Infection msn

Ok... Chui con !

J'ai pas vu l'éléphant dans le magasin de porcelaine...

1. Processus
- Ouvre le gestionnaire de tâches.
- Sous l'onglet processus, cliques sur MDN.EXE et termine le.

2. Regedit
- Ouvre l'éditeur de registre: démarrer / exécuter / Regedit
- Dans le panneau de gauche, rends toi là: HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Run
- Dans la colonne de droite qui s'affiche, supprime ceci: MDN = "MDN.exe"
- Ensuite, dans le panneau de gauche, rends toi là: HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
- Dans la colonne de droite qui s'affiche, supprime ceci: MDN = "MDN.exe"
- Ferme l'éditeur de registre.

3. Fichiers cachés
- Ouvre le poste de travail / Outil / Option des dossiers / Affichage / Cliques sur afficher les fichiers et dossiers cachés
- Cherches C:\WINDOWS\system32\mdn.exe et supprime le.

4. Scans
- Refais un scan avec Antivir
- Poste le rapport
- Refais un scan HiJackThis et poste le rapport.

Bon courage !

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:21:33, on 28/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Java\jre1.5.0_05\bin\jucheck.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAME.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\usnsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PCDrProfiler] "C:\Program Files\PC-Doctor 5 for Windows\RunProfiler.exe" -r
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ps2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [EPSON Stylus Photo RX640 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAME.EXE /P31 "EPSON Stylus Photo RX640 Series" /O6 "USB001" /M "Stylus Photo RX640"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [usnsvc.exe] C:\WINDOWS\usnsvc.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: Crystal.lnk = ?
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{B23B7734-9E2D-4754-96B7-AAA13FE29C5A}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe

Tu possèdes Avast!, tu n'es donc pas, pour moi et beaucoup d'autres helpers, protégé au mieux. Je te recommande d'en changer pour Avira Antivir, qui est beaucoup plus performant et réactif. Le petit défaut est qu'il est en anglais, c'est pourquoi voici deux liens qui t'aideront à en changer sans problème:
- Tutoriel: http://forum.malekal.com/ftopic4192.php
- Comparatif de Malekal: http://forum.malekal.com/ftopic3528.php
Désinstalle Avast! avant d'installer Avira Antivir !

Fais un scan avec antivir A JOUR et poste le rapport...

Euh va me falloir un pti moment pour analyser ca...
;o)

A biento

suite au rapport ai je tjs le ver?

voici le rapport en esperan taider...DiagHelp version v1.2 - http://www.malekal.com
excute le 28/09/2007 à 16:47:04,57

Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\WINDOWS\prefetch\CHCP.COM-18156052.pf -->28/09/2007 16:46:59
C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->28/09/2007 16:46:55
C:\WINDOWS\prefetch\WINRAR.EXE-39C6DAD9.pf -->28/09/2007 16:45:26
C:\WINDOWS\prefetch\VERCLSID.EXE-3667BD89.pf -->28/09/2007 16:45:25
C:\WINDOWS\prefetch\WLLOGINPROXY.EXE-2D4B6027.pf -->28/09/2007 16:45:08
C:\WINDOWS\prefetch\IEXPLORE.EXE-27122324.pf -->28/09/2007 16:44:58
C:\WINDOWS\prefetch\SETUP.OVR-154CE291.pf -->28/09/2007 16:30:13
C:\WINDOWS\prefetch\WUAUCLT.EXE-399A8E72.pf -->28/09/2007 16:30:11
C:\WINDOWS\prefetch\WMIPRVSE.EXE-28F301A9.pf -->28/09/2007 16:30:11
C:\WINDOWS\prefetch\WGATRAY.EXE-0ED38BED.pf -->28/09/2007 16:30:11

C:\WINDOWS\System32\drivers\aswmon.sys -->06/09/2007 12:05:25
C:\WINDOWS\System32\drivers\aswmon2.sys -->06/09/2007 12:05:10
C:\WINDOWS\System32\drivers\aswRdr.sys -->06/09/2007 12:03:02
C:\WINDOWS\System32\drivers\aswTdi.sys -->06/09/2007 12:02:20
C:\WINDOWS\System32\drivers\aavmker4.sys -->06/09/2007 12:00:53
C:\WINDOWS\System32\drivers\sptd.sys -->16/07/2007 21:21:37
C:\WINDOWS\System32\drivers\fetnd5bv.sys -->05/07/2007 06:33:54

C:\WINDOWS\System32\wpa.dbl -->28/09/2007 16:29:39
C:\WINDOWS\System32\nvapps.xml -->28/09/2007 16:29:11
C:\WINDOWS\System32\tmp.txt -->28/09/2007 16:25:55
C:\WINDOWS\System32\tmp.reg -->28/09/2007 16:25:55
C:\WINDOWS\System32\WS2Fix.exe -->28/09/2007 14:26:50
C:\WINDOWS\System32\FNTCACHE.DAT -->26/09/2007 09:14:29
C:\WINDOWS\System32\mdn.exe -->24/09/2007 19:17:40
C:\WINDOWS\System32\BASSMOD.dll -->17/09/2007 18:46:58
C:\WINDOWS\System32\CONFIG.NT -->09/09/2007 11:04:02
C:\WINDOWS\System32\aswBoot.exe -->06/09/2007 12:09:49
C:\WINDOWS\System32\AVASTSS.scr -->06/09/2007 12:00:07
C:\WINDOWS\System32\MRT.exe -->06/09/2007 04:50:42
C:\WINDOWS\System32\VCCLSID.exe -->06/09/2007 00:22:23
C:\WINDOWS\System32\TZLog.log -->29/08/2007 23:20:39
C:\WINDOWS\System32\lhacm.acm -->29/08/2007 16:03:09
C:\WINDOWS\System32\sirenacm.dll -->16/08/2007 16:17:18
C:\WINDOWS\System32\jupdate-1.6.0_02-b06.log -->01/08/2007 13:03:54
C:\WINDOWS\System32\wuaucpl.cpl.mui -->30/07/2007 19:20:06
C:\WINDOWS\System32\wuapi.dll.mui -->30/07/2007 19:19:52
C:\WINDOWS\System32\wuaueng.dll -->30/07/2007 19:19:42
C:\WINDOWS\System32\wuapi.dll -->30/07/2007 19:19:36
C:\WINDOWS\System32\wucltui.dll -->30/07/2007 19:19:32
C:\WINDOWS\System32\wuweb.dll -->30/07/2007 19:19:28
C:\WINDOWS\System32\wuaucpl.cpl -->30/07/2007 19:19:28
C:\WINDOWS\System32\cdm.dll -->30/07/2007 19:19:20

C:\WINDOWS\ModemLog_Bluetooth Fax Modem.txt -->28/09/2007 16:29:42
C:\WINDOWS\ModemLog_Bluetooth DUN Modem.txt -->28/09/2007 16:29:42
C:\WINDOWS\ModemLog_Bluetooth DUN Modem #2.txt -->28/09/2007 16:29:42
C:\WINDOWS\0.log -->28/09/2007 16:29:22
C:\WINDOWS\wiadebug.log -->28/09/2007 16:29:19
C:\WINDOWS\WindowsUpdate.log -->28/09/2007 16:29:14
C:\WINDOWS\wiaservc.log -->28/09/2007 16:29:14
C:\WINDOWS\bootstat.dat -->28/09/2007 16:29:03
C:\WINDOWS\SchedLgU.Txt -->28/09/2007 16:28:13
C:\WINDOWS\setupact.log -->28/09/2007 16:25:59
C:\WINDOWS\setuperr.log -->28/09/2007 16:08:48
C:\WINDOWS\ntbtlog.txt -->28/09/2007 16:07:38
C:\WINDOWS\msnfix.txt -->28/09/2007 15:14:17
C:\WINDOWS\Sti_Trace.log -->28/09/2007 05:16:35
C:\WINDOWS\mngui.INI -->08/09/2007 16:26:34

MD5 des fichiers sensibles
tcpip.sys b2220c618b42a2212a59d91ebd6fc4b4
ndis.sys 558635d3af1c7546d26067d5d9b6959e
null.sys 73c1e1f395918bc2c6dd67af7591a3ad
svchost.exe 1bd6c2f707a275cb7c16fd99fe0f31ca

Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 98C3-1840

Répertoire de C:\WINDOWS\system32

10/08/2004 21:00 6 144 csrss.exe
1 fichier(s) 6 144 octets
0 Rép(s) 300 732 317 696 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 98C3-1840

Répertoire de C:\WINDOWS\Downloaded Program Files

26/09/2007 18:39 <REP> .
26/09/2007 18:39 <REP> ..
02/03/2007 14:49 1 443 408 banksht2.dll
09/04/2007 22:47 65 desktop.ini
25/07/2002 18:13 24 576 dwusplay.dll
25/07/2002 18:13 196 608 dwusplay.exe
13/04/2004 06:04 307 200 isusweb.dll
22/02/2007 23:41 304 544 MessengerStatsPAClient.dll
28/02/2007 14:21 130 472 MineSweeper.dll
20/06/2006 15:44 379 704 MsnPUpld.dll
19/06/2006 14:40 393 MsnPUpld.inf
30/07/2007 19:24 295 muweb.inf
20/06/2006 15:44 117 560 PURen-us.dll
28/02/2007 14:21 142 248 SolitaireShowdown.dll
11/06/2007 12:21 5 021 swflash.inf
19/02/2007 11:26 159 128 ZIntro.ocx
14 fichier(s) 3 211 222 octets

Total des fichiers listés :
14 fichier(s) 3 211 222 octets
2 Rép(s) 300 732 313 600 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..

Liste des fichiers en exception sur le pare-feu XP SP2

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"C:\\Program Files\\Bid For Power\\quake3.exe"="C:\\Program Files\\Bid For Power\\quake3.exe:*:Enabled:quake3"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\MotoRacer3\\MotoRacer3.exe"="C:\\Program Files\\MotoRacer3\\MotoRacer3.exe:*:Enabled:Moto Racer 3 PC"
"C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\\Program Files\\KONAMI\\Winning Eleven 2007\\we2007.exe"="C:\\Program Files\\KONAMI\\Winning Eleven 2007\\we2007.exe:*:Enabled:pes6.exe"
"C:\\Program Files\\Eidos Interactive\\Hothouse Creations\\Gangsters 2\\Gangsters2SpawnedVersion.exe"="C:\\Program Files\\Eidos Interactive\\Hothouse Creations\\Gangsters 2\\Gangsters2SpawnedVersion.exe:*:Enabled:Gangsters 2"
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\\Program Files\\KONAMI\\Pro Evolution Soccer 6\\PES6.exe"="C:\\Program Files\\KONAMI\\Pro Evolution Soccer 6\\PES6.exe:*:Enabled:pes6.exe"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\EA SPORTS\\FIFA 07\\fifa07.exe"="C:\\Program Files\\EA SPORTS\\FIFA 07\\fifa07.exe:*:Enabled:fifa07"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\mcoinstall.exe"="C:\\mcoinstall.exe:*:Enabled:mcoinstall"
"C:\\Program Files\\IncrediMail\\bin\\ImApp.exe"="C:\\Program Files\\IncrediMail\\bin\\ImApp.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"="C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\Bomberman Online International\\BomberMan.exe"="C:\\Program Files\\Bomberman Online International\\BomberMan.exe:*:Disabled:BomberMan"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\guezmer666\\condition zero\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\guezmer666\\condition zero\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\guezmer666\\counter-strike\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\guezmer666\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\guezmer666\\condition zero deleted scenes\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\guezmer666\\condition zero deleted scenes\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe:*:Enabled:Kaspersky AV Scanner"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1160 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-28 16:47:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:6c,95,70,58,02,49,d1,8e,5e,ff,ed,c7,fe,65,be,62,14,15,b0,3a,d5,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:cd,76,c6,22,1c,6c,d1,43,a6,9f,ca,87,25,27,9d,6a,52,94,22,35,7b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,05,0f,60,33,b2,4b,0f,b8,0d,b4,27,2f,03,1e,76,37,fb,..
"khjeh"=hex:c1,2c,95,c7,d2,00,be,d0,20,77,71,c5,ff,fd,c6,28,39,e9,9f,89,14,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:93,4d,9c,db,4b,39,ee,a8,a7,f7,ef,e9,aa,61,29,d7,fd,07,75,2e,13,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:6c,95,70,58,02,49,d1,8e,5e,ff,ed,c7,fe,65,be,62,14,15,b0,3a,d5,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:cd,76,c6,22,1c,6c,d1,43,a6,9f,ca,87,25,27,9d,6a,52,94,22,35,7b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,05,0f,60,33,b2,4b,0f,b8,0d,b4,27,2f,03,1e,76,37,fb,..
"khjeh"=hex:c1,2c,95,c7,d2,00,be,d0,20,77,71,c5,ff,fd,c6,28,39,e9,9f,89,14,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:93,4d,9c,db,4b,39,ee,a8,a7,f7,ef,e9,aa,61,29,d7,fd,07,75,2e,13,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
260 - ehSched.exe
280 - GoogleUpdaterSe
320 - ehtray.exe
560 - RTHDCPL.EXE
664 - svchost.exe
708 - ashDisp.exe
788 - csrss.exe
812 - winlogon.exe
860 - services.exe
872 - lsass.exe
920 - StarWindService
1032 - svchost.exe
1088 - svchost.exe
1128 - svchost.exe
1304 - msnmsgr.exe
1428 - ashServ.exe
1512 - avgas.exe
1556 - ctfmon.exe
1608 - explorer.exe
2020 - guard.exe
2072 - mcrdsvc.exe
2096 - dslmon.exe
2156 - GoogleUpdater.e
2624 - iexplore.exe
2784 - ashMaiSv.exe
2816 - ashWebSv.exe
2936 - dllhost.exe
3932 - cmd.exe

Total number of processes = 29
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\ntkrnlpa.exe
806E2000 - \WINDOWS\system32\hal.dll
F7B10000 - \WINDOWS\system32\KDCOM.DLL
F7A20000 - \WINDOWS\system32\BOOTVID.dll
F7425000 - sptd.sys
F7B12000 - \WINDOWS\System32\Drivers\WMILIB.SYS
F740D000 - \WINDOWS\System32\Drivers\SCSIPORT.SYS
F73DE000 - ACPI.sys
F7610000 - isapnp.sys
F7620000 - ohci1394.sys
F7630000 - \WINDOWS\system32\DRIVERS\1394BUS.SYS
F73CD000 - pci.sys
F73BA000 - sfsync04.sys
F7BD8000 - pciide.sys
F7890000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
F7B14000 - viaide.sys
F7640000 - MountMgr.sys
F739B000 - ftdisk.sys
F7B16000 - dmload.sys
F7375000 - dmio.sys
F7898000 - PartMgr.sys
F7650000 - VolSnap.sys
F735D000 - atapi.sys
F7660000 - disk.sys
F7670000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
F733D000 - fltMgr.sys
F732B000 - sr.sys
F78A0000 - PxHelp20.sys
F7314000 - KSecDD.sys
F7287000 - Ntfs.sys
F725A000 - NDIS.sys
F78A8000 - sfhlp02.sys
F7246000 - sfdrv01a.sys
F722B000 - Mup.sys
F77F0000 - \SystemRoot\system32\DRIVERS\intelppm.sys
F676B000 - \SystemRoot\system32\DRIVERS\nv4_mini.sys
F6757000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
F7800000 - \SystemRoot\system32\DRIVERS\imapi.sys
F7810000 - \SystemRoot\system32\DRIVERS\cdrom.sys
F7820000 - \SystemRoot\system32\DRIVERS\redbook.sys
F6734000 - \SystemRoot\system32\DRIVERS\ks.sys
F7968000 - \SystemRoot\system32\DRIVERS\usbuhci.sys
F6711000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
F7970000 - \SystemRoot\system32\DRIVERS\usbehci.sys
F7830000 - \SystemRoot\system32\DRIVERS\fetnd5bv.sys
F66EC000 - \SystemRoot\system32\DRIVERS\HDAudBus.sys
F7840000 - \SystemRoot\system32\DRIVERS\nic1394.sys
F6686000 - \SystemRoot\System32\Drivers\araqxeiy.SYS
F6675000 - \SystemRoot\system32\DRIVERS\serial.sys
F6B0F000 - \SystemRoot\system32\DRIVERS\serenum.sys
F7C95000 - \SystemRoot\system32\DRIVERS\audstub.sys
F7B38000 - \SystemRoot\System32\Drivers\RootMdm.sys
F79D0000 - \SystemRoot\System32\Drivers\Modem.SYS
F7850000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
F6B0B000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
F665E000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
F7860000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
F7870000 - \SystemRoot\system32\DRIVERS\raspptp.sys
F79D8000 - \SystemRoot\system32\DRIVERS\TDI.SYS
F664D000 - \SystemRoot\system32\DRIVERS\psched.sys
F7880000 - \SystemRoot\system32\DRIVERS\msgpc.sys
F79E0000 - \SystemRoot\system32\DRIVERS\ptilink.sys
F79E8000 - \SystemRoot\system32\DRIVERS\raspti.sys
F6509000 - \SystemRoot\system32\DRIVERS\rdpdr.sys
F76A0000 - \SystemRoot\system32\DRIVERS\termdd.sys
F79F0000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
F79F8000 - \SystemRoot\system32\DRIVERS\mouclass.sys
F7A00000 - \SystemRoot\system32\drivers\SaiNtBus.sys
F7B3A000 - \SystemRoot\system32\DRIVERS\swenum.sys
F64B0000 - \SystemRoot\system32\DRIVERS\update.sys
F6AEF000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
F76B0000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F7AF4000 - \SystemRoot\system32\DRIVERS\SaiMini.sys
F76C0000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
F7A10000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
F7AF8000 - \SystemRoot\system32\DRIVERS\mouhid.sys
F7AFC000 - \SystemRoot\system32\DRIVERS\kbdhid.sys
F76D0000 - \SystemRoot\system32\DRIVERS\usbhub.sys
F7B3E000 - \SystemRoot\system32\DRIVERS\USBD.SYS
F39CD000 - \SystemRoot\system32\drivers\RtkHDAud.sys
F39AB000 - \SystemRoot\system32\drivers\portcls.sys
F76E0000 - \SystemRoot\system32\drivers\drmk.sys
F7B42000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F7C9C000 - \SystemRoot\System32\Drivers\Null.SYS
F7B44000 - \SystemRoot\System32\Drivers\Beep.SYS
F7C9D000 - \SystemRoot\System32\DRIVERS\AvgAsCln.sys
F7908000 - \SystemRoot\System32\drivers\vga.sys
F7B46000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F7B48000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F7910000 - \SystemRoot\System32\Drivers\Msfs.SYS
F7918000 - \SystemRoot\System32\Drivers\Npfs.SYS
F649C000 - \SystemRoot\system32\DRIVERS\rasacd.sys
F3928000 - \SystemRoot\system32\DRIVERS\ipsec.sys
F38CF000 - \SystemRoot\system32\DRIVERS\tcpip.sys
F7700000 - \SystemRoot\System32\Drivers\aswTdi.SYS
F38AE000 - \SystemRoot\system32\DRIVERS\ipnat.sys
F3886000 - \SystemRoot\system32\DRIVERS\netbt.sys
F7710000 - \SystemRoot\system32\DRIVERS\wanarp.sys
F3864000 - \SystemRoot\System32\drivers\afd.sys
F7720000 - \SystemRoot\system32\DRIVERS\arp1394.sys
F7730000 - \SystemRoot\system32\DRIVERS\netbios.sys
F3839000 - \SystemRoot\system32\DRIVERS\rdbss.sys
F37CA000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys
F7740000 - \SystemRoot\System32\Drivers\Fips.SYS
F7D1D000 - \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
F7928000 - \SystemRoot\System32\Drivers\Aavmker4.SYS
F3E40000 - \SystemRoot\system32\DRIVERS\hidusb.sys
F7950000 - \SystemRoot\system32\DRIVERS\USBSTOR.SYS
F7980000 - \SystemRoot\system32\DRIVERS\usbccgp.sys
F3661000 - \SystemRoot\system32\DRIVERS\adiusbaw.sys
F77A0000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F3649000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F7B52000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F39A3000 - \SystemRoot\System32\drivers\Dxapi.sys
F7990000 - \SystemRoot\System32\watchdog.sys
BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
F7C85000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9D5000 - \SystemRoot\System32\nv4_disp.dll
BFFA0000 - \SystemRoot\System32\ATMFD.DLL
BADA0000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
BAC0A000 - \SystemRoot\System32\Drivers\aswMon2.SYS
B99AD000 - \SystemRoot\system32\DRIVERS\mrxdav.sys
B98D0000 - \SystemRoot\system32\drivers\wdmaud.sys
F7780000 - \SystemRoot\system32\drivers\sysaudio.sys
B9831000 - \SystemRoot\system32\DRIVERS\atksgt.sys
B9596000 - \SystemRoot\System32\Drivers\HTTP.sys
F7900000 - \SystemRoot\system32\DRIVERS\lirsgt.sys
B9454000 - \SystemRoot\system32\DRIVERS\srv.sys
F7920000 - \SystemRoot\system32\DRIVERS\secdrv.sys
B9020000 - \SystemRoot\System32\Drivers\aswRdr.SYS
F7D2C000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 132

Liste des programmes installes

HijackThis 2.0.2
Navilog1 3.1.2

Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 98C3-1840

Répertoire de C:\Program Files

28/09/2007 15:46 <REP> .
28/09/2007 15:46 <REP> ..
25/09/2007 19:38 <REP> Adobe
10/04/2007 05:12 <REP> ADSL Autoconnect
10/04/2007 05:16 <REP> Ahead
17/07/2007 20:58 <REP> Alcohol Soft
10/04/2007 12:59 <REP> Alwil Software
27/09/2007 22:25 <REP> a-squared Free
05/09/2007 17:08 <REP> Azureus
10/04/2007 05:25 <REP> CCleaner
09/04/2007 23:57 <REP> Cegetel
28/06/2007 17:51 <REP> Common Files
10/04/2007 12:28 <REP> Creative
17/05/2007 15:48 <REP> directx
16/06/2007 15:47 <REP> Disc2Phone
28/09/2007 05:21 <REP> eMule
26/09/2007 20:53 <REP> Fichiers communs
10/04/2007 00:20 <REP> Google
26/09/2007 21:04 <REP> Grisoft
18/06/2007 20:35 <REP> inKline Global
15/08/2007 17:38 <REP> Internet Explorer
01/08/2007 13:03 <REP> Java
10/04/2007 00:01 <REP> Kit ADSL
27/09/2007 19:21 <REP> Messenger
26/09/2007 10:07 <REP> Messenger Plus! Live
10/07/2007 21:33 <REP> Micro Application
26/09/2007 17:29 <REP> Microsoft CAPICOM 2.1.0.2
09/04/2007 22:53 <REP> microsoft frontpage
28/04/2007 22:25 <REP> Microsoft Office
09/04/2007 22:46 <REP> Movie Maker
28/06/2007 19:03 <REP> MSBuild
09/04/2007 22:43 <REP> MSN Gaming Zone
15/08/2007 16:30 <REP> MSXML 4.0
28/06/2007 19:05 <REP> MSXML 6.0
28/09/2007 16:02 <REP> Navilog1
09/04/2007 22:46 <REP> NetMeeting
09/04/2007 22:44 <REP> Online Services
13/06/2007 05:08 <REP> Outlook Express
28/06/2007 19:00 <REP> Reference Assemblies
19/08/2007 22:56 <REP> ReflexiveArcade
18/08/2007 15:01 <REP> RegCleaner
09/04/2007 23:57 <REP> SAGEM
30/04/2007 19:45 <REP> Saitek
09/04/2007 22:47 <REP> Services en ligne
16/06/2007 15:48 <REP> Sony Ericsson
26/09/2007 21:00 <REP> Sophos
08/08/2007 19:56 <REP> Spybot - Search & Destroy
29/08/2007 16:56 <REP> Teamspeak2_RC2
28/09/2007 15:14 <REP> Trend Micro
25/09/2007 19:29 <REP> Ubisoft
01/09/2007 15:05 <REP> Valve
30/06/2007 14:35 <REP> VideoLAN
26/09/2007 09:37 <REP> Windows Live
27/09/2007 19:21 <REP> Windows Media Connect 2
10/04/2007 12:57 <REP> Windows Media Player
09/04/2007 22:42 <REP> Windows NT
09/04/2007 22:44 <REP> Windows Plus
14/06/2007 05:04 <REP> WinRAR
09/04/2007 22:53 <REP> xerox
0 fichier(s) 0 octets
59 Rép(s) 300 732 461 056 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 98C3-1840

Répertoire de C:\Program Files\fichiers communs

26/09/2007 20:53 <REP> .
26/09/2007 20:53 <REP> ..
26/09/2007 20:39 <REP> Adobe
10/04/2007 05:16 <REP> Ahead
24/08/2007 12:35 <REP> BinarySense
18/04/2007 19:32 <REP> Everstrike Software
21/06/2007 13:40 <REP> InstallShield
09/04/2007 22:51 <REP> Java
26/09/2007 09:34 <REP> Microsoft Shared
09/04/2007 22:46 <REP> MSSoap
10/04/2007 00:38 <REP> ODBC
09/04/2007 22:46 <REP> Services
10/04/2007 00:38 <REP> SpeechEngines
10/04/2007 14:06 <REP> Symantec Shared
13/06/2007 05:08 <REP> System
16/06/2007 15:49 <REP> Teleca Shared
0 fichier(s) 0 octets
16 Rép(s) 300 732 461 056 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 98C3-1840

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

09/04/2007 23:03 <REP> .
09/04/2007 23:03 <REP> ..
18/05/2001 15:57 561 209 MSONSEXT.DLL
03/06/1999 12:09 122 937 MSOWS409.DLL
07/03/2001 07:00 127 033 MSOWS40c.DLL
3 fichier(s) 811 179 octets
2 Rép(s) 300 732 456 960 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 98C3-1840

Répertoire de C:\Program Files\common files

28/06/2007 17:51 <REP> .
28/06/2007 17:51 <REP> ..
28/06/2007 17:51 <REP> EasyInfo
0 fichier(s) 0 octets
3 Rép(s) 300 732 456 960 octets libres

c:\Documents and Settings\guez\Application Data\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix.exe
c:\Documents and Settings\guez\Bureau\clean\pskill.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\catchme.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\diff.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\dumphive.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\FilesInfoCmd.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\find2.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\Fport.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\grep.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\KProcCheck.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\LFiles.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\LISTDLLS.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\md5sums.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\pslist.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\streams.exe
c:\Documents and Settings\guez\Bureau\DiagHelp\swreg.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\dumphive.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\exit.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\GenericRenosFix.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\HostsChk.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\Process.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\Reboot.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\restart.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\SmiUpdate.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\SrchSTS.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\swreg.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\swsc.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\swxcacls.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\unzip.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\VCCLSID.exe
c:\Documents and Settings\guez\Bureau\SmitfraudFix\WS2Fix.exe
c:\Documents and Settings\guez\Mes documents\programmes\cv lettre motiv\CV et lettre de motivation\DEPANN\_ISDEL.EXE
c:\Documents and Settings\guez\Mes documents\programmes\cv lettre motiv\CV et lettre de motivation\DEPANN\REGOCX32.EXE
c:\Documents and Settings\guez\Mes documents\programmes\cv lettre motiv\CV et lettre de motivation\DEPANN\SETUP.EXE
c:\Documents and Settings\guez\Mes documents\programmes\cv lettre motiv\CV et lettre de motivation\SETUP\_ISDEL.EXE
c:\Documents and Settings\guez\Mes documents\programmes\cv lettre motiv\CV et lettre de motivation\SETUP\SETUP.EXE
c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
c:\Documents and Settings\guez\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll
c:\Documents and Settings\guez\Application Data\Microsoft\IdentityCRL\Production\ppcrlui.dll
c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

****** Fin du rapport DiagHelp

arf merde... dommage ! On va faire çà:

- Télécharge Diaghelp.zip de Malekal_Morte http://www.malekal.com/download/DiagHelp.zip
- Cliques droit dessus et choisis extraire tout.
- Un nouveau dossier va être créé: DiagHelp
- Ouvre le et double cliques sur Go.cmd
- Choisis l'option 1
- Suis les instructions qui apparaissent, et appuies bien sur une touche quand demandé, après le rapport CatchMe.
- Peut-etre que tu devras redémarrer ton ordinateur.
- Copie colle le rapport se trouve dans C:Resultat.txt ici.

euh non je lai supprimer en pensan men debarasser tu kompren....

Mais as tu le fichier original que tu as accepté et qui t'a mis le vers ?

non la fentre msn souvre et envoi un fichier photo inconnu ke je nai pa sur mon pc...tout ce ke je pe te dire c kil sapel photo25....si ca pe taider....merci

C'est toi qui demande d'envoyer les fichiers donc ?

As tu toujours le fichier envoyé ?

le probleme es tjs la....ke faire svp...

g bien utiliser clean kom prevu voici le rapport.pour repondre a ta kestion plusieur fenetre de msn contact souvre et envoi une demande de fichier photo a mes contact...Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 28/09/2007 a 16:08:41,23

Microsoft Windows XP [version 5.1.2600]

*** Suppression des fichiers dans C:

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32

*** Suppression des fichiers dans C:\Program Files

*** Suppression des clefs du registre effectuee..
*** Fin du rapport !

Mouais...

Pas fameux çà.. Tu l'as ouvert le fichier téléchargé ? Comment sais tu que c'est un virus ?
- Télécharge clean.zip http://www.malekal.com/download/clean.zip sur ton bureau.
- Fais Clic droit, extraire tout.
- ATTENTION, Enregistre tout ce qui va suivre dans un fichier texte sur ton bureau car tu n'auras plus accès à internet en mode sans échec.
- Redémarre en mode sans échec. Pour cela, après le bip d'allumage de ton PC, tapotes sur F8. Un menu va s'ouvrir, sélectionne "Mode sans échec".Quand tu y seras, regardes les instructions que tu as enregistré pour connaitre la suite.
- Ouvre le dossier Clean sur ton bureau et double cliques sur clean.cmd
- Dans la fenêtre qui apparait, choisis l'option 2 et laisse le nettoyage commencer.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:16:51, on 28/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Saitek\Software\SaiSmart.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\mdn.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program files\valve\steam\steam.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
c:\progra~1\azureus\Azureus.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Machine Debug Mgr] mdn.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{568C2983-CCAF-402A-A9BB-9FC987C3F594}: NameServer = 86.64.145.144 84.103.237.144
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

MSNFix 1.521

C:\Documents and Settings\guez\Bureau\MSNFix
Fix exécuté le 28/09/2007 - 15:11:50,95 By guez
mode normal

************************ Recherche les fichiers présents

Aucun Fichier trouvé

************************ Recherche les dossiers présents

Aucun dossier trouvé

************************ Fichiers suspects

Aucun Fichier trouvé

------------------------------------------------------------------------
Auteur : !aur3n7 Contact: https://www.ionos.fr/
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------

Poste les rapports, c'est ce qui est demandé !

Tu ne dois rien faire d'HiJackThis avant que je te le demande !

virus toujours present avec hijack et msn fix komen faire....

Salut prisci,

Tu devrais créer ton propre sujet, car celui ci appartient a quelqu'un d'autre... Ensuite on pourra t'aider !

Bonjour,

J'ai le meme soucis, voici le rapport de Hijack

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:14:23, on 28/09/2007
Platform: Windows Vista (WinNT 6.00.1904)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Common Files\AOL\1189094706\ee\aolsoftware.exe
C:\Windows\usnsvc.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\AOL 9.0 VR\waol.exe
C:\Windows\system32\conime.exe
C:\Program Files\AOL 9.0 VR\shellmon.exe
C:\Windows\system32\lnaccess.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
c:\program files\aol\aol toolbar 4.0\AolTbServer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Fred\Downloads\HiJackThis_v2.exe
C:\Users\Fred\Downloads\ccsetup200.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1189094706\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [usnsvc.exe] C:\Windows\usnsvc.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0 VR\AOL.EXE" -b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Instant Access] C:\Windows\system32\lnaccess.exe /res
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 4.0\resources\fr-FR\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\Windows\system32\Shdocvw.dll
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: @%SystemRoot%\system32\aelupsvc.dll,-1 (AeLookupSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: @%systemroot%\system32\appinfo.dll,-100 (Appinfo) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-204 (AudioEndpointBuilder) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-200 (Audiosrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: @%SystemRoot%\system32\bfe.dll,-1001 (BFE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qmgr.dll,-1000 (BITS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\browser.dll,-100 (Browser) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-11 (CertPropSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: @%SystemRoot%\system32\cryptsvc.dll,-1001 (CryptSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @oleres.dll,-5012 (DcomLaunch) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dhcpcsvc.dll,-100 (Dhcp) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\dnsapi.dll,-101 (Dnscache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dot3svc.dll,-1102 (dot3svc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dps.dll,-500 (DPS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\eapsvc.dll,-1 (EapHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\ehome\ehrecvr.exe,-101 (ehRecvr) - Unknown owner - C:\Windows\ehome\ehRecvr.exe
O23 - Service: @%SystemRoot%\ehome\ehsched.exe,-101 (ehSched) - Unknown owner - C:\Windows\ehome\ehsched.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\emdmgmt.dll,-1000 (EMDMgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wevtsvc.dll,-200 (Eventlog) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @comres.dll,-2450 (EventSystem) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdPHost.dll,-100 (fdPHost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdrespub.dll,-100 (FDResPub) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @%SystemRoot%\System32\hidserv.dll,-101 (hidserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\kmsvc.dll,-6 (hkmsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: @%SystemRoot%\system32\ikeext.dll,-501 (IKEEXT) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\IPBusEnum.dll,-102 (IPBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\iphlpsvc.dll,-200 (iphlpsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @comres.dll,-2946 (KtmRm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\srvsvc.dll,-100 (LanmanServer) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wkssvc.dll,-100 (LanmanWorkstation) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: @%SystemRoot%\system32\lltdres.dll,-1 (lltdsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lmhsvc.dll,-101 (lmhosts) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-100 (MMCSS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\FirewallAPI.dll,-23090 (MpsSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe
O23 - Service: @%SystemRoot%\system32\iscsidsc.dll,-5000 (MSiSCSI) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\msimsg.dll,-27 (msiserver) - Unknown owner - C:\Windows\system32\msiexec.exe
O23 - Service: @%SystemRoot%\system32\qagentrt.dll,-6 (napagent) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32\netman.dll,-109 (Netman) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\netprof.dll,-246 (netprofm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\nlasvc.dll,-1 (NlaSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\nsisvc.dll,-200 (nsi) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8004 (p2pimsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8006 (p2psvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pcasvc.dll,-1 (PcaSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\pla.dll,-500 (pla) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\umpnpmgr.dll,-100 (PlugPlay) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8002 (PNRPAutoReg) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8000 (PNRPsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\polstore.dll,-5010 (PolicyAgent) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\profsvc.dll,-300 (ProfSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasauto.dll,-200 (RasAuto) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasmans.dll,-200 (RasMan) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @regsvc.dll,-1 (RemoteRegistry) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe
O23 - Service: @oleres.dll,-5010 (RpcSs) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\System32\SCardSvr.dll,-1 (SCardSvr) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\schedsvc.dll,-100 (Schedule) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-13 (SCPolicySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sdrsvc.dll,-107 (SDRSVC) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Sens.dll,-200 (SENS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\SessEnv.dll,-1026 (SessionEnv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\ipnathlp.dll,-106 (SharedAccess) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-12288 (ShellHWDetection) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe
O23 - Service: @%SystemRoot%\system32\SLUINotify.dll,-103 (SLUINotify) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe
O23 - Service: @%systemroot%\system32\ssdpsrv.dll,-100 (SSDPSRV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wiaservc.dll,-9 (stisvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\System32\swprv.dll,-103 (swprv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sysmain.dll,-1000 (SysMain) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\TabSvc.dll,-100 (TabletInputService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\tapisrv.dll,-10100 (TapiSrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\tbssvc.dll,-100 (TBS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\termsrv.dll,-268 (TermService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-8192 (Themes) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-102 (THREADORDER) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\trkwks.dll,-1 (TrkWks) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\servicing\TrustedInstaller.exe,-100 (TrustedInstaller) - Unknown owner - C:\Windows\servicing\TrustedInstaller.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe
O23 - Service: @%systemroot%\system32\upnphost.dll,-213 (upnphost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dwm.exe,-2000 (UxSms) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: @%SystemRoot%\system32\w32time.dll,-200 (W32Time) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\Windows\wanmpsvc.exe
O23 - Service: @%SystemRoot%\system32\wcncsvc.dll,-3 (wcncsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\WcsPlugInService.dll,-200 (WcsPlugInService) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-502 (WdiServiceHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-500 (WdiSystemHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\webclnt.dll,-100 (WebClient) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wecsvc.dll,-200 (Wecsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wercplsupport.dll,-101 (wercplsupport) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wersvc.dll,-100 (WerSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%ProgramFiles%\Windows Defender\MsMpRes.dll,-103 (WinDefend) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\winhttp.dll,-100 (WinHttpAutoProxySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmisvc.dll,-205 (Winmgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wsmsvc.dll,-101 (WinRM) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wlansvc.dll,-257 (Wlansvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\wmpnetwk.exe
O23 - Service: @%SystemRoot%\system32\wpcsvc.dll,-100 (WPCSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wpdbusenum.dll,-100 (WPDBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wscsvc.dll,-200 (wscsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\SearchIndexer.exe,-103 (WSearch) - Unknown owner - C:\Windows\system32\SearchIndexer.exe
O23 - Service: @%systemroot%\system32\wuaueng.dll,-105 (wuauserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wudfsvc.dll,-1000 (wudfsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe