Navilog effectué

Godzilla -  
Bonjour, aprés avoir lu les "au secours" d'autres internaut, moi aussi j'ai de super graves problèmes la liste serait hyper longue si je devais énumérer tous les problèmes que j'ai accumulés, j'ai donc exécuté le navilog comme conseillé voici le bloc note.
Sinon j'aurais voulu savoir si ce n'est pas plus simpl pour moi de réinstaller XP, mais vais-je perdre mes logiciels installés, mes fichiers photos et musicaux, je me sers de ce pc portable pour une émission de radio avec Jazler j'ai peur de tout perdre, la solution serait que je mette tout sur un disque dur externe mais est il possible de faire autrement, mes fichiers vont-ils disparaitre comment les sauvegarder? Merci pour votre réponse...

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 30.10.2007 à 19h00 par IL-MAFIOSO

Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180

*** Recherche Programmes installés ***

*** Recherche dossiers dans C:\WINDOWS ***

*** Recherche dossiers dans C:\Program Files ***

*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***

*** Recherche dossiers dans C:\Documents and Settings\Christophe Droit\Application Data ***

*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun fichier trouvé dans :

- C:\WINDOWS\system32
- C:\DOCUME~1\CHRIST~1\LOCALS~1\APPLIC~1

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

Fichiers trouvés :

dsusxq.exe trouvé !
dsusxq.dat trouvé !
dsusxq_nav.dat trouvé !
dsusxq_navps.dat trouvé !

* Recherche dans C:\DOCUME~1\CHRIST~1\LOCALS~1\APPLIC~1 *

*** Recherche fichiers ***

C:\WINDOWS\pack.epk trouvé !

*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé !

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

2)Recherche Heuristique :

C:\WINDOWS\system32\dsusxq.dat trouvé !
C:\WINDOWS\system32\dsusxq_nav.dat trouvé !

3)Recherche Certificats :

Certificat Egroup trouvé !

*** Analyse terminée le 01/11/2007 à 17:56:56,10 ***
Configuration: Windows XP
Internet Explorer 7.0

74 réponses

Résumé de la discussion

Le fil tourne autour d'une infection constatée sur Windows XP, avec des questionnements sur la sauvegarde des fichiers personnels et sur la possibilité de réinstaller le système sans tout perdre. La meilleure réponse recommande d'utiliser HijackThis pour supprimer les entrées indésirables et d'exécuter SmitFraudFix, tout en purgeant les éléments problématiques dans les démarrages et le fichier hosts. Des conseils complémentaires évoquent des options de nettoyage, des mises à jour et la sauvegarde des données sur disque externe avant toute action, afin de prévenir la perte de photos, musiques et logiciels. Des éléments mentionnent des outils et procédures spécifiques de l'époque, comme des nettoyages de registre et des corrections DNS, qui illustrent l approche multi-outils pour démêler une infection complexe.

Bobot (l’IA à votre service)
  1. g!rly Contributeur
    --
    mouvement de non entraide a suivre très prochainement...
    1. !^^![ME] Contributeur
      ??
  3. godzilla82
    Bonjour G!rly, merci pour ton doc, je m'en occupe et je te tiens au courant...@ plus tard.
    1. g!rly Contributeur
      salut godzilla,

      voici une liste de possiblités :

      http://perso.orange.fr/doc.jm/WU5-FAQ.htm

      @+
      2. godzilla82
        Je ne peux plus faire les MAJ depuis à peu prés un mois....

        Désolé pour la reponse tardive je dînais...
        1. g!rly Contributeur
          depuis quand ne peux tu plus faire les mises a jour?

          oui quelques flocons sont tombés ce matin,
          1. godzilla82
            Et bien quand je suis informé que des MAJ sont dispo, je lance Update et une fois quelles sont téléchargées (64 au total), la fénêtre me précise que certaines MAJ n'ont pas pu être installées, ce qui m'étonne un peu c'est que le tout fait 0 octets...

            Pour les sons j'ai déjà effectué cette manip. eh! t'as de la neige? c'est pas kool ici il fait 18° en journée...
            1. g!rly Contributeur
              bonsoir,

              oui le tennis ca fais du bien ;-)

              pour les mises a jour as tu un message d´erreure quand tu tente de les faire?

              pour régler les sons de windows

              1. Dans le menu Démarrer, cliquez sur "Panneau de configuration".
              2. Double-cliquez sur l'icône "Sons et périphériques audio" et allez sur le point "Sons".
              3. Cherchez les sons que vous souhaitez modifier et cliquez sur l'événement à modifier.
              4. Dans la liste "Evènements", cliquez sur le son à associer à l'événement ou optez pour "Parcourir…" pour choisir vos propres sons en format "wav".

              Cliquez sur "Aucun" si vous ne souhaitez associer aucun son à cet événement.

              Dès que vous aurez confirmé vos choix avec "Ok"
              1. godzilla82
                suis en pleine forme because trois heure tennis ce matin j'ai mal partout...

                Bon mon p'tit PC m'a laissé écrire mon bouquin cet aprés midi, Antivirus, Firewall et anti spyware sont trés efficace je n'ai plus d'ennui, il me reste encore le proble de MAJ windows qui ne s'installe pas même en les supprimants et en téléchargent de nouvelle, nothing Update ne veut rien savoir, mon son windows aussi introuvable pourtant j'ai fouillé tous les sons sont remplacés par un bip horrible, mais cela ne m'empêche pas de bosser et d'écouter mes albums d'Anathema...Sinon me conseillerais-tu de créer un point de resto??
                1. g!rly Contributeur
                  bonsoir d´helsinki,

                  bon ca me parait ok.

                  comment va tu, et surtout comment va ton pc?

                  Bonne soirée

                  @´+
                  1. godzilla82
                    Bonsoir à tous et à toutes, bonsoir g!rly! un coucou à tous de Verdun sur Garonne prés de Toulouse...
                    1. godzilla82
                      G!rly? j'vais me coucher, demain tennis à 9h j'ai peur de ne pas me lever, encore un grand merci pour tout ce que tu as fait ainsi qu'aux autres membres de CCM, bonne nuit à tous, à demain...Godzill@
                      1. godzilla82
                        Ok :

                        GMER 1.0.13.12551 - http://www.gmer.net
                        Rootkit scan 2007-11-03 00:02:01
                        Windows 5.1.2600 Service Pack 2

                        ---- System - GMER 1.0.13 ----

                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwClose
                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateFile
                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateKey
                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateProcess
                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateProcessEx
                        SSDT F7C3DA14 ZwCreateThread
                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwDeleteFile
                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwDeleteKey
                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwDeleteValueKey
                        SSDT \SystemRoot\system32\drivers\khips.sys ZwLoadDriver
                        SSDT \SystemRoot\system32\drivers\khips.sys ZwMapViewOfSection
                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwOpenFile
                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwOpenKey
                        SSDT F7C3DA00 ZwOpenProcess
                        SSDT F7C3DA05 ZwOpenThread
                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwResumeThread
                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwSetInformationFile
                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwSetValueKey
                        SSDT F7C3DA0F ZwTerminateProcess
                        SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwWriteFile
                        SSDT F7C3DA0A ZwWriteVirtualMemory

                        ---- Kernel code sections - GMER 1.0.13 ----

                        .text ntkrnlpa.exe!ZwCallbackReturn + 2C4E 80503932 2 Bytes [ AE, AA ]
                        PAGENDSM NDIS.sys!NdisMIndicateStatus F7258A5F 6 Bytes JMP AAAE4C5E \SystemRoot\system32\drivers\fwdrv.sys

                        ---- User code sections - GMER 1.0.13 ----

                        .text C:\WINDOWS\Explorer.EXE[148] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
                        .text C:\WINDOWS\Explorer.EXE[148] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
                        .text C:\WINDOWS\Explorer.EXE[148] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
                        .text C:\WINDOWS\Explorer.EXE[148] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
                        .text C:\WINDOWS\Explorer.EXE[148] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
                        .text C:\WINDOWS\Explorer.EXE[148] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
                        .text C:\WINDOWS\Explorer.EXE[148] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
                        .text C:\WINDOWS\Explorer.EXE[148] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
                        .text C:\WINDOWS\Explorer.EXE[148] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
                        .text C:\WINDOWS\Explorer.EXE[148] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
                        .text C:\WINDOWS\Explorer.EXE[148] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
                        .text C:\WINDOWS\Explorer.EXE[148] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
                        .text C:\WINDOWS\Explorer.EXE[148] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
                        .text C:\WINDOWS\Explorer.EXE[148] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
                        .text C:\WINDOWS\Explorer.EXE[148] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
                        .text C:\WINDOWS\Explorer.EXE[148] WININET.dll!InternetConnectA 77AB44DB 5 Bytes JMP 00080F54
                        .text C:\WINDOWS\Explorer.EXE[148] WININET.dll!InternetOpenA 77AB6D2A 5 Bytes JMP 00080D24
                        .text C:\WINDOWS\Explorer.EXE[148] WININET.dll!InternetOpenUrlA 77AB6FDD 5 Bytes JMP 00080E3C
                        .text C:\WINDOWS\Explorer.EXE[148] WININET.dll!InternetConnectW 77AC5D4C 5 Bytes JMP 00080FE0
                        .text C:\WINDOWS\Explorer.EXE[148] WININET.dll!InternetOpenW 77AC6CF3 5 Bytes JMP 00080DB0
                        .text C:\WINDOWS\Explorer.EXE[148] WININET.dll!InternetOpenUrlW 77AC7304 5 Bytes JMP 00080EC8
                        .text C:\WINDOWS\Explorer.EXE[148] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4
                        .text C:\WINDOWS\Explorer.EXE[148] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838
                        .text C:\WINDOWS\Explorer.EXE[148] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe[476] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838
                        .text C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe[524] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
                        .text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[688] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
                        .text C:\WINDOWS\system32\o2flash.exe[724] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
                        .text C:\WINDOWS\system32\o2flash.exe[724] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
                        .text C:\WINDOWS\system32\o2flash.exe[724] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
                        .text C:\WINDOWS\system32\o2flash.exe[724] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
                        .text C:\WINDOWS\system32\o2flash.exe[724] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
                        .text C:\WINDOWS\system32\o2flash.exe[724] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
                        .text C:\WINDOWS\system32\o2flash.exe[724] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
                        .text C:\WINDOWS\system32\o2flash.exe[724] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
                        .text C:\WINDOWS\system32\o2flash.exe[724] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
                        .text C:\WINDOWS\system32\o2flash.exe[724] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
                        .text C:\WINDOWS\system32\o2flash.exe[724] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
                        .text C:\WINDOWS\system32\o2flash.exe[724] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
                        .text C:\WINDOWS\system32\o2flash.exe[724] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
                        .text C:\WINDOWS\system32\o2flash.exe[724] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
                        .text C:\WINDOWS\system32\o2flash.exe[724] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
                        .text C:\WINDOWS\system32\csrss.exe[792] KERNEL32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001601A8
                        .text C:\WINDOWS\system32\csrss.exe[792] KERNEL32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00160090
                        .text C:\WINDOWS\system32\csrss.exe[792] KERNEL32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00160694
                        .text C:\WINDOWS\system32\csrss.exe[792] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 001602C0
                        .text C:\WINDOWS\system32\csrss.exe[792] KERNEL32.dll!CreateProcessA 7C802367 5 Bytes JMP 00160234
                        .text C:\WINDOWS\system32\csrss.exe[792] KERNEL32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00160004
                        .text C:\WINDOWS\system32\csrss.exe[792] KERNEL32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0016011C
                        .text C:\WINDOWS\system32\csrss.exe[792] KERNEL32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001604F0
                        .text C:\WINDOWS\system32\csrss.exe[792] KERNEL32.dll!CreateThread 7C81082F 5 Bytes JMP 0016057C
                        .text C:\WINDOWS\system32\csrss.exe[792] KERNEL32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001603D8
                        .text C:\WINDOWS\system32\csrss.exe[792] KERNEL32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0016034C
                        .text C:\WINDOWS\system32\csrss.exe[792] KERNEL32.dll!WinExec 7C86114D 5 Bytes JMP 00160464
                        .text C:\WINDOWS\system32\csrss.exe[792] KERNEL32.dll!SetThreadContext 7C862849 5 Bytes JMP 00160608
                        .text C:\WINDOWS\system32\csrss.exe[792] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001607AC
                        .text C:\WINDOWS\system32\csrss.exe[792] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00160720
                        .text C:\WINDOWS\system32\winlogon.exe[820] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000701A8
                        .text C:\WINDOWS\system32\winlogon.exe[820] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00070090
                        .text C:\WINDOWS\system32\winlogon.exe[820] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00070694
                        .text C:\WINDOWS\system32\winlogon.exe[820] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000702C0
                        .text C:\WINDOWS\system32\winlogon.exe[820] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00070234
                        .text C:\WINDOWS\system32\winlogon.exe[820] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00070004
                        .text C:\WINDOWS\system32\winlogon.exe[820] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0007011C
                        .text C:\WINDOWS\system32\winlogon.exe[820] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000704F0
                        .text C:\WINDOWS\system32\winlogon.exe[820] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0007057C
                        .text C:\WINDOWS\system32\winlogon.exe[820] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000703D8
                        .text C:\WINDOWS\system32\winlogon.exe[820] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0007034C
                        .text C:\WINDOWS\system32\winlogon.exe[820] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00070464
                        .text C:\WINDOWS\system32\winlogon.exe[820] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00070608
                        .text C:\WINDOWS\system32\winlogon.exe[820] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000707AC
                        .text C:\WINDOWS\system32\winlogon.exe[820] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00070720
                        .text C:\WINDOWS\system32\winlogon.exe[820] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000708C4
                        .text C:\WINDOWS\system32\winlogon.exe[820] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00070838
                        .text C:\WINDOWS\system32\winlogon.exe[820] WS2_32.dll!connect 719F406A 5 Bytes JMP 00070950
                        .text C:\WINDOWS\system32\services.exe[868] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
                        .text C:\WINDOWS\system32\services.exe[868] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
                        .text C:\WINDOWS\system32\services.exe[868] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
                        .text C:\WINDOWS\system32\services.exe[868] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
                        .text C:\WINDOWS\system32\services.exe[868] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
                        .text C:\WINDOWS\system32\services.exe[868] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
                        .text C:\WINDOWS\system32\services.exe[868] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
                        .text C:\WINDOWS\system32\services.exe[868] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
                        .text C:\WINDOWS\system32\services.exe[868] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
                        .text C:\WINDOWS\system32\services.exe[868] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
                        .text C:\WINDOWS\system32\services.exe[868] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
                        .text C:\WINDOWS\system32\services.exe[868] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
                        .text C:\WINDOWS\system32\services.exe[868] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
                        .text C:\WINDOWS\system32\services.exe[868] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
                        .text C:\WINDOWS\system32\services.exe[868] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
                        .text C:\WINDOWS\system32\services.exe[868] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4
                        .text C:\WINDOWS\system32\services.exe[868] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838
                        .text C:\WINDOWS\system32\services.exe[868] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000301A8
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00030090
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00030694
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000302C0
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00030234
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00030004
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0003011C
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000304F0
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0003057C
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000303D8
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0003034C
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00030464
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00030608
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000307AC
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00030720
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000308C4
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00030838
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] WS2_32.dll!connect 719F406A 5 Bytes JMP 00030950
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] WININET.dll!InternetConnectA 77AB44DB 5 Bytes JMP 00030F54
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] WININET.dll!InternetOpenA 77AB6D2A 5 Bytes JMP 00030D24
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] WININET.dll!InternetOpenUrlA 77AB6FDD 5 Bytes JMP 00030E3C
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] WININET.dll!InternetConnectW 77AC5D4C 5 Bytes JMP 00030FE0
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] WININET.dll!InternetOpenW 77AC6CF3 5 Bytes JMP 00030DB0
                        .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[996] WININET.dll!InternetOpenUrlW 77AC7304 5 Bytes JMP 00030EC8
                        .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
                        .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
                        .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
                        .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
                        .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
                        .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
                        .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
                        .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
                        .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
                        .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
                        .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
                        .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
                        .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
                        .text C:\WINDOWS\system32\svchost.exe[1036] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
                        .text C:\WINDOWS\system32\svchost.exe[1036] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
                        .text C:\WINDOWS\system32\svchost.exe[1036] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4
                        .text C:\WINDOWS\system32\svchost.exe[1036] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838
                        .text C:\WINDOWS\system32\svchost.exe[1036] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] WININET.dll!InternetConnectA 77AB44DB 5 Bytes JMP 00130F54
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] WININET.dll!InternetOpenA 77AB6D2A 5 Bytes JMP 00130D24
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] WININET.dll!InternetOpenUrlA 77AB6FDD 5 Bytes JMP 00130E3C
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] WININET.dll!InternetConnectW 77AC5D4C 5 Bytes JMP 00130FE0
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] WININET.dll!InternetOpenW 77AC6CF3 5 Bytes JMP 00130DB0
                        .text C:\Program Files\WinRAR\WinRAR.exe[1068] WININET.dll!InternetOpenUrlW 77AC7304 5 Bytes JMP 00130EC8
                        .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
                        .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
                        .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
                        .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
                        .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
                        .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
                        .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
                        .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
                        .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
                        .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
                        .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
                        .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
                        .text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
                        .text C:\WINDOWS\system32\svchost.exe[1128] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
                        .text C:\WINDOWS\system32\svchost.exe[1128] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
                        .text C:\WINDOWS\system32\svchost.exe[1128] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4
                        .text C:\WINDOWS\system32\svchost.exe[1128] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838
                        .text C:\WINDOWS\system32\svchost.exe[1128] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
                        .text C:\WINDOWS\system32\igfxpers.exe[1140] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
                        .text C:\WINDOWS\System32\svchost.exe[1232] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
                        .text C:\WINDOWS\System32\svchost.exe[1232] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
                        .text C:\WINDOWS\System32\svchost.exe[1232] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
                        .text C:\WINDOWS\System32\svchost.exe[1232] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
                        .text C:\WINDOWS\System32\svchost.exe[1232] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
                        .text C:\WINDOWS\System32\svchost.exe[1232] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
                        .text C:\WINDOWS\System32\svchost.exe[1232] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
                        .text C:\WINDOWS\System32\svchost.exe[1232] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
                        .text C:\WINDOWS\System32\svchost.exe[1232] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
                        .text C:\WINDOWS\System32\svchost.exe[1232] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
                        .text C:\WINDOWS\System32\svchost.exe[1232] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
                        .text C:\WINDOWS\System32\svchost.exe[1232] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
                        .text C:\WINDOWS\System32\svchost.exe[1232] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
                        .text C:\WINDOWS\System32\svchost.exe[1232] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
                        .text C:\WINDOWS\System32\svchost.exe[1232] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
                        .text C:\WINDOWS\System32\svchost.exe[1232] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4
                        .text C:\WINDOWS\System32\svchost.exe[1232] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838
                        .text C:\WINDOWS\System32\svchost.exe[1232] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950
                        .text C:\WINDOWS\System32\svchost.exe[1232] WININET.dll!InternetConnectA 77AB44DB 5 Bytes JMP 00080F54
                        .text C:\WINDOWS\System32\svchost.exe[1232] WININET.dll!InternetOpenA 77AB6D2A 5 Bytes JMP 00080D24
                        .text C:\WINDOWS\System32\svchost.exe[1232] WININET.dll!InternetOpenUrlA 77AB6FDD 5 Bytes JMP 00080E3C
                        .text C:\WINDOWS\System32\svchost.exe[1232] WININET.dll!InternetConnectW 77AC5D4C 5 Bytes JMP 00080FE0
                        .text C:\WINDOWS\System32\svchost.exe[1232] WININET.dll!InternetOpenW 77AC6CF3 5 Bytes JMP 00080DB0
                        .text C:\WINDOWS\System32\svchost.exe[1232] WININET.dll!InternetOpenUrlW 77AC7304 5 Bytes JMP 00080EC8
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838
                        .text C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe[1324] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950
                        .text C:\WINDOWS\system32\svchost.exe[1388] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
                        .text C:\WINDOWS\system32\svchost.exe[1388] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
                        .text C:\WINDOWS\system32\svchost.exe[1388] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
                        .text C:\WINDOWS\system32\svchost.exe[1388] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
                        .text C:\WINDOWS\system32\svchost.exe[1388] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
                        .text C:\WINDOWS\system32\svchost.exe[1388] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
                        .text C:\WINDOWS\system32\svchost.exe[1388] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
                        .text C:\WINDOWS\system32\svchost.exe[1388] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
                        .text C:\WINDOWS\system32\svchost.exe[1388] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
                        .text C:\WINDOWS\system32\svchost.exe[1388] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
                        .text C:\WINDOWS\system32\svchost.exe[1388] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
                        .text C:\WINDOWS\system32\svchost.exe[1388] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
                        .text C:\WINDOWS\system32\svchost.exe[1388] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
                        .text C:\WINDOWS\system32\svchost.exe[1388] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
                        .text C:\WINDOWS\system32\svchost.exe[1388] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
                        .text C:\WINDOWS\system32\svchost.exe[1388] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4
                        .text C:\WINDOWS\system32\svchost.exe[1388] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838
                        .text C:\WINDOWS\system32\svchost.exe[1388] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
                        .text C:\WINDOWS\system32\hkcmd.exe[1456] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
                        .text C:\WINDOWS\system32\svchost.exe[1492] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
                        .text C:\WINDOWS\system32\svchost.exe[1492] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
                        .text C:\WINDOWS\system32\svchost.exe[1492] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
                        .text C:\WINDOWS\system32\svchost.exe[1492] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
                        .text C:\WINDOWS\system32\svchost.exe[1492] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
                        .text C:\WINDOWS\system32\svchost.exe[1492] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
                        .text C:\WINDOWS\system32\svchost.exe[1492] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
                        .text C:\WINDOWS\system32\svchost.exe[1492] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
                        .text C:\WINDOWS\system32\svchost.exe[1492] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
                        .text C:\WINDOWS\system32\svchost.exe[1492] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
                        .text C:\WINDOWS\system32\svchost.exe[1492] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
                        .text C:\WINDOWS\system32\svchost.exe[1492] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
                        .text C:\WINDOWS\system32\svchost.exe[1492] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
                        .text C:\WINDOWS\system32\svchost.exe[1492] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
                        .text C:\WINDOWS\system32\svchost.exe[1492] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
                        .text C:\WINDOWS\system32\svchost.exe[1492] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4
                        .text C:\WINDOWS\system32\svchost.exe[1492] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838
                        .text C:\WINDOWS\system32\svchost.exe[1492] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950
                        .text C:\WINDOWS\system32\svchost.exe[1492] WININET.dll!InternetConnectA 77AB44DB 5 Bytes JMP 00080F54
                        .text C:\WINDOWS\system32\svchost.exe[1492] WININET.dll!InternetOpenA 77AB6D2A 5 Bytes JMP 00080D24
                        .text C:\WINDOWS\system32\svchost.exe[1492] WININET.dll!InternetOpenUrlA 77AB6FDD 5 Bytes JMP 00080E3C
                        .text C:\WINDOWS\system32\svchost.exe[1492] WININET.dll!InternetConnectW 77AC5D4C 5 Bytes JMP 00080FE0
                        .text C:\WINDOWS\system32\svchost.exe[1492] WININET.dll!InternetOpenW 77AC6CF3 5 Bytes JMP 00080DB0
                        .text C:\WINDOWS\system32\svchost.exe[1492] WININET.dll!InternetOpenUrlW 77AC7304 5 Bytes JMP 00080EC8
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
                        .text C:\WINDOWS\RTHDCPL.EXE[1628] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838
                        .text C:\WINDOWS\system32\spoolsv.exe[1796] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe[1804] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe[1804] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe[1804] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe[1804] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe[1804] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe[1804] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe[1804] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe[1804] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe[1804] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
                        .text C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe[1804] kernel32.dll!CreateProcessInternalW
                        3. g!rly Contributeur
                          re,

                          bon

                          nettoie tes fichiers temporaires avec ceci : atf cleaner, regarde le tuto...

                          http://www.infosecu.fr/atf.html

                          et :

                          Désactive ta restauration système:
                          pour cela :
                          Click droit sur poste de travail, dans l´arborescence sur propriétés;
                          dans la nouvelle fenettre click sur l´onglet restauration système;
                          coche la case désactiver la restauration systèm et applique.
                          puis redemarre le pc et click droit sur poste de travail, dans l´arborescence sur propriétés;
                          dans la nouvelle fenettre click sur l´onglet restauration systèm
                          décoche la case désactiver la restauration systèm et applique.

                          et :

                          http://www.gmer.net
                          GMER

                          post le rapport ici
                          1. godzilla82
                            J'ai fais la manip mais la ligne 023 a été virée avant...

                            Logfile of HijackThis v1.99.1
                            Scan saved at 23:02:56, on 02/11/2007
                            Platform: Windows XP SP2 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                            C:\WINDOWS\Explorer.EXE
                            C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                            C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                            C:\WINDOWS\system32\o2flash.exe
                            C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
                            C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
                            C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
                            C:\WINDOWS\system32\hkcmd.exe
                            C:\WINDOWS\system32\igfxpers.exe
                            C:\WINDOWS\system32\wuauclt.exe
                            C:\WINDOWS\RTHDCPL.EXE
                            C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                            C:\WINDOWS\system32\ctfmon.exe
                            C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe
                            C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\Rar$EX00.765\MyIE.exe
                            C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
                            C:\WINDOWS\system32\wuauclt.exe
                            C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                            O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                            O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
                            O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
                            O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                            O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                            O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                            O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                            O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                            O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                            O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                            O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
                            O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe
                            O4 - Global Startup: Jazler Studio Auto Startup.lnk = C:\Jazler Radio II\JZRADIO.exe
                            O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                            O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
                            O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
                            O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
                            O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                            O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                            O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O11 - Options group: [INTERNATIONAL] International*
                            O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
                            O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                            O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
                            O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                            O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                            O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                            O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                            O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                            O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
                            O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
                            1. g!rly Contributeur
                              bon

                              a l´aide de hijack this coche et fix ceci :
                              O17 - HKLM\System\CCS\Services\Tcpip\..\{82BD884B-C589-4FE9-A44A-E4D3697DD9C7}: NameServer = 208.67.220.220,208.67.222.222
                              O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
                              O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
                              O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
                              O23 - Service: Service de la passerelle de la couche Application ALGSysmonLog (ALGSysmonLog) - Unknown owner - C:\WINDOWS\system32\1031r.exe (file missing)

                              fix les lignes

                              puis ouvre a nouveau hijac this et click sur section outil > enlever un service nt et dans la case tiu copie et cole ceci :
                              Service de la passerelle de la couche Application ALGSysmonLog (ALGSysmonLog) et ok

                              repost un hijack this apres la manip
                              2. g!rly Contributeur
                                oui hijack this dis file missing

                                fais ceci :

                                Affiche tous les fichiers et dossiers :
                                Pour cela :
                                Clique sur démarrer/panneau de configuration/option des dossiers/affichage

                                Cocher afficher les dossiers cacher

                                Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

                                Décocher masquer les extensions dont le type est connu

                                Puis fais «Ok» pour valider les changements.

                                Et appliquer !

                                et regarde a nouveau
                                • 1
                                • 2
                                • 3
                                • 4

                                Discussions similaires

                                mappage noms de compte
                                jean38

                                17 réponses
                                demande de facturation sur application gratuite app store
                                maiiiiilys

                                24 réponses
                                Le mappage nom de comptes et ID de sécurité
                                SushiDan

                                1 réponse
                                Livraison chronopost
                                FD

                                5 réponses
                                PROBLEME MAPPAGE
                                HINGUESS

                                5 réponses