Virus protector

Question

Bonjour,
quand je demarre le pc(Vista),le bureau ne s'affiche pas,mais c'est Virus protector.
Quand je cherche un peu,je trouve que le processus s'appelle "aadmvrqas.exe".
Evidement,j'ai au prealable cherche sur le forum et les solutions avec rogue remover et SmitFraudFix non plus.
Je viens de faire un scan avec MBAM et toujours rien.


Merci d'avance

moment de grace · Answer

bonjour

peux tu poster ce rapport MBAM stp

de plus

• Télécharge Random's System Information Tool (RSIT) de Random/Random. 

(outil de diagnostic)

http://images.malwareremoval.com/random/RSIT.exe 

• Enregistre le sur ton Bureau. 

• Double clique sur RSIT.exe pour lancer l'outil. 

• Clique sur "Continue" à l'écran Disclaimer. 

• Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu s'il te le demande) 

et tu devras accepter la licence. 

• Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés stp

Les rapports se trouvent à cet endroit: 
C:\rsit\info.txt 
C:\rsit\log.txt

Marvolo · Answer

Rapport MBAM

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3510
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18882

12/03/2010 22:40:17
mbam-log-2010-03-12 (22-40-17).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|)
Eléments examinés: 383043
Temps écoulé: 3 hour(s), 21 minute(s), 8 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\{NSINAME} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Windows Tribute Service (Trojan.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1dcf4499-04f7-4b72-a782-db77fa010c94}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.189;85.255.112.113 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{722c9bed-6214-4b55-8533-104d7bfc01b1}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.189;85.255.112.113 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{c4ff0844-4cef-4130-bc06-070fee20df66}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.189;85.255.112.113 -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Shopper\Bin (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Shopper\Bin\2.5.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Windows\winsxs\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.0.6002.18005_lt-lt_bf12ba06fdc0c65b_msimsg.dll.mui_72e8994f (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Windows\System32\hBlvIvfF.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Marvolo · Answer

LOG.TXT

Logfile of random's system information tool 1.06 (written by random/random)
Run by Schizoprenic at 2010-03-12 22:52:07
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 49 GB (30%) free of 163 GB
Total RAM: 3070 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:52:39, on 12/03/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Windows\system32\svchost.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Windows\system32\spool\DRIVERS\W32X86\3\lxdnserv.exe
C:\Windows\system32\lxdncoms.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\stacsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10e.exe
C:\Users\Schizoprenic\Desktop\RSIT.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\Schizoprenic.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer fourni par Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: Shell=C:\Windows\system32\aadmvrqas.exe
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,"C:\Windows\pok32.exe",
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IEpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\PROGRA~1\GOOGLE~1\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [lxdnmon.exe] "C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"
O4 - HKLM\..\Run: [lxdnamon] "C:\Program Files\Lexmark 2600 Series\lxdnamon.exe"
O4 - HKLM\..\Run: [lxdimon.exe] "C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe"
O4 - HKLM\..\Run: [lxdiamon] "C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe"
O4 - HKLM\..\Run: [FBSSA] C:\Program Files\SGPSA\ie3sh.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe" -osboot
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [DeleteDir[CD8] Search Guard Plus] cmd.exe /C RD /S /Q C:\PROGRA~1\SEARCH~1
O4 - HKLM\..\RunOnce: [DeleteDir[CD8] Search Guard Plus Updater] cmd.exe /C RD /S /Q C:\PROGRA~1\SEARCH~2
O4 - HKLM\..\RunOnce: [DeleteDir[CD8] SGPSA] cmd.exe /C RD /S /Q C:\PROGRA~1\SGPSA
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [UMService] C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKLM\..\Policies\Explorer\Run: [FFreezer] C:\Windows\system32\explorer.exe\explorer.exe.exe
O4 - HKCU\..\Policies\Explorer\Run: [configs] C:\Windows\pok32.exe
O4 - HKCU\..\Policies\Explorer\Run: [FFreezer] C:\Windows\system32\explorer.exe\explorer.exe.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ºÜ¿ìÊÓÆµËÑË÷ - {998A88A0-A355-809B-831C-B83A80000991} - http://www.henkuai.com/?from=iebannel (file missing)
O9 - Extra 'Tools' menuitem: ºÜ¿ìÊÓÆµËÑË÷ - {998A88A0-A355-809B-831C-B83A80000991} - http://www.henkuai.com/?from=iebannel (file missing)
O9 - Extra button: Æô¶¯UUSee ÍøÂçµçÊÓ - {998A88A0-A355-809B-831C-B83A80000992} - C:\Program Files\uusee\UUSeePlayer.exe
O9 - Extra 'Tools' menuitem: Æô¶¯UUSee ÍøÂçµçÊÓ - {998A88A0-A355-809B-831C-B83A80000992} - C:\Program Files\uusee\UUSeePlayer.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix: 
O15 - Trusted Zone: http://*.www.m6.fr
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
O16 - DPF: {61FA0CB0-0806-46EA-B784-0F843285BA23} (TuentiFotoUploader Control) - http://estaticosak1.tuenti.com/client_apps/TuentiPhotoUploader.24936.cab
O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldfr-fr.cab
O17 - HKLM\System\CS1\Services\Tcpip\..\{1DCF4499-04F7-4B72-A782-DB77FA010C94}: NameServer = 85.255.112.189;85.255.112.113
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Browser Defender Update Service - Threat Expert Ltd. - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Service Google Update (gupdate1ca2cd22c28197e) (gupdate1ca2cd22c28197e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: lxdnCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\lxdnserv.exe
O23 - Service: lxdn_device -   - C:\Windows\system32\lxdncoms.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\stacsv.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

moment de grace · Answer

ok

tres infecté

Attention, avant de commencer, lit attentivement la procédure, et imprime la 

Aide à l’utilisation
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix



Télécharge ComboFix de sUBs  sur ton Bureau : 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

/!\ Déconnecte-toi du net et DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\ 

---> Double-clique sur ComboFix.exe 
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter 

SURTOUT INSTALLES LA CONSOLE DE RECUPERATION 
(si il te propose de l’installer remets internet)

---> Mets-le en langue française F 
Tape sur la touche 1 (Yes) pour démarrer le scan. 

Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC 

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire. 

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu 

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\ 

Note : Le rapport se trouve également là : C:\ComboFix.txt

Marvolo · Answer

Merci infiniment,tout semble marcher du tonnerre.
Tu me recommandes quoi comme antivirus?J'utilise AVG mais vu que tu m'as dit que j'avais enormement de virus,vaut mieux changer...

Ah oui,le rapport de combo fix:

ComboFix 10-03-12.02 - Schizoprenic 13/03/2010   6:33.1.2 - x86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.3070.2220 [GMT 0:00]
Lancé depuis: c:\users\Schizoprenic\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-1070371420-295023708-545849085-500
c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-3242307328-3026939525-2831412068-500
c:\$recycle.bin\S-1-5-21-3902122447-900610744-3200546403-500
c:\windows\10013sz9535.bin
c:\windows\105z3troj5869.exe
c:\windows\109909zcktoo5118.dll
c:\windows\1161b5c9dzor44.exe
c:\windows\1177vir5sz93.ocx
c:\windows\11ff9d5ware192z.bin
c:\windows\123d5zreat3139.exe
c:\windows\12858zac5tool975.dll
c:\windows\12c6add9ar53z39.bin
c:\windows\13028notza-vi5us13b9.bin
c:\windows\13094viruz53c.dll
c:\windows\1356backd9or9z.bin
c:\windows\13659hacktoo591z.dll
c:\windows\13849z5rm21f.cpl
c:\windows\1395th5ez26029.bin
c:\windows\14233hacktoolz955.bin
c:\windows\150z75acktool5d9.bin
c:\windows\152back5oz92017.exe
c:\windows\15495wozm35f9.dll
c:\windows\1579zspambot7309.dll
c:\windows\15916troj795z.bin
c:\windows\15z3steal9450.bin
c:\windows\16755viru9272z.cpl
c:\windows\16934sza5bot5d1.ocx
c:\windows\17009spam5otzbc.bin
c:\windows\17019hackto5l3zc.dll
c:\windows\174z49py16b5.cpl
c:\windows\17909s9y7z5.dll
c:\windows\17zste9l1547.cpl
c:\windows\18114not-9-vzru54ed.dll
c:\windows\18z6sp9rs5237.cpl
c:\windows\19009spambot7zf5.cpl
c:\windows\1900downloadz5820.ocx
c:\windows\1905threatz7586.ocx
c:\windows\190935irus175z.dll
c:\windows\19282zack9ool552.dll
c:\windows\19490nzt-a-vir9s5235.ocx
c:\windows\19590worm504z.bin
c:\windows\1967d5wnloader2z65.cpl
c:\windows\19961w5rmz719.bin
c:\windows\19995troz61d.cpl
c:\windows\19f9b5ck9oor2z74.cpl
c:\windows\19z6vir30159.exe
c:\windows\19z98sp5m9ot3a0.bin
c:\windows\1b94threa911549z.dll
c:\windows\1bf9ba5zdoor876.cpl
c:\windows\1d99steaz2528.ocx
c:\windows\1dz55ddwa9e640.cpl
c:\windows\1ef2spyzare1959.cpl
c:\windows\1f5bspzw9re245.ocx
c:\windows\1f68backdzor9257.bin
c:\windows\1z21not-a-virus5d79.ocx
c:\windows\1z55pyware798.cpl
c:\windows\1z594spy7679.dll
c:\windows\1z62st5al3119.bin
c:\windows\1z953sp9mbot3c1.ocx
c:\windows\1zd9s5ars92388.bin
c:\windows\20519w9rz620.dll
c:\windows\205529ot-a5virus1efz.ocx
c:\windows\2056spywa9e159z.dll
c:\windows\20912wo5z19c.exe
c:\windows\211z5tr5j949.cpl
c:\windows\21433spyz995.ocx
c:\windows\215z4sp9d.cpl
c:\windows\21939v5rus3bdz.exe
c:\windows\21z8t9o53d4.cpl
c:\windows\22202hazktool759.ocx
c:\windows\22z71spy9f45.cpl
c:\windows\23c95r26z.dll
c:\windows\23z62s9y615.cpl
c:\windows\23z76v59us2e.bin
c:\windows\242205pa9bot554z.cpl
c:\windows\24547sp9zbot772.bin
c:\windows\24709spa9b5t782z.ocx
c:\windows\25425vzr5s9cb.ocx
c:\windows\25615zoj29e9.exe
c:\windows\25795nzt-a-virus2bf9.bin
c:\windows\25857spamb9z5f4.dll
c:\windows\258z8s9y289.exe
c:\windows\25900s5z1e1.exe
c:\windows\2595ztroj690.dll
c:\windows\2599szarse1758.exe
c:\windows\259z6worm993.dll
c:\windows\25z0195y441.dll
c:\windows\25z909irus2e25.dll
c:\windows\2638s9y3dz5.dll
c:\windows\265495p9zaa.dll
c:\windows\26813v9rzs35.ocx
c:\windows\26834t9ojz405.cpl
c:\windows\26955izus549.bin
c:\windows\26995wozm299.cpl
c:\windows\26c5vir27z9.ocx
c:\windows\2707v9ru5z21.ocx
c:\windows\285879orz750.cpl
c:\windows\285cadd9are60z.dll
c:\windows\28795trojz8d.ocx
c:\windows\28e9threz530896.exe
c:\windows\28z98not-a-vir9s6905.cpl
c:\windows\2915stea55z9.cpl
c:\windows\2916zs5y4ee.exe
c:\windows\29551v9r5z382.dll
c:\windows\295759rus6dcz.ocx
c:\windows\29797sp9mzot651.dll
c:\windows\29z15irus450.cpl
c:\windows\2a53thrzat9639.bin
c:\windows\2ad5thiefz319.exe
c:\windows\2dz0s95ware551.bin
c:\windows\2z15thief2999.cpl
c:\windows\2z3c9i555.ocx
c:\windows\2z49thre9t5385.ocx
c:\windows\2z9es9arse3185.ocx
c:\windows\300069o5mz94.ocx
c:\windows\30341zi9u55bf.cpl
c:\windows\30555sz5mbot179.dll
c:\windows\30837not-az9i5usd8.ocx
c:\windows\30923zorm59.dll
c:\windows\30964troz55e.exe
c:\windows\3191thizf5799.dll
c:\windows\31ffba9kz5or1858.ocx
c:\windows\320z3vi5us7359.exe
c:\windows\32743hz5kt9ol567.exe
c:\windows\32b7vir951z.cpl
c:\windows\32z225acktool23a9.bin
c:\windows\32zbste5l7299.dll
c:\windows\340bt5zef394.ocx
c:\windows\35379spy509z.exe
c:\windows\354az5eal1912.cpl
c:\windows\355zspars92680.ocx
c:\windows\3589vir19z9.ocx
c:\windows\3594z95kdoor2101.bin
c:\windows\3599zhreat5438.bin
c:\windows\3696spywarez590.exe
c:\windows\379aviz835.exe
c:\windows\379d5zr9932.ocx
c:\windows\38559zr795.bin
c:\windows\3905zp9ware835.ocx
c:\windows\39279pz568.exe
c:\windows\39565zo919.bin
c:\windows\3957s9eal16z3.dll
c:\windows\39645wor51z6.bin
c:\windows\39995pywarz145.ocx
c:\windows\39c4viz995.dll
c:\windows\39c6spar5ez05.bin
c:\windows\39z5st5al9330.dll
c:\windows\3c58bac9d5oz2465.ocx
c:\windows\3ecds9ywaze195.bin
c:\windows\3f67t9izf1605.ocx
c:\windows\3z622no9-a-v5rus43f.exe
c:\windows\41zcvir98005.cpl
c:\windows\4339s5yz1c.dll
c:\windows\43zcs9yw5re538.ocx
c:\windows\44d7ad9waze11845.cpl
c:\windows\4511thzef3059.exe
c:\windows\4519w9rm2cz.bin
c:\windows\4531vir789z.exe
c:\windows\455cst9alz6715.dll
c:\windows\4592spywzre959.ocx
c:\windows\4715spyw9r519z2.cpl
c:\windows\4885otz9-virus24a.bin
c:\windows\48e7doz5load9r1540.dll
c:\windows\48f0threa513339z.cpl
c:\windows\4993dow9loazer5720.dll
c:\windows\49e1ad9wzre5982.bin
c:\windows\4cd35pywarez069.dll
c:\windows\4d3aszy5are392.cpl
c:\windows\4e15z9ckdoor2152.exe
c:\windows\4e44t9re5t1290z.exe
c:\windows\4e89threaz18945.bin
c:\windows\4f01threa59z709.cpl
c:\windows\4fbes95warz2249.cpl
c:\windows\4z0troj9105.bin
c:\windows\5049viruszf59.bin
c:\windows\505th5ez1998.bin
c:\windows\5071a9dwzre1708.ocx
c:\windows\5095spyz95.bin
c:\windows\509z3h9cktool59c.bin
c:\windows\50a9spyware1z34.dll
c:\windows\50bbt9r5at173z2.ocx
c:\windows\50e0vir159z.dll
c:\windows\50zdadd9are2009.dll
c:\windows\51075t9oz23e.cpl
c:\windows\51494szy6be.dll
c:\windows\51965worm565z.ocx
c:\windows\51espywa9e3137z.bin
c:\windows\51f1d5wnloaderz519.dll
c:\windows\51fzbac5door9032.ocx
c:\windows\52398zroj429.ocx
c:\windows\52815ackd9or23z0.exe
c:\windows\52892wormzb8.cpl
c:\windows\52e6zpa9se1473.exe
c:\windows\533zthr9at1125.ocx
c:\windows\53a2zir957.ocx
c:\windows\545069ot-a-virusz13.ocx
c:\windows\54835spamz9t2f7.dll
c:\windows\5490zhief171.dll
c:\windows\549339irus6za.cpl
c:\windows\5505spy91z.bin
c:\windows\551aspywarz398.exe
c:\windows\5581not-a-viru5972z.ocx
c:\windows\558zpyw9re536.ocx
c:\windows\559zworm26a.exe
c:\windows\55adbac9door21z3.cpl
c:\windows\55b95hreat2z787.dll
c:\windows\5698bac9door1562z.dll
c:\windows\56996trzj3b5.exe
c:\windows\56c5addwar91753z.dll
c:\windows\56d9spzrs51738.dll
c:\windows\56z6spy9ar52968.bin
c:\windows\5785steaz20259.bin
c:\windows\588estza9825.dll
c:\windows\58bfaddw9ze652.ocx
c:\windows\5925troz13a.dll
c:\windows\592evir20z95.ocx
c:\windows\5969spyzare755.cpl
c:\windows\5983szar9e257.ocx
c:\windows\5997spyware2z84.ocx
c:\windows\5aa5zt9al2065.bin
c:\windows\5aez5py9are1136.dll
c:\windows\5c31adzwar52592.exe
c:\windows\5c51stea9290z.exe
c:\windows\5c9e5hiz9755.ocx
c:\windows\5cc5spyware139z.bin
c:\windows\5ce7spa9se1z60.dll
c:\windows\5d1zthief9851.ocx
c:\windows\5e97zdd5are598.cpl
c:\windows\5e9fdownloade517z2.exe
c:\windows\5f9baddzar52998.bin
c:\windows\5fd4thief1z9.bin
c:\windows\5ffdthr9at29259z.exe
c:\windows\5z1bsteal591.ocx
c:\windows\605c9pzrse7285.bin
c:\windows\6255steal29z99.dll
c:\windows\633zthief19055.bin
c:\windows\64ebsp9r5e477z.ocx
c:\windows\65179irzs3d8.exe
c:\windows\6559downloader26z1.dll
c:\windows\655ad9warz881.dll
c:\windows\6589spywarez895.cpl
c:\windows\6590spa5se533z.bin
c:\windows\65d9dow5lzader2559.bin
c:\windows\6708zparse5971.cpl
c:\windows\67d4zhr9at4505.cpl
c:\windows\67e95hrea927z86.bin
c:\windows\6852spywzre1992.exe
c:\windows\6881ste5l1z93.ocx
c:\windows\68939orz1eb5.dll
c:\windows\68ezspywa9e5948.cpl
c:\windows\69839hrea52z255.cpl
c:\windows\6az49hre5t16773.cpl
c:\windows\6b5zsp9ware2454.bin
c:\windows\6ddaaz9war52373.bin
c:\windows\6e8e9h5zf361.bin
c:\windows\6eb75parsez985.bin
c:\windows\6z17st9al55.dll
c:\windows\6z29v953276.dll
c:\windows\7198a5d9aze2772.dll
c:\windows\71zbthreat14956.cpl
c:\windows\722bad59are860z.exe
c:\windows\7269a5dware3249z.cpl
c:\windows\72c59ddzare180.exe
c:\windows\739ft9izf9765.ocx
c:\windows\7498zackdoor2395.ocx
c:\windows\7529spyw5ze2237.exe
c:\windows\752fzt9al3169.bin
c:\windows\7597zir15.cpl
c:\windows\7599threa51z864.bin
c:\windows\75a9t9izf2379.cpl
c:\windows\75cdszywar93.bin
c:\windows\75dadownzo9der3237.bin
c:\windows\75ffzddware2978.bin
c:\windows\75z95t9al603.dll
c:\windows\76055py79z.dll
c:\windows\765ethreat9851z.bin
c:\windows\77075ir97z.dll
c:\windows\77595rus757z.bin
c:\windows\77a7dowzload5r22049.ocx
c:\windows\7852zownloader9549.ocx
c:\windows\789b9hief113z5.dll
c:\windows\791dstezl6505.dll
c:\windows\7a5dthief1495z.dll
c:\windows\7b51t9reat24z56.dll
c:\windows\7c9fszeal1354.bin
c:\windows\7d54spars954z.cpl
c:\windows\7d9ds5arse1476z.dll
c:\windows\7dz39teal18005.exe
c:\windows\7e42th95zt5552.bin
c:\windows\7e6b9z5door717.bin
c:\windows\7z5thief27599.bin
c:\windows\8256hackz9ol13b.cpl
c:\windows\845thzef1945.bin
c:\windows\8490szambot45a.cpl
c:\windows\850zt95j183.cpl
c:\windows\896b9ckdo5r9z4.exe
c:\windows\8993not-a-v5rz94b1.exe
c:\windows\905b5tezl2547.ocx
c:\windows\91535vzru5.exe
c:\windows\91z2threat26735.bin
c:\windows\92020worm55cz.dll
c:\windows\923zspam5ot4c6.cpl
c:\windows\93569z5oj1c7.cpl
c:\windows\93815izus7a3.cpl
c:\windows\945sz9f95.ocx
c:\windows\951espyware273z.cpl
c:\windows\952z0spy361.ocx
c:\windows\956zspy6279.bin
c:\windows\95b1spazse2179.exe
c:\windows\96dsparsez3995.exe
c:\windows\97225s5z378.cpl
c:\windows\9835szambot5b8.bin
c:\windows\98790tzo5653.cpl
c:\windows\98f8down5oader1z2.cpl
c:\windows\99693zi5us56d.bin
c:\windows\99d4stzal1885.bin
c:\windows\9ad05ir306z.exe
c:\windows\9c8fthief55z.ocx
c:\windows\9cc5ad5warz1620.exe
c:\windows\9cc5d9waze259.cpl
c:\windows\9ef2thr5az3376.bin
c:\windows\9fcfdownloa5er3z70.cpl
c:\windows\9z516troj4b1.exe
c:\windows\9z5f5ackdoor2048.exe
c:\windows\9z5wo95709.dll
c:\windows\9zaddware5354.ocx
c:\windows\a59adzw9re1047.bin
c:\windows\AdeVCVO.dll
c:\windows\agGwKJhOo.dll
c:\windows\ahVMYvNxk.exe
c:\windows\AkjSVdRIi.dll
c:\windows\apFNoT.exe
c:\windows\ApJokMoCD.exe
c:\windows\awxbkned.dll
c:\windows\b0spa5sz2978.exe
c:\windows\b5bdownloadzr3958.bin
c:\windows\bBdrGuLKJ.exe
c:\windows\bHymx.exe
c:\windows\BIUqUa.dll
c:\windows\BwDKhBpub.exe
c:\windows\c5zthief91035.bin
c:\windows\CfPKSYHa.dll
c:\windows\cfSLusC.dll
c:\windows\cjHAd.dll
c:\windows\CYpbt.exe
c:\windows\DdVANm.dll
c:\windows\DdVawJDe.exe
c:\windows\DfVDAwj.exe
c:\windows\dHHMOMnU.dll
c:\windows\dLGnrI.exe
c:\windows\dqrmU.dll
c:\windows\dUCFbOL.dll
c:\windows\e59vir25z3.bin
c:\windows\eAqgH.exe
c:\windows\easBRFSXB.dll
c:\windows\ef0baczdoo914515.dll
c:\windows\EJRtW.dll
c:\windows\elqnLK.dll
c:\windows\endkPM.dll
c:\windows\ePlQB.dll
c:\windows\eWFhlBnsw.exe
c:\windows\f15tzief21829.bin
c:\windows\fcSwLApw.exe
c:\windows\FjnOhR.exe
c:\windows\fkUhK.exe
c:\windows\fNOSv.exe
c:\windows\fsgxNr.dll
c:\windows\fTmuQP.dll
c:\windows\fUjpTc.dll
c:\windows\GExKuW.exe
c:\windows\gKHkgOf.dll
c:\windows\gkViF.exe
c:\windows\hAVEsJhG.exe
c:\windows\HEdxgIqO.exe
c:\windows\hhNJsxIP.dll
c:\windows\hiTLtb.dll
c:\windows\hsgDS.exe
c:\windows\IEnPcJLT.exe
c:\windows\IIiJnpV.exe
c:\windows\IJOmWef.exe
c:\windows\inkXpSDfl.exe
c:\windows\ivLmfqcRQ.dll
c:\windows\JCxvCxR.exe
c:\windows\jIGUeQh.dll
c:\windows\jNVqILbX.exe
c:\windows\JoPNqftjP.exe
c:\windows\JVHBc.dll
c:\windows\jVSWfVJhm.exe
c:\windows\jWTSqKo.dll
c:\windows\kAuDP.exe
c:\windows\KBfLR.exe
c:\windows\KcKrMvste.dll
c:\windows\kdxaePCM.dll
c:\windows\keGWjfw.dll
c:\windows\KejsOEN.dll
c:\windows\Keqxf.exe
c:\windows\LbpytdtHY.dll
c:\windows\lennHtXb.dll
c:\windows\lfJRdS.exe
c:\windows\LFOWLBhl.dll
c:\windows\LfRFHyjx.exe
c:\windows\LItXGSG.dll
c:\windows\LJLSA.exe
c:\windows\lNPCDl.dll
c:\windows\lPjAIH.exe
c:\windows\lsEyjv.exe
c:\windows\LXtBqB.dll
c:\windows\lyYpPUnkL.exe
c:\windows\MBYXnUl.exe
c:\windows\McHAYjivj.dll
c:\windows\meFQdeX.dll
c:\windows\MfBQRyv.dll
c:\windows\MIhLeyc.dll
c:\windows\mJSnhJ.dll
c:\windows\moiRu.dll
c:\windows\mpemdm.exe
c:\windows
EWglMRyj.dll
c:\windows
HJcjSeEm.dll
c:\windows\NkeOvtV.dll
c:\windows\NlQkS.exe
c:\windows\NqWtvyGtR.exe
c:\windows\OBnrwxJK.exe
c:\windows\OmejmQjO.exe
c:\windows\ONdiItRr.exe
c:\windows\OWDVh.dll
c:\windows\oxOVlU.exe
c:\windows\pHlryoK.dll
c:\windows\PIQvDiC.dll
c:\windows\PmYakNDj.exe
c:\windows\pqnPFWWp.dll
c:\windows\pRSXe.exe
c:\windows\PuFYyjsux.dll
c:\windows\pXYir.exe
c:\windows\QEnALkBSY.dll
c:\windows\QlFFSw.exe
c:\windows\qRTREKGa.dll
c:\windows\qVAuWax.exe
c:\windowsDWcFop.dll
c:\windows\RiCKFVe.exe
c:\windows\RjUdtcFn.dll
c:\windowsRMwARQ.exe
c:\windowswJmrFual.exe
c:\windows\sirFKRUn.exe
c:\windows\struct~.ini
c:\windows\SUlsRbYqI.exe
c:\windows\system32\1000back9z5r1780.cpl
c:\windows\system32\100z69orm358.exe
c:\windows\system32\100z9pa5se2748.ocx
c:\windows\system32\10479zroj55f9.ocx
c:\windows\system32\10943szy735.bin
c:\windows\system32\10975t5oj7cbz.bin
c:\windows\system32\10d7b9czdoor952.ocx
c:\windows\system32\10f995reat11622z.bin
c:\windows\system32\11820ha5z9ool614.cpl
c:\windows\system32\1192dow9lo5zer2.dll
c:\windows\system32\12435h9eat2657z.dll
c:\windows\system32\12c95hreat20z94.bin
c:\windows\system32\12z9thre5t1309.cpl
c:\windows\system32\13315not-a-virz9358.bin
c:\windows\system32\134529orz3.bin
c:\windows\system32\13457viz9s75e5.ocx
c:\windows\system32\138a5ackzoor1966.exe
c:\windows\system32\13912not-a5vizus49e.dll
c:\windows\system32\1418zhack59ol7a9.ocx
c:\windows\system32\144z59iru572e.cpl
c:\windows\system32\1498zvirus4259.cpl
c:\windows\system32\14990wor5z9.exe
c:\windows\system32\15269szambot72b5.bin
c:\windows\system32\15520h9ckzool448.cpl
c:\windows\system32\15594s5y5z9.bin
c:\windows\system32\1565thie9z261.exe
c:\windows\system32\15691wz5m649.ocx
c:\windows\system32\15851not-a-vir956cz.ocx
c:\windows\system32\15995troj5bz.bin
c:\windows\system32\1599thi9z345.exe
c:\windows\system32\165abackdoor2z749.dll
c:\windows\system32\17081z9y55f.cpl
c:\windows\system32\1752ztroj975.exe
c:\windows\system32\1795h9cktool7f3z.dll
c:\windows\system32\188455ot-a-viruz68b9.bin
c:\windows\system32\189ev5r1z52.ocx
c:\windows\system32\19159s5z445.bin
c:\windows\system32\1916spyware514z.exe
c:\windows\system32\19270no5-a-v9rus2c3z.ocx
c:\windows\system32\19518v9r5z245.bin
c:\windows\system32\19566ha59tooz1a9.dll
c:\windows\system32\19764worm5z9.cpl
c:\windows\system32\1980vzr859.bin
c:\windows\system32\19860hac5tooz6a8.bin
c:\windows\system32\1989threatz5717.bin
c:\windows\system32\1991zn5t-a-virus433.bin
c:\windows\system32\19ffthzeat25974.exe
c:\windows\system32\19z68worm5f85.ocx
c:\windows\system32\19z90spy7fe5.exe
c:\windows\system32\19zab5ckdo9r797.exe
c:\windows\system32\1azcsp9wa5e854.bin
c:\windows\system32\1d2zthief9550.ocx
c:\windows\system32\1d53zi91553.exe
c:\windows\system32\1e76dzwnload9r1825.bin
c:\windows\system32\1z17s5y491.bin
c:\windows\system32\1z57v9r2777.dll
c:\windows\system32\1z6659oj2ea.ocx
c:\windows\system32\1z961sp5c29.bin
c:\windows\system32\1z9avir24315.dll
c:\windows\system32\1zc9backd5or929.exe
c:\windows\system32\207269pamb5tz7e.cpl
c:\windows\system32\20859hac9z5ol421.cpl
c:\windows\system32\20cdbac5dz9r1354.cpl
c:\windows\system32\211495oz959f.cpl
c:\windows\system32\21395trojz755.exe
c:\windows\system32\2156sparse2z9.bin
c:\windows\system32\21600tr5j359z.exe
c:\windows\system32\21685troz962.ocx
c:\windows\system32\21946h5ckt9oz8e.cpl
c:\windows\system32\22196zo5m922.dll
c:\windows\system32\22290not-a-v5rus44z.bin
c:\windows\system32\2278thief9z59.exe
c:\windows\system32\23155not-a9viruszeb.exe
c:\windows\system32\23199wz9m4575.ocx
c:\windows\system32\2335s9ambot15z.dll
c:\windows\system32\234z5hac5tool699.exe
c:\windows\system32\23859pzrse930.dll
c:\windows\system32\241429ot-az5irus1fe.bin
c:\windows\system32\2414t9i5f23z1.exe
c:\windows\system32\24785spamzo59ed.exe
c:\windows\system32\2498vi51987z.ocx
c:\windows\system32\24e9bac5doorz397.bin
c:\windows\system32\25025no9-a-virzs3d5.exe
c:\windows\system32\25460viru9770z.exe
c:\windows\system32\25496hack9o5lz76.exe
c:\windows\system32\255765or931z.ocx
c:\windows\system32\25587not-a-vizus6195.cpl
c:\windows\system32\25850spy693z.bin
c:\windows\system32\2592zhac9tool665.ocx
c:\windows\system32\25d5thre9tz4532.dll
c:\windows\system32\2614downlz9d5r2077.exe
c:\windows\system32\26865vi9zs1d.exe
c:\windows\system32\27141not-a9vi5usz0a.dll
c:\windows\system32\27792sp5z3.ocx
c:\windows\system32\277dvir2z955.cpl
c:\windows\system32\28778h9cztool251.ocx
c:\windows\system32\29115spambzt6a3.bin
c:\windows\system32\29588w9rm58cz.exe
c:\windows\system32\29659zpambot605.dll
c:\windows\system32\29785zp569c.exe
c:\windows\system32\29819not-azvirus585.bin
c:\windows\system32\29970s5zmbot1f6.bin
c:\windows\system32\299aspywa5e1248z.dll
c:\windows\system32\299bvi5154z.cpl
c:\windows\system32\29c5spyw5rz1588.bin
c:\windows\system32\2aa9sp5war92z31.ocx
c:\windows\system32\2ad3thie5z4539.bin
c:\windows\system32\2bz5downl59der2573.exe
c:\windows\system32\2cdczownloade52197.dll
c:\windows\system32\2d05zi925565.ocx
c:\windows\system32\2e7d5hiefz294.exe
c:\windows\system32\2z314spa5bot5a49.bin
c:\windows\system32\2z484hackt5ol9b.cpl
c:\windows\system32\2z499spamb5t47d.dll
c:\windows\system32\2z6595r9j13.dll
c:\windows\system32\2z747hac9tool159.bin
c:\windows\system32\2z820not-a-virus955.cpl
c:\windows\system32\2z993virus35e.cpl
c:\windows\system32\2za1thi592609.cpl
c:\windows\system32\3020zw59mdb.bin
c:\windows\system32\305109ot-a5zirus335.ocx
c:\windows\system32\3052thzef921.cpl
c:\windows\system32\30954vir5972z.bin
c:\windows\system32\30979sp5zbo975c.dll
c:\windows\system32\30981tzoj3ff5.ocx
c:\windows\system32\31027wz952b.bin
c:\windows\system32\3133virzs9145.bin
c:\windows\system32\31568not9a-virzs13d.bin
c:\windows\system32\323zackdoor519.exe
c:\windows\system32\32656not-a-9izu5405.cpl
c:\windows\system32\32659zpy5a.dll
c:\windows\system32\3391thr5a98z75.dll
c:\windows\system32\33e5bac9zoor334.exe
c:\windows\system32\34015o9z4d8.cpl
c:\windows\system32\349bspyware1z55.dll
c:\windows\system32\34ee5ir277z9.exe
c:\windows\system32\350zs9y51d.cpl
c:\windows\system32\3529sp956z.cpl
c:\windows\system32\355aadd9arez500.exe
c:\windows\system32\35791zroj6c99.dll
c:\windows\system32\358dspyw5rz25529.cpl
c:\windows\system32\3593zhief9669.exe
c:\windows\system32\35b8spyware2z589.cpl
c:\windows\system32\35bctzr9a531330.bin
c:\windows\system32\35d4threat9528z.exe
c:\windows\system32\35dazd95are280.dll
c:\windows\system32\367zs5arse19779.bin
c:\windows\system32\3696thie92854z.ocx
c:\windows\system32\36c2addwa59z462.dll
c:\windows\system32\36zethief29195.ocx
c:\windows\system32\3718add5are327z9.bin
c:\windows\system32\378zaddwar5459.dll
c:\windows\system32\3825spywa9e2z83.ocx
c:\windows\system32\39095hrzat29929.exe
c:\windows\system32\392zspam59t5b1.cpl
c:\windows\system32\3947v5r89z.bin
c:\windows\system32\39dbsparsez576.dll
c:\windows\system32\3a945hiefz885.ocx
c:\windows\system32\3aa29ownload5r1z10.dll
c:\windows\system32\3c3zst9al35.cpl
c:\windows\system32\3e96zownloader859.bin
c:\windows\system32\3ef9back5o9r3z4.bin
c:\windows\system32\3z58backd9or2949.exe
c:\windows\system32\3z85spyware593.ocx
c:\windows\system32\4004hack5ool29cz.cpl
c:\windows\system32\41bc5zief13749.ocx
c:\windows\system32\41dz9hr5at9899.ocx
c:\windows\system32\445cs9ywaze2336.cpl
c:\windows\system32\4511sza95ot5d9.cpl
c:\windows\system32\4659ddwaze3185.ocx
c:\windows\system32\46d8t5ief1z90.exe
c:\windows\system32\472dadz59re2139.bin
c:\windows\system32\4789stezl6615.bin
c:\windows\system32\47f4v9r3z15.exe
c:\windows\system32\4812sp9zbot33c5.bin
c:\windows\system32\4923thz5f1358.dll
c:\windows\system32\4949spa5zot74f.dll
c:\windows\system32\497zaddw9r52175.bin
c:\windows\system32\49bstzal5675.dll
c:\windows\system32\49e95ddwaz9430.bin
c:\windows\system32\4b33threa9z1375.exe
c:\windows\system32\4ceabackdozr1695.ocx
c:\windows\system32\4db6dzw9loader5882.dll
c:\windows\system32\4df0tzr9at5788.dll
c:\windows\system32\4e25th9ea53z236.bin
c:\windows\system32\4fb5ba5kdoor2981z.bin
c:\windows\system32\4ff9stz9l27205.bin
c:\windows\system32\4z59spam5ot39d.ocx
c:\windows\system32\4z67sp9r5e590.cpl
c:\windows\system32\501bdzwnl5ader1595.cpl
c:\windows\system32\50549zr2211.dll
c:\windows\system32\50e0virz1905.ocx
c:\windows\system32\5149n9t-a-virus30bz.cpl
c:\windows\system32\51515not-a-virzs5f9.ocx
c:\windows\system32\5199ba5zdoor1205.bin
c:\windows\system32\5209dowzload5r741.cpl
c:\windows\system32\5234zviru970.ocx
c:\windows\system32\52c2b9ckdzor2743.ocx
c:\windows\system32\5310spywarz1999.bin
c:\windows\system32\535edow9loadez502.bin
c:\windows\system32\536dthr95t273z8.dll
c:\windows\system32\53z02spy946.exe
c:\windows\system32\54249not9a-virzs612.ocx
c:\windows\system32\54fa9teaz55.bin
c:\windows\system32\5555hz9ktool556.dll
c:\windows\system32\5558vir5z29.ocx
c:\windows\system32\5590threat28058z.exe
c:\windows\system32\55e2spz9se312.ocx
c:\windows\system32\568zspy289.cpl
c:\windows\system32\5699zir148.bin
c:\windows\system32\56athreaz288699.bin
c:\windows\system32\5719wo5mz93.cpl
c:\windows\system32\5748zd5ware279.bin
c:\windows\system32\5755spam9o518z.cpl
c:\windows\system32\5759not-azvi5us39f.exe
c:\windows\system32\57772spamb9tz9b.exe
c:\windows\system32\578zworm984.dll
c:\windows\system32\582329pz636.ocx
c:\windows\system32\58339s9amboz7ef.cpl
c:\windows\system32\5853za9ktool7a3.cpl
c:\windows\system32\58874s9y6az.exe
c:\windows\system32\5895sparze545.ocx
c:\windows\system32\58absz9rse1773.ocx
c:\windows\system32\58z7sp9rse953.ocx
c:\windows\system32\58zspyw9re537.cpl
c:\windows\system32\5904sparsz9059.exe
c:\windows\system32\590ethiefz095.bin
c:\windows\system32\59375ownl9adez77.bin
c:\windows\system32\59499orz55.ocx
c:\windows\system32\5950virzs19.bin
c:\windows\system32\5954virz958.cpl
c:\windows\system32\5975troj120z.exe
c:\windows\system32\599av9529z8.exe
c:\windows\system32\59cazir1092.dll
c:\windows\system32\5a09steaz475.cpl
c:\windows\system32\5b02s9eal2z51.exe
c:\windows\system32\5bc3a5dware945z.cpl
c:\windows\system32\5c15spa95e208z.ocx
c:\windows\system32\5c5eszyware28889.exe
c:\windows\system32\5cf7spywa9z154.bin
c:\windows\system32\5d9dspzrs5579.ocx
c:\windows\system32\5db0spyw9rez75.cpl
c:\windows\system32\5df09hreaz31551.bin
c:\windows\system32\5e8sp5rse991z.cpl
c:\windows\system32\5eezvir3099.cpl
c:\windows\system32\5f23zownl5ader3293.cpl
c:\windows\system32\5f45z9eal2023.cpl
c:\windows\system32\5z09worm509.ocx
c:\windows\system32\5z2t9ief1342.cpl
c:\windows\system32\5z61backdo9r2980.bin
c:\windows\system32\619zha95tool6a2.ocx
c:\windows\system32\61eabac9door359z.cpl
c:\windows\system32\627aba5kzo9r2870.exe
c:\windows\system32\62d4st5a9z12.dll
c:\windows\system32\6434w59z358.dll
c:\windows\system32\6459azdwa5e2494.bin
c:\windows\system32\64aeaddwz952851.dll
c:\windows\system32\6592spar9e57z.exe
c:\windows\system32\659azown9oader2540.bin
c:\windows\system32\65ddthrzat29951.cpl
c:\windows\system32\6695adzware25895.cpl
c:\windows\system32\66a3vi5z29.dll
c:\windows\system32\66aeazd59re1508.ocx
c:\windows\system32\671fthie529z9.dll
c:\windows\system32\673cd9wnlz5der1198.cpl
c:\windows\system32\675addware3z69.cpl
c:\windows\system32\695bviz967.exe
c:\windows\system32\695fspazse3162.dll
c:\windows\system32\6985a5dwaze773.dll
c:\windows\system32\6995download5r191z.cpl
c:\windows\system32\69z09t5al1096.cpl
c:\windows\system32\6azdb5c9door1499.dll
c:\windows\system32\6d17sp9r5e2428z.exe
c:\windows\system32\6d57t9rzat22709.dll
c:\windows\system32\6e45steal14z95.bin
c:\windows\system32\6fz5thi9f2997.exe
c:\windows\system32\6z5daddwar919115.cpl
c:\windows\system32\71529i51182z.dll
c:\windows\system32\7209stzal7095.dll
c:\windows\system32\73209zrus9a5.bin
c:\windows\system32\7329azdware5095.cpl
c:\windows\system32\7434t9ojz5.cpl
c:\windows\system32\7499sza9bot2d5.ocx
c:\windows\system32\75cazh9eat298245.bin
c:\windows\system32\75z8vir1914.ocx
c:\windows\system32\77929pyware755z.dll
c:\windows\system32\7824bac95oor2z96.bin
c:\windows\system32\7979downloa5erz985.ocx
c:\windows\system32\79z9spars52014.bin
c:\windows\system32\7a91addware3562z.ocx
c:\windows\system32\7b75zi92977.bin
c:\windows\system32\7ca5adzware2941.cpl
c:\windows\system32\7cb69zr24085.bin
c:\windows\system32\7d5tz95f1811.bin
c:\windows\system32\7dbcst9z5117.ocx
c:\windows\system32\7edf9dd5zre1433.cpl
c:\windows\system32\7f6zaddware5932.dll
c:\windows\system32\8022sp5mbzt1489.bin
c:\windows\system32\829w9r5cz.ocx
c:\windows\system32\889zackto9l1f5.exe
c:\windows\system32\8z95spa5b9t404.exe
c:\windows\system32\9079wzrm50e.exe
c:\windows\system32\910sp57d1z.bin
c:\windows\system32\91265spamzo51b7.cpl
c:\windows\system32\91598spy1zf5.exe
c:\windows\system32\9189noz-a-vi5us2669.ocx
c:\windows\system32\918sz9mbotd35.dll
c:\windows\system32\92252spambotz31.exe
c:\windows\system32\924565irzs9a.dll
c:\windows\system32\92545trzj7fb.bin
c:\windows\system32\9353viruze59.bin
c:\windows\system32\9391spz9b5t7eb.exe
c:\windows\system32\93935not-a-virzs7a.ocx
c:\windows\system32\95115hzcktool3c2.dll
c:\windows\system32\95459not-a-vzrus5be.ocx
c:\windows\system32\9583zviru544a.bin
c:\windows\system32\95d6thizf1550.dll
c:\windows\system32\95z4downloader564.bin
c:\windows\system32\9707not-a-virus41z5.bin
c:\windows\system32\98312sz5mbot9d.bin
c:\windows\system32\99024s5y3z.dll
c:\windows\system32\99617no5-a-virusz5c.cpl
c:\windows\system32\99845not5z-virus464.ocx
c:\windows\system32\9a84spyw5ze49.exe
c:\windows\system32\9acdsteaz3509.ocx
c:\windows\system32\9ae5vir1051z.exe
c:\windows\system32\9f0zspywa5e2409.cpl
c:\windows\system32\9z12addw5re643.ocx
c:\windows\system32\9z83spy754.exe
c:\windows\system32\9z857troj754.bin
c:\windows\system32\a69sza5se585.bin
c:\windows\system32\a9fbackdo5z1576.bin
c:\windows\system32\aezthre9t25751.exe
c:\windows\system32\b4e9pyw5rz2429.dll
c:\windows\system32\b65downloaderz339.bin
c:\windows\system32\b99dz5nloader296.ocx
c:\windows\system32\dc2ste5z9365.cpl
c:\windows\system32\drivers\AilRJN.exe
c:\windows\system32\drivers\aJmIwCGU.dll
c:\windows\system32\drivers\alODR.exe
c:\windows\system32\drivers\AqMse.exe
c:\windows\system32\drivers\BKhgBDj.dll
c:\windows\system32\drivers\bOjaY.dll
c:\windows\system32\drivers\ceDOuQcVu.exe
c:\windows\system32\drivers\cffRhDG.dll
c:\windows\system32\drivers\CoavnVNE.exe
c:\windows\system32\drivers\CTdxprPd.exe
c:\windows\system32\drivers\dDiliAB.exe
c:\windows\system32\drivers\DDOgkvI.exe
c:\windows\system32\drivers\dPHbBWkTP.dll
c:\windows\system32\drivers\dRhkt.exe
c:\windows\system32\drivers\dwCYYlkhf.dll
c:\windows\system32\drivers\dWiOCYeX.dll
c:\windows\system32\drivers\dYgqyuu.dll
c:\windows\system32\drivers\ehlbWx.dll
c:\windows\system32\drivers\ehrNagy.exe
c:\windows\system32\drivers\ERFhwUkj.exe
c:\windows\system32\drivers\fNdkYdEEX.exe
c:\windows\system32\drivers\FsBhJjVV.dll
c:\windows\system32\drivers\fspqPJ.dll
c:\windows\system32\drivers\fVnyXNeyM.exe
c:\windows\system32\drivers\FXIfss.exe
c:\windows\system32\drivers\fyAIt.dll
c:\windows\system32\drivers\gGuKQq.exe
c:\windows\system32\drivers\GjOtpus.exe
c:\windows\system32\drivers\Glqks.dll
c:\windows\system32\drivers\GRTLo.exe
c:\windows\system32\drivers\GufBajrtq.dll
c:\windows\system32\drivers\HGJOlkjF.dll
c:\windows\system32\drivers\hioQklSv.dll
c:\windows\system32\drivers\HIWRWtbiN.exe
c:\windows\system32\drivers\HOglQfn.exe
c:\windows\system32\drivers\HoTEge.exe
c:\windows\system32\drivers\HsqxDfD.dll
c:\windows\system32\drivers\hUgRmCI.dll
c:\windows\system32\drivers\IIfPlCI.dll
c:\windows\system32\drivers\iNBLK.exe
c:\windows\system32\drivers\ixkbeE.dll
c:\windows\system32\drivers\iytqKMV.exe
c:\windows\system32\drivers\Jafji.dll
c:\windows\system32\drivers\jbxwb.exe
c:\windows\system32\drivers\JJrykjsd.dll
c:\windows\system32\drivers\JkmpWyJKX.dll
c:\windows\system32\drivers\jrpNPIY.exe
c:\windows\system32\drivers\JTYnB.exe
c:\windows\system32\drivers\jWTIBG.exe
c:\windows\system32\drivers\KeppckMaS.exe
c:\windows\system32\drivers\KhVltDHUr.exe
c:\windows\system32\drivers\KIoeGAxrE.exe
c:\windows\system32\drivers\kOLxQxA.exe
c:\windows\system32\drivers\KRXMHbmBk.exe
c:\windows\system32\drivers\KxmKjpi.exe
c:\windows\system32\drivers\LHFTBnu.dll
c:\windows\system32\drivers\LHspHc.exe
c:\windows\system32\drivers\LjBAumQ.dll
c:\windows\system32\drivers\lkeBgluU.exe
c:\windows\system32\drivers\LtREWXyaS.exe
c:\windows\system32\drivers\MgfcUbwH.dll
c:\windows\system32\drivers\MSgKuwe.dll
c:\windows\system32\drivers\MSUsiDcUg.exe
c:\windows\system32\drivers\NaxkmYqO.dll
c:\windows\system32\drivers\NkhvEqw.dll
c:\windows\system32\drivers
OKAqY.dll
c:\windows\system32\drivers\NpXBoQr.dll
c:\windows\system32\drivers\OBGxTXF.dll
c:\windows\system32\drivers\OgiypPe.dll
c:\windows\system32\drivers\OIaYE.dll
c:\windows\system32\drivers\oOMEYkSsi.dll
c:\windows\system32\drivers\oTKnms.dll
c:\windows\system32\drivers\oumBah.exe
c:\windows\system32\drivers\peAIVl.exe
c:\windows\system32\drivers\pMqQCuKt.dll
c:\windows\system32\drivers\POQvOV.exe
c:\windows\system32\drivers\pOuHH.dll
c:\windows\system32\drivers\PtgXmiHOB.exe
c:\windows\system32\drivers\PyfjAm.exe
c:\windows\system32\drivers\qhiVOXm.exe
c:\windows\system32\drivers\qMiwL.dll
c:\windows\system32\drivers\QXpniF.dll
c:\windows\system32\drivers\qYAcL.exe
c:\windows\system32\drivers\RmovM.exe
c:\windows\system32\drivers\RrpHkvoII.dll
c:\windows\system32\driversSluw.exe
c:\windows\system32\drivers\SAQmKOoWJ.dll
c:\windows\system32\drivers\SpVLe.dll
c:\windows\system32\drivers	GSSJR.exe
c:\windows\system32\drivers	JQbouKo.exe
c:\windows\system32\drivers\TPLfNGlnn.exe
c:\windows\system32\drivers\TrlsnjPNr.dll
c:\windows\system32\drivers\TtwQbp.dll
c:\windows\system32\drivers\UgHmuA.dll
c:\windows\system32\drivers\UMgGpJwP.exe
c:\windows\system32\drivers\UMRjLF.dll
c:\windows\system32\drivers\uuqjwd.exe
c:\windows\system32\drivers\uYSJwQlbG.exe
c:\windows\system32\drivers\vcMPJK.exe
c:\windows\system32\drivers\vCwTd.dll
c:\windows\system32\drivers\VuhLJUg.dll
c:\windows\system32\drivers\vVCtuIgB.dll
c:\windows\system32\drivers\vWogOhb.dll
c:\windows\system32\drivers\vXNHRQmO.exe
c:\windows\system32\drivers\VYtra.dll
c:\windows\system32\drivers\WbUkWmW.dll
c:\windows\system32\drivers\wcLJLpsjB.dll
c:\windows\system32\drivers\WICkV.exe
c:\windows\system32\drivers\wroyf.exe
c:\windows\system32\drivers\WsMBKgXu.dll
c:\windows\system32\drivers\wVpxPynav.dll
c:\windows\system32\drivers\WWUaY.exe
c:\windows\system32\drivers\xAQAyeq.dll
c:\windows\system32\drivers\xDiPSvmY.exe
c:\windows\system32\drivers\XfJdGYKL.exe
c:\windows\system32\drivers\XfUbpGVjc.exe
c:\windows\system32\drivers\XkjYRKe.dll
c:\windows\system32\drivers\xkYjglml.exe
c:\windows\system32\drivers\xnbyn.exe
c:\windows\system32\drivers\xpIVD.dll
c:\windows\system32\drivers\XRSGmDS.exe
c:\windows\system32\drivers\XrVRGI.exe
c:\windows\system32\drivers\XvxiYgRv.exe
c:\windows\system32\drivers\yBwgPai.exe
c:\windows\system32\drivers\YcsRlskmK.exe
c:\windows\system32\drivers\YItcHi.dll
c:\windows\system32\drivers\YkTdCDRV.exe
c:\windows\system32\drivers\YtBLr.dll
c:\windows\system32\e43thief3z95.cpl
c:\windows\system32\RFSTyALrq.exe
c:\windows\system32	mp.reg
c:\windows\system32\z0105not-a-virus9b4.dll
c:\windows\system32\z0208vir9saf5.dll
c:\windows\system32\z0352spy7509.cpl
c:\windows\system32\z0509virus964.cpl
c:\windows\system32\z0ffdow5loader994.cpl
c:\windows\system32\z11689orm15.exe
c:\windows\system32\z1565w9rm503.bin
c:\windows\system32\z1824h5ckto9l30e.dll
c:\windows\system32\z26s5yw9re2520.bin
c:\windows\system32\z3173sp53ac9.bin
c:\windows\system32\z373spamb9te35.exe
c:\windows\system32\z494download5r1968.cpl
c:\windows\system32\z499threat26554.dll
c:\windows\system32\z527spywa5e2392.dll
c:\windows\system32\z5a6s9yware1925.exe
c:\windows\system32\z5astea9369.dll
c:\windows\system32\z5c5th5eat21997.dll
c:\windows\system32\z6592not-a-viru9404.dll
c:\windows\system32\z6f1a9dware1529.bin
c:\windows\system32\z80a59ware2067.bin
c:\windows\system32\z9425teal3901.dll
c:\windows\system32\zc9bdown5oader4409.cpl
c:\windows\system32\zc9steal5037.dll
c:\windows\system32\zebbth9ef5046.dll
c:\windows\TEKbky.exe
c:\windows	LXaBuSvv.exe
c:\windows\TuacncMbK.exe
c:\windows	WBWByyCw.exe
c:\windows\uaGmJVlgP.exe
c:\windows\UDhVaLPSu.exe
c:\windows\UFvknNlxE.dll
c:\windows\UgpwYxeae.dll
c:\windows\UGVKVL.dll
c:\windows\UhcvRRc.exe
c:\windows\UjOnYC.dll
c:\windows\UMKOwe.dll
c:\windows\uqeHn.dll
c:\windows\UTtprCU.exe
c:\windows\uVrkPN.dll
c:\windows\VetnvPsmv.dll
c:\windows\VfMhHW.exe
c:\windows\vsPGvCAwy.exe
c:\windows\VwCsCUrT.dll
c:\windows\wLwFOt.dll
c:\windows\WORXpFYXa.dll
c:\windows\WXTvUNCeS.dll
c:\windows\XLVqhJtq.dll
c:\windows\Xnoph.exe
c:\windows\ydluMs.exe
c:\windows\YhBaXIx.dll
c:\windows\yURgQX.dll
c:\windows\YYjRbrTi.dll
c:\windows\z09fspa5se25419.ocx
c:\windows\z13855a9ktool740.cpl
c:\windows\z1980spam5ot23b.dll
c:\windows\z1994spy59d.bin
c:\windows\z2738spy955.ocx
c:\windows\z3129tr5j105.bin
c:\windows\z3429spam5ot2f9.dll
c:\windows\z40e5ddware9419.dll
c:\windows\z4269not-a-95rus1c9.exe
c:\windows\z491s5eal2907.exe
c:\windows\z4abv59951.dll
c:\windows\z5036wo59b4.dll
c:\windows\z52889pyd25.ocx
c:\windows\z555i9us608.bin
c:\windows\z5970s5y9d5.ocx
c:\windows\z633spy1965.ocx
c:\windows\z692downloade51761.exe
c:\windows\z69athie93153.cpl
c:\windows\z74ath9ef19015.cpl
c:\windows\z8809d5ware344.ocx
c:\windows\z898steal525.exe
c:\windows\z8spy19e5.exe
c:\windows\z9153virus5a4.exe
c:\windows\z9560troj125.cpl
c:\windows\z98809irus25b.dll
c:\windows\z9ec9ir956.ocx
c:\windows\za59dow9loader894.dll
c:\windows\za93b5ck9oor285.bin
c:\windows\zb69addwar59922.cpl
c:\windows\zcf9backd5or2853.cpl
c:\windows\ze4fspyware3659.exe
D:esycled

.
(((((((((((((((((((((((((((((   Fichiers créés du 2010-02-13 au 2010-03-13  ))))))))))))))))))))))))))))))))))))
.

2010-03-13 06:45 . 2010-03-13 06:45	--------	d-----w-	c:\users\Schizoprenic\AppData\Local	emp
2010-03-13 06:45 . 2010-03-13 06:45	--------	d-----w-	c:\users\Default\AppData\Local	emp
2010-03-12 17:37 . 2010-03-12 17:37	--------	d-----w-	c:\users\Schizoprenic\AppData\Roaming\Malwarebytes
2010-03-12 17:37 . 2010-01-07 16:07	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-12 17:37 . 2010-03-12 17:37	--------	d-----w-	c:\programdata\Malwarebytes
2010-03-12 17:37 . 2010-03-12 17:37	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-03-12 17:37 . 2010-01-07 16:07	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-03-12 16:56 . 2008-12-18 15:55	142848	----a-w-	c:\users\Schizoprenic\AppData\Roaming\BSplayer\FFDShow\ff_liba52.dll
2010-03-12 15:50 . 2010-03-12 17:15	35	----a-w-	c:\users\Schizoprenic\AppData\Roaming\SetValue.bat
2010-03-11 10:27 . 2010-03-11 10:27	1471488	----a-w-	c:\windows\system32\aiXDKcoJh.dll
2010-03-11 10:27 . 2010-03-11 10:27	1471488	----a-w-	c:\windows\system32\aadmvrqas.exe
2010-03-09 15:24 . 2010-03-09 15:41	--------	d-----w-	c:\users\Schizoprenic\AppData\Roaming\DC++
2010-03-09 15:24 . 2010-03-09 15:24	--------	d-----w-	c:\users\Schizoprenic\AppData\Local\DC++
2010-03-09 15:19 . 2010-03-09 15:19	118784	----a-w-	c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShimspnpshimwmp.dll
2010-03-09 15:19 . 2010-03-09 15:19	118784	----a-w-	c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShimspnpshimswf.dll
2010-03-09 15:19 . 2010-03-09 15:19	118784	----a-w-	c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShimspnpshimrp.dll
2010-03-09 15:19 . 2010-03-09 15:19	118784	----a-w-	c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShimspnpshimqt.dll
2010-03-09 15:19 . 2010-03-09 15:19	118784	----a-w-	c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components
prpffbrowserrecordext.dll
2010-03-09 15:19 . 2010-03-09 15:19	300616	----a-w-	c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Commonpmainbrowserrecordplugin.dll
2010-03-09 15:19 . 2010-03-09 15:19	118784	----a-w-	c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hookpchromebrowserrecordhelper.dll
2010-03-09 15:19 . 2010-03-09 15:19	329312	----a-w-	c:\programdata\Real\RealPlayer\BrowserRecordPlugin\IEpbrowserrecordplugin.dll
2010-03-09 15:18 . 2010-03-09 15:18	--------	d-----w-	c:\program files\Common Files\xing shared
2010-03-06 17:45 . 2010-03-06 17:46	--------	d-----w-	c:\program files\Veetle
2010-03-05 01:41 . 2010-03-05 01:41	443912	----a-w-	c:\users\Schizoprenic\AppData\Roaming\Real\Update\setup3.10\setup.exe
2010-03-03 19:44 . 2010-03-03 19:51	5514304	----a-w-	c:\users\Schizoprenic\AppData\Roaming\TVU Networks\AutoUpgrade\TVUPlayer2.5.2.2.exe
2010-02-25 12:39 . 2007-05-12 00:34	356352	----a-w-	c:\windows\system32\NVUNINST.EXE
2010-02-22 01:06 . 2010-02-22 01:06	552	----a-w-	c:\users\Schizoprenic\AppData\Local\d3d8caps.dat
2010-02-21 23:48 . 2010-02-21 23:48	--------	d-----w-	c:\users\Schizoprenic\AppData\Local\Microsoft Corporation
2010-02-19 02:57 . 2010-02-19 02:57	--------	d-----w-	c:\program files\Windows Portable Devices
2010-02-19 02:53 . 2009-10-01 01:02	30208	----a-w-	c:\windows\system32\WPDShextAutoplay.exe
2010-02-19 02:52 . 2009-10-08 21:08	555520	----a-w-	c:\windows\system32\UIAutomationCore.dll
2010-02-19 02:52 . 2009-10-08 21:08	234496	----a-w-	c:\windows\system32\oleacc.dll
2010-02-19 02:52 . 2009-10-08 21:07	4096	----a-w-	c:\windows\system32\oleaccrc.dll
2010-02-19 02:28 . 2010-02-19 02:34	--------	d-----w-	c:\windows\system32\ca-ES
2010-02-19 02:28 . 2010-02-19 02:34	--------	d-----w-	c:\windows\system32\eu-ES
2010-02-19 02:28 . 2010-02-19 02:34	--------	d-----w-	c:\windows\system32\vi-VN
2010-02-19 01:43 . 2010-02-19 01:43	--------	d-----w-	c:\windows\system32\EventProviders
2010-02-19 01:42 . 2009-04-11 05:03	12240896	----a-w-	c:\windows\system32\NlsLexicons0007.dll
2010-02-19 01:42 . 2009-04-11 06:28	1081344	----a-w-	c:\windows\system32\SLCExt.dll
2010-02-19 01:42 . 2009-04-11 06:27	3408896	----a-w-	c:\windows\system32\SLsvc.exe
2010-02-19 01:42 . 2009-04-11 06:28	2134528	----a-w-	c:\windows\system32\FunctionDiscoveryFolder.dll
2010-02-19 01:42 . 2009-04-11 06:27	65536	----a-w-	c:\windows\system32\DevicePairingWizard.exe
2010-02-19 01:42 . 2009-04-11 05:03	2644480	----a-w-	c:\windows\system32\NlsLexicons0009.dll
2010-02-19 01:42 . 2009-04-11 06:28	1480704	----a-w-	c:\windows\system32\mssrch.dll
2010-02-19 01:40 . 2009-04-11 06:28	499712	----a-w-	c:\windows\system32\wbem\WmiPrvSD.dll
2010-02-19 01:39 . 2009-04-11 06:32	50664	----a-w-	c:\windows\system32\PSHED.DLL
2010-02-19 01:38 . 2009-04-11 06:28	1123840	----a-w-	c:\windows\system32\usercpl.dll
2010-02-19 01:37 . 2009-04-11 04:43	148480	----a-w-	c:\windows\system32\drivers
wifi.sys
2010-02-19 01:36 . 2009-04-11 06:28	83968	----a-w-	c:\windows\system32\wbem\wmiutils.dll
2010-02-19 01:36 . 2009-04-11 06:28	744448	----a-w-	c:\windows\system32\wbem\wbemcore.dll
2010-02-19 01:36 . 2009-04-11 06:28	30208	----a-w-	c:\windows\system32\wbem\wbemprox.dll
2010-02-19 01:36 . 2009-04-11 06:28	265728	----a-w-	c:\windows\system32\wbemepdrvfs.dll
2010-02-19 01:36 . 2009-04-11 06:28	189440	----a-w-	c:\windows\system32\wbem\mofd.dll
2010-02-19 01:36 . 2009-04-11 06:28	614912	----a-w-	c:\windows\system32\wbem\fastprox.dll
2010-02-19 01:36 . 2009-04-11 06:28	265728	----a-w-	c:\windows\system32\wbem\esscli.dll
2010-02-19 01:36 . 2009-04-11 06:28	705536	----a-w-	c:\windows\system32\SmiEngine.dll
2010-02-19 01:36 . 2009-04-11 06:28	218624	----a-w-	c:\windows\system32\wdscore.dll
2010-02-19 01:36 . 2009-04-11 06:27	130560	----a-w-	c:\windows\system32\PkgMgr.exe
2010-02-19 01:35 . 2009-04-11 06:28	247808	----a-w-	c:\windows\system32\drvstore.dll
2010-02-18 00:05 . 2009-12-08 20:01	3600456	----a-w-	c:\windows\system32
tkrnlpa.exe
2010-02-18 00:05 . 2009-12-08 20:01	3548216	----a-w-	c:\windows\system32
toskrnl.exe
2010-02-17 13:25 . 2009-10-29 09:17	2048	----a-w-	c:\windows\system32	zres.dll
2010-02-17 13:16 . 2009-11-09 12:31	24064	----a-w-	c:\windows\system32
shhttp.dll
2010-02-17 13:16 . 2009-11-09 10:36	411648	----a-w-	c:\windows\system32\drivers\http.sys
2010-02-17 13:16 . 2009-11-09 12:30	30720	----a-w-	c:\windows\system32\httpapi.dll
2010-02-17 13:15 . 2010-02-17 13:16	--------	d-----w-	c:\users\Schizoprenic\AppData\Local\ApplicationHistory
2010-02-17 13:15 . 2010-02-17 13:15	100	----a-w-	c:\users\Schizoprenic\AppData\Local\fusioncache.dat
2010-02-17 12:30 . 2009-09-10 14:58	310784	----a-w-	c:\windows\system32\unregmp2.exe
2010-02-17 12:30 . 2009-09-10 14:59	8147456	----a-w-	c:\windows\system32\wmploc.DLL
2010-02-17 12:13 . 2009-12-08 20:01	904776	----a-w-	c:\windows\system32\drivers	cpip.sys
2010-02-17 12:13 . 2009-12-08 17:26	30720	----a-w-	c:\windows\system32\drivers	cpipreg.sys
2010-02-17 12:12 . 2009-09-10 16:48	218624	----a-w-	c:\windows\system32\msv1_0.dll
2010-02-17 12:08 . 2009-08-24 11:36	377344	----a-w-	c:\windows\system32\winhttp.dll
2010-02-17 12:06 . 2009-09-04 11:41	60928	----a-w-	c:\windows\system32\msasn1.dll
2010-02-17 12:06 . 2009-08-11 16:44	1401856	----a-w-	c:\windows\system32\msxml6.dll
2010-02-17 12:06 . 2009-08-11 16:44	1248768	----a-w-	c:\windows\system32\msxml3.dll
2010-02-17 12:05 . 2009-09-14 09:29	144896	----a-w-	c:\windows\system32\drivers\srv2.sys
2010-02-17 12:05 . 2009-10-07 11:36	243712	----a-w-	c:\windows\system32astls.dll
2010-02-17 12:05 . 2009-12-04 18:29	1314816	----a-w-	c:\windows\system32\quartz.dll
2010-02-17 12:05 . 2009-12-04 18:30	12288	----a-w-	c:\windows\system32	sbyuv.dll
2010-02-17 12:05 . 2009-12-04 18:28	22528	----a-w-	c:\windows\system32\msyuv.dll
2010-02-17 12:05 . 2009-12-04 18:28	31744	----a-w-	c:\windows\system32\msvidc32.dll
2010-02-17 12:05 . 2009-12-04 18:28	13312	----a-w-	c:\windows\system32\msrle32.dll
2010-02-17 12:05 . 2009-12-04 18:28	82944	----a-w-	c:\windows\system32\mciavi32.dll
2010-02-17 12:05 . 2009-12-04 18:28	50176	----a-w-	c:\windows\system32\iyuv_32.dll
2010-02-17 12:05 . 2009-12-04 18:28	123904	----a-w-	c:\windows\system32\msvfw32.dll
2010-02-17 12:05 . 2009-12-04 18:27	91136	----a-w-	c:\windows\system32\avifil32.dll
2010-02-17 12:05 . 2009-08-10 12:35	355328	----a-w-	c:\windows\system32\WSDApi.dll
2010-02-17 12:04 . 2009-05-08 12:53	604672	----a-w-	c:\windows\system32\WMSPDMOD.DLL
2010-02-17 12:04 . 2009-12-11 11:43	302080	----a-w-	c:\windows\system32\drivers\srv.sys
2010-02-17 12:04 . 2009-12-11 11:43	98816	----a-w-	c:\windows\system32\drivers\srvnet.sys
2010-02-17 12:03 . 2009-10-19 13:38	156672	----a-w-	c:\windows\system32	2embed.dll
2010-02-17 12:03 . 2009-10-19 13:35	72704	----a-w-	c:\windows\system32\fontsub.dll
2010-02-17 12:02 . 2009-08-14 13:27	2036736	----a-w-	c:\windows\system32\win32k.sys
2010-02-17 12:01 . 2009-12-04 15:56	212992	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2010-02-17 12:01 . 2009-12-04 15:56	105984	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 11:23 . 2009-08-07 02:24	44768	----a-w-	c:\windows\system32\wups2.dll
2010-02-17 11:23 . 2009-08-07 02:24	53472	----a-w-	c:\windows\system32\wuauclt.exe
2010-02-17 11:23 . 2009-08-07 01:45	2421760	----a-w-	c:\windows\system32\wucltux.dll
2010-02-17 11:23 . 2009-08-07 02:23	1929952	----a-w-	c:\windows\system32\wuaueng.dll
2010-02-17 11:22 . 2009-08-07 02:24	35552	----a-w-	c:\windows\system32\wups.dll
2010-02-17 11:22 . 2009-08-07 02:23	575704	----a-w-	c:\windows\system32\wuapi.dll
2010-02-17 11:22 . 2009-08-07 01:44	87552	----a-w-	c:\windows\system32\wudriver.dll
2010-02-17 11:22 . 2009-08-06 18:23	171608	----a-w-	c:\windows\system32\wuwebv.dll
2010-02-17 11:22 . 2009-08-06 17:44	33792	----a-w-	c:\windows\system32\wuapp.exe
2010-02-13 12:20 . 1999-07-06 14:13	40960	----a-w-	c:\windows\system32\eax.dll
2010-02-13 12:20 . 2010-02-13 12:20	--------	d-----w-	c:\program files\Creative Labs
2010-02-12 14:28 . 1997-05-29 16:26	316416	----a-w-	c:\windows\IsUn040c.exe
2010-02-11 23:03 . 2010-02-11 23:20	--------	d-----w-	c:\program files\Nero
2010-02-11 23:02 . 2010-02-11 23:11	--------	d-----w-	c:\programdata\Nero

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-13 06:27 . 2009-10-11 22:43	--------	d-----w-	c:\programdata\avg8
2010-03-13 06:27 . 2006-11-02 15:48	713542	----a-w-	c:\windows\system32\perfh00C.dat
2010-03-13 06:27 . 2006-11-02 15:48	143542	----a-w-	c:\windows\system32\perfc00C.dat
2010-03-13 06:25 . 2009-10-11 22:43	--------	d-----w-	c:\program files\AVG
2010-03-13 06:19 . 2007-07-20 16:20	12	----a-w-	c:\windows\bthservsdp.dat
2010-03-13 06:09 . 2008-08-19 22:47	--------	d-----w-	c:\users\Schizoprenic\AppData\Roaming\Skype
2010-03-13 06:07 . 2008-08-28 09:09	--------	d-----w-	c:\users\Schizoprenic\AppData\Roaming\BSplayer
2010-03-13 01:39 . 2008-08-19 23:53	--------	d-----w-	c:\users\Schizoprenic\AppData\Roaming\MiniLyrics
2010-03-13 00:36 . 2008-11-02 23:59	--------	d-----w-	c:\program files\Steam
2010-03-12 23:45 . 2008-08-19 22:19	79480	----a-w-	c:\users\Schizoprenic\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-12 22:12 . 2009-01-17 16:36	--------	d-----w-	c:\program files\Tennis Elbow Manager
2010-03-12 17:15 . 2010-03-12 15:50	691	----a-w-	c:\users\Schizoprenic\AppData\Roaming\GetValue.vbs
2010-03-12 17:02 . 2009-12-31 08:29	--------	d-----w-	c:\program files	rend micro
2010-03-12 16:32 . 2007-07-23 08:45	--------	d-----w-	c:\program files\Google
2010-03-12 16:21 . 2009-05-19 18:14	--------	d-----w-	c:\program files\CCleaner
2010-03-12 16:20 . 2008-08-28 09:09	--------	d-----w-	c:\program files\Webteh
2010-03-12 14:51 . 2008-08-19 22:53	--------	d-----w-	c:\users\Schizoprenic\AppData\Roaming\uTorrent
2010-03-09 15:19 . 2008-09-15 10:59	--------	d-----w-	c:\program files\Common Files\Real
2010-03-09 15:18 . 2010-01-19 01:34	--------	d-----w-	c:\program files\Real
2010-03-09 01:24 . 2008-08-19 22:19	28000	----a-w-	c:\users\Schizoprenic\AppData\Roaming
vModes.dat
2010-03-08 16:30 . 2008-08-19 22:19	2032	----a-w-	c:\users\Schizoprenic\AppData\Local\d3d9caps.dat
2010-03-07 20:42 . 2008-08-19 23:38	--------	d-----w-	c:\program files\Minilyrics
2010-03-06 01:19 . 2008-08-19 22:53	--------	d-----w-	c:\program files\uTorrent
2010-03-05 01:37 . 2008-11-02 23:59	--------	d-----w-	c:\program files\Common Files\Steam
2010-02-22 02:05 . 2009-12-20 20:57	--------	d-----w-	c:\users\Schizoprenic\AppData\Roaming\DiskAid
2010-02-22 02:03 . 2009-12-18 21:42	--------	d-----w-	c:\programdata\NVIDIA
2010-02-21 23:33 . 2009-06-06 04:16	--------	d-----w-	c:\program files\PacificPoker
2010-02-21 23:31 . 2009-06-11 22:00	--------	d-----w-	c:\program files\PokerStars
2010-02-19 02:57 . 2006-11-02 10:25	665600	----a-w-	c:\windows\inf\drvindex.dat
2010-02-19 02:57 . 2010-02-19 02:57	0	---ha-w-	c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-02-19 02:56 . 2010-02-19 02:56	0	---ha-w-	c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-02-19 02:34 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Calendar
2010-02-19 02:34 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-02-19 02:34 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Sidebar
2010-02-19 02:34 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Journal
2010-02-19 02:34 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Collaboration
2010-02-19 02:34 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Photo Gallery
2010-02-19 02:34 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Defender
2010-02-19 00:08 . 2009-12-18 01:09	--------	d-----w-	c:\users\Schizoprenic\AppData\Roaming\Winamp
2010-02-18 10:38 . 2008-10-08 02:48	--------	d-----w-	c:\users\Schizoprenic\AppData\Roaming\dvdcss
2010-02-16 08:52 . 2008-10-08 17:53	--------	d-----w-	c:\programdata\Lx_cats
2010-02-12 12:51 . 2009-05-08 01:01	--------	d-----w-	c:\program files\Tennis Elbow 2009
2010-02-11 23:38 . 2009-02-27 15:29	--------	d-----w-	c:\program files\Common Files\Nero
2010-02-05 11:41 . 2010-02-05 11:40	--------	d-----w-	c:\program files\iTunes
2010-02-05 11:40 . 2010-02-05 11:40	--------	d-----w-	c:\program files\iPod
2010-02-05 11:40 . 2008-09-20 13:30	--------	d-----w-	c:\program files\Common Files\Apple
2010-02-05 11:35 . 2010-02-05 11:35	72488	----a-w-	c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-02-05 10:44 . 2010-02-05 10:44	--------	d-----w-	c:\program files\QuickTime
2010-02-02 22:08 . 2008-08-28 11:04	--------	d-----w-	c:\program files\Common Files\Adobe
2010-01-29 05:16 . 2010-01-29 05:16	--------	d-----w-	c:\users\Schizoprenic\AppData\Roaming\2K Sports
2010-01-22 15:20 . 2008-08-19 23:35	--------	d-----w-	c:\program files\Winamp
2010-01-22 15:13 . 2010-01-22 15:13	--------	d-----w-	c:\program files\Winamp Detect
2010-01-20 00:21 . 2007-07-23 08:59	--------	d-----w-	c:\program files\Sony
2010-01-20 00:21 . 2007-07-20 16:53	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-01-20 00:19 . 2007-07-23 08:48	--------	d-----w-	c:\program files\Common Files\Sony Shared
2010-01-20 00:17 . 2007-07-23 09:07	--------	d-----w-	c:\programdata\Sony Corporation
2010-01-16 14:16 . 2009-11-27 13:56	--------	d-----w-	c:\programdata\Messenger Plus!
2010-01-16 13:51 . 2008-08-23 05:46	--------	d-----w-	c:\program files\Messenger Plus! Live
2010-01-14 10:12 . 2009-10-04 04:16	181120	------w-	c:\windows\system32\MpSigStub.exe
2010-01-05 18:00 . 2010-01-10 07:12	85504	----a-w-	c:\windows\system32\ff_vfw.dll
2010-01-02 06:38 . 2010-02-17 12:18	916480	----a-w-	c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-02-17 12:18	71680	----a-w-	c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-02-17 12:18	109056	----a-w-	c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-02-17 12:18	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2009-09-13 22:10 . 2009-10-07 15:37	47104	----a-w-	c:\program files\mozilla firefox\components\FFComm.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2010-02-24 1771320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2007-06-10 118784]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-06-11 317560]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"lxdnmon.exe"="c:\program files\Lexmark 2600 Series\lxdnmon.exe" [2009-01-29 660136]
"lxdnamon"="c:\program files\Lexmark 2600 Series\lxdnamon.exe" [2009-01-29 16040]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"NvSvc"="c:\windows\system32
vsvc.dll" [2007-06-28 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"TkBellExe"="c:\program files\Common Files\Real\Update_OBealsched.exe" [2010-03-09 202256]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-6-22 739880]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-7-25 813584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\VESWinlogon]
2007-07-12 06:33	98304	----a-w-	c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk /r \??\J:\0autocheck autochk *

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 15:57	948672	----a-r-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-18 08:58	40368	----a-w-	c:\program files\Adobe\Reader 8.0\Readereader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-22 19:16	141608	----a-w-	c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 23:08	417792	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-03-09 15:17	202256	----a-w-	c:\program files\Common Files\Real\Update_OBealsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):e8,f0,42,19,0d,b1,ca,01

R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-09-15 721904]
R2 .EsetTrialReset;Eset Trial Reset;c:\windows\system32egedt32.exe [2006-11-02 9216]
R2 gupdate1ca2cd22c28197e;Service Google Update (gupdate1ca2cd22c28197e);c:\program files\Google\Update\GoogleUpdate.exe [2009-09-03 133104]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2007-07-03 28464]
R3 CyUsbNT;Cypress Manufacturing Driver;c:\windows\system32\Drivers\CyUsbNT.sys [2005-02-16 28800]
R3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys [x]
R3 MobileAdapter;Huawei Mobile Adapter USB Modem and USB Serial;c:\windows\system32\DRIVERS\hmvmdm.sys [2007-09-04 101504]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS
etaapl.sys [2009-06-05 17408]
R3 UsbEvdoAtc;LGE EVDO USB Serial Port;c:\windows\system32\DRIVERS\lgevdoatc.sys [x]
R3 usbevdobus;LGE EVDO Composite USB Device;c:\windows\system32\DRIVERS\lgevdobus.sys [x]
R3 UsbEvdoDiag;LGE EVDO USB Serial DM Port;c:\windows\system32\DRIVERS\lgevdodiag.sys [x]
R3 USBEVDOModem;LGE EVDO USB Modem;c:\windows\system32\DRIVERS\lgevdomodem.sys [x]
R3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-01-10 745472]
R3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-06-20 397312]
R3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-20 1089536]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2009-09-08 83312]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [2009-12-08 673136]
S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe [2008-02-27 594600]
S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\w

moment de grace · Answer

doucement, ce n'est pas fini...je n'ai encore jamais vu un rapport comme le tien !!!

d'ailleurs il n'est pas complet

1)

Rend toi sur Cjoint :&#61656; http://www.cijoint.fr/ 

Clique sur "Parcourir " dans la partie " Joindre un fichier[...] " 

Sélectionne le rapport C:\ComboFix.txt 

Clique ensuite sur "Créer le lien cjoint " et copie/colle le dans ton prochain message

.........................

2)

Téléchargez USBFIX de El Desaparecido, C_xx

http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe
ou
https://www.ionos.fr/?affiliate_id=77097

/!\ Utilisateur de vista et windows 7 :
ne pas oublier de désactiver Le contrôle des comptes utilisateurs 
https://www.commentcamarche.net/faq/8343-vista-desactiver-l-uac 

/!\ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir 

• Double clic sur le raccourci UsbFix présent sur le bureau . 

• Choisir l'option2 suppression
(d’autres options disponibles, voir le tutoriel). 
• Laissez travailler l'outil.
Le menu démarrer et les icônes vont disparaître.. c'est normal. 

Si un message te demande de redémarrer l'ordinateur fais le ... 

&#9679; Au redémarrage, le fix se relance... laisses l'opération s'effectuer. 

&#9679; Le bloc note s'ouvre avec un rapport, envoies le dans la prochaine réponse

 
• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt ) 

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) 

• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 


• Tuto : http://pagesperso-orange.fr/NosTools/usbfix.html


UsbFix peut te demander d'uploader un dossier compressé à cette adresse : https://www.ionos.fr/?affiliate_id=77097 

 Il est enregistré sur ton bureau. 

Merci de l'envoyer à l'adresse indiquée afin d'aider l'auteur de UsbFix dans ses recherches. 

........................

3)

Relances MalwareByte's Anti-Malware
Mets le à jour cette fois ci
Examen complet
supprimer ce qu'il trouve
poster le rapport

Marvolo · Answer

Arf,je suis allé trop vite en besogne...

http://www.cijoint.fr/cjlink.php?file=cj201003/cijwIDiaf1.txt
Le lien du fichier.

moment de grace · Answer

le plus gros est fait...

apres usbfix et mbam, on y verra plus clair

Marvolo · Answer

J'ai envoye le rapport d'usbfix et la je lance mbam.

Merci encore et la phrase "J'AI JAMAIS VU UN TRUC PAREIL" meme si c'etait sensé etre alarmant,ca m''a fait rigoler comme un con

moment de grace · Answer

(sourire)

le rapport usbfix doit êtrte posté ici pour que je le vérifie ( C:\UsbFix.txt ) 

quant au fichier que tu as envoyé au créateur de l'outil, tu peux le supprimer

Marvolo · Answer

Sinon,tu m'as pas repondu:
tu me conseilles quel antivirus?J'ai AVG actuellement mais vu tout le boxon,vvaut mieux passser a un truc plus performant.

Le rapport usbfix:


############################## | UsbFix V6.099 |

User : Schizoprenic (Administrateurs) # SCHYZOPHRENIC
Update on 11/03/2010 by El Desaparecido , C_XX & Chimay8
Start at: 07:43:10 | 13/03/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 Duo CPU     T7250  @ 2.00GHz
Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18882
Windows Firewall Status : Enabled

C:\ -> Disque fixe local # 158,7 Go (39,64 Go free) [Shaka] # NTFS
D:\ -> Disque fixe local # 17,53 Go (13,58 Go free) [Ikki] # NTFS
E:\ -> Disque amovible
F:\ -> Disque amovible # 1,9 Go (17,75 Mo free) [XTINCTION] # FAT
G:\ -> Disque CD-ROM # 7,36 Go (0 Mo free) [PES2010] # UDF
H:\ -> Disque CD-ROM

################## | Elements infectieux |

Supprimé ! C:\$Recycle.Bin\S-1-5-21-3242307328-3026939525-2831412068-1000 
Supprimé ! D:\$Recycle.Bin\S-1-5-21-1453738194-2990717095-2334957809-1000 
Supprimé ! D:\$Recycle.Bin\S-1-5-21-1453738194-2990717095-2334957809-500 
Supprimé ! D:\$Recycle.Bin\S-1-5-21-3242307328-3026939525-2831412068-1000 
Supprimé ! D:\$Recycle.Bin\S-1-5-21-3242307328-3026939525-2831412068-500 
(!) Non supprimé ! G:\autorun.inf 
Supprimé ! J:\winamp_cache_0001.xml 

################## | Registre |

Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"  
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"  

################## | Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{c5c6f980-ec1c-11de-986a-806e6f6e6963}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[13/12/2009 01:32|--a------|1024] C:\.rnd 
[13/12/2009 15:34|--a------|220] C:\aaw7boot.log 
[01/02/2010 14:43|--a------|319021] C:\AnalysisLog.sr0 
[18/09/2006 21:43|--a------|24] C:\autoexec.bat 
[11/04/2009 06:36|-rahs----|333257] C:\bootmgr 
[21/07/2007 01:27|-ra-s----|8192] C:\BOOTSECT.BAK 
[13/03/2010 06:49|--a------|116716] C:\ComboFix.txt 
[18/09/2006 21:43|--a------|10] C:\config.sys 
[10/07/2009 11:53|-rahs----|0] C:\IO.SYS 
[27/08/2008 18:14|--a------|2688] C:\LGSInst.Log 
[17/09/2009 13:45|--a------|78] C:\lxdi.log 
[10/07/2009 11:53|-rahs----|0] C:\MSDOS.SYS 
[29/02/2004 15:44|--a------|52576] C:\orange.bmp 
[?|?|?] C:\pagefile.sys 
[12/03/2010 17:16|--a------|4384] C:\rapport.txt 
[04/11/2008 14:02|--a------|11] C:\RPT23432 
[13/03/2010 07:47|--a------|2504] C:\UsbFix.txt 
[25/11/2009 23:20|--ah-----|305] D:\.iTunes Preferences.plist 
[?|?|?] D:\pagefile.sys 
[04/09/2009 06:11|-ra------|212480] G:\1031.mst 
[04/09/2009 06:11|-ra------|522752] G:\1034.mst 
[04/09/2009 06:11|-ra------|523264] G:\1036.mst 
[04/09/2009 06:11|-ra------|522240] G:\1040.mst 
[04/09/2009 06:11|-ra------|93696] G:\2070.mst 
[04/09/2009 06:10|-ra------|214408] G:\autorun.exe 
[04/09/2009 06:10|-ra------|47] G:\Autorun.inf 
[04/09/2009 06:11|-ra------|1696256] G:\Pro Evolution Soccer 2010.msi 
[04/09/2009 06:10|-ra------|1086] G:\readme.html 
[04/09/2009 06:10|-ra------|64] G:\region.inf 
[04/09/2009 06:10|-ra------|112008] G:\Setup.exe 
[29/03/2006 14:08|--ah-----|82] J:\._System Volume Information 
[02/07/2009 20:58|--ah-----|4096] J:\._.Trashes 
[13/03/2010 03:15|--a------|41] J:\pmp_usb.ini 

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido). 
# D:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido). 
# F:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido). 
# J:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido). 

################## | Upload | 

Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_SCHYZOPHRENIC.zip : https://www.ionos.fr/?affiliate_id=77097 
Merci pour votre contribution .  

################## | ! Fin du rapport # UsbFix V6.099 ! |

moment de grace · Answer

j'ai bien vu ta question...on voit ca à la fin

si j'oublie, reparles m'en

Marvolo · Answer

Rapport MBAM


Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3862
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18882

13/03/2010 11:43:26
mbam-log-2010-03-13 (11-43-26).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|J:\|)
Eléments examinés: 395020
Temps écoulé: 3 hour(s), 45 minute(s), 14 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\$RECYCLE.BIN\S-1-5-21-3242307328-3026939525-2831412068-1000\$RDUFHSE.Keymaker-CORE\keymaker.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.

moment de grace · Answer

ok

tu peux vider la quarantaine

fais ceci stp pour vérifier que tu es tranquille

/!\ Il faut impérativement désactiver tous tes logiciels de protection pour utiliser ce programme/!\ 

&#9654; Télécharge : Gmer (by Przemyslaw Gmerek) 

http://www.gmer.net/



&#9654; Dezippe gmer ,cliques sur l'onglet rootkit,lances le scan,des lignes rouges vont apparaitre. 

&#9654; Les lignes rouges indiquent la presence d'un rootkit.Postes moi le rapport gmer (cliques sur copy,puis vas dans demarrer ,puis ouvres le bloc note,vas dans edition et cliques sur coller,le rapport gmer va apparaitre,postes moi le)

moment de grace · Answer

ok

comment va le pc ?

je postes pour toi le rapport

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-16 11:57:57
Windows 6.0.6002 Service Pack 2
Running: 7rf1gwo0.exe; Driver: C:\Users\SCHIZO~1\AppData\Local\Temp\kwroiaog.sys


---- System - GMER 1.0.15 ----

INT 0x51 ? 87B48F00
INT 0x62 ? 87B48F00
INT 0x72 ? 86324BF8
INT 0x82 ? 85590BF8
INT 0x92 ? 85590BF8
INT 0xA2 ? 87B48F00
INT 0xA2 ? 87B48F00
INT 0xA2 ? 87B48F00
INT 0xB3 ? 87B48F00

---- Kernel code sections - GMER 1.0.15 ----

? System32\Drivers\spnc.sys Le chemin d'accès spécifié est introuvable. !
.text C:\Windows\system32\DRIVERS
vlddmkm.sys section is writeable [0x8FC03340, 0x3441C7, 0xE8000020]
.text USBPORT.SYS!DllUnload 903B541B 5 Bytes JMP 87B484E0
.text am81opkz.SYS 8B37A000 22 Bytes [82, A3, A1, 82, 6C, A2, A1, ...]
.text am81opkz.SYS 8B37A017 181 Bytes [00, 32, 07, DA, 8A, 3D, 05, ...]
.text am81opkz.SYS 8B37A0CE 10 Bytes [00, 00, 00, 00, 00, 00, 02, ...]
.text am81opkz.SYS 8B37A0DA 12 Bytes [00, 00, 02, 00, 00, 00, 24, ...]
.text am81opkz.SYS 8B37A0E7 714 Bytes [00, F0, 0E, 00, 00, 00, 00, ...]
.text ...
.text C:\Windows\system32\DRIVERS\atksgt.sys section is writeable [0xA14DF300, 0x3B6D8, 0xE8000020]
.text C:\Windows\system32\DRIVERS\lirsgt.sys section is writeable [0xA1522300, 0x1BEE, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Internet Explorer\iexplore.exe[2216] USER32.dll!CreateWindowExW 76141305 5 Bytes JMP 7108D9BC C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2216] USER32.dll!DialogBoxParamW 761610B0 5 Bytes JMP 70FB5689 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2216] USER32.dll!DialogBoxIndirectParamW 76162EF5 5 Bytes JMP 711843F7 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2216] USER32.dll!DialogBoxParamA 76178152 5 Bytes JMP 71184394 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2216] USER32.dll!DialogBoxIndirectParamA 7617847D 5 Bytes JMP 7118445A C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2216] USER32.dll!MessageBoxIndirectA 7618D4D9 5 Bytes JMP 71184329 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2216] USER32.dll!MessageBoxIndirectW 7618D5D3 5 Bytes JMP 711842BE C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2216] USER32.dll!MessageBoxExA 7618D639 5 Bytes JMP 7118425C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2216] USER32.dll!MessageBoxExW 7618D65D 5 Bytes JMP 711841FA C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] USER32.dll!SetWindowsHookExW 761387AD 5 Bytes JMP 71089B29 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] USER32.dll!CallNextHookEx 76138E3B 5 Bytes JMP 7107D171 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] USER32.dll!UnhookWindowsHookEx 761398DB 5 Bytes JMP 70FF486E C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] USER32.dll!CreateWindowExW 76141305 5 Bytes JMP 7108D9BC C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] USER32.dll!DialogBoxParamW 761610B0 5 Bytes JMP 70FB5689 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] USER32.dll!DialogBoxIndirectParamW 76162EF5 5 Bytes JMP 711843F7 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] USER32.dll!DialogBoxParamA 76178152 5 Bytes JMP 71184394 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] USER32.dll!DialogBoxIndirectParamA 7617847D 5 Bytes JMP 7118445A C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] USER32.dll!MessageBoxIndirectA 7618D4D9 5 Bytes JMP 71184329 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] USER32.dll!MessageBoxIndirectW 7618D5D3 5 Bytes JMP 711842BE C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] USER32.dll!MessageBoxExA 7618D639 5 Bytes JMP 7118425C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] USER32.dll!MessageBoxExW 7618D65D 5 Bytes JMP 711841FA C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] ole32.dll!OleLoadFromStream 76981E12 5 Bytes JMP 71184778 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4280] ole32.dll!CoCreateInstance 769B9EA6 5 Bytes JMP 7108DA18 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] kernel32.dll!FindResourceExA 76C72575 7 Bytes JMP 28001D80 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] kernel32.dll!FindResourceA 76C72653 5 Bytes JMP 28001CF0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] kernel32.dll!CreateEventA 76C944C0 5 Bytes JMP 28001840 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] kernel32.dll!LockResource 76C968DF 5 Bytes JMP 28001F50 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] kernel32.dll!FindResourceExW 76C969FD 7 Bytes JMP 28001C60 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] kernel32.dll!LoadResource 76C96ADB 7 Bytes JMP 28001E20 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] kernel32.dll!FindResourceW 76C97FA1 5 Bytes JMP 28001BE0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] kernel32.dll!SizeofResource 76C97FBF 7 Bytes JMP 28001EE0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] ADVAPI32.dll!CryptDeriveKey 77B6FCAE 7 Bytes JMP 28001000 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] ADVAPI32.dll!CryptDecrypt 77B6FE91 7 Bytes JMP 28001060 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] USER32.dll!CreateDialogParamW 761372A2 5 Bytes JMP 28006090 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] USER32.dll!SetWindowPlacement 76137963 5 Bytes JMP 28005E10 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] USER32.dll!SetWindowRgn 7613A221 7 Bytes JMP 28005F50 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] USER32.dll!LoadImageW 7613C9E5 5 Bytes JMP 280066E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] USER32.dll!LoadIconW 7613DA9F 5 Bytes JMP 280068D0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] USER32.dll!CreateWindowExW 76141305 5 Bytes JMP 28003C60 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] USER32.dll!GetWindowLongW 7614F8BF 7 Bytes JMP 28006A70 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] USER32.dll!PeekMessageW 7615045A 5 Bytes JMP 28004630 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] USER32.dll!TrackPopupMenuEx 76160CE7 5 Bytes JMP 28004F10 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] USER32.dll!MessageBoxIndirectW 7618D5D3 5 Bytes JMP 28006280 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] SHELL32.dll!Shell_NotifyIconW 76F18626 5 Bytes JMP 280033B0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] ole32.dll!CoRegisterClassObject 76977DB6 5 Bytes JMP 28002360 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] ole32.dll!CoCreateInstance 769B9EA6 5 Bytes JMP 28002600 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] ole32.dll!CoInitializeEx 769BAD63 5 Bytes JMP 28002260 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] WININET.dll!InternetReadFile 7685654B 5 Bytes JMP 2800A090 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] WININET.dll!InternetCloseHandle 76859088 5 Bytes JMP 2800A240 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[5012] WININET.dll!HttpOpenRequestA

Marvolo · Answer

Ouais,depuis combofix,plus de soucis et pas de lignes rouges dans le rapport

moment de grace · Answer

bien

relances RSIT et postes le rapport log stp

Marvolo · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Schizoprenic at 2010-03-17 03:45:02
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 28 GB (17%) free of 163 GB
Total RAM: 3070 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:45:10, on 17/03/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32undll32.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\System32undll32.exe
C:\Program Files\Lexmark 2600 Series\lxdnMsdMon.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Megaupload\Mega Manager\MegaManager.exe
c:\program files\steam\steamapps\common\football manager 2010\fm.exe
C:\Program Files\Steam\GameOverlayUI.exe
C:\Program Files\Winamp\winamp.exe
C:\Users\Schizoprenic\Desktop\RSIT.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\Schizoprenic.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IEpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\PROGRA~1\GOOGLE~1\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [lxdnmon.exe] "C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"
O4 - HKLM\..\Run: [lxdnamon] "C:\Program Files\Lexmark 2600 Series\lxdnamon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ºÜ¿ìÊÓÆµËÑË÷ - {998A88A0-A355-809B-831C-B83A80000991} - http://www.henkuai.com/?from=iebannel (file missing)
O9 - Extra 'Tools' menuitem: ºÜ¿ìÊÓÆµËÑË÷ - {998A88A0-A355-809B-831C-B83A80000991} - http://www.henkuai.com/?from=iebannel (file missing)
O9 - Extra button: Æô¶¯UUSee ÍøÂçµçÊÓ - {998A88A0-A355-809B-831C-B83A80000992} - C:\Program Files\uusee\UUSeePlayer.exe
O9 - Extra 'Tools' menuitem: Æô¶¯UUSee ÍøÂçµçÊÓ - {998A88A0-A355-809B-831C-B83A80000992} - C:\Program Files\uusee\UUSeePlayer.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O15 - Trusted Zone: http://*.www.m6.fr
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
O16 - DPF: {61FA0CB0-0806-46EA-B784-0F843285BA23} (TuentiFotoUploader Control) - http://estaticosak1.tuenti.com/client_apps/TuentiPhotoUploader.24936.cab
O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldfr-fr.cab
O17 - HKLM\System\CS1\Services\Tcpip\..\{1DCF4499-04F7-4B72-A782-DB77FA010C94}: NameServer = 85.255.112.189;85.255.112.113
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Service Google Update (gupdate1ca2cd22c28197e) (gupdate1ca2cd22c28197e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: lxdnCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\lxdnserv.exe
O23 - Service: lxdn_device -   - C:\Windows\system32\lxdncoms.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\stacsv.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

moment de grace · Answer

ok

encore plusieurs choses...

1)

Télécharge WareOut Removal Tool (par dj QUIOU & la team sécurité MH) ici :

 http://pc-system.fr/

Lance le fichier WareOut_Removal_Tool.bat et choisis l'option n°1
Patiente (une à deux minutes maximum) pendant que le programme sauvegarde le registre
Lis bien attentivement les instructions qui te seront données
A la fin de l'analyse, un rapport va s'ouvrir, poste le dans ta prochaine réponse.

...................

2)

Rends toi sur ce site : 

https://www.virustotal.com/gui/ 

Clique sur parcourir et cherche ce fichier : 

C:\Windows\system32\aiXDKcoJh.dll
C:\Windows\system32\aadmvrqas.exe


Clique sur Send File. 

Un rapport va s'élaborer ligne à ligne. 

Attends la fin. Il doit comprendre la taille du fichier envoyé. 

Sauvegarde le rapport avec le bloc-note. 

Copie le dans ta réponse.

Si tu ne trouves pas le fichier alors

Affiche tous les fichiers et dossiers : 

Pour cela : 
Clique sur démarrer/panneau de configuration/option des dossiers/affichage 

Cocher afficher les dossiers cachés

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" 

Décocher masquer les extensions dont le type est connu 

Puis fais «appliquer» pour valider les changements. 

Et OK

Marvolo · Answer

===== Rapport WareOut Removal Tool ===== 
 
version 3.6.2 
 
analyse effectuée le 18/03/2010 à  2:21:48,70 
 
Résultats de l'analyse : 
======================== 
 
~~~~ Recherche d'infections dans C:\ ~~~~ 
 
C:\autorun.inf trouvé! 
C:\autorun.inf suppression impossible 
 
 
~~~~ Recherche d'infections dans C:\Program Files\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Windows\system\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Windows\system32\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Windows\system32\drivers\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Users\Schizoprenic\AppData\Roaming\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Users\Schizoprenic\Bureau\ ~~~~ 
 
 
~~~~ Recherche de détournement de DNS ~~~~ 
 
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{1DCF4499-04F7-4B72-A782-DB77FA010C94}]
    NameServer    REG_SZ    85.255.112.189;85.255.112.113
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{722C9BED-6214-4B55-8533-104D7BFC01B1}]
    NameServer    REG_SZ    85.255.112.189;85.255.112.113
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{C4FF0844-4CEF-4130-BC06-070FEE20DF66}]
    NameServer    REG_SZ    85.255.112.189;85.255.112.113
 
 
~~~~ Recherche de Rootkits ~~~~ 
 
_______________________________________________________________________ 
 
catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-18 02:21:54
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden files ...

scan completed successfully
hidden files: 0

_______________________________________________________________________ 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    System    REG_SZ    

 
 
~~~~ Recherche d'infections dans C:\Users\SCHIZO~1\AppData\Local\Temp\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Users\Schizoprenic\Start Menu\Programs\ ~~~~ 
 
 
~~~~ Nettoyage du registre ~~~~ 
 
 
~~~~ Tentative de réparation des entrées suivantes: ~~~~ 
 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] = "System" 
 
[HKLM\SYSTEM\CurrentControlSet\Services\Windows Tribute Service] 
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_Windows Tribute Service] 
 
~~~~ Vérification: ~~~~ 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    System    REG_SZ    

 
 
_________________________________ 
 
développé par http://pc-system.fr 
_________________________________

Marvolo · Answer

RAPPORT aadmvrqas.exe Fichier aadmvrqas.exe reçu le 2010.03.18 02:28:38 (UTC) Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.50 2010.03.18 Trojan.Win32.SuspectCRC!IK AhnLab-V3 5.0.0.2 2010.03.17 - AntiVir 8.2.1.194 2010.03.17 TR/FakeMagic.A.5 Antiy-AVL 2.0.3.7 2010.03.17 - Authentium 5.2.0.5 2010.03.18 - Avast 4.8.1351.0 2010.03.17 - Avast5 5.0.332.0 2010.03.17 - AVG 9.0.0.787 2010.03.17 SHeur3.CTH BitDefender 7.2 2010.03.18 - CAT-QuickHeal 10.00 2010.03.17 - ClamAV 0.96.0.0-git 2010.03.18 - Comodo 4301 2010.03.18 - DrWeb 5.0.1.12222 2010.03.18 Trojan.Fakealert.13764 eSafe 7.0.17.0 2010.03.17 - eTrust-Vet 35.2.7371 2010.03.17 - F-Prot 4.5.1.85 2010.03.17 - F-Secure 9.0.15370.0 2010.03.18 - Fortinet 4.0.14.0 2010.03.15 - GData 19 2010.03.18 - Ikarus T3.1.1.80.0 2010.03.18 Trojan.Win32.SuspectCRC Jiangmin 13.0.900 2010.03.17 - K7AntiVirus 7.10.1000 2010.03.17 - Kaspersky 7.0.0.125 2010.03.17 - McAfee 5923 2010.03.17 - McAfee+Artemis 5923 2010.03.17 - McAfee-GW-Edition 6.8.5 2010.03.17 Trojan.FakeMagic.A.5 Microsoft 1.5605 2010.03.17 Trojan:Win32/FakeMagic NOD32 4953 2010.03.17 a variant of Win32/Kryptik.CYZ Norman 6.04.08 2010.03.17 - nProtect 2009.1.8.0 2010.03.17 - Panda 10.0.2.2 2010.03.17 - PCTools 7.0.3.5 2010.03.18 - Prevx 3.0 2010.03.18 - Rising 22.39.03.01 2010.03.18 - Sophos 4.51.0 2010.03.18 - Sunbelt 5945 2010.03.18 Trojan.Win32.Generic!SB.0 Symantec 20091.2.0.41 2010.03.18 Suspicious.Insight TheHacker 6.5.2.0.236 2010.03.17 Trojan/Kryptik.cyz TrendMicro 9.120.0.1004 2010.03.18 - VBA32 3.12.12.2 2010.03.17 - ViRobot 2010.3.17.2232 2010.03.17 - VirusBuster 5.0.27.0 2010.03.17 - Information additionnelle File size: 1471488 bytes MD5...: 2de28b05c1d8196f0aeca63de43a8667 SHA1..: 79609d65d3ce66d5cef2656f7856c7deee55fe09 SHA256: dc4ce80bfc64196b508f6a813fac8cec8052bcb12eee4a4af4c08016f1f3ec9e ssdeep: 24576:Lx8bEsE+HMbLAPZ1wQftekVSHKksU2w9c/K7uxvkF9TIlien0qr:LmVLc0
h1BFzAKXw9+xS9TIH7r
PEiD..: - PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1000
timedatestamp.....: 0x42316426 (Fri Mar 11 09:25:58 2005)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x155000 0x154600 8.00 48c3a670e88726301645809204ab1c5d
.rdata 0x156000 0xc000 0xbc00 7.61 adb6b04c1859327dfd38853f33c181f3
.data 0x162000 0xea000 0x2600 7.93 61266ef390ca5ba1c0b47493745682b7
.idata 0x24c000 0x1000 0xa00 4.63 824e95152f6c5aa347e58aa700766f8f
.rsrc 0x24d000 0x4000 0x3e00 4.38 e020776af0ebb38bf05387d846c21eec

( 6 imports )
> KERNEL32.dll: CloseHandle, CreateDirectoryA, EnumResourceNamesA, ExitProcess, GetCommandLineA, GetFileSize, GetModuleHandleA, GetStartupInfoA, HeapAlloc, LoadResource, MultiByteToWideChar, QueryPerformanceCounter, RemoveDirectoryA, RtlUnwind, SetLastError, SetUnhandledExceptionFilter, SleepEx, VirtualAlloc
> user32.dll: EndPaint, EmptyClipboard, GetDlgItem, CharUpperBuffA, CharToOemBuffA, GetWindowTextA, MessageBoxA, SetFocus, SetMenuInfo, ShowCaret, DrawMenuBar
> advapi32.dll: RegOpenKeyExA, RegLoadKeyA, RegEnumKeyA, RegCloseKey, RegQueryValueA
> ole32.dll: OleInitialize, OleGetClipboard, OleUninitialize, CreateILockBytesOnHGlobal, CoUninitialize, CoRegisterClassObject, RegisterDragDrop, ReleaseStgMedium, StringFromGUID2, WriteClassStg, DoDragDrop, CLSIDFromString, CoCreateInstance, CoGetClassObject, CoInitialize
> wininet.dll: InternetGetCookieA, InternetGetLastResponseInfoA, InternetQueryDataAvailable, InternetSetFilePointer, InternetSetOptionExA, InternetSetStatusCallbackA, InternetCrackUrlA, InternetConnectA, HttpSendRequestA, HttpQueryInfoA, HttpOpenRequestA, HttpAddRequestHeadersA, InternetCloseHandle
> shell32.dll: SHGetFileInfoA, SHGetMalloc, SHGetPathFromIDListA, ShellExecuteA, ShellExecuteExW, SHGetDesktopFolder

( 0 exports )
RDS...: NSRL Reference Data Set
- pdfid.: - trid..: Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) sigcheck:
publisher....: Westwood Studios
copyright....: Copyright (c) 2000 Westwood Studios
product......: Command _ Conquer : Tiberian Sun
description..: Main executable for Tiberian Sun
original name: Sun.exe
internal name: Sun
file version.: 2.03
comments.....:
signers......: -
signing date.: -
verified.....: Unsigned

Marvolo · Answer

Rapport aiXDKcoJh.dll Fichier aiXDKcoJh.dll reçu le 2010.03.18 02:33:52 (UTC) Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.50 2010.03.18 Trojan.Win32.SuspectCRC!IK AhnLab-V3 5.0.0.2 2010.03.18 - AntiVir 8.2.1.194 2010.03.17 TR/FakeMagic.A.5 Antiy-AVL 2.0.3.7 2010.03.17 - Authentium 5.2.0.5 2010.03.18 - Avast 4.8.1351.0 2010.03.17 Win32:Trojan-gen Avast5 5.0.332.0 2010.03.17 Win32:Trojan-gen AVG 9.0.0.787 2010.03.17 SHeur3.CTH BitDefender 7.2 2010.03.18 - CAT-QuickHeal 10.00 2010.03.17 - ClamAV 0.96.0.0-git 2010.03.18 - Comodo 4301 2010.03.18 - DrWeb 5.0.1.12222 2010.03.18 Trojan.Fakealert.13764 eSafe 7.0.17.0 2010.03.17 - eTrust-Vet 35.2.7371 2010.03.17 - F-Prot 4.5.1.85 2010.03.17 - F-Secure 9.0.15370.0 2010.03.18 - Fortinet 4.0.14.0 2010.03.15 - GData 19 2010.03.18 Win32:Trojan-gen Ikarus T3.1.1.80.0 2010.03.18 Trojan.Win32.SuspectCRC Jiangmin 13.0.900 2010.03.17 - K7AntiVirus 7.10.1000 2010.03.17 - Kaspersky 7.0.0.125 2010.03.17 - McAfee 5923 2010.03.17 - McAfee+Artemis 5923 2010.03.17 - McAfee-GW-Edition 6.8.5 2010.03.17 Trojan.FakeMagic.A.5 Microsoft 1.5605 2010.03.17 Trojan:Win32/FakeMagic NOD32 4953 2010.03.17 a variant of Win32/Kryptik.CYZ Norman 6.04.08 2010.03.17 - nProtect 2009.1.8.0 2010.03.17 - Panda 10.0.2.2 2010.03.17 - PCTools 7.0.3.5 2010.03.18 - Prevx 3.0 2010.03.18 - Rising 22.39.03.01 2010.03.18 - Sophos 4.51.0 2010.03.18 - Sunbelt 5945 2010.03.18 Trojan.Win32.Generic!SB.0 Symantec 20091.2.0.41 2010.03.18 Suspicious.Insight TheHacker 6.5.2.0.236 2010.03.17 Trojan/Kryptik.cyz TrendMicro 9.120.0.1004 2010.03.18 - VBA32 3.12.12.2 2010.03.17 - ViRobot 2010.3.17.2232 2010.03.17 - VirusBuster 5.0.27.0 2010.03.17 - Information additionnelle File size: 1471488 bytes MD5...: 2551f1e47e06584eec0b28e3598dc02f SHA1..: 9fbf72c45ee941a0f3ca6325553193d41790aa43 SHA256: 2a04255b600b394bfbc82afd01935344244348e5be414b5570a6a981d2d2aacf ssdeep: 24576:rx8bEsE+HMbLAPZ1wQftekVSHKksU2w9c/K7uxvkF9TIlien0qr:rmVLc0
h1BFzAKXw9+xS9TIH7r
PEiD..: - PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1000
timedatestamp.....: 0x42316426 (Fri Mar 11 09:25:58 2005)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x155000 0x154600 8.00 48c3a670e88726301645809204ab1c5d
.rdata 0x156000 0xc000 0xbc00 7.61 adb6b04c1859327dfd38853f33c181f3
.data 0x162000 0xea000 0x2600 7.93 61266ef390ca5ba1c0b47493745682b7
.idata 0x24c000 0x1000 0xa00 4.63 824e95152f6c5aa347e58aa700766f8f
.rsrc 0x24d000 0x4000 0x3e00 4.38 e020776af0ebb38bf05387d846c21eec

( 6 imports )
> KERNEL32.dll: CloseHandle, CreateDirectoryA, EnumResourceNamesA, ExitProcess, GetCommandLineA, GetFileSize, GetModuleHandleA, GetStartupInfoA, HeapAlloc, LoadResource, MultiByteToWideChar, QueryPerformanceCounter, RemoveDirectoryA, RtlUnwind, SetLastError, SetUnhandledExceptionFilter, SleepEx, VirtualAlloc
> user32.dll: EndPaint, EmptyClipboard, GetDlgItem, CharUpperBuffA, CharToOemBuffA, GetWindowTextA, MessageBoxA, SetFocus, SetMenuInfo, ShowCaret, DrawMenuBar
> advapi32.dll: RegOpenKeyExA, RegLoadKeyA, RegEnumKeyA, RegCloseKey, RegQueryValueA
> ole32.dll: OleInitialize, OleGetClipboard, OleUninitialize, CreateILockBytesOnHGlobal, CoUninitialize, CoRegisterClassObject, RegisterDragDrop, ReleaseStgMedium, StringFromGUID2, WriteClassStg, DoDragDrop, CLSIDFromString, CoCreateInstance, CoGetClassObject, CoInitialize
> wininet.dll: InternetGetCookieA, InternetGetLastResponseInfoA, InternetQueryDataAvailable, InternetSetFilePointer, InternetSetOptionExA, InternetSetStatusCallbackA, InternetCrackUrlA, InternetConnectA, HttpSendRequestA, HttpQueryInfoA, HttpOpenRequestA, HttpAddRequestHeadersA, InternetCloseHandle
> shell32.dll: SHGetFileInfoA, SHGetMalloc, SHGetPathFromIDListA, ShellExecuteA, ShellExecuteExW, SHGetDesktopFolder

( 0 exports )
RDS...: NSRL Reference Data Set
- pdfid.: -sigcheck:
publisher....: Westwood Studios
copyright....: Copyright (c) 2000 Westwood Studios
product......: Command _ Conquer : Tiberian Sun
description..: Main executable for Tiberian Sun
original name: Sun.exe
internal name: Sun
file version.: 2.03
comments.....:
signers......: -
signing date.: -
verified.....: Unsigned
trid..: Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)

moment de grace · Answer

ok

je demande une validation de script de suppression de ces deux fichiers infectés et je te poste ca

Marvolo · Answer

Alors?
Des news?

Sinon,quel antivirus prendre?

moment de grace · Answer

oups...avec la nouvelle version CCM, je t'ai un peu zappé 
désolé 

donc 


/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour Marvolo, il n'est pas transposable sur un autre ordinateur !  

crées un sur ton bureau un nouveau fichier bloc note que tu nommeras CFScrip.txt
Copies y ce texte dedans et enregistres le 

    KillAll:: 

File::
C:\Windows\system32\aiXDKcoJh.dll
C:\Windows\system32\aadmvrqas.exe   


* Désactive tes logiciels de protection  
* Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe (comme le lien suivant)  
http://apu.mabul.org/up/apu/2008/09/06/img-2258535my8h.gif  

* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.  
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.  
* Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt 



Je cherche beaucoup...et maintenant je trouve !  
(sourire)

moment de grace · Answer

ok

la suppression s'est bien passée

le pc va t il toujour bien ?

relances RSIT et postes le rapport log stp que l'on finalise ton affaire

Virus protector

26 réponses

Discussions similaires

Newsletters