-8B45-25125C377193}c:\program files\msn messenger\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger "UDP Query User{7158C179-D22E-4611-9A81-B7B25ED269A4}c:\program files\msn messenger\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger "TCP Query User{F3B7E70C-8638-4F77-B70F-6DFD13CF7E8D}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{C59C477A-463F-4C27-8548-4B4B88CE2235}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{DC12E3EB-123D-4300-AD80-81A1310A2B12}e:\steamapps\metalguinness\condition zero\hl.exe"= UDP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "UDP Query User{EBD28C76-4C6A-44A6-9597-36290089BD76}e:\steamapps\metalguinness\condition zero\hl.exe"= TCP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "TCP Query User{98BBC409-24E5-456A-91CC-15F2AB0EDDA8}c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe"= UDP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp "UDP Query User{AF392EBB-2109-4B07-A7EB-3FF1DC3587FB}c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe"= TCP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp "TCP Query User{75D5B769-E9B7-4ECD-A968-64F69140FEBD}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule "UDP Query User{4072DE3E-2979-4014-99DB-9BCBA6691A2F}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule "TCP Query User{E79107BB-D6D6-4B6D-8CA8-F951207431A1}e:\steamapps\metalguinness\condition zero\hl.exe"= UDP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "UDP Query User{9C8C1F2B-13AA-497A-B1A4-E70DFED2005A}e:\steamapps\metalguinness\condition zero\hl.exe"= TCP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "TCP Query User{4BFF0396-112C-4D87-962A-8441D316B35D}c:\program files\msn messenger\livecall.exe"= UDP:c:\program files\msn messenger\livecall.exe:Windows Live Call "UDP Query User{203365B6-2ECE-4AB3-8699-DB4D9149D7CF}c:\program files\msn messenger\livecall.exe"= TCP:c:\program files\msn messenger\livecall.exe:Windows Live Call "TCP Query User{CAB73677-1C09-4081-AD01-5300DB868A15}c:\windows\windl\mirc.exe"= UDP:c:\windows\windl\mirc.exe:mIRC "UDP Query User{CC70295B-BB83-48E0-A17F-33D79BAA85BA}c:\windows\windl\mirc.exe"= TCP:c:\windows\windl\mirc.exe:mIRC "TCP Query User{770B9900-1F8B-4214-BEED-FB29EA5111D5}e:\steamapps\metalguinness\counter-strike\hl.exe"= UDP:e:\steamapps\metalguinness\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{67EDDB4C-49C0-44B2-8E16-8B31F4B2E44E}e:\steamapps\metalguinness\counter-strike\hl.exe"= TCP:e:\steamapps\metalguinness\counter-strike\hl.exe:Half-Life Launcher "TCP Query User{734020D3-36B2-462A-A38B-1A3F59C68578}c:\program files\electronic arts\eadm\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager "UDP Query User{81075885-3713-42C7-9021-D3EB634014E6}c:\program files\electronic arts\eadm\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager "{5DC4668A-157D-404D-99CE-C146A4541247}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{54990A40-A2E4-4CC3-8B06-7043FAE0079B}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{C60606B6-D970-4157-9D6A-88E78386B774}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{2BF6CF69-373C-416C-B667-AE4195AF2BC7}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "TCP Query User{D8F15AAC-ACEC-4E4D-84D1-FF1CF7F6D7E3}c:\program files\disney interactive studios\pure\pure.exe"= UDP:c:\program files\disney interactive studios\pure\pure.exe:Pure "UDP Query User{3023AD3C-05BF-49E0-81D0-1BDF48814CEE}c:\program files\disney interactive studios\pure\pure.exe"= TCP:c:\program files\disney interactive studios\pure\pure.exe:Pure "{7B30449A-A6C0-49F0-8254-1FE93DD9C91A}"= UDP:c:\program files\Codemasters\GRID\GRID.exe:GRID "{104FA4C2-D549-4E2F-BE38-C22972FA9765}"= TCP:c:\program files\Codemasters\GRID\GRID.exe:GRID "TCP Query User{51E0DAB1-CB45-4A8C-9D16-06A5CC1B2276}c:\program files\activision\call of duty 2\cod2mp_s.exe"= UDP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s "UDP Query User{E0F1FBA4-1DE9-406E-8307-576CFC0FB45D}c:\program files\activision\call of duty 2\cod2mp_s.exe"= TCP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s "TCP Query User{FDBB74F5-E568-4D53-84F6-F452328C1D54}c:\program files\trackmania nations eswc\tmnationseswc.exe"= UDP:c:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "UDP Query User{FB09D548-52A1-4BE5-922C-D19248E8A128}c:\program files\trackmania nations eswc\tmnationseswc.exe"= TCP:c:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "TCP Query User{813A3210-4E32-41F2-B867-454ED9E70AA9}e:\steamapps\rolex306\condition zero\hl.exe"= UDP:e:\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "UDP Query User{9B9DE649-3A04-4CB1-B3A1-3D5951D4E70C}e:\steamapps\rolex306\condition zero\hl.exe"= TCP:e:\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "TCP Query User{5F3654C7-4019-4EA7-90A5-65BBCEDF0D49}c:\program files\steam\steamapps\rolex306\condition zero\hl.exe"= UDP:c:\program files\steam\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "UDP Query User{95743B52-55D0-4A8D-9D79-A477FF3103A3}c:\program files\steam\steamapps\rolex306\condition zero\hl.exe"= TCP:c:\program files\steam\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "TCP Query User{D9BFE5F3-F090-42C0-BCC8-267C8FA6DCD1}c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe"= UDP:c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "UDP Query User{3E906ACB-5E48-4138-B695-77AED847D04D}c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe"= TCP:c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "TCP Query User{EDB04522-575C-4F0B-B2DB-7C4F78E1C150}c:\users\nicolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe"= UDP:c:\users icolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe:wow-frfr-installer-downloader.exe "UDP Query User{B2D7216D-279B-4A90-992B-1B10FB288326}c:\users\nicolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe"= TCP:c:\users icolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe:wow-frfr-installer-downloader.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352] R1 cpuidlep;CpuIdle Pro System Driver;c:\windows\system32\drivers\cpuidlep.sys [2007-06-18 4484] R2 UxTuneUp;TuneUp Extension de thème;c:\windows\System32\svchost.exe -k netsvcs [2008-07-26 21504] S3 ce6230;Intel CE6230 Standalone USB Driver;c:\windows\system32\DRIVERS\CE6230StandaloneDriver.sys [2008-03-26 44800] S3 ce6230BDACAP;Realfine CE6230 BDA Driver;c:\windows\system32\DRIVERS\CE6230BDA.sys [2008-03-26 19328] S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50.sys [2007-11-05 28224] S3 PCASp50;PCASp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCASp50.sys [2007-11-05 27072] S3 Steam Client Service;Steam Client Service;c:\program files\Common Files\Steam\SteamService.exe /RunAsService [2008-11-16 104944] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3dd6a743-93e8-11dd-93af-001a9219cb78}] \shell\AutoRun\command - D:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6662202f-79a8-11dd-9321-001a9219cb78}] \shell\AutoRun\command - D:\Launcher.exe . Contenu du dossier 'Tâches planifiées' 2008-11-21 c:\windows\Tasks\Maintenance en 1 clic.job - c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-02 18:18] . - - - - ORPHELINS SUPPRIMES - - - - BHO-{E51B6382-1B9A-4627-BE54-0046B1D268DD} - (no file) WebBrowser-{32099AAC-C132-4136-9E9A-4E364A424E17} - (no file) HKLM-Explorer_Run-Spool - c:\users icolas\LOCALS~1\APPLIC~1\spoolsv.exe MSConfigStartUp-Host Process - c:\users icolas\svchost.exe MSConfigStartUp-NetAnalyse - c:\program files\NetAnalyse\NetAnalyse.exe MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_03\bin\jusched.exe MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe MSConfigStartUp-SystrayORAHSS - c:\program files\OrangeHSS\Systray\SystrayApp.exe . ------- Examen supplémentaire ------- . FireFox -: Profile - c:\users icolas\AppData\Roaming\Mozilla\Firefox\Profiles\3tprtbr3.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr/ FF -: plugin - c:\program files\iTunes\Mozilla Plugins pitunes.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-26 03:32:19 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . ------------------------ Autres processus actifs ------------------------ . c:\windows\System32 vvsvc.exe c:\windows\System32\audiodg.exe c:\windows\System32 undll32.exe c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe c:\program files\a-squared Anti-Malware\a2service.exe c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\windows\System32\PnkBstrA.exe c:\windows\System32\WUDFHost.exe c:\windows\System32\conime.exe c:\users icolas\AppData\Local\spoolsv.exe c:\windows\System32 undll32.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\System32\wbem\unsecapp.exe c:\windows\System32\wbem\WMIADAP.exe . ************************************************************************** . Heure de fin: 2008-11-26 3:37:09 - La machine a redémarré ComboFix-quarantined-files.txt 2008-11-26 02:37:05 Avant-CF: 28 176 322 560 octets libres Après-CF: 28,162,162,688 octets libres 294 --- E O F --- 2008-11-25 08:18:26

Lyonnais92 · Answer

Bonjour,

un fichier à contrôler:

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier : c:\users
icolas\AppData\Local\Temp\comrepl.exe       

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse. 

Si VirusTotal indique que le fichier a déjà été analysé, cliquer sur le bouton Reanalyse le fichier maintenant 

=======================

vérifie aussi celui-ci :

c:\windows\System32\spr32d35.dll

Lyonnais92 · Answer

Bonjour,

une relecture de mon analyse de ton rapport Combofix (merci Nicolas Coolman) m'amène à te demander de faire des choses en plus (et de faire attention dans l'utilisation du PC car il est très probable que ton infection évolue ou que de nouvelles apparaissent).
==================

Fais redémarrer l'ordi et remets un rapport RSIT.

==================
Fais un contrôle sur VirusTotal de ces 3 fichiers :


c:\users
icolas\AppData\Roaming\msts­c.exe
c:\windows\System32\drivers\mqtgsvc.e­xe
c:\windows\System32\drivers\logman.ex­e

et poste les rapports dans ta réponse.

savatage · Answer

voici l'analyse des fichiers que tu m'as cité fait par VirusTotal :

Antivirus  	Version  	Dernière mise à jour  	Résultat
AhnLab-V3	2008.11.24.3	2008.11.26	-
AntiVir	7.9.0.35	2008.11.26	-
Authentium	5.1.0.4	2008.11.26	-
Avast	4.8.1281.0	2008.11.25	-
AVG	8.0.0.199	2008.11.25	-
BitDefender	7.2	2008.11.26	-
CAT-QuickHeal	10.00	2008.11.26	-
ClamAV	0.94.1	2008.11.26	-
DrWeb	4.44.0.09170	2008.11.26	-
eSafe	7.0.17.0	2008.11.25	-
eTrust-Vet	31.6.6228	2008.11.26	-
Ewido	4.0	2008.11.25	-
F-Prot	4.4.4.56	2008.11.25	-
F-Secure	8.0.14332.0	2008.11.26	-
Fortinet	3.117.0.0	2008.11.26	-
GData	19	2008.11.26	-
Ikarus	T3.1.1.45.0	2008.11.26	-
K7AntiVirus	7.10.533	2008.11.25	-
Kaspersky	7.0.0.125	2008.11.26	Heur.Trojan.Generic
McAfee	5445	2008.11.25	-
McAfee+Artemis	5445	2008.11.25	Generic!Artemis
Microsoft	1.4104	2008.11.26	-
NOD32	3642	2008.11.26	-
Norman	5.80.02	2008.11.26	-
Panda	9.0.0.4	2008.11.25	Suspicious file
PCTools	4.4.2.0	2008.11.25	-
Prevx1	V2	2008.11.26	-
Rising	21.05.22.00	2008.11.26	-
SecureWeb-Gateway	6.7.6	2008.11.26	-
Sophos	4.35.0	2008.11.26	-
Sunbelt	3.1.1830.2	2008.11.26	BehavesLike.Win32.Malware (v)
Symantec	10	2008.11.26	-
TheHacker	6.3.1.1.163	2008.11.25	-
TrendMicro	8.700.0.1004	2008.11.26	-
VBA32	3.12.8.9	2008.11.26	-
ViRobot	2008.11.26.1487	2008.11.26	-
VirusBuster	4.5.11.0	2008.11.25	-


Antivirus  	Version  	Dernière mise à jour  	Résultat
AhnLab-V3	2008.11.24.3	2008.11.26	-
AntiVir	7.9.0.35	2008.11.26	-
Authentium	5.1.0.4	2008.11.26	-
Avast	4.8.1281.0	2008.11.25	-
AVG	8.0.0.199	2008.11.26	-
BitDefender	7.2	2008.11.26	-
CAT-QuickHeal	10.00	2008.11.26	-
ClamAV	0.94.1	2008.11.26	-
DrWeb	4.44.0.09170	2008.11.26	-
eSafe	7.0.17.0	2008.11.25	-
eTrust-Vet	31.6.6228	2008.11.26	-
Ewido	4.0	2008.11.25	-
F-Prot	4.4.4.56	2008.11.25	-
F-Secure	8.0.14332.0	2008.11.26	-
Fortinet	3.117.0.0	2008.11.26	-
GData	19	2008.11.26	-
Ikarus	T3.1.1.45.0	2008.11.26	-
K7AntiVirus	7.10.533	2008.11.25	-
Kaspersky	7.0.0.125	2008.11.26	Heur.Trojan.Generic
McAfee	5445	2008.11.25	-
McAfee+Artemis	5445	2008.11.25	Generic!Artemis
Microsoft	1.4104	2008.11.26	-
NOD32	3642	2008.11.26	-
Norman	5.80.02	2008.11.26	-
Panda	9.0.0.4	2008.11.25	Suspicious file
PCTools	4.4.2.0	2008.11.26	-
Prevx1	V2	2008.11.26	-
Rising	21.05.22.00	2008.11.26	-
SecureWeb-Gateway	6.7.6	2008.11.26	-
Sophos	4.35.0	2008.11.26	-
Sunbelt	3.1.1830.2	2008.11.26	BehavesLike.Win32.Malware (v)
Symantec	10	2008.11.26	-
TheHacker	6.3.1.1.163	2008.11.25	-
TrendMicro	8.700.0.1004	2008.11.26	-
VBA32	3.12.8.9	2008.11.26	-
ViRobot	2008.11.26.1487	2008.11.26	-
VirusBuster	4.5.11.0	2008.11.25	-

Antivirus  	Version  	Dernière mise à jour  	Résultat
AhnLab-V3	2008.11.24.3	2008.11.26	-
AntiVir	7.9.0.35	2008.11.26	-
Authentium	5.1.0.4	2008.11.26	-
Avast	4.8.1281.0	2008.11.25	-
AVG	8.0.0.199	2008.11.26	-
BitDefender	7.2	2008.11.26	-
CAT-QuickHeal	10.00	2008.11.26	-
ClamAV	0.94.1	2008.11.26	-
DrWeb	4.44.0.09170	2008.11.26	-
eSafe	7.0.17.0	2008.11.25	-
eTrust-Vet	31.6.6228	2008.11.26	-
Ewido	4.0	2008.11.25	-
F-Prot	4.4.4.56	2008.11.25	-
F-Secure	8.0.14332.0	2008.11.26	-
Fortinet	3.117.0.0	2008.11.26	-
GData	19	2008.11.26	-
Ikarus	T3.1.1.45.0	2008.11.26	-
K7AntiVirus	7.10.533	2008.11.25	-
Kaspersky	7.0.0.125	2008.11.26	Heur.Trojan.Generic
McAfee	5445	2008.11.25	-
McAfee+Artemis	5445	2008.11.25	Generic!Artemis
Microsoft	1.4104	2008.11.26	-
NOD32	3642	2008.11.26	-
Norman	5.80.02	2008.11.26	-
Panda	9.0.0.4	2008.11.25	Suspicious file
PCTools	4.4.2.0	2008.11.26	-
Prevx1	V2	2008.11.26	-
Rising	21.05.22.00	2008.11.26	-
SecureWeb-Gateway	6.7.6	2008.11.26	-
Sophos	4.35.0	2008.11.26	-
Sunbelt	3.1.1830.2	2008.11.26	BehavesLike.Win32.Malware (v)
Symantec	10	2008.11.26	-
TheHacker	6.3.1.1.163	2008.11.25	-
TrendMicro	8.700.0.1004	2008.11.26	-
VBA32	3.12.8.9	2008.11.26	-
ViRobot	2008.11.26.1487	2008.11.26	-
VirusBuster	4.5.11.0	2008.11.25	-

Antivirus  	Version  	Dernière mise à jour  	Résultat
AhnLab-V3	2008.11.24.3	2008.11.26	-
AntiVir	7.9.0.35	2008.11.26	-
Authentium	5.1.0.4	2008.11.26	-
Avast	4.8.1281.0	2008.11.25	-
AVG	8.0.0.199	2008.11.26	-
BitDefender	7.2	2008.11.26	-
CAT-QuickHeal	10.00	2008.11.26	-
ClamAV	0.94.1	2008.11.26	-
DrWeb	4.44.0.09170	2008.11.26	-
eSafe	7.0.17.0	2008.11.25	-
eTrust-Vet	31.6.6228	2008.11.26	-
Ewido	4.0	2008.11.26	-
F-Prot	4.4.4.56	2008.11.25	-
F-Secure	8.0.14332.0	2008.11.26	-
Fortinet	3.117.0.0	2008.11.26	-
GData	19	2008.11.26	-
Ikarus	T3.1.1.45.0	2008.11.26	-
K7AntiVirus	7.10.533	2008.11.25	-
Kaspersky	7.0.0.125	2008.11.26	Heur.Trojan.Generic
McAfee	5445	2008.11.25	-
McAfee+Artemis	5445	2008.11.25	Generic!Artemis
Microsoft	1.4104	2008.11.26	-
NOD32	3642	2008.11.26	-
Norman	5.80.02	2008.11.26	-
Panda	9.0.0.4	2008.11.25	Suspicious file
PCTools	4.4.2.0	2008.11.26	-
Prevx1	V2	2008.11.26	-
Rising	21.05.22.00	2008.11.26	-
SecureWeb-Gateway	6.7.6	2008.11.26	-
Sophos	4.35.0	2008.11.26	-
Sunbelt	3.1.1830.2	2008.11.26	BehavesLike.Win32.Malware (v)
Symantec	10	2008.11.26	-
TheHacker	6.3.1.1.163	2008.11.25	-
TrendMicro	8.700.0.1004	2008.11.26	-
VBA32	3.12.8.9	2008.11.26	-
ViRobot	2008.11.26.1487	2008.11.26	-
VirusBuster	4.5.11.0	2008.11.25	-

savatage · Answer

et voici les log de RSIT :

Logfile of random's system information tool 1.04 (written by random/random)
Run by nicolas at 2008-11-26 13:22:23
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 25 GB (11%) free of 231 GB
Total RAM: 2046 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:22:46, on 26/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32undll32.exe
C:\Windows\System32\drivers\mqtgsvc.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\System32\mobsync.exe
C:\Users
icolas\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis
icolas.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F3 - REG:win.ini: load=C:\Users
icolas\AppData\Local\Temp\comrepl.exe
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Policies\Explorer\Run: [MqtgSVC] C:\Windows\System32\drivers\mqtgsvc.exe /waitservice
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [Logman] C:\Windows\System32\drivers\logman.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [Logman] C:\Windows\System32\drivers\logman.exe /waitservice (User 'Default user')
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O13 - Gopher Prefix: 
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A91359C-8B83-42AA-BEC7-1DE18CE82297}: NameServer = 192.168.1.1
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

Lyonnais92 · Answer

Bonsoir,

Relance HijackThis.

Choisis Do a scan only

Coche la case devant les lignes suivantes

F3 - REG:win.ini: load=C:\Users
icolas\AppData\Local\Temp\comrepl.exe

Ferme toutes les fenêtres (hormis HijackThis), y compris ton navigateur.

Clique sur fix checked.

Ferme Hijackthis.

======================================

Copie ou imprime les instructions avant

Déconnecte toi d'internet et ferme toutes tes applications.

Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

Driver::
aw7chg4x
jfdcd


File::
c:\users
icolas\AppData\Local\Temp\comrepl.exe
c:\windows\System32\spr32d35.dll
c:\users
icolas\AppData\Roaming\msts­c.exe
c:\windows\System32\drivers\mqtgsvc.exe
c:\windows\System32\drivers\logman.exe 
 
Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]        
"MqtgSVC"=-
[HKUS\S-1-5-18\..\Policies\Explorer\Run]
"Logman"=-  
[HKUS\.DEFAULT\..\Policies\Explorer\Run]
"Logman"=-  

Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe

Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Réactive ton parefeu, ton antivirus, la garde de ton antispyware

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.

savatage · Answer

bonjour lyonnais,

désolé du retard, je n'étais pas très dispo ces 2 derniers jours. J'ai fait toutes les manips que tu m'as demandé mais je ne trouve pas le rapport de combofix, il n'est pas dans C:/combofix.txt. Voici celui de HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:32:52, on 27/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32undll32.exe
C:\Windows\System32\drivers\mqtgsvc.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Users
icolas\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis
icolas.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F3 - REG:win.ini: load=C:\Users
icolas\AppData\Local\Temp\comrepl.exe
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Policies\Explorer\Run: [MqtgSVC] C:\Windows\System32\drivers\mqtgsvc.exe /waitservice
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [Logman] C:\Windows\System32\drivers\logman.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [Logman] C:\Windows\System32\drivers\logman.exe /waitservice (User 'Default user')
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O13 - Gopher Prefix: 
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A91359C-8B83-42AA-BEC7-1DE18CE82297}: NameServer = 192.168.1.1
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

Lyonnais92 · Answer

Bonjour,

que s'est-il passé quand tu as fait le glisser-déposer de CfScript sur Combofix ?

savatage · Answer

eh bien ComcoFix s'est lancé correctement, il a supprimé les fichiers que j'ai copié/collé, mon PC a reboot et la finalisation s'est faite.

Lyonnais92 · Answer

Re,

recommence la totalité de la manip du post 13.

Vérifie que le fichier CFScript est bien créé sur ton Bureau, à côté de Combofix.

savatage · Answer

ok je vais faire ça mais le fichier CFscript que j'ai créé ne se trouve plus sur le bureau après l'avoir glissé sur ComboFix.

Lyonnais92 · Answer

Re,

recrée le.

savatage · Answer

re, c'est bon, voici le rapport de ComboFix : ComboFix 08-11-26.05 - nicolas 2008-11-27 13:16:27.3 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1250 [GMT 1:00] Lancé depuis: c:\users icolas\Desktop\ComboFix.exe Commutateurs utilisés :: c:\users icolas\Desktop\CFscript.txt * Un nouveau point de restauration a été créé FILE :: c:\users icolas\AppData\Local\Temp\comrepl.exe c:\users icolas\AppData\Roaming\mstsc.exe c:\windows\System32\drivers\logman.exe c:\windows\System32\drivers\mqtgsvc.exe c:\windows\System32\spr32d35.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . c:\users icolas\AppData\Local\Temp\comrepl.exe c:\windows\System32\drivers\logman.exe c:\windows\System32\drivers\mqtgsvc.exe c:\windows\System32\spr32d35.dll . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_jfdcd ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-27 au 2008-11-27 )))))))))))))))))))))))))))))))))))) . 2008-11-26 04:08 . 2008-10-21 06:25 1,645,568 --a------ c:\windows\System32\connect.dll 2008-11-26 04:08 . 2008-08-28 04:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll 2008-11-26 04:08 . 2008-08-28 04:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll 2008-11-26 04:08 . 2008-08-28 04:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll 2008-11-26 04:08 . 2008-10-22 04:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll 2008-11-26 03:30 . 2008-11-17 00:34 81,920 --a------ c:\users icolas\AppData\Roaming\mstsc.exe 2008-11-25 21:55 . 2008-11-25 21:56 d-------- C: sit 2008-11-24 23:35 . 2008-11-24 23:42 d-------- c:\program files\WowCartographe 2008-11-24 14:02 . 2008-11-24 19:42 d-------- c:\users icolas\WoW-2.3.0.7561-frFR 2008-11-18 14:06 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll 2008-11-18 14:06 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll 2008-11-18 14:06 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll 2008-11-18 14:06 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll 2008-11-18 14:06 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll 2008-11-18 14:06 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe 2008-11-18 14:06 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll 2008-11-18 14:06 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll 2008-11-18 14:06 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe 2008-11-16 22:16 . 2008-11-16 22:16 404,250 --a------ c:\windows\Revolution Script CZ Uninstaller.exe.bak 2008-11-16 15:32 . 2008-11-27 10:43 d-------- c:\program files\Steam 2008-11-16 13:59 . 2008-11-23 15:05 d-------- c:\program files\Common Files\Steam 2008-11-15 04:24 . 2008-11-15 04:25 d-------- c:\users icolas\AppData\Roaming\LiveCAD2 2008-11-15 04:23 . 2007-03-12 16:42 3,495,784 --a------ c:\windows\System32\d3dx9_33.dll 2008-11-14 01:44 . 2008-11-14 01:44 d-------- c:\program files\RVG Software 2008-11-12 13:37 . 2008-11-12 13:37 dr-h----- C:\AHCache 2008-11-12 05:01 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll 2008-11-12 05:01 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll 2008-11-12 05:01 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys 2008-11-11 02:13 . 2008-11-17 01:08 d-------- c:\users\All Users kfree 2008-11-11 02:13 . 2008-11-17 01:08 d-------- c:\programdata kfree 2008-10-31 23:30 . 2008-08-05 10:49 428,544 --a------ c:\windows\System32\EncDec.dll 2008-10-31 23:30 . 2008-08-05 10:49 293,376 --a------ c:\windows\System32\psisdecd.dll 2008-10-31 23:30 . 2008-08-05 10:48 217,088 --a------ c:\windows\System32\psisrndr.ax 2008-10-31 23:30 . 2008-08-05 10:48 177,664 --a------ c:\windows\System32\mpg2splt.ax 2008-10-31 23:30 . 2008-08-05 10:48 80,896 --a------ c:\windows\System32\MSNP.ax 2008-10-29 14:23 . 2008-08-12 04:39 443,392 --a------ c:\windows\System32\win32spl.dll 2008-10-29 14:23 . 2008-09-18 05:56 147,456 --a------ c:\windows\System32\Faultrep.dll 2008-10-29 14:23 . 2008-09-18 05:56 125,952 --a------ c:\windows\System32\wersvc.dll 2008-10-27 02:15 . 2008-10-27 02:15 d-------- c:\program files\Pokerbility . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-27 12:15 23,068,672 ----a-w c:\users\émilie\NTUSER.DAT 2008-11-27 12:15 23,068,672 ----a-w c:\users\émilie\NTUSER.DAT 2008-11-27 11:57 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-27 11:57 --------- d-----w c:\program files\Electronic Arts 2008-11-27 10:23 --------- d-----w c:\program files\bwin 2008-11-23 02:48 --------- d-----w c:\users icolas\AppData\Roaming\OpenOffice.org2 2008-11-19 22:20 --------- d-----w c:\users icolas\AppData\Roaming eamspeak2 2008-11-17 16:58 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2008-11-17 16:46 --------- d-----w c:\program files\Lavasoft 2008-11-17 16:46 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-11-16 23:51 --------- d-----w c:\program files\Spybot - Search & Destroy 2008-11-16 14:13 --------- d-----w c:\programdata\Codemasters 2008-11-14 18:38 --------- d-----w c:\program files\WinamaxPoker 2008-11-14 01:22 --------- d-----w c:\programdata\NVIDIA 2008-11-12 00:25 --------- d-----w c:\users icolas\AppData\Roaming\LimeWire 2008-10-27 20:53 --------- d-----w c:\program files\Activision 2008-10-25 14:39 --------- d-----w c:\users icolas\AppData\Roaming\Mumble 2008-10-22 15:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2008-10-22 15:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2008-10-22 11:33 444,952 ----a-w c:\windows\System32\wrap_oal.dll 2008-10-22 11:33 109,080 ----a-w c:\windows\System32\OpenAL32.dll 2008-10-22 11:33 --------- d-----w c:\program files\OpenAL 2008-10-20 12:11 --------- d-----w c:\users icolas\AppData\Roaming\Paltalk 2008-10-20 12:11 --------- d-----w c:\program files\Paltalk Messenger 2008-10-19 16:08 --------- d-----w c:\program files\PokerStars.NET 2008-10-18 13:04 --------- d-----w c:\programdata\Media Center Programs 2008-10-18 11:43 --------- d-----w c:\program files\GameSpy 2008-10-18 11:39 669,184 ----a-w c:\windows\System32\pbsvc.exe 2008-10-18 11:39 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-10-18 11:39 22,328 ----a-w c:\users icolas\AppData\Roaming\PnkBstrK.sys 2008-10-18 11:39 103,736 ----a-w c:\windows\System32\PnkBstrB.exe 2008-10-17 23:12 --------- d-s---w c:\users\émilie\AppData\Roaming\Microsoft 2008-10-17 23:11 --------- d-----w c:\programdata\Avg7 2008-10-17 23:10 --------- d-----w c:\programdata\Grisoft 2008-10-17 19:36 --------- d-----w c:\users icolas\AppData\Roaming\AVG7 2008-10-17 18:59 --------- d-----w c:\programdata\Spybot - Search & Destroy 2008-10-15 22:14 --------- d-----w c:\program files\Windows Mail 2008-10-15 09:19 --------- d-----w c:\program files\PokerRewardsCalculator 2008-10-15 09:18 --------- d-----w c:\program files\Image-Line 2008-10-15 09:17 1,890 ----a-w c:\windows\System32\ealregsnapshot1.reg 2008-10-14 17:56 --------- d-----w c:\program files\Common Files\InstallShield 2008-10-14 17:53 --------- d--h--r c:\users icolas\AppData\Roaming\SecuROM 2008-10-14 17:50 --------- d-----w c:\programdata\Electronic Arts 2008-10-10 11:14 --------- d-----w c:\programdata\ma-config.com 2008-10-10 11:14 --------- d-----w c:\program files\ma-config.com 2008-10-08 14:43 --------- d-----w c:\program files\eMule 2008-10-07 12:22 107,888 ----a-w c:\windows\System32\CmdLineExt.dll 2008-10-07 12:21 --------- d-----w c:\users icolas\AppData\Roaming\Disney Interactive Studios 2008-10-07 12:05 --------- d-----w c:\program files\Disney Interactive Studios 2008-10-07 12:02 --------- d-----w c:\program files\DAEMON Tools Lite 2008-10-06 22:15 --------- d-----w c:\program files\Mumble 2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll 2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll 2008-09-30 12:06 --------- d-----w c:\program files\Sony 2008-09-30 11:37 --------- d-----w c:\users icolas\AppData\Roaming\dvdcss 2008-09-28 13:00 --------- d-----w c:\users icolas\AppData\Roaming\Sony Corporation 2008-09-28 12:53 --------- d-----w c:\programdata\Sony Corporation 2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32 tkrnlpa.exe 2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32 toskrnl.exe 2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys 2008-09-06 18:11 66,872 ----a-w c:\windows\System32\PnkBstrA.exe 2008-08-31 12:07 56 ---ha-w c:\users\All Users\ezsidmv.dat 2008-08-31 12:07 56 ---ha-w c:\programdata\ezsidmv.dat 2008-08-27 22:14 174 --sha-w c:\program files\desktop.ini 2008-08-27 19:13 82,432 ----a-w c:\windows\System32\axaltocm.dll 2008-08-27 19:13 101,888 ----a-w c:\windows\System32\ifxcardm.dll 2007-12-31 19:36 147,456 ----a-w c:\users icolas\vbzip10.dll 2007-12-07 14:37 44 ----a-w c:\users icolas\addresses.dat . ((((((((((((((((((((((((((((( snapshot_2008-11-27_10.47.12.77 ))))))))))))))))))))))))))))))))))))))))) . + 2008-11-27 09:42:41 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2008-11-27 09:42:41 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2008-11-27 09:43:20 1,572,864 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2008-11-27 12:18:32 1,572,864 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT - 2008-11-27 08:51:32 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-11-27 09:42:42 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2008-11-27 08:51:32 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-11-27 09:42:42 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-11-27 08:51:32 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-11-27 09:42:42 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-11-26 02:27:21 262,144 ----a-w c:\windows\System32\config\systemprofile tuser.dat + 2008-11-27 12:15:56 262,144 ----a-w c:\windows\System32\config\systemprofile tuser.dat - 2008-11-27 09:29:04 16,912 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3353809018-4188295010-4142484477-1000_UserData.bin + 2008-11-27 09:44:45 16,960 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3353809018-4188295010-4142484477-1000_UserData.bin - 2008-11-27 09:29:03 82,890 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-11-27 09:44:45 82,944 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] "Steam"="c:\program files\steam\steam.exe" [2008-11-16 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSConfig"="c:\windows\System32\msconfig.exe" [2008-01-19 227840] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 266497] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13535776] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 92704] "RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 c:\windows\RtHDVCpl.exe] [HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run] "Logman"="c:\windows\System32\drivers\logman.exe" [BU] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "msacm.l3acm"= l3codecp.acm "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm "vidc.X264"= x264vfw.dll "msacm.l3codec"= l3codecp.acm [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^hpoddt01.exe.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\hpoddt01.exe.lnk backup=c:\windows\pss\hpoddt01.exe.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader eader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe] --a------ 2008-01-19 08:33 125952 c:\windows\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-06-02 10:13 267048 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 15:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] --a------ 2008-01-19 08:38 1008184 c:\program files\Windows Defender\MSASCui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] --a------ 2008-01-19 08:33 202240 c:\program files\Windows Media Player\wmpnscfg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl] --a------ 2006-12-01 13:37 4186112 c:\windows\RtHDVCpl.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{ED529C9F-5CB9-4A9B-890F-FAD69EB8621B}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule "UDP Query User{46B144C2-E876-4240-BABC-37FCA70E5C54}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule "TCP Query User{5C9ECA7F-D381-4D76-8B45-25125C377193}c:\program files\msn messenger\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger "UDP Query User{7158C179-D22E-4611-9A81-B7B25ED269A4}c:\program files\msn messenger\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger "TCP Query User{F3B7E70C-8638-4F77-B70F-6DFD13CF7E8D}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{C59C477A-463F-4C27-8548-4B4B88CE2235}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{DC12E3EB-123D-4300-AD80-81A1310A2B12}e:\steamapps\metalguinness\condition zero\hl.exe"= UDP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "UDP Query User{EBD28C76-4C6A-44A6-9597-36290089BD76}e:\steamapps\metalguinness\condition zero\hl.exe"= TCP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "TCP Query User{98BBC409-24E5-456A-91CC-15F2AB0EDDA8}c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe"= UDP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp "UDP Query User{AF392EBB-2109-4B07-A7EB-3FF1DC3587FB}c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe"= TCP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp "TCP Query User{75D5B769-E9B7-4ECD-A968-64F69140FEBD}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule "UDP Query User{4072DE3E-2979-4014-99DB-9BCBA6691A2F}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule "TCP Query User{E79107BB-D6D6-4B6D-8CA8-F951207431A1}e:\steamapps\metalguinness\condition zero\hl.exe"= UDP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "UDP Query User{9C8C1F2B-13AA-497A-B1A4-E70DFED2005A}e:\steamapps\metalguinness\condition zero\hl.exe"= TCP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "TCP Query User{4BFF0396-112C-4D87-962A-8441D316B35D}c:\program files\msn messenger\livecall.exe"= UDP:c:\program files\msn messenger\livecall.exe:Windows Live Call "UDP Query User{203365B6-2ECE-4AB3-8699-DB4D9149D7CF}c:\program files\msn messenger\livecall.exe"= TCP:c:\program files\msn messenger\livecall.exe:Windows Live Call "TCP Query User{CAB73677-1C09-4081-AD01-5300DB868A15}c:\windows\windl\mirc.exe"= UDP:c:\windows\windl\mirc.exe:mIRC "UDP Query User{CC70295B-BB83-48E0-A17F-33D79BAA85BA}c:\windows\windl\mirc.exe"= TCP:c:\windows\windl\mirc.exe:mIRC "TCP Query User{770B9900-1F8B-4214-BEED-FB29EA5111D5}e:\steamapps\metalguinness\counter-strike\hl.exe"= UDP:e:\steamapps\metalguinness\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{67EDDB4C-49C0-44B2-8E16-8B31F4B2E44E}e:\steamapps\metalguinness\counter-strike\hl.exe"= TCP:e:\steamapps\metalguinness\counter-strike\hl.exe:Half-Life Launcher "TCP Query User{734020D3-36B2-462A-A38B-1A3F59C68578}c:\program files\electronic arts\eadm\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager "UDP Query User{81075885-3713-42C7-9021-D3EB634014E6}c:\program files\electronic arts\eadm\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager "{5DC4668A-157D-404D-99CE-C146A4541247}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{54990A40-A2E4-4CC3-8B06-7043FAE0079B}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{C60606B6-D970-4157-9D6A-88E78386B774}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{2BF6CF69-373C-416C-B667-AE4195AF2BC7}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "TCP Query User{D8F15AAC-ACEC-4E4D-84D1-FF1CF7F6D7E3}c:\program files\disney interactive studios\pure\pure.exe"= UDP:c:\program files\disney interactive studios\pure\pure.exe:Pure "UDP Query User{3023AD3C-05BF-49E0-81D0-1BDF48814CEE}c:\program files\disney interactive studios\pure\pure.exe"= TCP:c:\program files\disney interactive studios\pure\pure.exe:Pure "{7B30449A-A6C0-49F0-8254-1FE93DD9C91A}"= UDP:c:\program files\Codemasters\GRID\GRID.exe:GRID "{104FA4C2-D549-4E2F-BE38-C22972FA9765}"= TCP:c:\program files\Codemasters\GRID\GRID.exe:GRID "TCP Query User{51E0DAB1-CB45-4A8C-9D16-06A5CC1B2276}c:\program files\activision\call of duty 2\cod2mp_s.exe"= UDP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s "UDP Query User{E0F1FBA4-1DE9-406E-8307-576CFC0FB45D}c:\program files\activision\call of duty 2\cod2mp_s.exe"= TCP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s "TCP Query User{FDBB74F5-E568-4D53-84F6-F452328C1D54}c:\program files\trackmania nations eswc\tmnationseswc.exe"= UDP:c:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "UDP Query User{FB09D548-52A1-4BE5-922C-D19248E8A128}c:\program files\trackmania nations eswc\tmnationseswc.exe"= TCP:c:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "TCP Query User{813A3210-4E32-41F2-B867-454ED9E70AA9}e:\steamapps\rolex306\condition zero\hl.exe"= UDP:e:\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "UDP Query User{9B9DE649-3A04-4CB1-B3A1-3D5951D4E70C}e:\steamapps\rolex306\condition zero\hl.exe"= TCP:e:\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "TCP Query User{5F3654C7-4019-4EA7-90A5-65BBCEDF0D49}c:\program files\steam\steamapps\rolex306\condition zero\hl.exe"= UDP:c:\program files\steam\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "UDP Query User{95743B52-55D0-4A8D-9D79-A477FF3103A3}c:\program files\steam\steamapps\rolex306\condition zero\hl.exe"= TCP:c:\program files\steam\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "TCP Query User{D9BFE5F3-F090-42C0-BCC8-267C8FA6DCD1}c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe"= UDP:c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "UDP Query User{3E906ACB-5E48-4138-B695-77AED847D04D}c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe"= TCP:c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "TCP Query User{EDB04522-575C-4F0B-B2DB-7C4F78E1C150}c:\users\nicolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe"= UDP:c:\users icolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe:wow-frfr-installer-downloader.exe "UDP Query User{B2D7216D-279B-4A90-992B-1B10FB288326}c:\users\nicolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe"= TCP:c:\users icolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe:wow-frfr-installer-downloader.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352] R1 cpuidlep;CpuIdle Pro System Driver;c:\windows\system32\drivers\cpuidlep.sys [2007-06-18 4484] S3 ce6230;Intel CE6230 Standalone USB Driver;c:\windows\system32\DRIVERS\CE6230StandaloneDriver.sys [2008-03-26 44800] S3 ce6230BDACAP;Realfine CE6230 BDA Driver;c:\windows\system32\DRIVERS\CE6230BDA.sys [2008-03-26 19328] S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50.sys [2007-11-05 28224] S3 PCASp50;PCASp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCASp50.sys [2007-11-05 27072] S3 Steam Client Service;Steam Client Service;c:\program files\Common Files\Steam\SteamService.exe /RunAsService [2008-11-16 104944] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3dd6a743-93e8-11dd-93af-001a9219cb78}] \shell\AutoRun\command - D:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6662202f-79a8-11dd-9321-001a9219cb78}] \shell\AutoRun\command - D:\Launcher.exe . Contenu du dossier 'Tâches planifiées' 2008-11-21 c:\windows\Tasks\Maintenance en 1 clic.job - c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-02 18:18] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-27 13:18:34 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-11-27 13:19:46 ComboFix-quarantined-files.txt 2008-11-27 12:19:44 ComboFix2.txt 2008-11-26 02:37:10 Avant-CF: 49,335,115,776 octets libres Après-CF: 49,302,212,608 octets libres 292 --- E O F --- 2008-11-27 08:50:24

Lyonnais92 · Answer

Re,

Spybot S&D est très désagréable.

Tu le désinstalles :
Démarrer, Panneau de configuration, Ajout suppression de programmes.

Ensuite, tu relances une maneuvre de Combofix (avec les mêmes précautions) et ce script :

Driver:: 
aw7chg4x 
jfdcd 


File:: 
c:\users
icolas\AppData\Local\Temp\comrepl.exe 
c:\windows\System32\spr32d35.dll 
c:\users
icolas\AppData\Roaming\msts­c.exe 
c:\windows\System32\drivers\mqtgsvc.exe 
c:\windows\System32\drivers\logman.exe

Folder::
c:\program files\Spybot - Search & Destroy
c:\programdata\Spybot - Search & Destroy 

Registry:: 
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 
"MqtgSVC"=- 
[HKUS\S-1-5-18\..\Policies\Explorer\Run] 
"Logman"=- 
[HKUS\.DEFAULT\..\Policies\Explorer\Run] 
"Logman"=-

savatage · Answer

re je ne sais pas si tu voulais que je poste le rapport mais le voici : ComboFix 08-11-27.01 - nicolas 2008-11-27 16:18:56.4 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1325 [GMT 1:00] Lancé depuis: c:\users icolas\Desktop\ComboFix.exe Commutateurs utilisés :: c:\users icolas\Desktop\CFscript.txt * Un nouveau point de restauration a été créé * Resident AV is active FILE :: c:\users icolas\AppData\Local\Temp\comrepl.exe c:\users icolas\AppData\Roaming\mstsc.exe c:\windows\System32\drivers\logman.exe c:\windows\System32\drivers\mqtgsvc.exe c:\windows\System32\spr32d35.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Spybot - Search & Destroy c:\program files\Spybot - Search & Destroy\advcheck.dll c:\program files\Spybot - Search & Destroy\SDHelper.dll c:\program files\Spybot - Search & Destroy\Tools.dll c:\programdata\Spybot - Search & Destroy c:\programdata\Spybot - Search & Destroy\Logs\Checks.080712-1913.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.080712-1913.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.080712-1930.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.080712-1933.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.080712-2029.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.080712-2035.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.080712-2059.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.080712-2104.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.080713-2344.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.080713-2345.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.080721-1303.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.080721-1309.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.080728-1229.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.080728-1237.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.080806-2011.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.080806-2020.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.080825-1846.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.080825-1901.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.080911-2216.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.080911-2228.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.080915-1940.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.080915-1952.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.081008-1247.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.081008-1258.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.081023-1620.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.081023-1631.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.081031-1445.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.081031-1445.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.081031-1446.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.081031-1456.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.081117-0051.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.081117-0105.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.081117-1315.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.081117-1316.txt c:\programdata\Spybot - Search & Destroy\Logs\Checks.081121-0039.log c:\programdata\Spybot - Search & Destroy\Logs\Checks.081121-0041.txt c:\programdata\Spybot - Search & Destroy\Logs\Fixes.080712-1933.txt c:\programdata\Spybot - Search & Destroy\Logs\Fixes.080712-2059.txt c:\programdata\Spybot - Search & Destroy\Logs\Fixes.080712-2139.txt c:\programdata\Spybot - Search & Destroy\Logs\Fixes.080713-2345.txt c:\programdata\Spybot - Search & Destroy\Logs\Fixes.080721-1310.txt c:\programdata\Spybot - Search & Destroy\Logs\Fixes.080728-1241.txt c:\programdata\Spybot - Search & Destroy\Logs\Fixes.080825-1905.txt c:\programdata\Spybot - Search & Destroy\Logs\Fixes.080911-2244.txt c:\programdata\Spybot - Search & Destroy\Logs\Fixes.080911-2245.txt c:\programdata\Spybot - Search & Destroy\Logs\Fixes.080915-2118.txt c:\programdata\Spybot - Search & Destroy\Logs\Fixes.081023-1647.txt c:\programdata\Spybot - Search & Destroy\Logs\Fixes.081117-0108.txt c:\programdata\Spybot - Search & Destroy\Logs\Resident.log c:\programdata\Spybot - Search & Destroy\Logs\Update downloads.log c:\programdata\Spybot - Search & Destroy\ProcCache.sbc c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker1.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker10.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker11.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker12.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker13.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker14.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker15.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker16.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker17.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker18.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker19.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker2.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker20.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker21.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker22.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker23.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker24.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker25.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker26.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker27.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker28.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker29.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker3.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker4.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker5.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker6.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker7.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker8.zip c:\programdata\Spybot - Search & Destroy\Recovery\EverestPoker9.zip c:\programdata\Spybot - Search & Destroy\Recovery\MailSkinnerrtk.zip c:\programdata\Spybot - Search & Destroy\Recovery\MessengerSkinnerrtk.zip c:\programdata\Spybot - Search & Destroy\Recovery\Overview.ini c:\programdata\Spybot - Search & Destroy\Recovery\RegCleanr.zip c:\programdata\Spybot - Search & Destroy\Recovery\RegCleanr1.zip c:\programdata\Spybot - Search & Destroy\Recovery\RevealerKeylogger.zip c:\programdata\Spybot - Search & Destroy\Recovery\RevealerKeylogger1.zip c:\programdata\Spybot - Search & Destroy\Recovery\RevealerKeylogger2.zip c:\programdata\Spybot - Search & Destroy\Recovery\RevealerKeylogger3.zip c:\programdata\Spybot - Search & Destroy\Recovery\RevealerKeylogger4.zip c:\programdata\Spybot - Search & Destroy\Recovery\SmitfraudC.zip c:\programdata\Spybot - Search & Destroy\Recovery\SmitfraudC1.zip c:\programdata\Spybot - Search & Destroy\Recovery\SmitfraudCgp.zip c:\programdata\Spybot - Search & Destroy\Recovery\SmitfraudCgp1.zip c:\programdata\Spybot - Search & Destroy\Recovery\SmitfraudCgp2.zip c:\programdata\Spybot - Search & Destroy\Recovery\SmitfraudCgp3.zip c:\programdata\Spybot - Search & Destroy\Recovery\SpywareSecure.zip c:\programdata\Spybot - Search & Destroy\Recovery\WinBHOje.zip c:\programdata\Spybot - Search & Destroy\Recovery\WinBHOje1.zip c:\programdata\Spybot - Search & Destroy\Recovery\WinBHOje2.zip c:\programdata\Spybot - Search & Destroy\Recovery\WinBHOje3.zip c:\programdata\Spybot - Search & Destroy\Recovery\WinBHOje4.zip c:\programdata\Spybot - Search & Destroy\Recovery\WinBHOje5.zip c:\programdata\Spybot - Search & Destroy\Recovery\WinBHOje6.zip c:\programdata\Spybot - Search & Destroy\Recovery\WinBHOje7.zip c:\programdata\Spybot - Search & Destroy\Recovery\WinSmallbuy.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt1.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt10.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt11.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt12.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt13.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt14.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt15.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt2.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt3.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt4.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt5.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt6.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt7.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt8.zip c:\programdata\Spybot - Search & Destroy\Recovery\ZlobDownloadervdt9.zip . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-27 au 2008-11-27 )))))))))))))))))))))))))))))))))))) . 2008-11-27 15:43 . 2008-11-27 16:13 d-------- c:\users icolas\AppData\Roaming\Skype 2008-11-27 15:42 . 2008-11-27 15:42 d-------- c:\program files\Skype 2008-11-27 15:42 . 2008-11-27 15:42 d-------- c:\program files\Common Files\Skype 2008-11-27 15:04 . 2008-11-27 15:14 d-------- c:\users icolas\AppData\Roaming\OnlineArmor 2008-11-27 15:04 . 2008-11-27 15:04 d-------- c:\users\All Users\OnlineArmor 2008-11-27 15:04 . 2008-11-27 15:04 d-------- c:\programdata\OnlineArmor 2008-11-27 15:03 . 2008-11-27 15:03 d-------- c:\windows\LastGood 2008-11-27 15:03 . 2008-11-26 17:18 178,376 --a------ c:\windows\System32\drivers\OADriver.sys 2008-11-27 15:03 . 2008-11-26 17:18 30,920 --a------ c:\windows\System32\drivers\OAmon.sys 2008-11-27 15:03 . 2008-11-26 16:10 29,384 --a------ c:\windows\System32\drivers\OAnet.sys 2008-11-27 15:02 . 2008-11-27 15:02 d-------- c:\program files\Tall Emu 2008-11-27 15:02 . 2008-11-27 15:02 d-------- C:\OnlineArmor 2008-11-27 14:21 . 2008-11-27 14:21 404,250 --a------ c:\windows\Revolution Script CZ Uninstaller.exe 2008-11-26 04:08 . 2008-10-21 06:25 1,645,568 --a------ c:\windows\System32\connect.dll 2008-11-26 04:08 . 2008-08-28 04:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll 2008-11-26 04:08 . 2008-08-28 04:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll 2008-11-26 04:08 . 2008-08-28 04:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll 2008-11-26 04:08 . 2008-10-22 04:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll 2008-11-26 03:30 . 2008-11-17 00:34 81,920 --a------ c:\users icolas\AppData\Roaming\mstsc.exe 2008-11-25 21:55 . 2008-11-25 21:56 d-------- C: sit 2008-11-24 23:35 . 2008-11-24 23:42 d-------- c:\program files\WowCartographe 2008-11-24 14:02 . 2008-11-24 19:42 d-------- c:\users icolas\WoW-2.3.0.7561-frFR 2008-11-18 14:06 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll 2008-11-18 14:06 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll 2008-11-18 14:06 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll 2008-11-18 14:06 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll 2008-11-18 14:06 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll 2008-11-18 14:06 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe 2008-11-18 14:06 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll 2008-11-18 14:06 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll 2008-11-18 14:06 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe 2008-11-16 15:32 . 2008-11-27 14:33 d-------- c:\program files\Steam 2008-11-16 13:59 . 2008-11-23 15:05 d-------- c:\program files\Common Files\Steam 2008-11-15 04:24 . 2008-11-15 04:25 d-------- c:\users icolas\AppData\Roaming\LiveCAD2 2008-11-15 04:23 . 2007-03-12 16:42 3,495,784 --a------ c:\windows\System32\d3dx9_33.dll 2008-11-14 01:44 . 2008-11-14 01:44 d-------- c:\program files\RVG Software 2008-11-12 13:37 . 2008-11-12 13:37 dr-h----- C:\AHCache 2008-11-12 05:01 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll 2008-11-12 05:01 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll 2008-11-12 05:01 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys 2008-11-11 02:13 . 2008-11-17 01:08 d-------- c:\users\All Users kfree 2008-11-11 02:13 . 2008-11-17 01:08 d-------- c:\programdata kfree 2008-10-31 23:30 . 2008-08-05 10:49 428,544 --a------ c:\windows\System32\EncDec.dll 2008-10-31 23:30 . 2008-08-05 10:49 293,376 --a------ c:\windows\System32\psisdecd.dll 2008-10-31 23:30 . 2008-08-05 10:48 217,088 --a------ c:\windows\System32\psisrndr.ax 2008-10-31 23:30 . 2008-08-05 10:48 177,664 --a------ c:\windows\System32\mpg2splt.ax 2008-10-31 23:30 . 2008-08-05 10:48 80,896 --a------ c:\windows\System32\MSNP.ax 2008-10-29 14:23 . 2008-08-12 04:39 443,392 --a------ c:\windows\System32\win32spl.dll 2008-10-29 14:23 . 2008-09-18 05:56 147,456 --a------ c:\windows\System32\Faultrep.dll 2008-10-29 14:23 . 2008-09-18 05:56 125,952 --a------ c:\windows\System32\wersvc.dll 2008-10-27 02:15 . 2008-10-27 02:15 d-------- c:\program files\Pokerbility . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-27 15:18 23,068,672 ----a-w c:\users\émilie\NTUSER.DAT 2008-11-27 15:18 23,068,672 ----a-w c:\users\émilie\NTUSER.DAT 2008-11-27 15:05 --------- d-----w c:\users icolas\AppData\Roaming\skypePM 2008-11-27 14:42 --------- d-----w c:\programdata\Skype 2008-11-27 11:57 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-27 11:57 --------- d-----w c:\program files\Electronic Arts 2008-11-27 10:23 --------- d-----w c:\program files\bwin 2008-11-23 02:48 --------- d-----w c:\users icolas\AppData\Roaming\OpenOffice.org2 2008-11-19 22:20 --------- d-----w c:\users icolas\AppData\Roaming eamspeak2 2008-11-17 16:58 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2008-11-17 16:46 --------- d-----w c:\program files\Lavasoft 2008-11-17 16:46 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-11-16 14:13 --------- d-----w c:\programdata\Codemasters 2008-11-14 18:38 --------- d-----w c:\program files\WinamaxPoker 2008-11-14 01:22 --------- d-----w c:\programdata\NVIDIA 2008-11-12 00:25 --------- d-----w c:\users icolas\AppData\Roaming\LimeWire 2008-10-27 20:53 --------- d-----w c:\program files\Activision 2008-10-25 14:39 --------- d-----w c:\users icolas\AppData\Roaming\Mumble 2008-10-22 15:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2008-10-22 15:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2008-10-22 11:33 444,952 ----a-w c:\windows\System32\wrap_oal.dll 2008-10-22 11:33 109,080 ----a-w c:\windows\System32\OpenAL32.dll 2008-10-22 11:33 --------- d-----w c:\program files\OpenAL 2008-10-20 12:11 --------- d-----w c:\users icolas\AppData\Roaming\Paltalk 2008-10-20 12:11 --------- d-----w c:\program files\Paltalk Messenger 2008-10-19 16:08 --------- d-----w c:\program files\PokerStars.NET 2008-10-18 13:04 --------- d-----w c:\programdata\Media Center Programs 2008-10-18 11:43 --------- d-----w c:\program files\GameSpy 2008-10-18 11:39 669,184 ----a-w c:\windows\System32\pbsvc.exe 2008-10-18 11:39 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-10-18 11:39 22,328 ----a-w c:\users icolas\AppData\Roaming\PnkBstrK.sys 2008-10-18 11:39 103,736 ----a-w c:\windows\System32\PnkBstrB.exe 2008-10-17 23:12 --------- d-s---w c:\users\émilie\AppData\Roaming\Microsoft 2008-10-17 23:11 --------- d-----w c:\programdata\Avg7 2008-10-17 23:10 --------- d-----w c:\programdata\Grisoft 2008-10-17 19:36 --------- d-----w c:\users icolas\AppData\Roaming\AVG7 2008-10-15 22:14 --------- d-----w c:\program files\Windows Mail 2008-10-15 09:19 --------- d-----w c:\program files\PokerRewardsCalculator 2008-10-15 09:18 --------- d-----w c:\program files\Image-Line 2008-10-15 09:17 1,890 ----a-w c:\windows\System32\ealregsnapshot1.reg 2008-10-14 17:56 --------- d-----w c:\program files\Common Files\InstallShield 2008-10-14 17:53 --------- d--h--r c:\users icolas\AppData\Roaming\SecuROM 2008-10-14 17:50 --------- d-----w c:\programdata\Electronic Arts 2008-10-10 11:14 --------- d-----w c:\programdata\ma-config.com 2008-10-10 11:14 --------- d-----w c:\program files\ma-config.com 2008-10-08 14:43 --------- d-----w c:\program files\eMule 2008-10-07 12:22 107,888 ----a-w c:\windows\System32\CmdLineExt.dll 2008-10-07 12:21 --------- d-----w c:\users icolas\AppData\Roaming\Disney Interactive Studios 2008-10-07 12:05 --------- d-----w c:\program files\Disney Interactive Studios 2008-10-07 12:02 --------- d-----w c:\program files\DAEMON Tools Lite 2008-10-06 22:15 --------- d-----w c:\program files\Mumble 2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll 2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll 2008-09-30 12:06 --------- d-----w c:\program files\Sony 2008-09-30 11:37 --------- d-----w c:\users icolas\AppData\Roaming\dvdcss 2008-09-28 13:00 --------- d-----w c:\users icolas\AppData\Roaming\Sony Corporation 2008-09-28 12:53 --------- d-----w c:\programdata\Sony Corporation 2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32 tkrnlpa.exe 2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32 toskrnl.exe 2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys 2008-09-06 18:11 66,872 ----a-w c:\windows\System32\PnkBstrA.exe 2008-08-31 12:07 56 ---ha-w c:\users\All Users\ezsidmv.dat 2008-08-31 12:07 56 ---ha-w c:\programdata\ezsidmv.dat 2008-08-27 22:14 174 --sha-w c:\program files\desktop.ini 2008-08-27 19:13 82,432 ----a-w c:\windows\System32\axaltocm.dll 2008-08-27 19:13 101,888 ----a-w c:\windows\System32\ifxcardm.dll 2007-12-31 19:36 147,456 ----a-w c:\users icolas\vbzip10.dll 2007-12-07 14:37 44 ----a-w c:\users icolas\addresses.dat . ((((((((((((((((((((((((((((( snapshot_2008-11-27_10.47.12.77 ))))))))))))))))))))))))))))))))))))))))) . - 2008-10-05 22:13:30 51,200 ----a-w c:\windows\inf\infpub.dat + 2008-11-27 14:03:38 51,200 ----a-w c:\windows\inf\infpub.dat - 2008-10-05 22:13:28 86,016 ----a-w c:\windows\inf\infstor.dat + 2008-11-27 14:03:37 86,016 ----a-w c:\windows\inf\infstor.dat - 2008-10-05 22:13:30 143,360 ----a-w c:\windows\inf\infstrng.dat + 2008-11-27 14:03:38 143,360 ----a-w c:\windows\inf\infstrng.dat + 2008-11-27 13:22:42 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2008-11-27 13:22:42 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2008-11-27 09:43:09 1,572,864 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT + 2008-11-27 13:23:44 1,572,864 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT - 2008-11-27 09:43:20 1,572,864 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2008-11-27 15:21:35 1,572,864 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT - 2008-11-27 08:51:32 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-11-27 15:14:40 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2008-11-27 08:51:32 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-11-27 15:14:40 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-11-27 08:51:32 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-11-27 15:14:40 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-11-26 02:27:21 262,144 ----a-w c:\windows\System32\config\systemprofile tuser.dat + 2008-11-27 15:18:27 262,144 ----a-w c:\windows\System32\config\systemprofile tuser.dat + 2008-11-26 15:10:18 29,384 ----a-w c:\windows\System32\DriverStore\FileRepository\oanet.inf_812b2ea4\OAnet.sys - 2008-11-27 09:29:04 16,912 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3353809018-4188295010-4142484477-1000_UserData.bin + 2008-11-27 13:24:39 16,984 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3353809018-4188295010-4142484477-1000_UserData.bin - 2008-11-27 09:29:03 82,890 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-11-27 13:24:39 83,014 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-11-27 09:29:02 62,126 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2008-11-27 13:24:38 62,126 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] "Steam"="c:\program files\steam\steam.exe" [2008-11-16 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSConfig"="c:\windows\System32\msconfig.exe" [2008-01-19 227840] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 266497] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13535776] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 92704] "@OnlineArmor GUI"="c:\program files\Tall Emu\Online Armor\oaui.exe" [2008-11-26 6223048] "RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 c:\windows\RtHDVCpl.exe] [HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run] "Logman"="c:\windows\System32\drivers\logman.exe" [BU] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "EnableShellExecuteHooks"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "msacm.l3acm"= l3codecp.acm "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm "vidc.X264"= x264vfw.dll "msacm.l3codec"= l3codecp.acm [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^hpoddt01.exe.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\hpoddt01.exe.lnk backup=c:\windows\pss\hpoddt01.exe.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader eader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe] --a------ 2008-01-19 08:33 125952 c:\windows\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-06-02 10:13 267048 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 15:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] --a------ 2008-01-19 08:38 1008184 c:\program files\Windows Defender\MSASCui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] --a------ 2008-01-19 08:33 202240 c:\program files\Windows Media Player\wmpnscfg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl] --a------ 2006-12-01 13:37 4186112 c:\windows\RtHDVCpl.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{ED529C9F-5CB9-4A9B-890F-FAD69EB8621B}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule "UDP Query User{46B144C2-E876-4240-BABC-37FCA70E5C54}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule "TCP Query User{5C9ECA7F-D381-4D76-8B45-25125C377193}c:\program files\msn messenger\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger "UDP Query User{7158C179-D22E-4611-9A81-B7B25ED269A4}c:\program files\msn messenger\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger "TCP Query User{F3B7E70C-8638-4F77-B70F-6DFD13CF7E8D}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{C59C477A-463F-4C27-8548-4B4B88CE2235}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{DC12E3EB-123D-4300-AD80-81A1310A2B12}e:\steamapps\metalguinness\condition zero\hl.exe"= UDP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "UDP Query User{EBD28C76-4C6A-44A6-9597-36290089BD76}e:\steamapps\metalguinness\condition zero\hl.exe"= TCP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "TCP Query User{98BBC409-24E5-456A-91CC-15F2AB0EDDA8}c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe"= UDP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp "UDP Query User{AF392EBB-2109-4B07-A7EB-3FF1DC3587FB}c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe"= TCP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp "TCP Query User{75D5B769-E9B7-4ECD-A968-64F69140FEBD}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule "UDP Query User{4072DE3E-2979-4014-99DB-9BCBA6691A2F}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule "TCP Query User{E79107BB-D6D6-4B6D-8CA8-F951207431A1}e:\steamapps\metalguinness\condition zero\hl.exe"= UDP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "UDP Query User{9C8C1F2B-13AA-497A-B1A4-E70DFED2005A}e:\steamapps\metalguinness\condition zero\hl.exe"= TCP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "TCP Query User{4BFF0396-112C-4D87-962A-8441D316B35D}c:\program files\msn messenger\livecall.exe"= UDP:c:\program files\msn messenger\livecall.exe:Windows Live Call "UDP Query User{203365B6-2ECE-4AB3-8699-DB4D9149D7CF}c:\program files\msn messenger\livecall.exe"= TCP:c:\program files\msn messenger\livecall.exe:Windows Live Call "TCP Query User{CAB73677-1C09-4081-AD01-5300DB868A15}c:\windows\windl\mirc.exe"= UDP:c:\windows\windl\mirc.exe:mIRC "UDP Query User{CC70295B-BB83-48E0-A17F-33D79BAA85BA}c:\windows\windl\mirc.exe"= TCP:c:\windows\windl\mirc.exe:mIRC "TCP Query User{770B9900-1F8B-4214-BEED-FB29EA5111D5}e:\steamapps\metalguinness\counter-strike\hl.exe"= UDP:e:\steamapps\metalguinness\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{67EDDB4C-49C0-44B2-8E16-8B31F4B2E44E}e:\steamapps\metalguinness\counter-strike\hl.exe"= TCP:e:\steamapps\metalguinness\counter-strike\hl.exe:Half-Life Launcher "TCP Query User{734020D3-36B2-462A-A38B-1A3F59C68578}c:\program files\electronic arts\eadm\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager "UDP Query User{81075885-3713-42C7-9021-D3EB634014E6}c:\program files\electronic arts\eadm\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager "{5DC4668A-157D-404D-99CE-C146A4541247}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{54990A40-A2E4-4CC3-8B06-7043FAE0079B}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{C60606B6-D970-4157-9D6A-88E78386B774}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{2BF6CF69-373C-416C-B667-AE4195AF2BC7}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "TCP Query User{D8F15AAC-ACEC-4E4D-84D1-FF1CF7F6D7E3}c:\program files\disney interactive studios\pure\pure.exe"= UDP:c:\program files\disney interactive studios\pure\pure.exe:Pure "UDP Query User{3023AD3C-05BF-49E0-81D0-1BDF48814CEE}c:\program files\disney interactive studios\pure\pure.exe"= TCP:c:\program files\disney interactive studios\pure\pure.exe:Pure "{7B30449A-A6C0-49F0-8254-1FE93DD9C91A}"= UDP:c:\program files\Codemasters\GRID\GRID.exe:GRID "{104FA4C2-D549-4E2F-BE38-C22972FA9765}"= TCP:c:\program files\Codemasters\GRID\GRID.exe:GRID "TCP Query User{51E0DAB1-CB45-4A8C-9D16-06A5CC1B2276}c:\program files\activision\call of duty 2\cod2mp_s.exe"= UDP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s "UDP Query User{E0F1FBA4-1DE9-406E-8307-576CFC0FB45D}c:\program files\activision\call of duty 2\cod2mp_s.exe"= TCP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s "TCP Query User{FDBB74F5-E568-4D53-84F6-F452328C1D54}c:\program files\trackmania nations eswc\tmnationseswc.exe"= UDP:c:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "UDP Query User{FB09D548-52A1-4BE5-922C-D19248E8A128}c:\program files\trackmania nations eswc\tmnationseswc.exe"= TCP:c:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "TCP Query User{813A3210-4E32-41F2-B867-454ED9E70AA9}e:\steamapps\rolex306\condition zero\hl.exe"= UDP:e:\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "UDP Query User{9B9DE649-3A04-4CB1-B3A1-3D5951D4E70C}e:\steamapps\rolex306\condition zero\hl.exe"= TCP:e:\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "TCP Query User{5F3654C7-4019-4EA7-90A5-65BBCEDF0D49}c:\program files\steam\steamapps\rolex306\condition zero\hl.exe"= UDP:c:\program files\steam\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "UDP Query User{95743B52-55D0-4A8D-9D79-A477FF3103A3}c:\program files\steam\steamapps\rolex306\condition zero\hl.exe"= TCP:c:\program files\steam\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "TCP Query User{D9BFE5F3-F090-42C0-BCC8-267C8FA6DCD1}c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe"= UDP:c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "UDP Query User{3E906ACB-5E48-4138-B695-77AED847D04D}c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe"= TCP:c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "TCP Query User{EDB04522-575C-4F0B-B2DB-7C4F78E1C150}c:\users\nicolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe"= UDP:c:\users icolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe:wow-frfr-installer-downloader.exe "UDP Query User{B2D7216D-279B-4A90-992B-1B10FB288326}c:\users\nicolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe"= TCP:c:\users icolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe:wow-frfr-installer-downloader.exe "{C1345C7E-BEAD-4749-894F-CB8B8BC43CFE}"= c:\program files\Skype\Phone\Skype.exe:Skype R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352] R1 cpuidlep;CpuIdle Pro System Driver;c:\windows\system32\drivers\cpuidlep.sys [2007-06-18 4484] R1 OADevice;OADriver;\??\c:\windows\system32\drivers\OADriver.sys [2008-11-27 178376] R1 OAmon;OAmon;\??\c:\windows\system32\drivers\OAmon.sys [2008-11-27 30920] R2 OAcat;Online Armor Helper Service;"c:\program files\Tall Emu\Online Armor\oacat.exe" [2008-11-27 1402568] R3 OAnet;OnlineArmor Service;c:\windows\system32\DRIVERS\oanet.sys [2008-11-27 29384] S2 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\oasrv.exe [2008-11-27 3321032] S3 ce6230;Intel CE6230 Standalone USB Driver;c:\windows\system32\DRIVERS\CE6230StandaloneDriver.sys [2008-03-26 44800] S3 ce6230BDACAP;Realfine CE6230 BDA Driver;c:\windows\system32\DRIVERS\CE6230BDA.sys [2008-03-26 19328] S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50.sys [2007-11-05 28224] S3 PCASp50;PCASp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCASp50.sys [2007-11-05 27072] S3 Steam Client Service;Steam Client Service;c:\program files\Common Files\Steam\SteamService.exe /RunAsService [2008-11-16 104944] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3dd6a743-93e8-11dd-93af-001a9219cb78}] \shell\AutoRun\command - D:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6662202f-79a8-11dd-9321-001a9219cb78}] \shell\AutoRun\command - D:\Launcher.exe *Newly Created Service* - OADEVICE *Newly Created Service* - OAMON . Contenu du dossier 'Tâches planifiées' 2008-11-21 c:\windows\Tasks\Maintenance en 1 clic.job - c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-02 18:18] . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-27 16:21:48 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-11-27 16:23:02 ComboFix-quarantined-files.txt 2008-11-27 15:22:59 ComboFix2.txt 2008-11-27 12:19:47 ComboFix3.txt 2008-11-26 02:37:10 Avant-CF: 41 409 986 560 octets libres Après-CF: 41,412,722,688 octets libres 445 --- E O F --- 2008-11-27 08:50:24

Lyonnais92 · Answer

Re,

Télécharge OAD http://sosvirus.changelog.fr/OAD.exe
- Enregistre le sur ton Bureau

Double clique sur le OAD pour le lancer

- nom de fichier à rechercher tape ou fais un copier coller de : logman
- Type de recherche : sélectionne l'option 6 puis valide [entree]

OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ai terminé.
Le rapport de recherche s'affichera automatiquement à dès qu'il en aura terminé.

- Fais un copier / coller de ce rapport dans ton prochain post.

Note importante : Suivant la taille des disques dur cette recherche peut prendre plusieurs minutes. Sois patient(e) 

Clique droit sur le fichier OAD.exe et sur Propriétés, dans l'onglet Compatibilité, Cadre "Niveau de privilège" il faut cocher "Exécuter ce programme en tant qu'administrateur".

savatage · Answer

OAD est en train de chercher.
Peux tu me dire ce qu'il se passe exactement dans mon PC car je fais tout ce que tu me demande sans savoir ce qu'il y a. Merci beacoup .

savatage · Answer

voila, la recherche est finie et il ne trouve rien...

Lyonnais92 · Answer

Bonjour,

tu as une infection assez nouvelle ainsi qu'on peut le voir à travers les rapports de VirusTotal des fichiers suspects (en fait infectés) : un certain nombre d'heuristiques (des outils qui analysent le comportement du fichier, ce qu'il fait, si il commande des téléchargements, ouvre des ports, ...) les identifient comme nocifs dans savoir très bien ou les classer.

Une particularité : les fichiers infectés portent le même nom que des fichiers légitimes. mais ils ne sont pas dans les répertoires des fichiers légitimes.

Je crois avoir identifié les objets à supprimer (je vérifie que je n'en ai pas oublié avec OAD). je galère un peu d'une part partce que je me suis fait piégé sur cette histoire de nom et parce que un outil de sécurité (probablement Spybot S&D) a régénéré une clé de registre.

Si le problème persiste, je relirai toutes les lignes"non évidentes" des rapports pour voir l'indice qui m'aurait échappé.

Lyonnais92 · Answer

Re,

tu me postes le rapport quand même.

savatage · Answer

j'ai aussi un certain nombre de ports ouverts ( au moins 50) sous le nom de MSNMSGR depuis au moins 2 mois.
Je les ai deja tous supprimé moult fois un par un mais ils reviennent systématiquement. Crois-tu que ça a un rapport avec mon infection ?

savatage · Answer

euh... à la fin de la recherche le bloc note s'est ouvert sans rien dedans. Une nouvelle recherche est en cours .

savatage · Answer

la recherche vient de se terminer, bloc note s'ouvre et me dit : Impossible de trouver le fichier C:\resultat.txt.
                                                                                        Voulez-vous créer un nouveau fichier ?

Lyonnais92 · Answer

Re,

pour OAD, c'est ma faute.

Fais ça :

Clique droit sur le fichier OAD.exe et sur Propriétés, dans l'onglet Compatibilité, Cadre "Niveau de privilège" il faut cocher "Exécuter ce programme en tant qu'administrateur".

Recommence la recherche.

Pour tes ports, j'avais vu que tu avais beaucoup d'autorisations.

Tu as On line Armor comme parefeu.

Tu dois pouvoir bloquer MSNMSGR (au moins provisoirement, il faut que je regarde).

savatage · Answer

il me dit la même chose, fichier introuvable...

savatage · Answer

désolé le rapport vient de sortir, le voici :

 27/11/2008 ---- 18:32:32,37  

----------------------------------
§§§§§§ [logman] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-p..mmandline.resources_31bf3856ad364e35_6.0.6000.16386_fr-fr_8ec3e2c205f861ec]
"f!logman.exe.mui"=hex:6c,00,6f,00,67,00,6d,00,61,00,6e,00,2e,00,65,00,78,00,\

[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.0.6000.16386_none_5eecb8d501ea0d84]
"f!logman.exe"=hex:6c,00,6f,00,67,00,6d,00,61,00,6e,00,2e,00,65,00,78,00,65,00

[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.0.6001.18000_none_61237ad0fed51e58]
"f!logman.exe"=hex:6c,00,6f,00,67,00,6d,00,61,00,6e,00,2e,00,65,00,78,00,65,00

[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.0.6001.18000_001c50b5\ComponentFamilies\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_none_a9fec90c6c4fef92\f256!logman.exe]

[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.0.6001.18000_001c50b5\ComponentFamilies\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_none_a9fec90c6c4fef92\f256!logman.exe\1dd5acfa919993bd119487b8b6be36794ff23dd398e027a3a567853a47416714]

[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.0.6001.18000_001c50b5\ComponentFamilies\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_none_a9fec90c6c4fef92\f256!logman.exe\6ff18dca30ddb3524ff5bc210c0abad62859002d6a0b754f9e59a665c619bbb1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7AC3286D-4D1D-4817-84FC-C1C85E3AF0D9}]
@="ISearchCatalogManager2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}]
@="ISearchCatalogManager"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\DerivedData\Components\x86_microsoft-windows-p..mmandline.resources_31bf3856ad364e35_6.0.6000.16386_fr-fr_8ec3e2c205f861ec]
"f!logman.exe.mui"=hex:6c,00,6f,00,67,00,6d,00,61,00,6e,00,2e,00,65,00,78,00,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\DerivedData\Components\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.0.6000.16386_none_5eecb8d501ea0d84]
"f!logman.exe"=hex:6c,00,6f,00,67,00,6d,00,61,00,6e,00,2e,00,65,00,78,00,65,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\DerivedData\Components\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.0.6001.18000_none_61237ad0fed51e58]
"f!logman.exe"=hex:6c,00,6f,00,67,00,6d,00,61,00,6e,00,2e,00,65,00,78,00,65,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\DerivedData\VersionedIndex\6.0.6001.18000_001c50b5\ComponentFamilies\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_none_a9fec90c6c4fef92\f256!logman.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\DerivedData\VersionedIndex\6.0.6001.18000_001c50b5\ComponentFamilies\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_none_a9fec90c6c4fef92\f256!logman.exe\1dd5acfa919993bd119487b8b6be36794ff23dd398e027a3a567853a47416714]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\DerivedData\VersionedIndex\6.0.6001.18000_001c50b5\ComponentFamilies\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_none_a9fec90c6c4fef92\f256!logman.exe\6ff18dca30ddb3524ff5bc210c0abad62859002d6a0b754f9e59a665c619bbb1]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Logman"="C:\Windows\System32\drivers\logman.exe /waitservice"

"C:\Users\nicolas\AppData\Local\Temp\Rar$EX00.829\[cheatdb.fr]  Infamous\inFaMous GL.exe"="inFaMous GL"
"C:\Windows\System32\logman.exe"="Utilitaire d'enregistrement des Performances"

"C:\Users\nicolas\AppData\Local\Temp\Rar$EX00.829\[cheatdb.fr]  Infamous\inFaMous GL.exe"="inFaMous GL"
"C:\Windows\System32\logman.exe"="Utilitaire d'enregistrement des Performances"

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Logman"="C:\Windows\System32\drivers\logman.exe /waitservice"

*******************
     [Fichier] 
*******************

c:\Qoobox\Quarantine\C\Windows\System32\drivers\logman.exe.vir
c:\Windows\System32\fr-FR\logman.exe.mui
c:\Windows\System32\logman.exe
c:\Windows\winsxs\x86_microsoft-windows-p..mmandline.resources_31bf3856ad364e35_6.0.6000.16386_fr-fr_8ec3e2c205f861ec\logman.exe.mui
c:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.0.6000.16386_none_5eecb8d501ea0d84\logman.exe
c:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.0.6001.18000_none_61237ad0fed51e58\logman.exe


*********************
     [Même date] 
*********************

[02/11/2006 ] --- REP ---> C:\Program Files\.   
[02/11/2006 ] --- REP ---> C:\Program Files\..   
[02/11/2006 ] --- REP ---> C:\Program Files\Common Files  
[02/11/2006 ] --- REP ---> C:\Program Files\Internet Explorer  
[02/11/2006 ] --- REP ---> C:\Program Files\Microsoft Games  
[02/11/2006 ] --- REP ---> C:\Program Files\Movie Maker  
[02/11/2006 ] --- REP ---> C:\Program Files\MSBuild   
[02/11/2006 ] --- REP ---> C:\Program Files\Reference Assemblies  
[02/11/2006 ] --- REP ---> C:\Program Files\Uninstall Information  
[02/11/2006 ] --- REP ---> C:\Program Files\Windows Calendar  
[02/11/2006 ] --- REP ---> C:\Program Files\Windows Collaboration  
[02/11/2006 ] --- REP ---> C:\Program Files\Windows Defender  
[02/11/2006 ] --- REP ---> C:\Program Files\Windows Mail  
[02/11/2006 ] --- REP ---> C:\Program Files\Windows Media Player 
[02/11/2006 ] --- REP ---> C:\Program Files\Windows NT  
[02/11/2006 ] --- REP ---> C:\Program Files\Windows Photo Gallery 
[02/11/2006 ] --- REP ---> C:\Program Files\Windows Sidebar  
[02/11/2006 ] ---> C:\autoexec.bat   
[02/11/2006 ] ---> C:\config.sys   
[02/11/2006 ] ---> C:\Windows\_default.pif   
[02/11/2006 ] ---> C:\Windows\bootstat.dat   
[02/11/2006 ] ---> C:\Windows\hh.exe   
[02/11/2006 ] ---> C:\Windows\HomePremium.xml   
[02/11/2006 ] ---> C:\Windows\mib.bin   
[02/11/2006 ] ---> C:\Windows\msdfmap.ini   
[02/11/2006 ] ---> C:\Windows\system.ini   
[02/11/2006 ] ---> C:\Windows\system32\12520437.cpx   
[02/11/2006 ] ---> C:\Windows\system32\12520850.cpx   
[02/11/2006 ] ---> C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0   
[02/11/2006 ] ---> C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0   
[02/11/2006 ] ---> C:\Windows\system32\8point1.wav   
[02/11/2006 ] ---> C:\Windows\system32\ACCTRES.dll   
[02/11/2006 ] ---> C:\Windows\system32\acledit.dll   
[02/11/2006 ] ---> C:\Windows\system32\acppage.dll   
[02/11/2006 ] ---> C:\Windows\system32\acprgwiz.dll   
[02/11/2006 ] ---> C:\Windows\system32\acwizard.ico   
[02/11/2006 ] ---> C:\Windows\system32\AdapterTroubleshooter.exe   
[02/11/2006 ] ---> C:\Windows\system32\aecache.dll   
[02/11/2006 ] ---> C:\Windows\system32\aelupsvc.dll   
[02/11/2006 ] ---> C:\Windows\system32\AltTab.dll   
[02/11/2006 ] ---> C:\Windows\system32\amcompat.tlb   
[02/11/2006 ] ---> C:\Windows\system32\ANSI.SYS   
[02/11/2006 ] ---> C:\Windows\system32\append.exe   
[02/11/2006 ] ---> C:\Windows\system32\ARP.EXE   
[02/11/2006 ] ---> C:\Windows\system32\asferror.dll   
[02/11/2006 ] ---> C:\Windows\system32\asycfilt.dll   
[02/11/2006 ] ---> C:\Windows\system32\atmlib.dll   
[02/11/2006 ] ---> C:\Windows\system32\attrib.exe   
[02/11/2006 ] ---> C:\Windows\system32\AuthFWWizFwk.dll   
[02/11/2006 ] ---> C:\Windows\system32\autoexec.nt   
[02/11/2006 ] ---> C:\Windows\system32\AuxiliaryDisplayClassInstaller.dll   
[02/11/2006 ] ---> C:\Windows\system32\avicap.dll   
[02/11/2006 ] ---> C:\Windows\system32\avicap32.dll   
[02/11/2006 ] ---> C:\Windows\system32\avifile.dll   
[02/11/2006 ] ---> C:\Windows\system32\axaltocm.dll   
[02/11/2006 ] ---> C:\Windows\system32\azman.msc   
[02/11/2006 ] ---> C:\Windows\system32\batmeter.dll   
[02/11/2006 ] ---> C:\Windows\system32\bdaplgin.ax   
[02/11/2006 ] ---> C:\Windows\system32\bidispl.dll   
[02/11/2006 ] ---> C:\Windows\system32\bios1.rom   
[02/11/2006 ] ---> C:\Windows\system32\bios4.rom   
[02/11/2006 ] ---> C:\Windows\system32\bitsperf.dll   
[02/11/2006 ] ---> C:\Windows\system32\bitsprx2.dll   
[02/11/2006 ] ---> C:\Windows\system32\bitsprx3.dll   
[02/11/2006 ] ---> C:\Windows\system32\bitsprx4.dll   
[02/11/2006 ] ---> C:\Windows\system32\bitsprx5.dll   
[02/11/2006 ] ---> C:\Windows\system32\bopomofo.uce   
[02/11/2006 ] ---> C:\Windows\system32\brcoinst.dll   
[02/11/2006 ] ---> C:\Windows\system32\brdgcfg.dll   
[02/11/2006 ] ---> C:\Windows\system32\bridgeres.dll   
[02/11/2006 ] ---> C:\Windows\system32\bthserv.dll   
[02/11/2006 ] ---> C:\Windows\system32\bthudtask.exe   
[02/11/2006 ] ---> C:\Windows\system32\C_037.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10000.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10001.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10002.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10003.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10004.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10005.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10006.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10007.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10008.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10010.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10017.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10021.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10029.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10079.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10081.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_10082.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1026.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1047.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1140.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1141.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1142.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1143.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1144.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1145.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1146.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1147.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1148.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1149.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1250.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1251.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1252.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1253.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1254.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1255.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1256.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1257.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1258.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_1361.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20000.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20001.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20002.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20003.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20004.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20005.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20105.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20106.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20107.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20108.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20127.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20261.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20269.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20273.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20277.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20278.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20280.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20284.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20285.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20290.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20297.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20420.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20423.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20424.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20833.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20838.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20866.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20871.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20880.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20905.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20924.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20932.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20936.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_20949.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_21025.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_21027.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_21866.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_28591.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_28592.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_28593.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_28594.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_28595.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_28596.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_28597.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_28598.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_28599.NLS   
[02/11/2006 ] ---> C:\Windows\system32\c_28603.nls   
[02/11/2006 ] ---> C:\Windows\system32\C_28605.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_437.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_500.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_708.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_720.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_737.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_775.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_850.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_852.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_855.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_857.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_858.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_860.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_861.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_862.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_863.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_864.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_865.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_866.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_869.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_870.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_874.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_875.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_932.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_936.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_949.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_950.NLS   
[02/11/2006 ] ---> C:\Windows\system32\C_G18030.DLL   
[02/11/2006 ] ---> C:\Windows\system32\C_IS2022.DLL   
[02/11/2006 ] ---> C:\Windows\system32\C_ISCII.DLL   
[02/11/2006 ] ---> C:\Windows\system32\calc.exe   
[02/11/2006 ] ---> C:\Windows\system32\CardGames.dll   
[02/11/2006 ] ---> C:\Windows\system32\catsrvps.dll   
[02/11/2006 ] ---> C:\Windows\system32\cero.rs   
[02/11/2006 ] ---> C:\Windows\system32\certenc.dll   
[02/11/2006 ] ---> C:\Windows\system32\certmgr.msc   
[02/11/2006 ] ---> C:\Windows\system32\charmap.exe   
[02/11/2006 ] ---> C:\Windows\system32\chcp.com   
[02/11/2006 ] ---> C:\Windows\system32\chkdsk.exe   
[02/11/2006 ] ---> C:\Windows\system32\chkntfs.exe   
[02/11/2006 ] ---> C:\Windows\system32\choice.exe   
[02/11/2006 ] ---> C:\Windows\system32\CHxReadingStringIME.dll   
[02/11/2006 ] ---> C:\Windows\system32\CIRCoInst.dll   
[02/11/2006 ] ---> C:\Windows\system32\clb.dll   
[02/11/2006 ] ---> C:\Windows\system32\cleanmgr.exe   
[02/11/2006 ] ---> C:\Windows\system32\cliconfg.dll   
[02/11/2006 ] ---> C:\Windows\system32\cliconfg.exe   
[02/11/2006 ] ---> C:\Windows\system32\cliconfg.rll   
[02/11/2006 ] ---> C:\Windows\system32\clip.exe   
[02/11/2006 ] ---> C:\Windows\system32\cmdkey.exe   
[02/11/2006 ] ---> C:\Windows\system32\cngaudit.dll   
[02/11/2006 ] ---> C:\Windows\system32\cnvfat.dll   
[02/11/2006 ] ---> C:\Windows\system32\cofire.exe   
[02/11/2006 ] ---> C:\Windows\system32\collab.cpl   
[02/11/2006 ] ---> C:\Windows\system32\colorcpl.exe   
[02/11/2006 ] ---> C:\Windows\system32\comcat.dll   
[02/11/2006 ] ---> C:\Windows\system32\comexp.msc   
[02/11/2006 ] ---> C:\Windows\system32\COMM.drv   
[02/11/2006 ] ---> C:\Windows\system32\COMMAND.COM   
[02/11/2006 ] ---> C:\Windows\system32\COMMDLG.DLL   
[02/11/2006 ] ---> C:\Windows\system32\comp.exe   
[02/11/2006 ] ---> C:\Windows\system32\compact.exe   
[02/11/2006 ] ---> C:\Windows\system32\compmgmt.msc   
[02/11/2006 ] ---> C:\Windows\system32\compobj.dll   
[02/11/2006 ] ---> C:\Windows\system32\config.nt   
[02/11/2006 ] ---> C:\Windows\system32\console.dll   
[02/11/2006 ] ---> C:\Windows\system32\control.exe   
[02/11/2006 ] ---> C:\Windows\system32\country.sys   
[02/11/2006 ] ---> C:\Windows\system32\credwiz.exe   
[02/11/2006 ] ---> C:\Windows\system32\CRPPresentation.dll   
[02/11/2006 ] ---> C:\Windows\system32\crtdll.dll   
[02/11/2006 ] ---> C:\Windows\system32\cryptdlg.dll   
[02/11/2006 ] ---> C:\Windows\system32\cryptext.dll   
[02/11/2006 ] ---> C:\Windows\system32\ctfmon.exe   
[02/11/2006 ] ---> C:\Windows\system32\ctl3d32.dll   
[02/11/2006 ] ---> C:\Windows\system32\ctl3dv2.dll   
[02/11/2006 ] ---> C:\Windows\system32\d3d8thk.dll   
[02/11/2006 ] ---> C:\Windows\system32\d3dramp.dll   
[02/11/2006 ] ---> C:\Windows\system32\davclnt.dll   
[02/11/2006 ] ---> C:\Windows\system32\dbnmpntw.dll   
[02/11/2006 ] ---> C:\Windows\system32\dciman32.dll   
[02/11/2006 ] ---> C:\Windows\system32\dcomcnfg.exe   
[02/11/2006 ] ---> C:\Windows\system32\DDACLSys.dll   
[02/11/2006 ] ---> C:\Windows\system32\DDEML.DLL   
[02/11/2006 ] ---> C:\Windows\system32\ddrawex.dll   
[02/11/2006 ] ---> C:\Windows\system32\debug.exe   
[02/11/2006 ] ---> C:\Windows\system32\deskadp.dll   
[02/11/2006 ] ---> C:\Windows\system32\deskmon.dll   
[02/11/2006 ] ---> C:\Windows\system32\deskperf.dll   
[02/11/2006 ] ---> C:\Windows\system32\desktop.ini   
[02/11/2006 ] ---> C:\Windows\system32\DeviceEject.exe   
[02/11/2006 ] ---> C:\Windows\system32\DeviceProperties.exe   
[02/11/2006 ] ---> C:\Windows\system32\devmgmt.msc   
[02/11/2006 ] ---> C:\Windows\system32\dfrgifps.dll   
[02/11/2006 ] ---> C:\Windows\system32\DfrgRes.dll   
[02/11/2006 ] ---> C:\Windows\system32\dfsrres.dll   
[02/11/2006 ] ---> C:\Windows\system32\dhcpcmonitor.dll   
[02/11/2006 ] ---> C:\Windows\system32\dhcpsoc.dll   
[02/11/2006 ] ---> C:\Windows\system32\dialer.exe   
[02/11/2006 ] ---> C:\Windows\system32\dinput.dll   
[02/11/2006 ] ---> C:\Windows\system32\diskcomp.com   
[02/11/2006 ] ---> C:\Windows\system32\diskcopy.com   
[02/11/2006 ] ---> C:\Windows\system32\diskcopy.dll   
[02/11/2006 ] ---> C:\Windows\system32\diskmgmt.msc   
[02/11/2006 ] ---> C:\Windows\system32\diskperf.exe   
[02/11/2006 ] ---> C:\Windows\system32\dllhost.exe   
[02/11/2006 ] ---> C:\Windows\system32\dllhst3g.exe   
[02/11/2006 ] ---> C:\Windows\system32\dmband.dll   
[02/11/2006 ] ---> C:\Windows\system32\dmcompos.dll   
[02/11/2006 ] ---> C:\Windows\system32\dmdskres.dll   
[02/11/2006 ] ---> C:\Windows\system32\dmintf.dll   
[02/11/2006 ] ---> C:\Windows\system32\dmstyle.dll   
[02/11/2006 ] ---> C:\Windows\system32\docprop.dll   
[02/11/2006 ] ---> C:\Windows\system32\doskey.exe   
[02/11/2006 ] ---> C:\Windows\system32\dosx.exe   
[02/11/2006 ] ---> C:\Windows\system32\dplaysvr.exe   
[02/11/2006 ] ---> C:\Windows\system32\dplayx.dll   
[02/11/2006 ] ---> C:\Windows\system32\dpmodemx.dll   
[02/11/2006 ] ---> C:\Windows\system32\dpnaddr.dll   
[02/11/2006 ] ---> C:\Windows\system32\dpnathlp.dll   
[02/11/2006 ] ---> C:\Windows\system32\dpnhpast.dll   
[02/11/2006 ] ---> C:\Windows\system32\dpnhupnp.dll   
[02/11/2006 ] ---> C:\Windows\system32\dpnlobby.dll   
[02/11/2006 ] ---> C:\Windows\system32\dpnsvr.exe   
[02/11/2006 ] ---> C:\Windows\system32\dpwsockx.dll   
[02/11/2006 ] ---> C:\Windows\system32\drivers\adp94xx.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\adpahci.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\adpu160m.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\adpu320.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\AGP440.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\aliide.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\AMDAGP.SYS   
[02/11/2006 ] ---> C:\Windows\system32\drivers\amdide.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\amdk7.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\arc.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\arcsas.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\battc.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\BrFiltLo.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\BrFiltUp.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\BrSerId.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\BrSerWdm.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\BrUsbMdm.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\BrUsbSer.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\bthmodem.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\circlass.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\cmdide.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\compbatt.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\crcdisk.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\crusoe.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\djsvs.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\E1G60I32.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\elxstor.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\fdc.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\flpydisk.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\GAGP30KX.SYS   
[02/11/2006 ] ---> C:\Windows\system32\drivers\gm.dls   
[02/11/2006 ] ---> C:\Windows\system32\drivers\gmreadme.txt   
[02/11/2006 ] ---> C:\Windows\system32\drivers\HdAudio.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\hidbth.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\hidir.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\HpCISSs.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\i2omgmt.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\i2omp.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\iaStorV.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\iirsp.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\intelide.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\intelppm.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\IPMIDrv.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\isapnp.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\iteatapi.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\iteraid.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\lsi_fc.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\lsi_sas.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\lsi_scsi.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\megasas.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\mpio.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\Mraid35x.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\msahci.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\msdsm.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\nfrd960.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\ntrigdigi.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\NV_AGP.SYS   
[02/11/2006 ] ---> C:\Windows\system32\drivers\nvraid.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\nvstor.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\parport.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\parvdm.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\pcmcia.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\PEAuth.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\processr.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\ql2300.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\ql40xx.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\rdpdr.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\sbp2port.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\secdrv.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\sffdisk.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\sffp_mmc.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\sffp_sd.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\sfloppy.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\SISAGP.SYS   
[02/11/2006 ] ---> C:\Windows\system32\drivers\sisraid2.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\sisraid4.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\sym_hi.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\sym_u3.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\symc8xx.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\UAGP35.SYS   
[02/11/2006 ] ---> C:\Windows\system32\drivers\ULIAGPKX.SYS   
[02/11/2006 ] ---> C:\Windows\system32\drivers\uliahci.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\ulsata.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\ulsata2.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\usbcir.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\usbuhci.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\vgapnp.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\VIAAGP.SYS   
[02/11/2006 ] ---> C:\Windows\system32\drivers\viac7.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\viaide.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\vsmraid.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\wacompen.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\wd.sys   
[02/11/2006 ] ---> C:\Windows\system32\drivers\wmiacpi.sys   
[02/11/2006 ] ---> C:\Windows\system32\drprov.dll   
[02/11/2006 ] ---> C:\Windows\system32\DRWATSON.EXE   
[02/11/2006 ] ---> C:\Windows\system32\ds16gt.dLL   
[02/11/2006 ] ---> C:\Windows\system32\ds32gt.dll   
[02/11/2006 ] ---> C:\Windows\system32\dssec.dat   
[02/11/2006 ] ---> C:\Windows\system32\dswave.dll   
[02/11/2006 ] ---> C:\Windows\system32\dtsh.dll   
[02/11/2006 ] ---> C:\Windows\system32\dvdplay.exe   
[02/11/2006 ] ---> C:\Windows\system32\dvdupgrd.exe   
[02/11/2006 ] ---> C:\Windows\system32\edit.com   
[02/11/2006 ] ---> C:\Windows\system32\EDIT.HLP   
[02/11/2006 ] ---> C:\Windows\system32\edlin.exe   
[02/11/2006 ] ---> C:\Windows\system32\efsui.exe   
[02/11/2006 ] ---> C:\Windows\system32\ega.cpi   
[02/11/2006 ] ---> C:\Windows\system32\encapi.dll   
[02/11/2006 ] ---> C:\Windows\system32\eqossnap.dll   
[02/11/2006 ] ---> C:\Windows\system32\eudcedit.exe   
[02/11/2006 ] ---> C:\Windows\system32\eventcreate.exe   
[02/11/2006 ] ---> C:\Windows\system32\EventViewer_EventDetails.xsl   
[02/11/2006 ] ---> C:\Windows\system32\eventvwr.exe   
[02/11/2006 ] ---> C:\Windows\system32\eventvwr.msc   
[02/11/2006 ] ---> C:\Windows\system32\exe2bin.exe   
[02/11/2006 ] ---> C:\Windows\system32\expsrv.dll   
[02/11/2006 ] ---> C:\Windows\system32\fastopen.exe   
[02/11/2006 ] ---> C:\Windows\system32\fc.exe   
[02/11/2006 ] ---> C:\Windows\system32\fdProxy.dll   
[02/11/2006 ] ---> C:\Windows\system32\FDResPub.dll   
[02/11/2006 ] ---> C:\Windows\system32\fdWNet.dll   
[02/11/2006 ] ---> C:\Windows\system32\find.exe   
[02/11/2006 ] ---> C:\Windows\system32\finger.exe   
[02/11/2006 ] ---> C:\Windows\system32\FirewallSettings.exe   
[02/11/2006 ] ---> C:\Windows\system32\fixmapi.exe   
[02/11/2006 ] ---> C:\Windows\system32\fltLib.dll   
[02/11/2006 ] ---> C:\Windows\system32\fltMC.exe   
[02/11/2006 ] ---> C:\Windows\system32\FNTCACHE.DAT   
[02/11/2006 ] ---> C:\Windows\system32\fontview.exe   
[02/11/2006 ] ---> C:\Windows\system32\forfiles.exe   
[02/11/2006 ] ---> C:\Windows\system32\format.com   
[02/11/2006 ] ---> C:\Windows\system32\gatherWiredInfo.xslt   
[02/11/2006 ] ---> C:\Windows\system32\gatherWirelessInfo.xslt   
[02/11/2006 ] ---> C:\Windows\system32\gb2312.uce   
[02/11/2006 ] ---> C:\Windows\system32\gcdef.dll   
[02/11/2006 ] ---> C:\Windows\system32\GDI.EXE   
[02/11/2006 ] ---> C:\Windows\system32\getuname.dll   
[02/11/2006 ] ---> C:\Windows\system32\glmf32.dll   
[02/11/2006 ] ---> C:\Windows\system32\glu32.dll   
[02/11/2006 ] ---> C:\Windows\system32\gptext.dll   
[02/11/2006 ] ---> C:\Windows\system32\GRAPHICS.COM   
[02/11/2006 ] ---> C:\Windows\system32\graphics.pro   
[02/11/2006 ] ---> C:\Windows\system32\grpconv.exe   
[02/11/2006 ] ---> C:\Windows\system32\hal.dll   
[02/11/2006 ] ---> C:\Windows\system32\halacpi.dll   
[02/11/2006 ] ---> C:\Windows\system32\halmacpi.dll   
[02/11/2006 ] ---> C:\Windows\system32\hdwwiz.cpl   
[02/11/2006 ] ---> C:\Windows\system32\hdwwiz.exe   
[02/11/2006 ] ---> C:\Windows\system32\help.exe   
[02/11/2006 ] ---> C:\Windows\system32\hhsetup.dll   
[02/11/2006 ] ---> C:\Windows\system32\hid.dll   
[02/11/2006 ] ---> C:\Windows\system32\hidphone.tsp   
[02/11/2006 ] ---> C:\Windows\system32\hidserv.dll   
[02/11/2006 ] ---> C:\Windows\system32\HIMEM.SYS   
[02/11/2006 ] ---> C:\Windows\system32\HOSTNAME.EXE   
[02/11/2006 ] ---> C:\Windows\system32\hotplug.dll   
[02/11/2006 ] ---> C:\Windows\system32\hpotscl1.dll   
[02/11/2006 ] ---> C:\Windows\system32\hpowiav1.dll   
[02/11/2006 ] ---> C:\Windows\system32\HPZLLLHN.DLL   
[02/11/2006 ] ---> C:\Windows\system32\htui.dll   
[02/11/2006 ] ---> C:\Windows\system32\iac25_32.ax   
[02/11/2006 ] ---> C:\Windows\system32\iccvid.dll   
[02/11/2006 ] ---> C:\Windows\system32\icmp.dll   
[02/11/2006 ] ---> C:\Windows\system32\icmui.dll   
[02/11/2006 ] ---> C:\Windows\system32\IconCodecService.dll   
[02/11/2006 ] ---> C:\Windows\system32\icrav03.rat   
[02/11/2006 ] ---> C:\Windows\system32\icsigd.dll   
[02/11/2006 ] ---> C:\Windows\system32\ideograf.uce   
[02/11/2006 ] ---> C:\Windows\system32\ieakui.dll   
[02/11/2006 ] ---> C:\Windows\system32\ieuinit.inf   
[02/11/2006 ] ---> C:\Windows\system32\ieUnatt.exe   
[02/11/2006 ] ---> C:\Windows\system32\ifsutilx.dll   
[02/11/2006 ] ---> C:\Windows\system32\ifxcardm.dll   
[02/11/2006 ] ---> C:\Windows\system32\imaadp32.acm   
[02/11/2006 ] ---> C:\Windows\system32\imageres.dll   
[02/11/2006 ] ---> C:\Windows\system32\INETRES.dll   
[02/11/2006 ] ---> C:\Windows\system32\iologmsg.dll   
[02/11/2006 ] ---> C:\Windows\system32\IPBusEnumProxy.dll   
[02/11/2006 ] ---> C:\Windows\system32\iprop.dll   
[02/11/2006 ] ---> C:\Windows\system32\ir32_32.dll   
[02/11/2006 ] ---> C:\Windows\system32\ir41_32.ax   
[02/11/2006 ] ---> C:\Windows\system32\ir41_qc.dll   
[02/11/2006 ] ---> C:\Windows\system32\ir41_qcx.dll   
[02/11/2006 ] ---> C:\Windows\system32\ir50_32.dll   
[02/11/2006 ] ---> C:\Windows\system32\ir50_qc.dll   
[02/11/2006 ] ---> C:\Windows\system32\ir50_qcx.dll   
[02/11/2006 ] ---> C:\Windows\system32\irclass.dll   
[02/11/2006 ] ---> C:\Windows\system32\irftp.exe   
[02/11/2006 ] ---> C:\Windows\system32\irmon.dll   
[02/11/2006 ] ---> C:\Windows\system32\irprops.cpl   
[02/11/2006 ] ---> C:\Windows\system32\iscsicli.exe   
[02/11/2006 ] ---> C:\Windows\system32\iscsicpl.dll   
[02/11/2006 ] ---> C:\Windows\system32\iscsicpl.exe   
[02/11/2006 ] ---> C:\Windows\system32\iscsidsc.dll   
[02/11/2006 ] ---> C:\Windows\system32\itircl.dll   
[02/11/2006 ] ---> C:\Windows\system32\ivfsrc.ax   
[02/11/2006 ] ---> C:\Windows\system32\iyuv_32.dll   
[02/11/2006 ] ---> C:\Windows\system32\kanji_1.uce   
[02/11/2006 ] ---> C:\Windows\system32\kanji_2.uce   
[02/11/2006 ] ---> C:\Windows\system32\KB16.COM   
[02/11/2006 ] ---> C:\Windows\system32\kbd101.dll   
[02/11/2006 ] ---> C:\Windows\system32\kbd101a.dll   
[02/11/2006 ] ---> C:\Windows\system32\kbd101b.dll   
[02/11/2006 ] ---> C:\Windows\system32\kbd101c.dll   
[02/11/2006 ] ---> C:\Windows\system32\kbd103.dll   
[02/11/2006 ] ---> C:\Windows\system32\kbd106.dll   
[02/11/2006 ] ---> C:\Windows\system32\KBDA1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDA2.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDA3.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDAL.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDARME.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDARMW.DLL   
[02/11/2006 ] ---> C:\Windows\system32\kbdax2.dll   
[02/11/2006 ] ---> C:\Windows\system32\KBDAZE.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDAZEL.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDBASH.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDBE.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDBENE.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDBGPH.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDBHC.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDBLR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDBR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDBU.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDBULG.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDCA.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDCAN.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDCR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDCZ.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDCZ1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDCZ2.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDDA.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDDIV1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDDIV2.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDDV.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDES.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDEST.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDFA.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDFC.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDFI.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDFI1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDFO.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDFR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDGAE.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDGEO.DLL   
[02/11/2006 ] ---> C:\Windows\system32\kbdgeoer.dll   
[02/11/2006 ] ---> C:\Windows\system32\kbdgeoqw.dll   
[02/11/2006 ] ---> C:\Windows\system32\KBDGKL.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDGR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDGR1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDGRLND.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDHE.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDHE220.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDHE319.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDHEB.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDHELA2.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDHELA3.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDHEPT.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDHU.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDHU1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\kbdibm02.dll   
[02/11/2006 ] ---> C:\Windows\system32\KBDIC.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINASA.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINBE1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINBE2.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINBEN.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINDEV.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINGUJ.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINHIN.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINKAN.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINMAL.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINMAR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINORI.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINPUN.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINTAM.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINTEL.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDINUK2.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDIR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDIT.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDIT142.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDIULAT.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDKAZ.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDKHMR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDKYR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDLA.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDLAO.DLL   
[02/11/2006 ] ---> C:\Windows\system32\kbdlk41a.dll   
[02/11/2006 ] ---> C:\Windows\system32\KBDLT.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDLT1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDLT2.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDLV.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDLV1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDMAC.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDMACST.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDMAORI.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDMLT47.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDMLT48.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDMON.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDMONMO.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDNE.DLL   
[02/11/2006 ] ---> C:\Windows\system32\kbdnec.dll   
[02/11/2006 ] ---> C:\Windows\system32\kbdnec95.dll   
[02/11/2006 ] ---> C:\Windows\system32\kbdnecat.dll   
[02/11/2006 ] ---> C:\Windows\system32\kbdnecnt.dll   
[02/11/2006 ] ---> C:\Windows\system32\KBDNEPR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDNO.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDNO1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDPASH.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDPL.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDPL1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDPO.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDRO.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDROPR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDROST.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDRU.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDRU1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSF.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSG.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSL.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSL1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSMSFI.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSMSNO.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSN1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSOREX.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSORST.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSP.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSW.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSW09.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSYR1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDSYR2.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDTAJIK.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDTAT.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDTH0.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDTH1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDTH2.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDTH3.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDTIPRC.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDTUF.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDTUQ.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDTURME.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDUGHR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDUK.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDUKX.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDUR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDUR1.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDURDU.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDUS.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDUSA.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDUSL.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDUSR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDUSX.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDUZB.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDVNTC.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDYAK.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDYCC.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KBDYCL.DLL   
[02/11/2006 ] ---> C:\Windows\system32\KEY01.SYS   
[02/11/2006 ] ---> C:\Windows\system32\keyboard.drv   
[02/11/2006 ] ---> C:\Windows\system32\KEYBOARD.SYS   
[02/11/2006 ] ---> C:\Windows\system32\keyiso.dll   
[02/11/2006 ] ---> C:\Windows\system32\kmddsp.tsp   
[02/11/2006 ] ---> C:\Windows\system32\korean.uce   
[02/11/2006 ] ---> C:\Windows\system32\krnl386.exe   
[02/11/2006 ] ---> C:\Windows\system32\ksuser.dll   
[02/11/2006 ] ---> C:\Windows\system32\Kswdmcap.ax   
[02/11/2006 ] ---> C:\Windows\system32\l_intl.nls   
[02/11/2006 ] ---> C:\Windows\system32\label.exe   
[02/11/2006 ] ---> C:\Windows\system32\lanman.drv   
[02/11/2006 ] ---> C:\Windows\system32\LAPRXY.DLL   
[02/11/2006 ] ---> C:\Windows\system32\lcphrase.tbl   
[02/11/2006 ] ---> C:\Windows\system32\lcptr.tbl   
[02/11/2006 ] ---> C:\Windows\system32\license.rtf   
[02/11/2006 ] ---> C:\Windows\system32\linkinfo.dll   
[02/11/2006 ] ---> C:\Windows\system32\lltdres.dll   
[02/11/2006 ] ---> C:\Windows\system32\lmhsvc.dll   
[02/11/2006 ] ---> C:\Windows\system32\LOADFIX.COM   
[02/11/2006 ] ---> C:\Windows\system32\Locator.exe   
[02/11/2006 ] ---> C:\Windows\system32\lusrmgr.msc   
[02/11/2006 ] ---> C:\Windows\system32\lz32.dll   
[02/11/2006 ] ---> C:\Windows\system32\lzexpand.dll   
[02/11/2006 ] ---> C:\Windows\system32\Magnification.dll   
[02/11/2006 ] ---> C:\Windows\system32\Magnify.exe   
[02/11/2006 ] ---> C:\Windows\system32\main.cpl   
[02/11/2006 ] ---> C:\Windows\system32\mapi32.dll   
[02/11/2006 ] ---> C:\Windows\system32\mapistub.dll   
[02/11/2006 ] ---> C:\Windows\system32\mciavi.drv   
[02/11/2006 ] ---> C:\Windows\system32\mciavi32.dll   
[02/11/2006 ] ---> C:\Windows\system32\mcicda.dll   
[02/11/2006 ] ---> C:\Windows\system32\mciqtz32.dll   
[02/11/2006 ] ---> C:\Windows\system32\mciseq.dll   
[02/11/2006 ] ---> C:\Windows\system32\mciseq.drv   
[02/11/2006 ] ---> C:\Windows\system32\mciwave.dll   
[02/11/2006 ] ---> C:\Windows\system32\mciwave.drv   
[02/11/2006 ] ---> C:\Windows\system32\MdRes.exe   
[02/11/2006 ] ---> C:\Windows\system32\mem.exe   
[02/11/2006 ] ---> C:\Windows\system32\mf3216.dll   
[02/11/2006 ] ---> C:\Windows\system32\mfc40.dll   
[02/11/2006 ] ---> C:\Windows\system32\mfc40u.dll   
[02/11/2006 ] ---> C:\Windows\system32\mferror.dll   
[02/11/2006 ] ---> C:\Windows\system32\mgmtapi.dll   
[02/11/2006 ] ---> C:\Windows\system32\miguiresource.dll   
[02/11/2006 ] ---> C:\Windows\system32\migwiz.lnk   
[02/11/2006 ] ---> C:\Windows\system32\mlang.dat   
[02/11/2006 ] ---> C:\Windows\system32\mmci.dll   
[02/11/2006 ] ---> C:\Windows\system32\mmcico.dll   
[02/11/2006 ] ---> C:\Windows\system32\MMSYSTEM.DLL   
[02/11/2006 ] ---> C:\Windows\system32\mmtask.tsk   
[02/11/2006 ] ---> C:\Windows\system32\mode.com   
[02/11/2006 ] ---> C:\Windows\system32\montr_ci.dll   
[02/11/2006 ] ---> C:\Windows\system32\more.com   
[02/11/2006 ] ---> C:\Windows\system32\moricons.dll   
[02/11/2006 ] ---> C:\Windows\system32\mouse.drv   
[02/11/2006 ] ---> C:\Windows\system32\mpnotify.exe   
[02/11/2006 ] ---> C:\Windows\system32\MRINFO.EXE   
[02/11/2006 ] ---> C:\Windows\system32\mrt.exe   
[02/11/2006 ] ---> C:\Windows\system32\msacm.dll   
[02/11/2006 ] ---> C:\Windows\system32\msadp32.acm   
[02/11/2006 ] ---> C:\Windows\system32\msafd.dll   
[02/11/2006 ] ---> C:\Windows\system32\msasn1.dll   
[02/11/2006 ] ---> C:\Windows\system32\msaudite.dll   
[02/11/2006 ] ---> C:\Windows\system32\mscat32.dll   
[02/11/2006 ] ---> C:\Windows\system32\mscdexnt.exe   
[02/11/2006 ] ---> C:\Windows\system32\mscpx32r.dLL   
[02/11/2006 ] ---> C:\Windows\system32\mscpxl32.dLL   
[02/11/2006 ] ---> C:\Windows\system32\msctfime.ime   
[02/11/2006 ] ---> C:\Windows\system32\msctfp.dll   
[02/11/2006 ] ---> C:\Windows\system32\msdatsrc.tlb   
[02/11/2006 ] ---> C:\Windows\system32\msdxm.tlb   
[02/11/2006 ] ---> C:\Windows\system32\msexch40.dll   
[02/11/2006 ] ---> C:\Windows\system32\msg711.acm   
[02/11/2006 ] ---> C:\Windows\system32\msgsm32.acm   
[02/11/2006 ] ---> C:\Windows\system32\mshtmler.dll   
[02/11/2006 ] ---> C:\Windows\system32\msidntld.dll   
[02/11/2006 ] ---> C:\Windows\system32\msiltcfg.dll   
[02/11/2006 ] ---> C:\Windows\system32\msimg32.dll   
[02/11/2006 ] ---> C:\Windows\system32\msimsg.dll   
[02/11/2006 ] ---> C:\Windows\system32\msjint40.dll   
[02/11/2006 ] ---> C:\Windows\system32\msjter40.dll   
[02/11/2006 ] ---> C:\Windows\system32\msorc32r.dll   
[02/11/2006 ] ---> C:\Windows\system32\msports.dll   
[02/11/2006 ] ---> C:\Windows\system32\msprivs.dll   
[02/11/2006 ] ---> C:\Windows\system32\MsraLegacy.tlb   
[02/11/2006 ] ---> C:\Windows\system32\msrd2x40.dll   
[02/11/2006 ] ---> C:\Windows\system32\msrle32.dll   
[02/11/2006 ] ---> C:\Windows\system32\msshavmsg.dll   
[02/11/2006 ] ---> C:\Windows\system32\mssign32.dll   
[02/11/2006 ] ---> C:\Windows\system32\mssip32.dll   
[02/11/2006 ] ---> C:\Windows\system32\msswch.dll   
[02/11/2006 ] ---> C:\Windows\system32\msvcirt.dll   
[02/11/2006 ] ---> C:\Windows\system32\msvcp60.dll   
[02/11/2006 ] ---> C:\Windows\system32\msvcrt20.dll   
[02/11/2006 ] ---> C:\Windows\system32\msvcrt40.dll   
[02/11/2006 ] ---> C:\Windows\system32\msvideo.dll   
[02/11/2006 ] ---> C:\Windows\system32\mswdat10.dll   
[02/11/2006 ] ---> C:\Windows\system32\mswstr10.dll   
[02/11/2006 ] ---> C:\Windows\system32\msxml3r.dll   
[02/11/2006 ] ---> C:\Windows\system32\msxml6r.dll   
[02/11/2006 ] ---> C:\Windows\system32\msyuv.dll   
[02/11/2006 ] ---> C:\Windows\system32\mtxex.dll   
[02/11/2006 ] ---> C:\Windows\system32\muifontsetup.dll   
[02/11/2006 ] ---> C:\Windows\system32\MUILanguageCleanup.dll   
[02/11/2006 ] ---> C:\Windows\system32\NAPCLCFG.MSC   
[02/11/2006 ] ---> C:\Windows\system32\Narrator.exe   
[02/11/2006 ] ---> C:\Windows\system32\NativeHooks.dll   
[02/11/2006 ] ---> C:\Windows\system32\ncpa.cpl   
[02/11/2006 ] ---> C:\Windows\system32\nddeapi.dll   
[02/11/2006 ] ---> C:\Windows\system32\NdfEventView.xml   
[02/11/2006 ] ---> C:\Windows\system32\ndishc.dll   
[02/11/2006 ] ---> C:\Windows\system32\ndproxystub.dll   
[02/11/2006 ] ---> C:\Windows\system32\ndptsp.tsp   
[02/11/2006 ] ---> C:\Windows\system32\netapi.dll   
[02/11/2006 ] ---> C:\Windows\system32\netfxperf.dll   
[02/11/2006 ] ---> C:\Windows\system32\neth.dll   
[02/11/2006 ] ---> C:\Windows\system32\netmsg.dll   
[02/11/2006 ] ---> C:\Windows\system32\NetProj.exe   
[02/11/2006 ] ---> C:\Windows\system32\netrap.dll   
[02/11/2006 ] ---> C:\Windows\system32\netsh.exe   
[02/11/2006 ] ---> C:\Windows\system32\NETSTAT.EXE   
[02/11/2006 ] ---> C:\Windows\system32\newdev.exe   
[02/11/2006 ] ---> C:\Windows\system32\nlmsprep.dll   
[02/11/2006 ] ---> C:\Windows\system32\nlsfunc.exe   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0001.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0002.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0003.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons000a.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons000c.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons000d.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons000f.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0010.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0011.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0013.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0018.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0019.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons001a.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons001b.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons001d.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0020.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0021.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0022.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0024.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0026.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0027.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons002a.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0039.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons003e.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0045.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0046.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0047.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0049.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons004a.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons004b.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons004c.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons004e.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0414.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0416.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0816.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons081a.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsLexicons0c1a.dll   
[02/11/2006 ] ---> C:\Windows\system32\NlsModels0011.dll   
[02/11/2006 ] ---> C:\Windows\system32\NOISE.CHS   
[02/11/2006 ] ---> C:\Windows\system32\NOISE.CHT   
[02/11/2006 ] ---> C:\Windows\system32\NOISE.DAT   
[02/11/2006 ] ---> C:\Windows\system32\noise.jpn   
[02/11/2006 ] ---> C:\Windows\system32\noise.kor   
[02/11/2006 ] ---> C:\Windows\system32\NOISE.THA   
[02/11/2006 ] ---> C:\Windows\system32\normaliz.dll   
[02/11/2006 ] ---> C:\Windows\system32\normidna.nls   
[02/11/2006 ] ---> C:\Windows\system32\normnfc.nls   
[02/11/2006 ] ---> C:\Windows\system32\normnfd.nls   
[02/11/2006 ] ---> C:\Windows\system32\normnfkc.nls   
[02/11/2006 ] ---> C:\Windows\system32\normnfkd.nls   
[02/11/2006 ] ---> C:\Windows\system32\npmproxy.dll   
[02/11/2006 ] ---> C:\Windows\system32\NTDOS.SYS   
[02/11/2006 ] ---> C:\Windows\system32\NTDOS404.SYS   
[02/11/2006 ] ---> C:\Windows\system32\NTDOS411.SYS   
[02/11/2006 ] ---> C:\Windows\system32\NTDOS412.SYS   
[02/11/2006 ] ---> C:\Windows\system32\NTDOS804.SYS   
[02/11/2006 ] ---> C:\Windows\system32\NTIO.SYS   
[02/11/2006 ] ---> C:\Windows\system32\NTIO404.SYS   
[02/11/2006 ] ---> C:\Windows\system32\NTIO411.SYS   
[02/11/2006 ] ---> C:\Windows\system32\NTIO412.SYS   
[02/11/2006 ] ---> C:\Windows\system32\NTIO804.SYS   
[02/11/2006 ] ---> C:\Windows\system32\ntlanui2.dll   
[02/11/2006 ] ---> C:\Windows\system32\ntprint.exe   
[02/11/2006 ] ---> C:\Windows\system32\ntvdmd.dll   
[02/11/2006 ] ---> C:\Windows\system32\ocsetapi.dll   
[02/11/2006 ] ---> C:\Windows\system32\odbc16gt.dll   
[02/11/2006 ] ---> C:\Windows\system32\odbc32gt.dll   
[02/11/2006 ] ---> C:\Windows\system32\odbcad32.exe   
[02/11/2006 ] ---> C:\Windows\system32\odbcconf.exe   
[02/11/2006 ] ---> C:\Windows\system32\odbcconf.rsp   
[02/11/2006 ] ---> C:\Windows\system32\odbcint.dll   
[02/11/2006 ] ---> C:\Windows\system32\odbcji32.dll   
[02/11/2006 ] ---> C:\Windows\system32\oddbse32.dll   
[02/11/2006 ] ---> C:\Windows\system32\odexl32.dll   
[02/11/2006 ] ---> C:\Windows\system32\odfox32.dll   
[02/11/2006 ] ---> C:\Windows\system32\odpdx32.dll   
[02/11/2006 ] ---> C:\Windows\system32\odtext32.dll   
[02/11/2006 ] ---> C:\Windows\system32\oflc.rs   
[02/11/2006 ] ---> C:\Windows\system32\ole2.dll   
[02/11/2006 ] ---> C:\Windows\system32\ole2disp.dll   
[02/11/2006 ] ---> C:\Windows\system32\ole2nls.dll   
[02/11/2006 ] ---> C:\Windows\system32\oleaccrc.dll   
[02/11/2006 ] ---> C:\Windows\system32\olecli.dll   
[02/11/2006 ] ---> C:\Windows\system32\oleres.dll   
[02/11/2006 ] ---> C:\Windows\system32\OLESVR.DLL   
[02/11/2006 ] ---> C:\Windows\system32\onlinesetup.cmd   
[02/11/2006 ] ---> C:\Windows\system32\openfiles.exe   
[02/11/2006 ] ---> C:\Windows\system32\opengl32.dll   
[02/11/2006 ] ---> C:\Windows\system32\osk.exe   
[02/11/2006 ] ---> C:\Windows\system32\osuninst.dll   
[02/11/2006 ] ---> C:\Windows\system32\pacercnt.h   
[02/11/2006 ] ---> C:\Windows\system32\pacerprf.ini   
[02/11/2006 ] ---> C:\Windows\system32\packager.dll   
[02/11/2006 ] ---> C:\Windows\system32\panmap.dll   
[02/11/2006 ] ---> C:\Windows\system32\PATHPING.EXE   
[02/11/2006 ] ---> C:\Windows\system32\pautoenr.dll   
[02/11/2006 ] ---> C:\Windows\system32\pcaelv.exe   
[02/11/2006 ] ---> C:\Windows\system32\pcalua.exe   
[02/11/2006 ] ---> C:\Windows\system32\pcaui.exe   
[02/11/2006 ] ---> C:\Windows\system32\pcl.sep   
[02/11/2006 ] ---> C:\Windows\system32\pegi-fi.rs   
[02/11/2006 ] ---> C:\Windows\system32\pegi-pt.rs   
[02/11/2006 ] ---> C:\Windows\system32\pegi.rs   
[02/11/2006 ] ---> C:\Windows\system32\pegibbfc.rs   
[02/11/2006 ] ---> C:\Windows\system32\perfc009.dat   
[02/11/2006 ] ---> C:\Windows\system32\perfc00C.dat   
[02/11/2006 ] ---> C:\Windows\system32\perfctrs.dll   
[02/11/2006 ] ---> C:\Windows\system32\perfd009.dat   
[02/11/2006 ] ---> C:\Windows\system32\perfd00C.dat   
[02/11/2006 ] ---> C:\Windows\system32\perfdisk.dll   
[02/11/2006 ] ---> C:\Windows\system32\perfh009.dat   
[02/11/2006 ] ---> C:\Windows\system32\perfh00C.dat   
[02/11/2006 ] ---> C:\Windows\system32\perfi009.dat   
[02/11/2006 ] ---> C:\Windows\system32\perfi00C.dat   
[02/11/2006 ] ---> C:\Windows\system32\perfos.dll   
[02/11/2006 ] ---> C:\Windows\system32\perfproc.dll   
[02/11/2006 ] ---> C:\Windows\system32\PerfStringBackup.INI   
[02/11/2006 ] ---> C:\Windows\system32\pid.dll   
[02/11/2006 ] ---> C:\Windows\system32\pifmgr.dll   
[02/11/2006 ] ---> C:\Windows\system32\plasrv.exe   
[02/11/2006 ] ---> C:\Windows\system32\pmspl.dll   
[02/11/2006 ] ---> C:\Windows\system32\pnrpperf.dll   
[02/11/2006 ] ---> C:\Windows\system32\powercfg.exe   
[02/11/2006 ] ---> C:\Windows\system32\prflbmsg.dll   
[02/11/2006 ] ---> C:\Windows\system32\print.exe   
[02/11/2006 ] ---> C:\Windows\system32\printui.exe   
[02/11/2006 ] ---> C:\Windows\system32\proquota.exe   
[02/11/2006 ] ---> C:\Windows\system32\psapi.dll   
[02/11/2006 ] ---> C:\Windows\system32\pscript.sep   
[02/11/2006 ] ---> C:\Windows\system32\pstorec.dll   
[02/11/2006 ] ---> C:\Windows\system32\pstorsvc.dll   
[02/11/2006 ] ---> C:\Windows\system32\qedwipes.dll   
[02/11/2006 ] ---> C:\Windows\system32\qmgrprxy.dll   
[02/11/2006 ] ---> C:\Windows\system32\racpldlg.dll   
[02/11/2006 ] ---> C:\Windows\system32\radardt.dll   
[02/11/2006 ] ---> C:\Windows\system32\radarrs.dll   
[02/11/2006 ] ---> C:\Windows\system32\rasadhlp.dll   
[02/11/2006 ] ---> C:\Windows\system32\rasautou.exe   
[02/11/2006 ] ---> C:\Windows\system32\rasdial.exe   
[02/11/2006 ] ---> C:\Windows\system32\rasmxs.dll   
[02/11/2006 ] ---> C:\Windows\system32\rasser.dll   
[02/11/2006 ] ---> C:\Windows\system32\recover.exe   
[02/11/2006 ] ---> C:\Windows\system32\redir.exe   
[02/11/2006 ] ---> C:\Windows\system32\regedt32.exe   
[02/11/2006 ] ---> C:\Windows\system32\regsvr32.exe   
[02/11/2006 ] ---> C:\Windows\system32\relog.exe   
[02/11/2006 ] ---> C:\Windows\system32\RelPost.exe   
[02/11/2006 ] ---> C:\Windows\system32\remotesp.tsp   
[02/11/2006 ] ---> C:\Windows\system32\rendezvousSession.tlb   
[02/11/2006 ] ---> C:\Windows\system32\replace.exe   
[02/11/2006 ] ---> C:\Windows\system32\RmClient.exe   
[02/11/2006 ] ---> C:\Windows\system32\rnr20.dll

Lyonnais92 · Answer

Re,

tu fais une analyse sur VirusTotal de ces 5 fichiers :

c:\Windows\System32\fr-FR\logman.exe.mui 

c:\Windows\System32\logman.exe 

c:\Windows\winsxs\x86_microsoft-windows-p..mmandline.resources_31bf3856ad364e35_6.0.6000.16386_fr-fr_8ec3e2c205f861ec\logman.exe.mui 

c:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.0.6000.16386_none_5eecb8d501ea0d84\logman.exe 

c:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.0.6001.18000_none_61237ad0fed51e58\logman.exe 


Le mode d'emploi :


Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier :  le nom du fichier à analyser 

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse. 

Si VirusTotal indique que le fichier a déjà été analysé, cliquer sur le bouton Reanalyse le fichier maintenant

savatage · Answer

re,

pour les 5 fichiers il ne trouve rien.

Lyonnais92 · Answer

Re,


1) Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

2) Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton Bureau à partir de ce lien :

https://download.cnet.com/Malwarebytes/3000-8022_4-10804572.html

3) A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.

4) Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.

5) Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

6) MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :

7) Dans l'onglet analyse, vérifie que "Exécuter une analyse rapide"  est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

8) MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

9) A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

10) Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

11) MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

12) Ferme MBAM en cliquant sur Quitter.

13) Poste le rapport dans ta réponse

savatage · Answer

bonsoir, 

voici le rapport de MalwareBytes : 

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1430
Windows 6.0.6001 Service Pack 1

28/11/2008 00:39:16
mbam-log-2008-11-28 (00-39-16).txt

Type de recherche: Examen rapide
Eléments examinés: 45537
Temps écoulé: 2 minute(s), 30 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users
icolas\AppData\Roaming\Microsoft\mstsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users
icolas\Local Settings\spoolsv.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Users
icolas\Local Settings\Application Data\spoolsv.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Lyonnais92 · Answer

Bonjour,

fais redémarrer l'ordi et remets un rapport RSIT.

savatage · Answer

bonjour lyonnais,

je tiens à te remercier pour le temps que tu passes à résoudre mon problème et pour ton aide. Depuis 2 jours, je n'ai plus d'alertes d'antivir. Voici le rapport de RSIT: 


Logfile of random's system information tool 1.04 (written by random/random)
Run by nicolas at 2008-11-28 14:53:00
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 38 GB (17%) free of 231 GB
Total RAM: 2046 MB (71% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:53:14, on 28/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32undll32.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Steam\Steam.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users
icolas\Documents\Logiciels telechargés\RSIT.exe
C:\Program Files\Trend Micro\HijackThis
icolas.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [Logman] C:\Windows\System32\drivers\logman.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [Logman] C:\Windows\System32\drivers\logman.exe /waitservice (User 'Default user')
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O13 - Gopher Prefix: 
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A91359C-8B83-42AA-BEC7-1DE18CE82297}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oacat.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe

Lyonnais92 · Answer

Re,

on continue.

Relance HijackThis (cherche C:\Program Files\Trend Micro\HijackThis
icolas.exe et double clique)
.

Choisis Do a scan only

Coche la case devant les lignes suivantes

O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [Logman] C:\Windows\System32\drivers\logman.exe /waitservice (User 'SYSTEM')  
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [Logman] C:\Windows\System32\drivers\logman.exe /waitservice (User 'Default user')   


Ferme toutes les fenêtres (hormis HijackThis), y compris ton navigateur.

Clique sur fix checked.

Ferme Hijackthis.

=====================
Copie ou imprime les instructions avant

Déconnecte toi d'internet et ferme toutes tes applications.

Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :



Driver::
addt4i0c

Folder::
C:\ProgramDatakfree

File::
C:\Windows\system32\drivers\addt4i0c.sys
c:\users
icolas\AppData\Local\Temp\comrepl.exe
c:\windows\System32\spr32d35.dll
c:\users
icolas\AppData\Roaming\msts­c.exe
c:\windows\System32\drivers\mqtgsvc.exe
c:\windows\System32\drivers\logman.exe
 
 
 


Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe

Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Réactive ton parefeu, ton antivirus, la garde de ton antispyware

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.

savatage · Answer

re, voici le rapport : ComboFix 08-11-27.01 - nicolas 2008-11-29 1:09:14.6 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1235 [GMT 1:00] Lancé depuis: c:\users icolas\Desktop\ComboFix.exe Commutateurs utilisés :: c:\users icolas\Desktop\CFscript.txt * Un nouveau point de restauration a été créé FILE :: c:\users icolas\AppData\Local\Temp\comrepl.exe c:\users icolas\AppData\Roaming\mstsc.exe c:\windows\system32\drivers\addt4i0c.sys c:\windows\System32\drivers\logman.exe c:\windows\System32\drivers\mqtgsvc.exe c:\windows\System32\spr32d35.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . c:\programdata kfree . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-28 au 2008-11-29 )))))))))))))))))))))))))))))))))))) . 2008-11-28 21:38 . 2008-11-28 21:38 435,578 --a------ c:\windows\Revolution Script CZ Uninstaller.exe 2008-11-28 18:43 . 2008-11-28 23:32 d-------- c:\program files\Steam 2008-11-28 18:43 . 2008-11-28 18:47 d-------- c:\program files\Common Files\Steam 2008-11-28 03:35 . 2008-11-28 03:39 d-------- c:\users icolas\AppData\Roaming\vlc 2008-11-28 03:22 . 2008-11-28 03:22 d-------- c:\program files\Common Files\xing shared 2008-11-28 00:27 . 2008-11-28 00:27 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-28 00:27 . 2008-10-22 16:10 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2008-11-28 00:27 . 2008-10-22 16:10 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2008-11-27 15:43 . 2008-11-27 16:13 d-------- c:\users icolas\AppData\Roaming\Skype 2008-11-27 15:42 . 2008-11-27 15:42 d-------- c:\program files\Skype 2008-11-27 15:42 . 2008-11-27 15:42 d-------- c:\program files\Common Files\Skype 2008-11-27 15:04 . 2008-11-29 00:01 d-------- c:\users icolas\AppData\Roaming\OnlineArmor 2008-11-27 15:04 . 2008-11-27 15:04 d-------- c:\users\All Users\OnlineArmor 2008-11-27 15:04 . 2008-11-27 15:04 d-------- c:\programdata\OnlineArmor 2008-11-27 15:03 . 2008-11-26 17:18 178,376 --a------ c:\windows\System32\drivers\OADriver.sys 2008-11-27 15:03 . 2008-11-26 17:18 30,920 --a------ c:\windows\System32\drivers\OAmon.sys 2008-11-27 15:03 . 2008-11-26 16:10 29,384 --a------ c:\windows\System32\drivers\OAnet.sys 2008-11-27 15:02 . 2008-11-27 15:02 d-------- c:\program files\Tall Emu 2008-11-27 15:02 . 2008-11-27 15:02 d-------- C:\OnlineArmor 2008-11-26 04:08 . 2008-10-21 06:25 1,645,568 --a------ c:\windows\System32\connect.dll 2008-11-26 04:08 . 2008-08-28 04:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll 2008-11-26 04:08 . 2008-08-28 04:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll 2008-11-26 04:08 . 2008-08-28 04:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll 2008-11-26 04:08 . 2008-10-22 04:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll 2008-11-26 03:30 . 2008-11-17 00:34 81,920 --a------ c:\users icolas\AppData\Roaming\mstsc.exe 2008-11-25 21:55 . 2008-11-25 21:56 d-------- C: sit 2008-11-24 23:35 . 2008-11-24 23:42 d-------- c:\program files\WowCartographe 2008-11-24 14:02 . 2008-11-24 19:42 d-------- c:\users icolas\WoW-2.3.0.7561-frFR 2008-11-18 14:06 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll 2008-11-18 14:06 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll 2008-11-18 14:06 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll 2008-11-18 14:06 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll 2008-11-18 14:06 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll 2008-11-18 14:06 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe 2008-11-18 14:06 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll 2008-11-18 14:06 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll 2008-11-18 14:06 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe 2008-11-15 04:24 . 2008-11-15 04:25 d-------- c:\users icolas\AppData\Roaming\LiveCAD2 2008-11-15 04:23 . 2007-03-12 16:42 3,495,784 --a------ c:\windows\System32\d3dx9_33.dll 2008-11-14 01:44 . 2008-11-14 01:44 d-------- c:\program files\RVG Software 2008-11-12 13:37 . 2008-11-12 13:37 dr-h----- C:\AHCache 2008-11-12 05:01 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll 2008-11-12 05:01 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll 2008-11-12 05:01 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys 2008-10-31 23:30 . 2008-08-05 10:49 428,544 --a------ c:\windows\System32\EncDec.dll 2008-10-31 23:30 . 2008-08-05 10:49 293,376 --a------ c:\windows\System32\psisdecd.dll 2008-10-31 23:30 . 2008-08-05 10:48 217,088 --a------ c:\windows\System32\psisrndr.ax 2008-10-31 23:30 . 2008-08-05 10:48 177,664 --a------ c:\windows\System32\mpg2splt.ax 2008-10-31 23:30 . 2008-08-05 10:48 80,896 --a------ c:\windows\System32\MSNP.ax 2008-10-29 14:23 . 2008-08-12 04:39 443,392 --a------ c:\windows\System32\win32spl.dll 2008-10-29 14:23 . 2008-09-18 05:56 147,456 --a------ c:\windows\System32\Faultrep.dll 2008-10-29 14:23 . 2008-09-18 05:56 125,952 --a------ c:\windows\System32\wersvc.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-29 00:08 23,068,672 ----a-w c:\users\émilie\NTUSER.DAT 2008-11-29 00:08 23,068,672 ----a-w c:\users\émilie\NTUSER.DAT 2008-11-28 22:10 --------- d-----w c:\users icolas\AppData\Roaming eamspeak2 2008-11-28 18:14 --------- d-----w c:\users icolas\AppData\Roaming\dvdcss 2008-11-28 17:36 --------- d-----w c:\users icolas\AppData\Roaming\OpenOffice.org2 2008-11-28 02:34 --------- d-----w c:\program files\VideoLAN 2008-11-28 02:22 --------- d-----w c:\program files\Common Files\Real 2008-11-28 00:53 --------- d-----w c:\program files\bwin 2008-11-27 16:27 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-11-27 16:26 103,736 ----a-w c:\windows\System32\PnkBstrB.exe 2008-11-27 15:05 --------- d-----w c:\users icolas\AppData\Roaming\skypePM 2008-11-27 14:42 --------- d-----w c:\programdata\Skype 2008-11-27 11:57 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-27 11:57 --------- d-----w c:\program files\Electronic Arts 2008-11-17 16:46 --------- d-----w c:\program files\Lavasoft 2008-11-17 16:46 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-11-16 14:13 --------- d-----w c:\programdata\Codemasters 2008-11-14 18:38 --------- d-----w c:\program files\WinamaxPoker 2008-11-14 01:22 --------- d-----w c:\programdata\NVIDIA 2008-11-12 00:25 --------- d-----w c:\users icolas\AppData\Roaming\LimeWire 2008-10-27 20:53 --------- d-----w c:\program files\Activision 2008-10-27 01:15 --------- d-----w c:\program files\Pokerbility 2008-10-25 14:39 --------- d-----w c:\users icolas\AppData\Roaming\Mumble 2008-10-22 11:33 444,952 ----a-w c:\windows\System32\wrap_oal.dll 2008-10-22 11:33 109,080 ----a-w c:\windows\System32\OpenAL32.dll 2008-10-22 11:33 --------- d-----w c:\program files\OpenAL 2008-10-20 12:11 --------- d-----w c:\users icolas\AppData\Roaming\Paltalk 2008-10-20 12:11 --------- d-----w c:\program files\Paltalk Messenger 2008-10-19 16:08 --------- d-----w c:\program files\PokerStars.NET 2008-10-18 13:04 --------- d-----w c:\programdata\Media Center Programs 2008-10-18 11:43 --------- d-----w c:\program files\GameSpy 2008-10-18 11:39 669,184 ----a-w c:\windows\System32\pbsvc.exe 2008-10-18 11:39 22,328 ----a-w c:\users icolas\AppData\Roaming\PnkBstrK.sys 2008-10-17 23:12 --------- d-s---w c:\users\émilie\AppData\Roaming\Microsoft 2008-10-17 23:11 --------- d-----w c:\programdata\Avg7 2008-10-17 23:10 --------- d-----w c:\programdata\Grisoft 2008-10-17 19:36 --------- d-----w c:\users icolas\AppData\Roaming\AVG7 2008-10-15 22:14 --------- d-----w c:\program files\Windows Mail 2008-10-15 09:19 --------- d-----w c:\program files\PokerRewardsCalculator 2008-10-15 09:18 --------- d-----w c:\program files\Image-Line 2008-10-15 09:17 1,890 ----a-w c:\windows\System32\ealregsnapshot1.reg 2008-10-14 17:56 --------- d-----w c:\program files\Common Files\InstallShield 2008-10-14 17:53 --------- d--h--r c:\users icolas\AppData\Roaming\SecuROM 2008-10-14 17:50 --------- d-----w c:\programdata\Electronic Arts 2008-10-10 11:14 --------- d-----w c:\programdata\ma-config.com 2008-10-10 11:14 --------- d-----w c:\program files\ma-config.com 2008-10-08 14:43 --------- d-----w c:\program files\eMule 2008-10-07 12:22 107,888 ----a-w c:\windows\System32\CmdLineExt.dll 2008-10-07 12:21 --------- d-----w c:\users icolas\AppData\Roaming\Disney Interactive Studios 2008-10-07 12:05 --------- d-----w c:\program files\Disney Interactive Studios 2008-10-07 12:02 --------- d-----w c:\program files\DAEMON Tools Lite 2008-10-06 22:15 --------- d-----w c:\program files\Mumble 2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll 2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll 2008-09-30 12:06 --------- d-----w c:\program files\Sony 2008-09-28 13:00 --------- d-----w c:\users icolas\AppData\Roaming\Sony Corporation 2008-09-28 12:53 --------- d-----w c:\programdata\Sony Corporation 2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32 tkrnlpa.exe 2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32 toskrnl.exe 2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys 2008-09-06 18:11 66,872 ----a-w c:\windows\System32\PnkBstrA.exe 2008-08-31 12:07 56 ---ha-w c:\users\All Users\ezsidmv.dat 2008-08-31 12:07 56 ---ha-w c:\programdata\ezsidmv.dat 2008-08-27 22:14 174 --sha-w c:\program files\desktop.ini 2007-12-31 19:36 147,456 ----a-w c:\users icolas\vbzip10.dll 2007-12-07 14:37 44 ----a-w c:\users icolas\addresses.dat . ((((((((((((((((((((((((((((( snapshot_2008-11-29_ 1.01.09,75 ))))))))))))))))))))))))))))))))))))))))) . - 2008-11-29 00:00:32 1,572,864 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2008-11-29 00:10:36 1,572,864 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT - 2008-11-28 23:58:01 262,144 ----a-w c:\windows\System32\config\systemprofile tuser.dat + 2008-11-29 00:08:56 262,144 ----a-w c:\windows\System32\config\systemprofile tuser.dat + 2008-11-29 00:08:56 262,144 ---ha-w c:\windows\System32\config\systemprofile tuser.dat.LOG1 . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] "Steam"="c:\program files\steam\steam.exe" [2008-11-28 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSConfig"="c:\windows\System32\msconfig.exe" [2008-01-19 227840] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 266497] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13535776] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 92704] "@OnlineArmor GUI"="c:\program files\Tall Emu\Online Armor\oaui.exe" [2008-11-26 6223048] "TkBellExe"="c:\program files\Common Files\Real\Update_OB ealsched.exe" [2008-11-28 185872] "RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 c:\windows\RtHDVCpl.exe] [HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run] "Logman"="c:\windows\System32\drivers\logman.exe" [BU] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "EnableShellExecuteHooks"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "msacm.l3acm"= l3codecp.acm "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm "vidc.X264"= x264vfw.dll "msacm.l3codec"= l3codecp.acm [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^hpoddt01.exe.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\hpoddt01.exe.lnk backup=c:\windows\pss\hpoddt01.exe.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader eader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe] --a------ 2008-01-19 08:33 125952 c:\windows\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-06-02 10:13 267048 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 15:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] --a------ 2008-01-19 08:38 1008184 c:\program files\Windows Defender\MSASCui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] --a------ 2008-01-19 08:33 202240 c:\program files\Windows Media Player\wmpnscfg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl] --a------ 2006-12-01 13:37 4186112 c:\windows\RtHDVCpl.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{ED529C9F-5CB9-4A9B-890F-FAD69EB8621B}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule "UDP Query User{46B144C2-E876-4240-BABC-37FCA70E5C54}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule "TCP Query User{5C9ECA7F-D381-4D76-8B45-25125C377193}c:\program files\msn messenger\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger "UDP Query User{7158C179-D22E-4611-9A81-B7B25ED269A4}c:\program files\msn messenger\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger "TCP Query User{F3B7E70C-8638-4F77-B70F-6DFD13CF7E8D}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{C59C477A-463F-4C27-8548-4B4B88CE2235}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{DC12E3EB-123D-4300-AD80-81A1310A2B12}e:\steamapps\metalguinness\condition zero\hl.exe"= UDP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "UDP Query User{EBD28C76-4C6A-44A6-9597-36290089BD76}e:\steamapps\metalguinness\condition zero\hl.exe"= TCP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "TCP Query User{98BBC409-24E5-456A-91CC-15F2AB0EDDA8}c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe"= UDP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp "UDP Query User{AF392EBB-2109-4B07-A7EB-3FF1DC3587FB}c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe"= TCP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp "TCP Query User{75D5B769-E9B7-4ECD-A968-64F69140FEBD}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule "UDP Query User{4072DE3E-2979-4014-99DB-9BCBA6691A2F}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule "TCP Query User{E79107BB-D6D6-4B6D-8CA8-F951207431A1}e:\steamapps\metalguinness\condition zero\hl.exe"= UDP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "UDP Query User{9C8C1F2B-13AA-497A-B1A4-E70DFED2005A}e:\steamapps\metalguinness\condition zero\hl.exe"= TCP:e:\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "TCP Query User{4BFF0396-112C-4D87-962A-8441D316B35D}c:\program files\msn messenger\livecall.exe"= UDP:c:\program files\msn messenger\livecall.exe:Windows Live Call "UDP Query User{203365B6-2ECE-4AB3-8699-DB4D9149D7CF}c:\program files\msn messenger\livecall.exe"= TCP:c:\program files\msn messenger\livecall.exe:Windows Live Call "TCP Query User{CAB73677-1C09-4081-AD01-5300DB868A15}c:\windows\windl\mirc.exe"= UDP:c:\windows\windl\mirc.exe:mIRC "UDP Query User{CC70295B-BB83-48E0-A17F-33D79BAA85BA}c:\windows\windl\mirc.exe"= TCP:c:\windows\windl\mirc.exe:mIRC "TCP Query User{770B9900-1F8B-4214-BEED-FB29EA5111D5}e:\steamapps\metalguinness\counter-strike\hl.exe"= UDP:e:\steamapps\metalguinness\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{67EDDB4C-49C0-44B2-8E16-8B31F4B2E44E}e:\steamapps\metalguinness\counter-strike\hl.exe"= TCP:e:\steamapps\metalguinness\counter-strike\hl.exe:Half-Life Launcher "TCP Query User{734020D3-36B2-462A-A38B-1A3F59C68578}c:\program files\electronic arts\eadm\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager "UDP Query User{81075885-3713-42C7-9021-D3EB634014E6}c:\program files\electronic arts\eadm\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager "{5DC4668A-157D-404D-99CE-C146A4541247}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{54990A40-A2E4-4CC3-8B06-7043FAE0079B}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{C60606B6-D970-4157-9D6A-88E78386B774}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{2BF6CF69-373C-416C-B667-AE4195AF2BC7}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "TCP Query User{D8F15AAC-ACEC-4E4D-84D1-FF1CF7F6D7E3}c:\program files\disney interactive studios\pure\pure.exe"= UDP:c:\program files\disney interactive studios\pure\pure.exe:Pure "UDP Query User{3023AD3C-05BF-49E0-81D0-1BDF48814CEE}c:\program files\disney interactive studios\pure\pure.exe"= TCP:c:\program files\disney interactive studios\pure\pure.exe:Pure "{7B30449A-A6C0-49F0-8254-1FE93DD9C91A}"= UDP:c:\program files\Codemasters\GRID\GRID.exe:GRID "{104FA4C2-D549-4E2F-BE38-C22972FA9765}"= TCP:c:\program files\Codemasters\GRID\GRID.exe:GRID "TCP Query User{51E0DAB1-CB45-4A8C-9D16-06A5CC1B2276}c:\program files\activision\call of duty 2\cod2mp_s.exe"= UDP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s "UDP Query User{E0F1FBA4-1DE9-406E-8307-576CFC0FB45D}c:\program files\activision\call of duty 2\cod2mp_s.exe"= TCP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s "TCP Query User{FDBB74F5-E568-4D53-84F6-F452328C1D54}c:\program files\trackmania nations eswc\tmnationseswc.exe"= UDP:c:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "UDP Query User{FB09D548-52A1-4BE5-922C-D19248E8A128}c:\program files\trackmania nations eswc\tmnationseswc.exe"= TCP:c:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "TCP Query User{813A3210-4E32-41F2-B867-454ED9E70AA9}e:\steamapps\rolex306\condition zero\hl.exe"= UDP:e:\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "UDP Query User{9B9DE649-3A04-4CB1-B3A1-3D5951D4E70C}e:\steamapps\rolex306\condition zero\hl.exe"= TCP:e:\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "TCP Query User{5F3654C7-4019-4EA7-90A5-65BBCEDF0D49}c:\program files\steam\steamapps\rolex306\condition zero\hl.exe"= UDP:c:\program files\steam\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "UDP Query User{95743B52-55D0-4A8D-9D79-A477FF3103A3}c:\program files\steam\steamapps\rolex306\condition zero\hl.exe"= TCP:c:\program files\steam\steamapps olex306\condition zero\hl.exe:Half-Life Launcher "TCP Query User{D9BFE5F3-F090-42C0-BCC8-267C8FA6DCD1}c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe"= UDP:c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "UDP Query User{3E906ACB-5E48-4138-B695-77AED847D04D}c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe"= TCP:c:\program files\steam\steamapps\metalguinness\condition zero\hl.exe:Half-Life Launcher "TCP Query User{EDB04522-575C-4F0B-B2DB-7C4F78E1C150}c:\users\nicolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe"= UDP:c:\users icolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe:wow-frfr-installer-downloader.exe "UDP Query User{B2D7216D-279B-4A90-992B-1B10FB288326}c:\users\nicolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe"= TCP:c:\users icolas\documents\logiciels telechargés\wow-frfr-installer-downloader.exe:wow-frfr-installer-downloader.exe "{C1345C7E-BEAD-4749-894F-CB8B8BC43CFE}"= c:\program files\Skype\Phone\Skype.exe:Skype "TCP Query User{5850C9E1-8F1D-48DF-A782-F3D88899F3C0}c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe"= UDP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp "UDP Query User{03F4CC7C-CD7C-4D5C-9114-FC1CB2BFD78D}c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe"= TCP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp "TCP Query User{4CA0CF66-EEA9-4C13-A310-B940317A733C}c:\program files\videolan\vlc\vlc.exe"= UDP:c:\program files\videolan\vlc\vlc.exe:VLC media player "UDP Query User{EEEA2276-BA2A-4D4A-9F3C-23E12E1C32BB}c:\program files\videolan\vlc\vlc.exe"= TCP:c:\program files\videolan\vlc\vlc.exe:VLC media player [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352] R1 cpuidlep;CpuIdle Pro System Driver;c:\windows\system32\drivers\cpuidlep.sys [2007-06-18 4484] R1 OADevice;OADriver;\??\c:\windows\system32\drivers\OADriver.sys [2008-11-27 178376] R1 OAmon;OAmon;\??\c:\windows\system32\drivers\OAmon.sys [2008-11-27 30920] R2 OAcat;Online Armor Helper Service;"c:\program files\Tall Emu\Online Armor\oacat.exe" [2008-11-27 1402568] R3 OAnet;OnlineArmor Service;c:\windows\system32\DRIVERS\oanet.sys [2008-11-27 29384] S2 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\oasrv.exe [2008-11-27 3321032] S3 ce6230;Intel CE6230 Standalone USB Driver;c:\windows\system32\DRIVERS\CE6230StandaloneDriver.sys [2008-03-26 44800] S3 ce6230BDACAP;Realfine CE6230 BDA Driver;c:\windows\system32\DRIVERS\CE6230BDA.sys [2008-03-26 19328] S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50.sys [2007-11-05 28224] S3 PCASp50;PCASp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCASp50.sys [2007-11-05 27072] S3 Steam Client Service;Steam Client Service;c:\program files\Common Files\Steam\SteamService.exe /RunAsService [2008-11-28 104944] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3dd6a743-93e8-11dd-93af-001a9219cb78}] \shell\AutoRun\command - D:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6662202f-79a8-11dd-9321-001a9219cb78}] \shell\AutoRun\command - D:\Launcher.exe . Contenu du dossier 'Tâches planifiées' 2008-11-28 c:\windows\Tasks\Maintenance en 1 clic.job - c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-02 18:18] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-29 01:10:43 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-11-29 1:11:58 ComboFix-quarantined-files.txt 2008-11-29 00:11:55 ComboFix2.txt 2008-11-27 15:23:03 ComboFix3.txt 2008-11-27 12:19:47 ComboFix4.txt 2008-11-26 02:37:10 Avant-CF: 39,958,863,872 octets libres Après-CF: 39,926,288,384 octets libres 301 --- E O F --- 2008-11-27 17:20:36

savatage · Answer

plus de réponse lyonnais ???

Lyonnais92 · Answer

Bonjour,

sorry, mais pas simple.

Relance MBAM, mets à jour et fais un scan complet (je te préviens, ça peut durer toute la nuit).

Poste le rapport.

savatage · Answer

salut,

ok je ferais ça cette nuit avant de me coucher. Bonne soirée

savatage · Answer

bonsoir voici le log de MBAM 


Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1459
Windows 6.0.6001 Service Pack 1

04/12/2008 22:44:09
mbam-log-2008-12-04 (22-44-09).txt

Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 187953
Temps écoulé: 1 hour(s), 55 minute(s), 9 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Lyonnais92 · Answer

Re,


- > Ouvre ce lien pour scanner ton PC avec un BitDefender en ligne (uniquement sous Internet Explorer) :

http://www.bitdefender.fr/scan_fr/scan8/ie.html

Utilisation :
Cliquer sur "J'accepte" puis accepter également l'ActiveX bloqué par la barre anti-popup du SP2 qui clignotera en haut et l'installer.
Ensuite, cliquer sur "Cliquez ici pour scanner".
Patienter jusqu'à la fin du scan qui peut durer assez longtemps...

Copier/coller le rapport entier sur le forum.

Tutoriel en images ici : http://pageperso.aol.fr/rginformatique/mapage/defender.htm (merci à Balltrap34 pour cette réalisation)

savatage · Answer

salut lyonnais,

j'ai bien suivi ce que tu m'as demandé au sujet de BitDenfender, mais site me dit qu'il est impossible de démarrer le scan. J'ai bien installer ActiveX.

Lyonnais92 · Answer

Re,

essaye comme ceci.

Ferme Internet Explorer, réouvre le par un clic droit sur l'icône et Exécuter comme administrateur.

 

- Fais un scan en ligne Kaspersky avec Internet Explorer :

- Dans la nouvelle fenêtre, clique sur J'accepte.
- Valide l'installation d'un ou de plusieurs ActiveX si c'est nécessaire.
- Patiente pendant l'installation des Mises à jour.
- Choisis par la suite l'analyse du Poste de travail.
- Sauvegarde puis colle le rapport généré en fin d'analyse.

AIDE : Configurer le contrôle des ActiveX

NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte toi sur le site de Kaspersky pour retenter le scan en ligne.

Shbdchk13 persistant

48 réponses

Discussions similaires