VIRUS

Question

Bonjour, 
j'ai un virus spyWorm.win32, des trojan
mon antivirus (Avast) arrête pas de me trouver des virus
lorsque je me connecte sur msn, des messages en anglais vont à mes contacts (même si je suis en hors ligne). ces messages parlent de photo et n'envoie pas de lien....mon ordi se bloque, la souris ne bouge plus.
je me demande si quelqu'un ne prend pas le contrôle de mon pc.

voilà si quelqu'un pouvait m'aider ça serait sympa.

Regis59 · Answer

Bienvenue sur le forum d’entraide de CommentCaMarche.net 

Nous connaissons votre situation et nous vous conseillons de ne surtout pas vous inquiéter.
De plus, au vu du nombre croissant de désinfections effectuées sur le forum, nous vous demandons un peu de patience et surtout de ne pas créer plusieurs postes pour le même problème.
Merci de votre compréhension.

Télécharge HijackThis ici: 
http://telechargement.zebulon.fr/138-hijackthis-1991.html 

Dézippe le dans un dossier prévu à cet effet. 
Par exemple C:\hijackthis < Enregistre-le bien dans c : ! 
Démo : (Merci a Balltrap34 pour cette réalisation)   
http://pageperso.aol.fr/balltrap34/Hijenr.gif 
	
Lance le puis: 
Clique sur "do a system scan and save logfile" (cf démo) 
Faire un copier coller du log entier sur le forum

Démo : (Merci a Balltrap34 pour cette réalisation)   
http://pageperso.aol.fr/balltrap34/demohijack.htm
	
Bon courage

A+

JO · Answer

Alors voilà le rapport (merci de l'aide)



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:13:51, on 10/11/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\mdasvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\Program Files\Fichiers communs\07%2F06%2F2007\bm.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\07%2F0~1\uga6pcw.exe
C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe
C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe
C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\malka\Local Settings\Temp\Répertoire temporaire 1 pour HiJackThis.zip\HijackThis.exe
C:\WINDOWS\explorer.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\System32\wobnujql.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Logical Disk Awareness] mdasvc.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Fichiers communs\07%2F06%2F2007\bm.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [uga6pcw] "C:\PROGRA~1\FICHIE~1\07%2F0~1\uga6pcw.exe" -start
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [Salestart(2)] "C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" dm=http://defensedudisque.com; ad=http://defensedudisque.com
O4 - HKLM\..\Run: [Salestart(3)] "C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" dm=http://moncontenuassistant.com; ad=http://moncontenuassistant.com
O4 - HKLM\..\Run: [ac18511d] rundll32.exe "C:\WINDOWS\System32\vjmppwqe.dll",b
O4 - HKLM\..\Run: [07%2F06%2F2007] C:\Program Files\07%2F06%2F2007\pgs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

Regis59 · Answer

Re,

Télécharge MSNFix.zip (de !aur3n7) sur ton bureau:
http://sosvirus.changelog.fr/MSNFix.zip

Décompresse-le (clic droit >> Extraire ici) et place les fichiers dans C:\MSNFix (très important).

Double cliquer sur le fichier MSNFix.bat.
- Exécutez l'option R.
-- Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage

Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal

- Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.txt

A+

JO · Answer

merci.

et ensuite je dois faire quoi? 
poster le rapport?

Regis59 · Answer

Oui :-)

A+

JO · Answer

MSNFix 1.573  
 
C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix 
Fix exécuté le 11/11/2007 - 13:34:30,87 By malka 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\DOCUME~1\malka\LOCALS~1\Temp\image??.zip 

************************  MSNCHK ***** /!\ beta test /!\


 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\DOCUME~1\malka\LOCALS~1\Temp\image??.zip  
 
 
 
************************ Nettoyage du registre 
 
 
 
************************ Fichiers suspects 
 
/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention 
 
[C:\PROGRA~1\ACMonitor_X83.exe] 58A76DB344B6F8E04EC35837AD6ABCCE 

[color=#FF0000][b]==>[/b][/color] SVP merci d'envoyer le fichier  [b] C:\DOCUME~1\malka\Bureau\Upload_Me.zip [/b] sur http://upload.changelog.fr

 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 11112007_13345406.zip
 
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------

Regis59 · Answer

Ok 

Ou en sont tes soucis?

A+

JO · Answer

j'ai toujours des alertes de virus  network worm et d'autres
et des trojan....

Regis59 · Answer

Oui Normal.

Télécharge VirtumundoBegone sur le bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions. 
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse avec un nouveau rapport HijackThis. 
Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu.

et:

Télécharge VundoFix.exe (par Atribune) sur ton Bureau. 
http://www.atribune.org/ccount/click.php?id=4 

Double-clique VundoFix.exe afin de le lancer. 
Clique sur le bouton Scan for Vundo. 
Lorsque le scan est complété, clique sur le bouton Remove Vundo. 
Une invite te demandera si tu veux supprimer les fichiers, clique YES 
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers. 
Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK 
Démarre ton PC à nouveau. 
Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

A+

JO · Answer

Rapport VBG 


[11/12/2007, 17:37:51] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\malka\Bureau\VirtumundoBeGone.exe" )
[11/12/2007, 17:38:02] - Detected System Information:
[11/12/2007, 17:38:02] -  Windows Version: 5.1.2600, 
[11/12/2007, 17:38:02] -  Current Username: malka (Admin)
[11/12/2007, 17:38:02] -  Windows is in NORMAL mode.
[11/12/2007, 17:38:02] - Searching for Browser Helper Objects:
[11/12/2007, 17:38:02] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:02] -  BHO 2: {634BBAB7-3F60-4426-944F-A62B9007F67F} ()
[11/12/2007, 17:38:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:02] -  Checking for HKLM\...\Winlogon\Notify\efccdaw
[11/12/2007, 17:38:02] -  Found: HKLM\...\Winlogon\Notify\efccdaw - This is probably Virtumundo.
[11/12/2007, 17:38:02] -  Assigning {634BBAB7-3F60-4426-944F-A62B9007F67F} MSEvents Object
[11/12/2007, 17:38:02] - BHO list has been changed! Starting over...
[11/12/2007, 17:38:02] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:02] -  BHO 2: {634BBAB7-3F60-4426-944F-A62B9007F67F} (MSEvents Object)
[11/12/2007, 17:38:02] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:02] -  BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:02] -  BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:02] -  BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:02] -  BHO 6: {A95B2816-1D7E-4561-A202-68C0DE02353A} ()
[11/12/2007, 17:38:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:02] -  Checking for HKLM\...\Winlogon\Notify\wobnujql
[11/12/2007, 17:38:02] -  Found: HKLM\...\Winlogon\Notify\wobnujql - This is probably Virtumundo.
[11/12/2007, 17:38:02] -  Assigning {A95B2816-1D7E-4561-A202-68C0DE02353A} MSEvents Object
[11/12/2007, 17:38:03] - BHO list has been changed! Starting over...
[11/12/2007, 17:38:03] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:03] -  BHO 2: {634BBAB7-3F60-4426-944F-A62B9007F67F} (MSEvents Object)
[11/12/2007, 17:38:03] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:03] -  BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:03] -  BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:03] -  BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:03] -  BHO 6: {A95B2816-1D7E-4561-A202-68C0DE02353A} (MSEvents Object)
[11/12/2007, 17:38:03] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:03] -  BHO 7: {B200FD97-F425-4D51-BCFA-3A19883DFACD} ()
[11/12/2007, 17:38:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:03] -  Checking for HKLM\...\Winlogon\Notify\mllmn
[11/12/2007, 17:38:03] -  Key not found: HKLM\...\Winlogon\Notify\mllmn, continuing.
[11/12/2007, 17:38:03] -  BHO 8: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[11/12/2007, 17:38:03] - Finished Searching Browser Helper Objects
[11/12/2007, 17:38:03] - *** Detected MSEvents Object
[11/12/2007, 17:38:03] - Trying to remove MSEvents Object...
[11/12/2007, 17:38:04] -    Terminating Process: IEXPLORE.EXE
[11/12/2007, 17:38:05] -    Terminating Process: RUNDLL32.EXE
[11/12/2007, 17:38:05] -    Disabling Automatic Shell Restart
[11/12/2007, 17:38:05] -    Terminating Process: EXPLORER.EXE
[11/12/2007, 17:38:05] -    Suspending the NT Session Manager System Service
[11/12/2007, 17:38:05] -    Terminating Windows NT Logon/Logoff Manager
[11/12/2007, 17:38:06] -    Re-enabling Automatic Shell Restart
[11/12/2007, 17:38:06] -   File to disable: C:\WINDOWS\System32\efccdaw.dll
[11/12/2007, 17:38:06] -  Renaming C:\WINDOWS\System32\efccdaw.dll -> C:\WINDOWS\System32\efccdaw.dll.vir
[11/12/2007, 17:38:07] -  File successfully renamed!
[11/12/2007, 17:38:07] -   Removing HKLM\...\Browser Helper Objects\{634BBAB7-3F60-4426-944F-A62B9007F67F}
[11/12/2007, 17:38:07] -   Removing HKCR\CLSID\{634BBAB7-3F60-4426-944F-A62B9007F67F}
[11/12/2007, 17:38:07] -   Adding Kill Bit for ActiveX for GUID: {634BBAB7-3F60-4426-944F-A62B9007F67F}
[11/12/2007, 17:38:07] -   Deleting ATLEvents/MSEvents Registry entries
[11/12/2007, 17:38:07] -   Removing HKLM\...\Winlogon\Notify\efccdaw
[11/12/2007, 17:38:07] - Searching for Browser Helper Objects:
[11/12/2007, 17:38:07] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:07] -  BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:07] -  BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:07] -  BHO 4: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:07] -  BHO 5: {A95B2816-1D7E-4561-A202-68C0DE02353A} (MSEvents Object)
[11/12/2007, 17:38:07] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:07] -  BHO 6: {B200FD97-F425-4D51-BCFA-3A19883DFACD} ()
[11/12/2007, 17:38:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:07] -  Checking for HKLM\...\Winlogon\Notify\mllmn
[11/12/2007, 17:38:07] -  Key not found: HKLM\...\Winlogon\Notify\mllmn, continuing.
[11/12/2007, 17:38:07] -  BHO 7: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[11/12/2007, 17:38:07] - Finished Searching Browser Helper Objects
[11/12/2007, 17:38:07] - *** Detected MSEvents Object
[11/12/2007, 17:38:07] - Trying to remove MSEvents Object...
[11/12/2007, 17:38:08] -    Terminating Process: IEXPLORE.EXE
[11/12/2007, 17:38:08] -    Terminating Process: RUNDLL32.EXE
[11/12/2007, 17:38:08] -    Disabling Automatic Shell Restart
[11/12/2007, 17:38:08] -    Terminating Process: EXPLORER.EXE
[11/12/2007, 17:38:08] -    Suspending the NT Session Manager System Service
[11/12/2007, 17:38:09] -    Terminating Windows NT Logon/Logoff Manager
[11/12/2007, 17:38:09] -    Re-enabling Automatic Shell Restart
[11/12/2007, 17:38:09] -   File to disable: C:\WINDOWS\System32\wobnujql.dll
[11/12/2007, 17:38:09] -  Renaming C:\WINDOWS\System32\wobnujql.dll -> C:\WINDOWS\System32\wobnujql.dll.vir
[11/12/2007, 17:38:09] -  File successfully renamed!
[11/12/2007, 17:38:09] -   Removing HKLM\...\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/12/2007, 17:38:09] -   Removing HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/12/2007, 17:38:09] -   Adding Kill Bit for ActiveX for GUID: {A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/12/2007, 17:38:09] -   Deleting ATLEvents/MSEvents Registry entries
[11/12/2007, 17:38:09] -   Removing HKLM\...\Winlogon\Notify\wobnujql
[11/12/2007, 17:38:09] - Searching for Browser Helper Objects:
[11/12/2007, 17:38:09] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:09] -  BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:09] -  BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:09] -  BHO 4: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:09] -  BHO 5: {B200FD97-F425-4D51-BCFA-3A19883DFACD} ()
[11/12/2007, 17:38:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:09] -  Checking for HKLM\...\Winlogon\Notify\mllmn
[11/12/2007, 17:38:09] -  Key not found: HKLM\...\Winlogon\Notify\mllmn, continuing.
[11/12/2007, 17:38:09] -  BHO 6: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[11/12/2007, 17:38:09] - Finished Searching Browser Helper Objects
[11/12/2007, 17:38:09] - Finishing up...
[11/12/2007, 17:38:09] - A restart is needed.
[11/12/2007, 17:38:16] - Attempting to Restart via STOP error (Blue Screen!)

JO · Answer

Rapport VBG 


[11/12/2007, 17:37:51] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\malka\Bureau\VirtumundoBeGone.exe" )
[11/12/2007, 17:38:02] - Detected System Information:
[11/12/2007, 17:38:02] -  Windows Version: 5.1.2600, 
[11/12/2007, 17:38:02] -  Current Username: malka (Admin)
[11/12/2007, 17:38:02] -  Windows is in NORMAL mode.
[11/12/2007, 17:38:02] - Searching for Browser Helper Objects:
[11/12/2007, 17:38:02] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:02] -  BHO 2: {634BBAB7-3F60-4426-944F-A62B9007F67F} ()
[11/12/2007, 17:38:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:02] -  Checking for HKLM\...\Winlogon\Notify\efccdaw
[11/12/2007, 17:38:02] -  Found: HKLM\...\Winlogon\Notify\efccdaw - This is probably Virtumundo.
[11/12/2007, 17:38:02] -  Assigning {634BBAB7-3F60-4426-944F-A62B9007F67F} MSEvents Object
[11/12/2007, 17:38:02] - BHO list has been changed! Starting over...
[11/12/2007, 17:38:02] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:02] -  BHO 2: {634BBAB7-3F60-4426-944F-A62B9007F67F} (MSEvents Object)
[11/12/2007, 17:38:02] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:02] -  BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:02] -  BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:02] -  BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:02] -  BHO 6: {A95B2816-1D7E-4561-A202-68C0DE02353A} ()
[11/12/2007, 17:38:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:02] -  Checking for HKLM\...\Winlogon\Notify\wobnujql
[11/12/2007, 17:38:02] -  Found: HKLM\...\Winlogon\Notify\wobnujql - This is probably Virtumundo.
[11/12/2007, 17:38:02] -  Assigning {A95B2816-1D7E-4561-A202-68C0DE02353A} MSEvents Object
[11/12/2007, 17:38:03] - BHO list has been changed! Starting over...
[11/12/2007, 17:38:03] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:03] -  BHO 2: {634BBAB7-3F60-4426-944F-A62B9007F67F} (MSEvents Object)
[11/12/2007, 17:38:03] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:03] -  BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:03] -  BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:03] -  BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:03] -  BHO 6: {A95B2816-1D7E-4561-A202-68C0DE02353A} (MSEvents Object)
[11/12/2007, 17:38:03] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:03] -  BHO 7: {B200FD97-F425-4D51-BCFA-3A19883DFACD} ()
[11/12/2007, 17:38:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:03] -  Checking for HKLM\...\Winlogon\Notify\mllmn
[11/12/2007, 17:38:03] -  Key not found: HKLM\...\Winlogon\Notify\mllmn, continuing.
[11/12/2007, 17:38:03] -  BHO 8: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[11/12/2007, 17:38:03] - Finished Searching Browser Helper Objects
[11/12/2007, 17:38:03] - *** Detected MSEvents Object
[11/12/2007, 17:38:03] - Trying to remove MSEvents Object...
[11/12/2007, 17:38:04] -    Terminating Process: IEXPLORE.EXE
[11/12/2007, 17:38:05] -    Terminating Process: RUNDLL32.EXE
[11/12/2007, 17:38:05] -    Disabling Automatic Shell Restart
[11/12/2007, 17:38:05] -    Terminating Process: EXPLORER.EXE
[11/12/2007, 17:38:05] -    Suspending the NT Session Manager System Service
[11/12/2007, 17:38:05] -    Terminating Windows NT Logon/Logoff Manager
[11/12/2007, 17:38:06] -    Re-enabling Automatic Shell Restart
[11/12/2007, 17:38:06] -   File to disable: C:\WINDOWS\System32\efccdaw.dll
[11/12/2007, 17:38:06] -  Renaming C:\WINDOWS\System32\efccdaw.dll -> C:\WINDOWS\System32\efccdaw.dll.vir
[11/12/2007, 17:38:07] -  File successfully renamed!
[11/12/2007, 17:38:07] -   Removing HKLM\...\Browser Helper Objects\{634BBAB7-3F60-4426-944F-A62B9007F67F}
[11/12/2007, 17:38:07] -   Removing HKCR\CLSID\{634BBAB7-3F60-4426-944F-A62B9007F67F}
[11/12/2007, 17:38:07] -   Adding Kill Bit for ActiveX for GUID: {634BBAB7-3F60-4426-944F-A62B9007F67F}
[11/12/2007, 17:38:07] -   Deleting ATLEvents/MSEvents Registry entries
[11/12/2007, 17:38:07] -   Removing HKLM\...\Winlogon\Notify\efccdaw
[11/12/2007, 17:38:07] - Searching for Browser Helper Objects:
[11/12/2007, 17:38:07] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:07] -  BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:07] -  BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:07] -  BHO 4: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:07] -  BHO 5: {A95B2816-1D7E-4561-A202-68C0DE02353A} (MSEvents Object)
[11/12/2007, 17:38:07] - ALERT: Found MSEvents Object!
[11/12/2007, 17:38:07] -  BHO 6: {B200FD97-F425-4D51-BCFA-3A19883DFACD} ()
[11/12/2007, 17:38:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:07] -  Checking for HKLM\...\Winlogon\Notify\mllmn
[11/12/2007, 17:38:07] -  Key not found: HKLM\...\Winlogon\Notify\mllmn, continuing.
[11/12/2007, 17:38:07] -  BHO 7: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[11/12/2007, 17:38:07] - Finished Searching Browser Helper Objects
[11/12/2007, 17:38:07] - *** Detected MSEvents Object
[11/12/2007, 17:38:07] - Trying to remove MSEvents Object...
[11/12/2007, 17:38:08] -    Terminating Process: IEXPLORE.EXE
[11/12/2007, 17:38:08] -    Terminating Process: RUNDLL32.EXE
[11/12/2007, 17:38:08] -    Disabling Automatic Shell Restart
[11/12/2007, 17:38:08] -    Terminating Process: EXPLORER.EXE
[11/12/2007, 17:38:08] -    Suspending the NT Session Manager System Service
[11/12/2007, 17:38:09] -    Terminating Windows NT Logon/Logoff Manager
[11/12/2007, 17:38:09] -    Re-enabling Automatic Shell Restart
[11/12/2007, 17:38:09] -   File to disable: C:\WINDOWS\System32\wobnujql.dll
[11/12/2007, 17:38:09] -  Renaming C:\WINDOWS\System32\wobnujql.dll -> C:\WINDOWS\System32\wobnujql.dll.vir
[11/12/2007, 17:38:09] -  File successfully renamed!
[11/12/2007, 17:38:09] -   Removing HKLM\...\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/12/2007, 17:38:09] -   Removing HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/12/2007, 17:38:09] -   Adding Kill Bit for ActiveX for GUID: {A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/12/2007, 17:38:09] -   Deleting ATLEvents/MSEvents Registry entries
[11/12/2007, 17:38:09] -   Removing HKLM\...\Winlogon\Notify\wobnujql
[11/12/2007, 17:38:09] - Searching for Browser Helper Objects:
[11/12/2007, 17:38:09] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[11/12/2007, 17:38:09] -  BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/12/2007, 17:38:09] -  BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/12/2007, 17:38:09] -  BHO 4: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[11/12/2007, 17:38:09] -  BHO 5: {B200FD97-F425-4D51-BCFA-3A19883DFACD} ()
[11/12/2007, 17:38:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/12/2007, 17:38:09] -  Checking for HKLM\...\Winlogon\Notify\mllmn
[11/12/2007, 17:38:09] -  Key not found: HKLM\...\Winlogon\Notify\mllmn, continuing.
[11/12/2007, 17:38:09] -  BHO 6: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[11/12/2007, 17:38:09] - Finished Searching Browser Helper Objects
[11/12/2007, 17:38:09] - Finishing up...
[11/12/2007, 17:38:09] - A restart is needed.
[11/12/2007, 17:38:16] - Attempting to Restart via STOP error (Blue Screen!)

JO · Answer

Nouveau rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:48:15, on 12/11/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\mdasvc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\FICHIE~1\07%2F0~1\uga6pcw.exe
C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe
C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe
C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32undll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\sol.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\System32\bbkkorit.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Logical Disk Awareness] mdasvc.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Fichiers communs\07%2F06%2F2007\bm.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [uga6pcw] "C:\PROGRA~1\FICHIE~1\07%2F0~1\uga6pcw.exe" -start
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [Salestart(2)] "C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" dm=http://defensedudisque.com; ad=http://defensedudisque.com
O4 - HKLM\..\Run: [Salestart(3)] "C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" dm=http://moncontenuassistant.com; ad=http://moncontenuassistant.com
O4 - HKLM\..\Run: [ac18511d] rundll32.exe "C:\WINDOWS\System32\slbaylia.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

JO · Answer

Rapport VUNDO FIX


VundoFix V6.5.11

Checking Java version...

Scan started at 17:50:19 12/11/2007

Listing files found while scanning....

C:\WINDOWS\System32\bbkkorit.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\System32\bbkkorit.dll
C:\WINDOWS\System32\bbkkorit.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\System32\bbkkorit.dll
C:\WINDOWS\System32\bbkkorit.dll Has been deleted!

Performing Repairs to the registry.
Done!

JO · Answer

Nouveau nouveau rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:01:31, on 12/11/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\mdasvc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\FICHIE~1\07%2F0~1\uga6pcw.exe
C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe
C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe
C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Logical Disk Awareness] mdasvc.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Fichiers communs\07%2F06%2F2007\bm.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [uga6pcw] "C:\PROGRA~1\FICHIE~1\07%2F0~1\uga6pcw.exe" -start
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [Salestart(2)] "C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" dm=http://defensedudisque.com; ad=http://defensedudisque.com
O4 - HKLM\..\Run: [Salestart(3)] "C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" dm=http://moncontenuassistant.com; ad=http://moncontenuassistant.com
O4 - HKLM\..\Run: [ac18511d] rundll32.exe "C:\WINDOWS\System32\slbaylia.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

Regis59 · Answer

Ok;

Télécharge Combofix sUBs : [url=http://download.bleepingcomputer.com/sUBs/ComboFix.exe]combofix.exe[/url]
et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

Copie/colle un nouveau rapport HiJackThis avec.

A+

JO · Answer

ComboFix 07-11-08.1 - malka 2007-11-13 13:49:57.1 - NTFSx86 Running from: C:\Documents and Settings\malka\Bureau\ComboFix.exe * Created a new restore point . Incapable d'obtenir les privilèges Système (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data.\salesmonitor C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk C:\Documents and Settings\malka\Application Data\install_en[1].exe C:\Documents and Settings\malka\Bureau\Live Safety Center.lnk C:\Documents and Settings\malka\Bureau\Online Security Guide.lnk C:\Documents and Settings\malka\Favoris\Online Security Guide.lnk C:\WINDOWS\system32\bbkkorit.dllbox C:\WINDOWS\system32\mllmn.dll C:\WINDOWS\system32\nmllm.ini C:\WINDOWS\system32\nmllm.ini2 C:\WINDOWS\system32\wobnujql.dllbox C:\WINDOWS\system32\xbdhonur.dll . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-13 to 2007-11-13 )))))))))))))))))))))))))))))))))))) . 2007-11-13 13:49 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-12 17:50 d-------- C:\VundoFix Backups 2007-11-12 17:40 145,472 --a------ C:\WINDOWS\system32\fsccgijy.dll 2007-11-12 17:40 84,032 --a------ C:\WINDOWS\system32\slbaylia.dll 2007-11-11 11:59 d-------- C:\MSN FIXX 2007-11-11 02:19 d-------- C:\msnfix 2007-11-10 17:39 84,032 --a------ C:\WINDOWS\system32\vjmppwqe.dll 2007-11-09 17:31 d-------- C:\Program Files\Trend Micro 2007-11-09 16:41 84,032 --------- C:\WINDOWS\system32\oqorhbil.dll 2007-11-08 19:26 36,352 --a------ C:\WINDOWS\system32\ssqpmkh.dll 2007-11-08 18:16 36,352 --a------ C:\WINDOWS\system32\gebxxyw.dll 2007-11-08 17:53 36,352 --a------ C:\WINDOWS\system32\hggdcyw.dll 2007-11-08 17:43 36,352 --a------ C:\WINDOWS\system32\urqrsts.dll 2007-11-08 00:25 d-------- C:\Documents and Settings\malka\Application Data\MonContenuassistant 2007-11-07 21:31 d--hs---- C:\found.000 2007-11-07 13:14 d-------- C:\Program Files\Fichiers communs\MonContenuassistant 2007-11-07 13:13 d-------- C:\Documents and Settings\malka\Application Data\defensedudisque 2007-11-07 13:08 dr------- C:\Documents and Settings\All Users\Application Data\defensedudisque 2007-11-07 13:07 d-------- C:\Program Files\Fichiers communs\DefenseDuDisque 2007-11-07 13:07 d-------- C:\Program Files\DefenseDuDisque 2007-11-07 13:03 d-------- C:\Documents and Settings\malka\Application Data\[u]0[/u]7%2F06%2F2007 2007-11-07 12:56 681,984 --a------ C:\WINDOWS\is-P5HI2.exe 2007-11-07 12:54 681,984 --a------ C:\WINDOWS\is-NSG79.exe 2007-11-07 12:50 681,984 --a------ C:\WINDOWS\is-KJNGJ.exe 2007-11-07 12:39 681,984 --a------ C:\WINDOWS\is-LEKDT.exe 2007-11-07 12:36 681,984 --a------ C:\WINDOWS\is-DNTO1.exe 2007-11-07 12:34 681,984 --a------ C:\WINDOWS\is-BG01F.exe 2007-11-07 12:32 681,984 --a------ C:\WINDOWS\is-F0KPU.exe 2007-11-07 12:28 d-------- C:\Program Files\Fichiers communs\[u]0[/u]7%2F06%2F2007 2007-11-07 12:28 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-11-07 12:19 145,472 --a------ C:\WINDOWS\system32\wobnujql.dll.vir 2007-11-07 12:19 145,472 --a------ C:\WINDOWS\system32\ihwmfyei.dll 2007-11-05 20:58 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-11-05 20:58 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-11-05 20:58 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-11-05 20:58 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-11-05 20:58 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-11-05 20:58 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-05 20:58 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-11-05 20:50 36,352 --a------ C:\WINDOWS\system32\rqrsrrr.dll 2007-11-05 20:39 36,352 --a------ C:\WINDOWS\system32\qomklki.dll 2007-11-05 19:55 36,352 --a------ C:\WINDOWS\system32\wvuvtrq.dll 2007-11-05 19:53 36,352 --a------ C:\WINDOWS\system32\efccdaw.dll.vir 2007-11-04 21:20 10,752 -r-hs---- C:\WINDOWS\system32\mdasvc.exe 2007-11-02 17:39 56,448 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys 2007-11-02 17:39 56,448 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys 2007-11-02 17:38 50,688 --a------ C:\WINDOWS\system32\vfwwdm32.dll 2007-11-02 17:38 50,688 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll 2007-11-02 17:38 45,568 --a------ C:\WINDOWS\system32\iyuv_32.dll 2007-11-02 17:38 45,568 --a--c--- C:\WINDOWS\system32\dllcache\iyuv_32.dll 2007-11-02 17:38 8,192 --a------ C:\WINDOWS\system32\tsbyuv.dll 2007-11-02 17:38 8,192 --a--c--- C:\WINDOWS\system32\dllcache\tsbyuv.dll 2007-11-01 19:32 26,528 -ra------ C:\WINDOWS\system32\drivers\lvuvcflt.sys 2007-11-01 19:32 24,960 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-11-01 19:32 24,960 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-12 18:39 --------- d-----w C:\Program Files\FoxTarot4 2007-11-08 20:07 --------- d-----w C:\Documents and Settings\malka\Application Data\LimeWire 2007-11-07 17:10 --------- d-----w C:\Program Files\MSN Messenger 2007-11-06 13:04 --------- d-----w C:\Program Files\Ubi Soft 2007-11-05 19:58 --------- d-----w C:\Program Files\Alwil Software 2007-09-14 20:32 --------- d-----w C:\Program Files\LimeWire 2007-09-14 20:32 --------- d-----w C:\Program Files\Java 2007-09-14 20:30 --------- d-----w C:\Program Files\Fichiers communs\Java 2006-11-11 14:07 17,144 ----a-w C:\Documents and Settings\malka\Application Data\GDIPFONTCACHEV1.DAT 2001-06-20 14:19 40,960 ----a-w C:\Program Files\ACMonitor_X83.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-04-23 11:24] "nwiz"="nwiz.exe" [2004-04-23 11:24 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-04-23 11:24] "Lexmark X83 Button Monitor"="C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe" [2001-10-12 17:36] "Lexmark X83 Button Manager"="C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe" [2001-06-10 13:59] "PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2001-10-25 19:20] "SoundMan"="SOUNDMAN.EXE" [2003-08-14 23:34 C:\WINDOWS\SOUNDMAN.EXE] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 08:18] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00] "Logical Disk Awareness"="mdasvc.exe" [2007-11-04 20:19 C:\WINDOWS\system32\mdasvc.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] "Salestart(1)"="C:\Program Files\Fichiers communs\[u]0[/u]7%2F06%2F2007\stmon.exe" [2007-10-11 15:21] "Salestart(2)"="C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" [2007-10-09 18:00] "Salestart(3)"="C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" [2007-10-09 15:09] "ac18511d"="C:\WINDOWS\System32\slbaylia.dll" [2007-11-12 17:40] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-28 13:00] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\System32\mllmn.dll R0 PzWDM;PzWDM;C:\WINDOWS\System32\Drivers\PzWDM.sys R3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;C:\WINDOWS\System32\DRIVERS\WlanUIG.sys S2 BulkUsb;Genesys Logic USB Scanner Controller NT 5.0;C:\WINDOWS\System32\Drivers\usbscan.sys S3 PAC7311;VGA SoC PC-Camer@;C:\WINDOWS\System32\DRIVERS\PA707UCM.SYS . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-11-02 14:16:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-13 13:57:41 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-13 13:59:56 - machine was rebooted . --- E O F ---

JO · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:01:51, on 13/11/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\mdasvc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe
C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe
C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Logical Disk Awareness] mdasvc.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [Salestart(2)] "C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" dm=http://defensedudisque.com; ad=http://defensedudisque.com
O4 - HKLM\..\Run: [Salestart(3)] "C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" dm=http://moncontenuassistant.com; ad=http://moncontenuassistant.com
O4 - HKLM\..\Run: [ac18511d] rundll32.exe "C:\WINDOWS\System32\slbaylia.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

JO · Answer

je n'ai plus rien à faire??

Regis59 · Answer

Si lol

Dans ajout/suppression de programmes tu as ceci?
DefenseDuDisque
MonContenuassistant

A+

JO · Answer

dsl j'ai posé la question comme je n'avais plus de réponse.

non je les ai pas dans ajout/suppression, j'avais dû les supprimer avant

Regis59 · Answer

Re,

Vas sur le site https://virusscan.jotti.org/ 
- Clic en haut à droite sur "Parcourir", navigue dans les dossiers et sélectionne ce fichier : C:\WINDOWS\is-P5HI2.exe
- Clic sur submit toujours en haut à droite 
- Le scan va se lancer, ça va prendre un petit instant 
- En bas, tu as le résultat du scan, copie/colle le résultat complet du scan ici. 
Aide : https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId662799


télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

C:\WINDOWS\system32\fsccgijy.dll
C:\WINDOWS\system32\slbaylia.dll
C:\WINDOWS\system32\vjmppwqe.dll
C:\WINDOWS\system32\oqorhbil.dll
C:\WINDOWS\system32\ssqpmkh.dll
C:\WINDOWS\system32\gebxxyw.dll
C:\WINDOWS\system32\hggdcyw.dll
C:\WINDOWS\system32\urqrsts.dll
C:\Documents and Settings\malka\Application Data\MonContenuassistant
C:\Program Files\Fichiers communs\MonContenuassistant
C:\Documents and Settings\All Users\Application Data\defensedudisque
C:\Program Files\Fichiers communs\DefenseDuDisque
C:\Program Files\DefenseDuDisque
C:\Documents and Settings\malka\Application Data\defensedudisque 
C:\WINDOWS\system32\atl71.dll
C:\WINDOWS\system32\wobnujql.dll.vir
C:\WINDOWS\system32\ihwmfyei.dll
C:\WINDOWS\system32\rqrsrrr.dll
C:\WINDOWS\system32\qomklki.dll
C:\WINDOWS\system32\wvuvtrq.dll
C:\WINDOWS\system32\efccdaw.dll.vir
C:\WINDOWS\system32\mdasvc.exe
C:\WINDOWS\System32\slbaylia.dll
C:\WINDOWS\System32\mllmn.dll 

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

A+

JO · Answer

Scanner results  
Scan taken on 18 Nov 2007 20:11:39 (GMT)  
A-Squared  Found nothing 
AntiVir  Found nothing 
ArcaVir  Found nothing 
Avast  Found nothing 
AVG Antivirus  Found nothing 
BitDefender  Found nothing 
ClamAV  Found nothing 
CPsecure  Found nothing 
Dr.Web  Found nothing 
F-Prot Antivirus  Found nothing 
F-Secure Anti-Virus  Found nothing 
Fortinet  Found nothing 
Kaspersky Anti-Virus  Found nothing 
NOD32  Found nothing 
Norman Virus Control  Found nothing 
Panda Antivirus  Found nothing 
Rising Antivirus  Found nothing 
Sophos Antivirus  Found nothing 
VirusBuster  Found nothing 
VBA32  Found nothing

JO · Answer

C:\WINDOWS\system32\fsccgijy.dll unregistered successfully.
C:\WINDOWS\system32\fsccgijy.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\slbaylia.dll
C:\WINDOWS\system32\slbaylia.dll NOT unregistered.
C:\WINDOWS\system32\slbaylia.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\vjmppwqe.dll
C:\WINDOWS\system32\vjmppwqe.dll NOT unregistered.
C:\WINDOWS\system32\vjmppwqe.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\oqorhbil.dll
C:\WINDOWS\system32\oqorhbil.dll NOT unregistered.
C:\WINDOWS\system32\oqorhbil.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ssqpmkh.dll
C:\WINDOWS\system32\ssqpmkh.dll NOT unregistered.
C:\WINDOWS\system32\ssqpmkh.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\gebxxyw.dll
C:\WINDOWS\system32\gebxxyw.dll NOT unregistered.
C:\WINDOWS\system32\gebxxyw.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\hggdcyw.dll
C:\WINDOWS\system32\hggdcyw.dll NOT unregistered.
C:\WINDOWS\system32\hggdcyw.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\urqrsts.dll
C:\WINDOWS\system32\urqrsts.dll NOT unregistered.
C:\WINDOWS\system32\urqrsts.dll moved successfully.
C:\Documents and Settings\malka\Application Data\MonContenuassistant\Logs moved successfully.
C:\Documents and Settings\malka\Application Data\MonContenuassistant moved successfully.
C:\Program Files\Fichiers communs\MonContenuassistant moved successfully.
Folder move failed. C:\Documents and Settings\All Users\Application Data\defensedudisque\Data\user scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\All Users\Application Data\defensedudisque\Data\oid scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\All Users\Application Data\defensedudisque\Data\em scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\All Users\Application Data\defensedudisque\Data\ac scheduled to be moved on reboot.
C:\Documents and Settings\All Users\Application Data\defensedudisque\Data moved successfully.
C:\Documents and Settings\All Users\Application Data\defensedudisque moved successfully.
C:\Program Files\Fichiers communs\DefenseDuDisque moved successfully.
C:\Program Files\DefenseDuDisque moved successfully.
C:\Documents and Settings\malka\Application Data\defensedudisque\Logs moved successfully.
C:\Documents and Settings\malka\Application Data\defensedudisque moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\atl71.dll
C:\WINDOWS\system32\atl71.dll NOT unregistered.
C:\WINDOWS\system32\atl71.dll moved successfully.
C:\WINDOWS\system32\wobnujql.dll.vir moved successfully.
C:\WINDOWS\system32\ihwmfyei.dll unregistered successfully.
C:\WINDOWS\system32\ihwmfyei.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\rqrsrrr.dll
C:\WINDOWS\system32\rqrsrrr.dll NOT unregistered.
C:\WINDOWS\system32\rqrsrrr.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\qomklki.dll
C:\WINDOWS\system32\qomklki.dll NOT unregistered.
C:\WINDOWS\system32\qomklki.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\wvuvtrq.dll
C:\WINDOWS\system32\wvuvtrq.dll NOT unregistered.
C:\WINDOWS\system32\wvuvtrq.dll moved successfully.
C:\WINDOWS\system32\efccdaw.dll.vir moved successfully.
C:\WINDOWS\system32\mdasvc.exe moved successfully.
File/Folder C:\WINDOWS\System32\slbaylia.dll not found.
File/Folder C:\WINDOWS\System32\mllmn.dll not found.
 
Created on 11/18/2007 21:20:37

Regis59 · Answer

Ok, remet un combofix et un Hijackthis stp

A+

JO · Answer

Hijackthis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:17:49, on 19/11/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\cmd.exe
C:\WINDOWS\system32\cscript.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Logical Disk Awareness] mdasvc.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [Salestart(2)] "C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" dm=http://defensedudisque.com; ad=http://defensedudisque.com
O4 - HKLM\..\Run: [Salestart(3)] "C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" dm=http://moncontenuassistant.com; ad=http://moncontenuassistant.com
O4 - HKLM\..\Run: [ac18511d] rundll32.exe "C:\WINDOWS\System32\slbaylia.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

JO · Answer

Le combofix a expiré.

Quelle est le nouveau lien?

Regis59 · Answer

Salut

fournit moi ce rapport stp
http://www.malekal.com/DiagHelp/DiagHelp.php

A+

JO · Answer

DiagHelp version v1.4 - http://www.malekal.com
excute le 21/11/2007 à 0:04:22,88

Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\WINDOWS\prefetch\CHCP.COM-17EDBDC9.pf -->21/11/2007 00:04:19
C:\WINDOWS\prefetch\CMD.EXE-034B0549.pf -->21/11/2007 00:03:56
C:\WINDOWS\prefetch\EXPLORER.EXE-02121B1A.pf -->21/11/2007 00:03:17
C:\WINDOWS\prefetch\QTTASK.EXE-1876A1A1.pf -->21/11/2007 00:00:25
C:\WINDOWS\prefetch\WUAUCLT.EXE-1360D60A.pf -->21/11/2007 00:00:01
C:\WINDOWS\prefetch\IEXPLORE.EXE-2D97EBE6.pf -->20/11/2007 23:59:47
C:\WINDOWS\prefetch\MSNAPPAU.EXE-17A3A6E5.pf -->20/11/2007 23:59:38
C:\WINDOWS\prefetch\LOG VIEWER.EXE-367A4CA4.pf -->20/11/2007 23:55:08
C:\WINDOWS\prefetch\SETUP.OVR-1ABDA79A.pf -->20/11/2007 23:34:22
C:\WINDOWS\prefetch\AVAST.SETUP-295443AF.pf -->20/11/2007 23:34:15

C:\WINDOWS\System32\drivers\aswmon.sys -->06/09/2007 12:05:25
C:\WINDOWS\System32\drivers\aswmon2.sys -->06/09/2007 12:05:10
C:\WINDOWS\System32\drivers\aswRdr.sys -->06/09/2007 12:03:02
C:\WINDOWS\System32\drivers\aswTdi.sys -->06/09/2007 12:02:20
C:\WINDOWS\System32\drivers\aavmker4.sys -->06/09/2007 12:00:53
C:\WINDOWS\System32\drivers\lvuvcflt.sys -->12/05/2007 01:31:12
C:\WINDOWS\System32\drivers\secdrv.sys -->28/10/2006 12:07:54

C:\WINDOWS\System32\nvapps.xml -->20/11/2007 15:28:11
C:\WINDOWS\System32\ailyabls.ini -->18/11/2007 19:59:08
C:\WINDOWS\System32\wpa.dbl -->18/11/2007 12:06:08
C:\WINDOWS\System32\mcrh.tmp -->14/11/2007 19:43:53
C:\WINDOWS\System32\isohspie.ini -->12/11/2007 17:39:46
C:\WINDOWS\System32\eqwppmjv.ini -->11/11/2007 13:30:23
C:\WINDOWS\System32\libhroqo.ini -->10/11/2007 17:38:39
C:\WINDOWS\System32\ocjolhyc.ini -->09/11/2007 16:40:04
C:\WINDOWS\System32\uicpdmix.ini -->08/11/2007 13:25:03
C:\WINDOWS\System32\CONFIG.NT -->06/11/2007 15:58:59
C:\WINDOWS\System32\perfh00C.dat -->28/10/2007 09:11:50
C:\WINDOWS\System32\perfh009.dat -->28/10/2007 09:11:50
C:\WINDOWS\System32\perfc00C.dat -->28/10/2007 09:11:50
C:\WINDOWS\System32\perfc009.dat -->28/10/2007 09:11:50
C:\WINDOWS\System32\PerfStringBackup.INI -->28/10/2007 09:11:49
C:\WINDOWS\System32\jupdate-1.6.0_02-b06.log -->14/09/2007 21:32:22
C:\WINDOWS\System32\aswBoot.exe -->06/09/2007 12:09:49
C:\WINDOWS\System32\AvastSS.scr -->06/09/2007 12:00:07
C:\WINDOWS\System32\wuweb.dll -->30/07/2007 19:19:46
C:\WINDOWS\System32\javaws.exe -->12/07/2007 01:22:38
C:\WINDOWS\System32\javacpl.cpl -->12/07/2007 01:22:36
C:\WINDOWS\System32\javaw.exe -->12/07/2007 00:22:04
C:\WINDOWS\System32\java.exe -->12/07/2007 00:22:00
C:\WINDOWS\System32\QuickTimeVR.qtx -->29/06/2007 05:24:58
C:\WINDOWS\System32\QuickTime.qts -->29/06/2007 05:24:58

C:\WINDOWS\WindowsUpdate.log -->20/11/2007 23:34:50
C:\WINDOWS\0.log -->20/11/2007 15:28:36
C:\WINDOWS\wiaservc.log -->20/11/2007 15:28:15
C:\WINDOWS\wiadebug.log -->20/11/2007 15:28:14
C:\WINDOWS\ACMonitor_X83.ini -->20/11/2007 15:28:07
C:\WINDOWS\bootstat.dat -->20/11/2007 15:27:55
C:\WINDOWS\SchedLgU.Txt -->20/11/2007 07:45:35
C:\WINDOWS\cookies.ini -->18/11/2007 12:45:05
C:\WINDOWS\tsoc.log -->18/11/2007 12:40:03
C:\WINDOWS\ocmsn.log -->18/11/2007 12:40:03
C:\WINDOWS\ocgen.log -->18/11/2007 12:40:03
C:\WINDOWS\ntdtcsetup.log -->18/11/2007 12:40:03
C:\WINDOWS\msgsocm.log -->18/11/2007 12:40:03
C:\WINDOWS\imsins.log -->18/11/2007 12:40:03
C:\WINDOWS\iis6.log -->18/11/2007 12:40:03

winlogon.exe
svchost.exe
ws2_32.dll
user32.dll
tcpip.sys
ndis.sys
null.sys
Verified: Signed

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 1664
Command line: C:\WINDOWS\Explorer.EXE

Base Size Version Path
0x01000000 0xf8000 6.00.2600.0000 C:\WINDOWS\Explorer.EXE
0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll
0x77290000 0x63000 6.00.2600.0000 C:\WINDOWS\system32\SHLWAPI.dll
0x77390000 0x802000 6.00.2600.0000 C:\WINDOWS\system32\SHELL32.dll
0x770e0000 0x8b000 3.50.5014.0000 C:\WINDOWS\system32\OLEAUT32.dll
0x75f10000 0xfc000 6.00.2600.0000 C:\WINDOWS\System32\BROWSEUI.dll
0x76960000 0x149000 6.00.2600.0000 C:\WINDOWS\System32\SHDOCVW.dll
0x5b090000 0x34000 6.00.2600.0000 C:\WINDOWS\System32\UxTheme.dll
0x78090000 0xe5000 6.00.2800.1816 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1816_x-ww_7d33ba0e\comctl32.dll
0x77300000 0x8b000 5.82.2600.0000 C:\WINDOWS\system32\comctl32.dll
0x7a170000 0x80000 2001.12.4414.0062 C:\WINDOWS\System32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0042 C:\WINDOWS\System32\COMRes.dll
0x5b950000 0x71000 6.00.2600.0000 C:\WINDOWS\System32\themeui.dll
0x76ac0000 0x15000 3.00.9238.0000 C:\WINDOWS\System32\ATL.DLL
0x76250000 0x8c000 5.131.2600.0000 C:\WINDOWS\system32\CRYPT32.dll
0x74aa0000 0x43000 6.00.2600.0000 C:\WINDOWS\System32\webcheck.dll
0x74a60000 0x9000 6.00.2600.0000 C:\WINDOWS\System32\BatMeter.dll
0x74a40000 0x7000 6.00.2600.0000 C:\WINDOWS\System32\POWRPROF.dll
0x76390000 0x1fb000 2.00.2600.0000 C:\WINDOWS\System32\msi.dll
0x76190000 0x98000 6.00.2600.0000 C:\WINDOWS\system32\WININET.dll
0x76100000 0x8e000 6.00.2600.0000 C:\WINDOWS\System32\shdoclc.dll
0x723a0000 0x13000 6.00.2600.0000 C:\WINDOWS\System32\browselc.dll
0x76080000 0x78000 6.00.2600.0000 C:\WINDOWS\system32\urlmon.dll
0x08530000 0x1fd000 9.00.0000.2980 C:\WINDOWS\System32\WMVCore.DLL
0x07260000 0x39000 9.00.0000.2980 C:\WINDOWS\System32\WMASF.DLL
0x72380000 0x19000 6.00.2600.0000 C:\WINDOWS\System32\mydocs.dll
0x746e0000 0x8f000 6.00.2600.0000 C:\WINDOWS\System32\mlang.dll
0x732d0000 0x51000 6.00.2600.0000 C:\WINDOWS\System32\zipfldr.dll
0x64f00000 0x12000 4.07.1043.0000 C:\Program Files\Alwil Software\Avast4\ashShell.dll
0x10000000 0x3a2000 6.14.0010.6085 C:\WINDOWS\System32\nvcpl.dll
0x76340000 0x46000 6.00.2600.0000 C:\WINDOWS\system32\comdlg32.dll
0x74bf0000 0x2c000 4.02.5406.0000 C:\WINDOWS\System32\OLEACC.dll
0x76010000 0x61000 6.00.8972.0000 C:\WINDOWS\System32\MSVCP60.dll
0x01990000 0x70000 6.14.0010.6085 C:\WINDOWS\System32\nvshell.dll
0x011f0000 0xb000 6.00.0000.0878 C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
0x32520000 0x12000 10.00.2609.0000 C:\Program Files\Microsoft Office\Office10\msohev.dll
0x76be0000 0x2b000 5.131.2600.0000 C:\WINDOWS\System32\WINTRUST.dll
0x0ffd0000 0x22000 5.01.2518.0000 C:\WINDOWS\System32\rsaenh.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 856
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x6f000 \??\C:\WINDOWS\system32\winlogon.exe
0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll
0x76250000 0x8c000 5.131.2600.0000 C:\WINDOWS\system32\CRYPT32.dll
0x76be0000 0x2b000 5.131.2600.0000 C:\WINDOWS\system32\WINTRUST.dll
0x77390000 0x802000 6.00.2600.0000 C:\WINDOWS\system32\SHELL32.dll
0x77290000 0x63000 6.00.2600.0000 C:\WINDOWS\system32\SHLWAPI.dll
0x77300000 0x8b000 5.82.2600.0000 C:\WINDOWS\system32\COMCTL32.dll
0x1f7b0000 0x31000 3.520.7713.0000 C:\WINDOWS\system32\ODBC32.dll
0x76340000 0x46000 6.00.2600.0000 C:\WINDOWS\system32\comdlg32.dll
0x78090000 0xe5000 6.00.2800.1816 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1816_x-ww_7d33ba0e\comctl32.dll
0x1f850000 0x18000 3.520.7713.0000 C:\WINDOWS\system32\odbcint.dll
0x76b70000 0x1f000 6.00.2600.0000 C:\WINDOWS\system32\SHSVCS.dll
0x5b090000 0x34000 6.00.2600.0000 C:\WINDOWS\system32\uxtheme.dll
0x0ffd0000 0x22000 5.01.2518.0000 C:\WINDOWS\System32\rsaenh.dll
0x77000000 0xd4000 2001.12.4414.0042 C:\WINDOWS\system32\COMRes.dll
0x770e0000 0x8b000 3.50.5014.0000 C:\WINDOWS\system32\OLEAUT32.dll
0x7a170000 0x80000 2001.12.4414.0062 C:\WINDOWS\system32\CLBCATQ.DLL

Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est AC18-51B2

Répertoire de C:\WINDOWS\system32

28/08/2001 13:00 4 096 csrss.exe
1 fichier(s) 4 096 octets
0 Rép(s) 60 881 113 088 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est AC18-51B2

Répertoire de C:\WINDOWS\Downloaded Program Files

08/11/2007 20:52 <REP> .
08/11/2007 20:52 <REP> ..
23/07/2006 21:38 65 desktop.ini
14/10/1997 17:52 697 DirectAnimation Java Classes.osd
13/04/2007 14:27 367 LegitCheckControl.inf
20/01/2000 14:25 1 162 Microsoft XML Parser for Java.osd
03/06/2002 17:53 144 QTPlugin.inf
11/06/2007 12:21 5 021 swflash.inf
11/08/2004 01:22 3 036 wmv9dmo.inf
30/07/2007 19:24 293 wuweb.inf
8 fichier(s) 10 785 octets

Total des fichiers listés :
8 fichier(s) 10 785 octets
2 Rép(s) 60 881 113 088 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..

Liste des fichiers en exception sur le pare-feu XP SP2

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-21 00:05:32
Windows 5.1.2600 NTFS

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
324 - ACMonitor_X83.e
348 - AcBtnMgr_X83.ex
360 - printray.exe
464 - ashWebSv.exe
508 - jusched.exe
524 - ashDisp.exe
576 - stmon.exe
600 - ctfmon.exe
648 - ashMaiSv.exe
660 - WLANUTL.exe
688 - PAStiSvc.exe
832 - csrss.exe
856 - winlogon.exe
900 - services.exe
912 - lsass.exe
1096 - svchost.exe
1144 - CALMAIN.exe
1224 - svchost.exe
1284 - cmd.exe
1344 - IEXPLORE.EXE
1388 - iPodService.exe
1476 - svchost.exe
1520 - svchost.exe
1616 - usnsvc.exe
1664 - explorer.exe
1792 - ashServ.exe
2040 - spoolsv.exe
3124 - msnmsgr.exe
3208 - LimeWire.exe
3352 - jucheck.exe

Total number of processes = 31
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D0000 - \WINDOWS\system32\ntoskrnl.exe
806B5000 - \WINDOWS\system32\hal.dll
F9F32000 - \WINDOWS\system32\KDCOM.DLL
F9E42000 - \WINDOWS\system32\BOOTVID.dll
F99E5000 - ACPI.sys
F9F34000 - \WINDOWS\System32\DRIVERS\WMILIB.SYS
F9A32000 - pci.sys
F9A42000 - isapnp.sys
F9A52000 - ohci1394.sys
F9A62000 - \WINDOWS\System32\DRIVERS\1394BUS.SYS
F9F36000 - viaide.sys
F9CB2000 - \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
F9A72000 - MountMgr.sys
F99C6000 - ftdisk.sys
F9F38000 - dmload.sys
F99A2000 - dmio.sys
F9CBA000 - PartMgr.sys
F9A82000 - VolSnap.sys
F998C000 - atapi.sys
F9A92000 - disk.sys
F9AA2000 - \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
F997A000 - sr.sys
F9E46000 - PzWDM.sys
F9966000 - KSecDD.sys
F98E3000 - Ntfs.sys
F98BB000 - NDIS.sys
F9CC2000 - viaagp1.sys
F98A1000 - Mup.sys
F9AD2000 - \SystemRoot\System32\DRIVERS\nic1394.sys
F9C72000 - \SystemRoot\System32\DRIVERS\processr.sys
F8F9E000 - \SystemRoot\System32\DRIVERS\nv4_mini.sys
F9C82000 - \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
F9D4A000 - \SystemRoot\System32\DRIVERS\usbuhci.sys
F8F7F000 - \SystemRoot\System32\DRIVERS\USBPORT.SYS
F9C92000 - \SystemRoot\System32\DRIVERS\cdrom.sys
F9CA2000 - \SystemRoot\System32\DRIVERS\redbook.sys
F8F5F000 - \SystemRoot\System32\DRIVERS\ks.sys
F9D52000 - \SystemRoot\System32\Drivers\GEARAspiWDM.sys
F9AE2000 - \SystemRoot\System32\DRIVERS\imapi.sys
F8EF0000 - \SystemRoot\system32\drivers\ALCXWDM.SYS
F8ECF000 - \SystemRoot\system32\drivers\portcls.sys
F9240000 - \SystemRoot\system32\drivers\drmk.sys
F8E6C000 - \SystemRoot\system32\drivers\ALCXSENS.SYS
F9D5A000 - \SystemRoot\System32\DRIVERS\fetnd5.sys
F9D62000 - \SystemRoot\System32\DRIVERS\fdc.sys
F9230000 - \SystemRoot\System32\DRIVERS\serial.sys
F9F12000 - \SystemRoot\System32\DRIVERS\serenum.sys
F8E59000 - \SystemRoot\System32\DRIVERS\parport.sys
F9220000 - \SystemRoot\System32\DRIVERS\i8042prt.sys
F9D6A000 - \SystemRoot\System32\DRIVERS\mouclass.sys
F9D72000 - \SystemRoot\System32\DRIVERS\kbdclass.sys
FA16A000 - \SystemRoot\System32\DRIVERS\audstub.sys
F9210000 - \SystemRoot\System32\DRIVERS\rasl2tp.sys
F9F1A000 - \SystemRoot\System32\DRIVERS\ndistapi.sys
F8E43000 - \SystemRoot\System32\DRIVERS\ndiswan.sys
F9200000 - \SystemRoot\System32\DRIVERS\raspppoe.sys
F91F0000 - \SystemRoot\System32\DRIVERS\raspptp.sys
F9F1E000 - \SystemRoot\System32\DRIVERS\TDI.SYS
F8E32000 - \SystemRoot\System32\DRIVERS\psched.sys
F91E0000 - \SystemRoot\System32\DRIVERS\msgpc.sys
F9D7A000 - \SystemRoot\System32\DRIVERS\ptilink.sys
F9D82000 - \SystemRoot\System32\DRIVERS\raspti.sys
F8DC2000 - \SystemRoot\System32\DRIVERS\rdpdr.sys
F91D0000 - \SystemRoot\System32\DRIVERS\termdd.sys
FA177000 - \SystemRoot\System32\DRIVERS\swenum.sys
F8DA0000 - \SystemRoot\System32\DRIVERS\update.sys
F91C0000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F91B0000 - \SystemRoot\System32\DRIVERS\usbhub.sys
F9F5A000 - \SystemRoot\System32\DRIVERS\USBD.SYS
F9D8A000 - \SystemRoot\System32\DRIVERS\USBSTOR.SYS
F9D92000 - \SystemRoot\System32\DRIVERS\flpydisk.sys
F7C0A000 - \SystemRoot\System32\DRIVERS\WlanUIG.sys
F9F60000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
FA081000 - \SystemRoot\System32\Drivers\Null.SYS
F9F62000 - \SystemRoot\System32\Drivers\Beep.SYS
F9DA2000 - \SystemRoot\System32\drivers\vga.sys
F9F64000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F9F66000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F9DAA000 - \SystemRoot\System32\Drivers\Msfs.SYS
F9DB2000 - \SystemRoot\System32\Drivers\Npfs.SYS
F9ED6000 - \SystemRoot\System32\DRIVERS\rasacd.sys
F9B02000 - \SystemRoot\System32\DRIVERS\ipsec.sys
F7B72000 - \SystemRoot\System32\DRIVERS\tcpip.sys
F9B12000 - \SystemRoot\System32\Drivers\aswTdi.SYS
F7B4D000 - \SystemRoot\System32\DRIVERS\netbt.sys
F9B22000 - \SystemRoot\System32\DRIVERS\netbios.sys
F7A85000 - \SystemRoot\System32\DRIVERS\rdbss.sys
F7A21000 - \SystemRoot\System32\DRIVERS\mrxsmb.sys
F9B42000 - \SystemRoot\System32\Drivers\Fips.SYS
F9B52000 - \SystemRoot\System32\DRIVERS\wanarp.sys
F9B62000 - \SystemRoot\System32\DRIVERS\arp1394.sys
F9DC2000 - \SystemRoot\System32\Drivers\Aavmker4.SYS
F9BE2000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F79E3000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F9F98000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \??\C:\WINDOWS\system32\win32k.sys
F7BEE000 - \??\C:\WINDOWS\system32\watchdog.sys
BFF80000 - \SystemRoot\System32\drivers\dxg.sys
FA04E000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9B8000 - \SystemRoot\System32\nv4_disp.dll
F6A43000 - \SystemRoot\System32\drivers\afd.sys
F6ACF000 - \SystemRoot\System32\DRIVERS\mdc8021x.sys
F6ACB000 - \SystemRoot\System32\DRIVERS\ndisuio.sys
F604D000 - \SystemRoot\System32\Drivers\aswMon2.SYS
F6001000 - \SystemRoot\System32\Drivers\Fastfat.SYS
F5EAD000 - \SystemRoot\system32\drivers\wdmaud.sys
F60FB000 - \SystemRoot\system32\drivers\sysaudio.sys
F5D9F000 - \SystemRoot\System32\DRIVERS\mrxdav.sys
F9F58000 - \SystemRoot\System32\Drivers\ParVdm.SYS
F5FB5000 - \SystemRoot\System32\DRIVERS\secdrv.sys
F5A56000 - \SystemRoot\System32\DRIVERS\srv.sys
F594A000 - \SystemRoot\System32\Drivers\aswRdr.SYS
F5926000 - \??\C:\WINDOWS\System32\PCANDIS5.SYS
F4C9D000 - \SystemRoot\system32\drivers\kmixer.sys
BFFA0000 - \SystemRoot\System32\ATMFD.DLL
FA078000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 116

Liste des programmes installes

Adobe Flash Player 9 ActiveX
Adobe Reader 6.0 - Français
Apple Software Update
avast! Antivirus
Barre d'outils MSN
Camera Access Library
Camera Support Core Library
Camera Window DS
Camera Window DVC
Camera Window DVC
Camera Window MC
Canon Camera Access Library
Canon Camera Support Core Library
Canon Camera Window DC_DV 5 for ZoomBrowser EX
Canon Camera Window DC_DV 6 for ZoomBrowser EX
Canon Camera Window DSLR 5 for ZoomBrowser EX
Canon Camera Window MC 6 for ZoomBrowser EX
CANON iMAGE GATEWAY Task
CANON iMAGE GATEWAY Task for ZoomBrowser EX
Canon Internet Library for ZoomBrowser EX
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon Utilities PhotoStitch 3.1
Canon ZoomBrowser EX (F)
FoxTarot version 4.0
FusionSoft DVD Player XP Version 5.0
HijackThis 2.0.2
Internet Library
iTunes
Java(TM) 6 Update 2
Les Sims Deluxe
Lexmark X83
LimeWire 4.14.8
LiveBox
Messenger Plus! Live
MGI PhotoSuite 8.1 (suppression seulement)
Microsoft Office XP Professional with FrontPage
MovieEdit Task
NVIDIA Drivers
ONES Trial (F)
PC VGA Camer@
PC VGA Camer@
Philips Digital Audio Player
PhotoStitch
QuickTime
RAW Image Task 2.2
Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g
The Sims House Party
WebFldrs XP
Windows Live Messenger
Windows Live Sign-in Assistant

Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est AC18-51B2

Répertoire de C:\Program Files

20/11/2007 23:59 <REP> .
20/11/2007 23:59 <REP> ..
20/06/2001 15:19 40 960 ACMonitor_X83.exe
28/10/2006 12:06 <REP> Adobe
05/11/2007 20:58 <REP> Alwil Software
03/09/2007 17:58 <REP> Apple Software Update
22/07/2006 10:37 <REP> Canon
25/06/2006 14:14 <REP> ComPlus Applications
18/11/2007 21:20 <REP> Fichiers communs
20/11/2007 21:19 <REP> FoxTarot4
03/04/2007 19:38 <REP> FusionSoft DVD Player XP
23/07/2006 21:37 <REP> Internet Explorer
03/09/2007 18:01 <REP> iPod
03/09/2007 18:02 <REP> iTunes
14/09/2007 21:32 <REP> Java
01/07/2006 13:34 <REP> Lexmark
08/07/2006 12:33 <REP> LexmarkX83
14/09/2007 21:32 <REP> LimeWire
08/07/2006 12:42 <REP> Maxis
19/07/2006 08:25 <REP> Messenger
19/06/2007 18:39 <REP> Messenger Plus! Live
01/07/2006 13:41 <REP> MGI
25/06/2006 19:52 <REP> Microsoft ActiveSync
25/06/2006 14:17 <REP> microsoft frontpage
25/06/2006 19:51 <REP> Microsoft Office
23/07/2006 21:37 <REP> Movie Maker
23/07/2006 21:36 <REP> MSN
01/07/2006 13:23 <REP> MSN Apps
25/06/2006 14:13 <REP> MSN Gaming Zone
07/11/2007 18:10 <REP> MSN Messenger
01/07/2006 16:03 <REP> MSN Toolbar
23/07/2006 21:37 <REP> NetMeeting
28/07/2006 18:07 <REP> ONES Trial (F)
23/07/2006 21:37 <REP> Outlook Express
08/07/2006 12:24 <REP> PC VGA Camer@
22/11/2006 18:29 <REP> Philips
03/09/2007 18:00 <REP> QuickTime
30/06/2006 19:50 <REP> SAGEM
30/06/2006 19:51 <REP> SAGEM Wi-Fi USB 802.11g
25/06/2006 14:15 <REP> Services en ligne
09/11/2007 17:31 <REP> Trend Micro
06/11/2007 14:04 <REP> Ubi Soft
19/06/2007 18:39 <REP> Windows Live
06/05/2007 12:36 <REP> Windows Media Player
25/06/2006 14:13 <REP> Windows NT
25/06/2006 14:17 <REP> xerox
1 fichier(s) 40 960 octets
45 Rép(s) 60 880 834 560 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est AC18-51B2

Répertoire de C:\Program Files\fichiers communs

18/11/2007 21:20 <REP> .
18/11/2007 21:20 <REP> ..
11/11/2007 21:44 <REP> 07%2F06%2F2007
28/10/2006 23:13 <REP> Adobe
25/06/2006 19:52 <REP> Designer
22/11/2006 18:28 <REP> InstallShield
14/09/2007 21:30 <REP> Java
07/11/2007 18:07 <REP> Microsoft Shared
25/06/2006 14:14 <REP> MSSoap
25/06/2006 14:44 <REP> ODBC
08/07/2006 12:24 <REP> PCCamera
25/06/2006 14:14 <REP> Services
25/06/2006 14:44 <REP> SpeechEngines
23/07/2006 21:37 <REP> System
0 fichier(s) 0 octets
14 Rép(s) 60 880 834 560 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est AC18-51B2

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

25/06/2006 19:52 <REP> .
25/06/2006 19:52 <REP> ..
25/06/2006 19:51 <REP> 1033
14/02/2001 20:45 1 318 912 MSONSEXT.DLL
12/02/2001 23:23 58 784 MSOSV.DLL
03/06/1999 13:09 122 937 MSOWS409.DLL
07/03/2001 08:00 127 033 MSOWS40c.DLL
06/08/2000 08:04 401 462 MSVCP60.DLL
22/01/2001 02:25 69 632 PKMAXCTL.DLL
22/01/2001 02:25 872 448 PKMCDO.DLL
22/01/2001 02:25 159 744 PKMCORE.DLL
07/02/2001 08:59 106 496 PKMFORMS.DLL
22/01/2001 02:25 671 744 PKMRES.DLL
22/01/2001 02:25 28 672 PKMSSTLB.DLL
22/01/2001 02:25 40 960 PKMTEMPL.DLL
22/01/2001 02:25 24 576 PKMTRACE.DLL
22/01/2001 02:25 86 016 PKMWS.DLL
22/01/2001 02:25 237 568 PROMDEMO.DLL
22/01/2001 02:25 184 320 SECMGR.DLL
22/01/2001 02:25 323 584 VAIDDMGR.DLL
22/01/2001 02:25 32 768 VAIMEM.DLL
18 fichier(s) 4 867 656 octets
3 Rép(s) 60 880 834 560 octets libres

c:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.3.1.3\iTunesSetupAdmin.exe
c:\Documents and Settings\malka\Application Data\LimeWire\.NetworkShare\LimeWireWin4.14.10.exe
c:\Documents and Settings\malka\Application Data\Macromedia\Flash Player\#SharedObjects\L89GXBQ2\localhost\MainCD.exe
c:\Documents and Settings\malka\Bureau\OTMoveIt.exe
c:\Documents and Settings\malka\Bureau\VirtumundoBeGone.exe
c:\Documents and Settings\malka\Bureau\VundoFix.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\catchme.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\diff.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\dumphive.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\FilesInfoCmd.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\find2.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\Fport.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\grep.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\gzip.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\KProcCheck.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\LFiles.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\LISTDLLS.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\md5sums.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\pslist.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\sigcheck.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\streams.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\swreg.exe
c:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\tar.exe
c:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\msnchk.exe
c:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\MD5File.exe
c:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\msnchk.exe
c:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\Process.exe
c:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\swreg.exe
c:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\zip.exe
c:\Documents and Settings\malka\Local Settings\Temporary Internet Files\Content.IE5\SLIBO9QJ\in23[1].exe
c:\Documents and Settings\malka\Mes documents\DVD_Player_5.0_XP.exe
c:\Documents and Settings\malka\Mes documents\JOANNE COURS\Nouveau dossier\iTunesSetup.exe
c:\Documents and Settings\malka\Mes documents\JOANNE COURS\Nouveau dossier\LimeWireWin.exe
c:\Documents and Settings\malka\Mes documents\JOANNE COURS\Nouveau dossier\MPSetup.exe
c:\Documents and Settings\malka\Mes documents\Nouveau dossier\HJTInstall.exe
c:\Documents and Settings\malka\Mes documents\Nouveau dossier\INSTALL_MSN_MESSENGER_NT.EXE
c:\Documents and Settings\malka\Mes documents\Nouveau dossier\installer_fr.exe
c:\Documents and Settings\malka\Mes documents\Nouveau dossier\setup_fr.exe
c:\Documents and Settings\malka\Mes documents\Nouveau dossier\setupfre.exe
c:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\MD5File.exe
c:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\msnchk.exe
c:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\Process.exe
c:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\swreg.exe
c:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\zip.exe
c:\Documents and Settings\malka\Mes documents\programmes\Avast4.exe
c:\Documents and Settings\malka\Mes documents\programmes\Install_Messenger.exe
c:\Documents and Settings\malka\Mes documents\programmes\INSTALL_MSN_MESSENGER_NT.EXE
c:\Documents and Settings\malka\Mes documents\programmes\nvidia_6085.exe
c:\Documents and Settings\malka\Mes documents\programmes\pb_alc650_5320.exe
c:\Documents and Settings\malka\Mes documents\programmes\viahyperion4in1448v.exe
c:\Documents and Settings\malka\Mes documents\programmes\viausb20xp.exe
c:\Documents and Settings\malka\Mes documents\programmes\wmp11-windowsxp-x86-FR-FR.exe
c:\Documents and Settings\malka\Mes documents\programmes\Office\INSTMSI.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\INSTMSIW.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\Office XP.exe
c:\Documents and Settings\malka\Mes documents\programmes\Office\SETUP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\FILES\SYSTEM\EXTRACT.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\DCOM95.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\IE5COMP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\IE5SETUP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\OAINST.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\VRML2C.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OWC\SETUP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\PFILES\COMMON\MSSHARED\OFFICE10\DW.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\PFILES\MSOFFICE\OFFICE10\OFFCLN.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\SUPPORT\INSTMSI.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\SUPPORT\INSTMSIW.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\SUPPORT\Q282879.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\MSDE2000\SETUP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\MSDE2000\MSI\INSTMSI.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\MSDE2000\MSI\INSTMSIW.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\INSTMSI.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\INSTMSIW.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\SETUP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\ADMPACK\ADMPACK.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\HTMLHELP\HTMLHELP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\OCP\_ISDEL.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\OCP\SETUP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\PPTVIEW\PPVIEW97.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\SUPPORT\INSTMSI.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\SUPPORT\INSTMSIW.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\SUPPORT\Q282879.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\INSTMSI.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\INSTMSIW.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SETUPSE.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQLWRAP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\FILES\SUPPORT\INSTMSI.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\FILES\SUPPORT\INSTMSIW.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\FILES\SUPPORT\Q282879.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\BCP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\CMDWRAP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\CNFGSVR.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\DCOMSCM.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\DISTRIB.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\DTSRUN.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\DTSWIZ.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\LOGREAD.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\ODBCCMPT.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\OSQL.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\REBUILDM.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\REGREBLD.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\REPLMERG.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SCM.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SNAPSHOT.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SQLAGENT.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SQLMANGR.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SQLSERVR.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SVRNETCN.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\VSWITCH.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\OTHER\DTCSETUP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SETUP\_ISDEL.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SETUP\MSETUP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SETUP\SETUPSQL.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SETUP\SQLSTP.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SYSTEM\CLICONFG.EXE
c:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SYSTEM\REGSVR32.EXE
c:\Documents and Settings\malka\Mes documents\VIVRE APRES LA CHUTE DU MUR DE BERLIN\MsgPlusLive-411.exe
c:\Documents and Settings\malka\Mes documents\VIVRE APRES LA CHUTE DU MUR DE BERLIN\psa30se_ytb612_a708_DLM_en_us.exe
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
c:\Documents and Settings\malka\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
c:\Documents and Settings\malka\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll

****** Fin du rapport DiagHelp
Veuillez svp envoyer le fichier C:\upload_moi_MALKA-OPM3M753E.tar.gz a l'adresse http://upload.malekal.com

JO · Answer

FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
https://www.mcafee.com/en-us/index.html

Pid Process Port Proto Path
1540 -> 5000 TCP
4 System -> 1031 TCP
0 System -> 12080 TCP
4 System -> 139 TCP
0 System -> 1540 TCP
4 System -> 445 TCP
660 ashMaiSv -> 12025 TCP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
660 ashMaiSv -> 12110 TCP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
660 ashMaiSv -> 12119 TCP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
660 ashMaiSv -> 12143 TCP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
532 ashWebSv -> 12080 TCP C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
2452 jucheck -> 1530 TCP C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
520 jusched -> 1527 TCP C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
520 jusched -> 1528 TCP C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
1228 svchost -> 1026 TCP C:\WINDOWS\System32\svchost.exe
1100 svchost -> 135 TCP C:\WINDOWS\system32\svchost.exe

1540 -> 1406 UDP
4 System -> 1025 UDP
0 System -> 1445 UDP
4 System -> 1900 UDP
4 System -> 445 UDP
660 ashMaiSv -> 123 UDP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
660 ashMaiSv -> 137 UDP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
660 ashMaiSv -> 138 UDP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
532 ashWebSv -> 1034 UDP C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
2452 jucheck -> 1391 UDP C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
520 jusched -> 1027 UDP C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
520 jusched -> 1036 UDP C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
520 jusched -> 15656 UDP C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
520 jusched -> 60315 UDP C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
1100 svchost -> 135 UDP C:\WINDOWS\system32\svchost.exe
1228 svchost -> 500 UDP C:\WINDOWS\System32\svchost.exe

PsList 1.26 - Process Information Lister
Copyright (C) 1999-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

Process information for MALKA-OPM3M753E:

Name Pid Pri Thd Hnd VM WS Priv
Idle 0 0 1 0 0 20 0
System 4 8 57 289 1876 80 0
smss 760 11 3 21 3796 80 164
csrss 836 13 12 489 24828 1724 1640
winlogon 860 13 20 448 45492 2320 5444
services 904 9 20 333 21680 1848 1464
spoolsv 168 8 14 154 45680 2008 3240
alg 512 8 3 68 13956 1000 480
ashWebSv 532 8 18 121 86684 6900 11444
nvsvc32 564 8 3 66 19368 600 500
ashMaiSv 660 8 8 83 52500 552 2884
PAStiSvc 668 8 2 23 7868 424 192
svchost 740 8 5 111 16572 1044 776
svchost 1100 8 9 285 31252 1756 1352
svchost 1228 8 58 1049 102200 11088 11276
CALMAIN 1280 8 7 116 22428 960 676
svchost 1508 8 6 93 29132 1368 1028
svchost 1540 8 13 155 30928 1028 1188
aswUpdSv 1756 8 3 31 16352 64 380
ashServ 1812 13 24 251 113608 12868 22828
usnsvc 2576 8 3 82 14624 1648 644
lsass 916 9 20 319 38516 460 3192
explorer 1692 8 15 388 86272 6420 12892
ACMonitor_X83 356 8 1 26 16204 1288 344
AcBtnMgr_X83 380 8 1 25 24212 784 432
WLANUTL 388 8 2 60 34692 1284 1132
printray 456 8 1 31 34992 888 756
SOUNDMAN 464 8 2 52 30280 900 580
jusched 520 8 3 152 53412 4656 1232
jucheck 2452 8 4 182 57664 5624 2400
ashDisp 600 8 7 76 42764 840 2276
stmon 616 8 2 104 56804 1752 1284
ctfmon 632 8 1 52 15080 788 348
IEXPLORE 720 8 19 533 197392 24256 35996
msnmsgr 2116 8 33 623 172936 14868 32708
cmd 3200 8 1 22 13376 1140 1384
pslist 3404 13 2 72 17408 1452 664

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 1692
Command line: C:\WINDOWS\Explorer.EXE

Base Size Version Path
0x01000000 0xf8000 6.00.2600.0000 C:\WINDOWS\Explorer.EXE
0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll
0x77290000 0x63000 6.00.2600.0000 C:\WINDOWS\system32\SHLWAPI.dll
0x77390000 0x802000 6.00.2600.0000 C:\WINDOWS\system32\SHELL32.dll
0x770e0000 0x8b000 3.50.5014.0000 C:\WINDOWS\system32\OLEAUT32.dll
0x75f10000 0xfc000 6.00.2600.0000 C:\WINDOWS\System32\BROWSEUI.dll
0x76960000 0x149000 6.00.2600.0000 C:\WINDOWS\System32\SHDOCVW.dll
0x5b090000 0x34000 6.00.2600.0000 C:\WINDOWS\System32\UxTheme.dll
0x78090000 0xe5000 6.00.2800.1816 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1816_x-ww_7d33ba0e\comctl32.dll
0x77300000 0x8b000 5.82.2600.0000 C:\WINDOWS\system32\comctl32.dll
0x7a170000 0x80000 2001.12.4414.0062 C:\WINDOWS\System32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0042 C:\WINDOWS\System32\COMRes.dll
0x5b950000 0x71000 6.00.2600.0000 C:\WINDOWS\System32\themeui.dll
0x71ca0000 0x1b000 6.00.2600.0000 C:\WINDOWS\System32\actxprxy.dll
0x76ac0000 0x15000 3.00.9238.0000 C:\WINDOWS\System32\ATL.DLL
0x76250000 0x8c000 5.131.2600.0000 C:\WINDOWS\system32\CRYPT32.dll
0x74aa0000 0x43000 6.00.2600.0000 C:\WINDOWS\System32\webcheck.dll
0x74a60000 0x9000 6.00.2600.0000 C:\WINDOWS\System32\BatMeter.dll
0x74a40000 0x7000 6.00.2600.0000 C:\WINDOWS\System32\POWRPROF.dll
0x76390000 0x1fb000 2.00.2600.0000 C:\WINDOWS\System32\msi.dll
0x76190000 0x98000 6.00.2600.0000 C:\WINDOWS\system32\WININET.dll
0x76100000 0x8e000 6.00.2600.0000 C:\WINDOWS\System32\shdoclc.dll
0x732d0000 0x51000 6.00.2600.0000 C:\WINDOWS\System32\zipfldr.dll
0x64f00000 0x12000 4.07.1043.0000 C:\Program Files\Alwil Software\Avast4\ashShell.dll
0x723a0000 0x13000 6.00.2600.0000 C:\WINDOWS\System32\browselc.dll
0x10000000 0xb000 6.00.0000.0878 C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
0x76080000 0x78000 6.00.2600.0000 C:\WINDOWS\system32\urlmon.dll
0x32520000 0x12000 10.00.2609.0000 C:\Program Files\Microsoft Office\Office10\msohev.dll
0x76be0000 0x2b000 5.131.2600.0000 C:\WINDOWS\System32\WINTRUST.dll
0x0ffd0000 0x22000 5.01.2518.0000 C:\WINDOWS\System32\rsaenh.dll
0x70ee0000 0x7000 1.01.0000.3917 C:\WINDOWS\System32\asfsipc.dll
0x60990000 0xd000 2.00.2600.0000 C:\WINDOWS\System32\MSISIP.DLL
0x74e10000 0x10000 5.06.0000.6626 C:\WINDOWS\System32\wshext.dll
0x76340000 0x46000 6.00.2600.0000 C:\WINDOWS\system32\comdlg32.dll
0x59000000 0xe000 5.06.0000.6626 C:\WINDOWS\System32\wshFR.DLL
0x365a0000 0x15000 10.00.2625.0000 C:\PROGRA~1\MICROS~2\Office10\MCPS.DLL
0x76010000 0x61000 6.00.8972.0000 C:\WINDOWS\System32\MSVCP60.DLL

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 860
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x6f000 \??\C:\WINDOWS\system32\winlogon.exe
0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll
0x76250000 0x8c000 5.131.2600.0000 C:\WINDOWS\system32\CRYPT32.dll
0x76be0000 0x2b000 5.131.2600.0000 C:\WINDOWS\system32\WINTRUST.dll
0x77390000 0x802000 6.00.2600.0000 C:\WINDOWS\system32\SHELL32.dll
0x77290000 0x63000 6.00.2600.0000 C:\WINDOWS\system32\SHLWAPI.dll
0x77300000 0x8b000 5.82.2600.0000 C:\WINDOWS\system32\COMCTL32.dll
0x1f7b0000 0x31000 3.520.7713.0000 C:\WINDOWS\system32\ODBC32.dll
0x76340000 0x46000 6.00.2600.0000 C:\WINDOWS\system32\comdlg32.dll
0x78090000 0xe5000 6.00.2800.1816 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1816_x-ww_7d33ba0e\comctl32.dll
0x1f850000 0x18000 3.520.7713.0000 C:\WINDOWS\system32\odbcint.dll
0x76b70000 0x1f000 6.00.2600.0000 C:\WINDOWS\system32\SHSVCS.dll
0x5b090000 0x34000 6.00.2600.0000 C:\WINDOWS\system32\uxtheme.dll
0x0ffd0000 0x22000 5.01.2518.0000 C:\WINDOWS\System32\rsaenh.dll
0x77000000 0xd4000 2001.12.4414.0042 C:\WINDOWS\system32\COMRes.dll
0x770e0000 0x8b000 3.50.5014.0000 C:\WINDOWS\system32\OLEAUT32.dll
0x7a170000 0x80000 2001.12.4414.0062 C:\WINDOWS\system32\CLBCATQ.DLL

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
IEXPLORE.EXE pid: 720
Command line: "C:\Program Files\Internet Explorer\IEXPLORE.EXE"

Base Size Version Path
0x00400000 0x19000 6.00.2600.0000 C:\Program Files\Internet Explorer\IEXPLORE.EXE
0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll
0x77290000 0x63000 6.00.2600.0000 C:\WINDOWS\system32\SHLWAPI.dll
0x76960000 0x149000 6.00.2600.0000 C:\WINDOWS\System32\SHDOCVW.dll
0x78090000 0xe5000 6.00.2800.1816 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1816_x-ww_7d33ba0e\comctl32.dll
0x77390000 0x802000 6.00.2600.0000 C:\WINDOWS\system32\SHELL32.dll
0x77300000 0x8b000 5.82.2600.0000 C:\WINDOWS\system32\comctl32.dll
0x5b090000 0x34000 6.00.2600.0000 C:\WINDOWS\system32\uxtheme.dll
0x75f10000 0xfc000 6.00.2600.0000 C:\WINDOWS\System32\BROWSEUI.dll
0x723a0000 0x13000 6.00.2600.0000 C:\WINDOWS\System32\browselc.dll
0x7a170000 0x80000 2001.12.4414.0062 C:\WINDOWS\System32\CLBCATQ.DLL
0x770e0000 0x8b000 3.50.5014.0000 C:\WINDOWS\system32\OLEAUT32.dll
0x77000000 0xd4000 2001.12.4414.0042 C:\WINDOWS\System32\COMRes.dll
0x76190000 0x98000 6.00.2600.0000 C:\WINDOWS\system32\WININET.dll
0x76250000 0x8c000 5.131.2600.0000 C:\WINDOWS\system32\CRYPT32.dll
0x10000000 0xb000 6.00.0000.0878 C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
0x6d7c0000 0x79000 6.00.0020.0006 C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
0x7c340000 0x56000 7.10.3052.0004 C:\Program Files\Java\jre1.6.0_02\bin\MSVCR71.dll
0x29500000 0x51000 4.00.0249.0001 C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
0x76080000 0x78000 6.00.2600.0000 C:\WINDOWS\system32\urlmon.dll
0x0ffd0000 0x22000 5.01.2518.0000 C:\WINDOWS\System32\rsaenh.dll
0x27500000 0xc9000 4.00.0249.0001 C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\msidcrl40.dll
0x76be0000 0x2b000 5.131.2600.0000 C:\WINDOWS\System32\WINTRUST.dll
0x02020000 0x28000 1.02.3000.1001 C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
0x72d50000 0x114000 8.20.8730.0001 C:\WINDOWS\System32\msxml3.dll
0x746e0000 0x8f000 6.00.2600.0000 C:\WINDOWS\System32\mlang.dll
0x73ca0000 0x10000 5.131.2600.0000 C:\WINDOWS\System32\cryptnet.dll
0x01e20000 0x49000 1.02.5000.1021 C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
0x01e90000 0x2c000 1.02.5000.1021 C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\mtbres.dll
0x76100000 0x8e000 6.00.2600.0000 C:\WINDOWS\System32\shdoclc.dll
0x76390000 0x1fb000 2.00.2600.0000 C:\WINDOWS\System32\msi.dll
0x76ac0000 0x15000 3.00.9238.0000 C:\WINDOWS\System32\ATL.DLL
0x74780000 0x2ad000 6.00.2600.0000 C:\WINDOWS\System32\mshtml.dll
0x74630000 0x27000 3.10.0349.0000 C:\WINDOWS\System32\MSLS31.DLL
0x75be0000 0x91000 5.06.0000.6626 C:\WINDOWS\System32\jscript.dll
0x66cc0000 0xa000 6.00.2600.0000 C:\WINDOWS\System32\imgutil.dll
0x5e680000 0xb000 6.00.2600.0000 C:\WINDOWS\System32\pngfilt.dll
0x73250000 0x75000 5.06.0000.6626 C:\WINDOWS\system32\vbscript.dll
0x30000000 0x2ef000 9.00.0047.0000 C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx
0x76340000 0x46000 6.00.2600.0000 C:\WINDOWS\system32\comdlg32.dll
0x65000000 0x9000 5.03.0000.0900 C:\WINDOWS\System32\ddrawex.dll
0x51000000 0x4d000 5.03.0000.0900 C:\WINDOWS\System32\DDRAW.dll
0x6c270000 0x33000 6.03.2600.0000 C:\WINDOWS\System32\dxtrans.dll
0x6c2b0000 0x55000 6.03.2600.0000 C:\WINDOWS\System32\dxtmsft.dll
0x672b0000 0x3b000 6.00.2600.0000 C:\WINDOWS\System32\iepeers.dll
0x74c20000 0x6f000 6.00.2600.0000 C:\WINDOWS\System32\mshtmled.dll
0x71ca0000 0x1b000 6.00.2600.0000 C:\WINDOWS\System32\actxprxy.dll
0x09a30000 0x61000 6.00.0000.0878 C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\ActiveX\pdf.ocx
0x66700000 0x91000 7.02.0000.0240 C:\Program Files\QuickTime\QTPlugin.ocx
0x09aa0000 0x472000 9.00.0000.2980 C:\WINDOWS\System32\wmp.dll
0x09f20000 0x2d9000 9.00.0000.2980 C:\WINDOWS\System32\wmploc.dll
0x72a70000 0x18000 6.00.2600.0000 C:\WINDOWS\System32\plugin.ocx

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
services.exe pid: 904
Command line: C:\WINDOWS\system32\services.exe

Base Size Version Path
0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est AC18-51B2

Répertoire de C:\Program Files

21/11/2007 17:43 <REP> .
21/11/2007 17:43 <REP> ..
20/06/2001 15:19 40 960 ACMonitor_X83.exe
28/10/2006 12:06 <REP> Adobe
05/11/2007 20:58 <REP> Alwil Software
03/09/2007 17:58 <REP> Apple Software Update
22/07/2006 10:37 <REP> Canon
25/06/2006 14:14 <REP> ComPlus Applications
18/11/2007 21:20 <REP> Fichiers communs
20/11/2007 21:19 <REP> FoxTarot4
03/04/2007 19:38 <REP> FusionSoft DVD Player XP
23/07/2006 21:37 <REP> Internet Explorer
03/09/2007 18:01 <REP> iPod
03/09/2007 18:02 <REP> iTunes
14/09/2007 21:32 <REP> Java
01/07/2006 13:34 <REP> Lexmark
08/07/2006 12:33 <REP> LexmarkX83
14/09/2007 21:32 <REP> LimeWire
08/07/2006 12:42 <REP> Maxis
19/07/2006 08:25 <REP> Messenger
19/06/2007 18:39 <REP> Messenger Plus! Live
01/07/2006 13:41 <REP> MGI
25/06/2006 19:52 <REP> Microsoft ActiveSync
25/06/2006 14:17 <REP> microsoft frontpage
25/06/2006 19:51 <REP> Microsoft Office
23/07/2006 21:37 <REP> Movie Maker
23/07/2006 21:36 <REP> MSN
01/07/2006 13:23 <REP> MSN Apps
25/06/2006 14:13 <REP> MSN Gaming Zone
07/11/2007 18:10 <REP> MSN Messenger
01/07/2006 16:03 <REP> MSN Toolbar
23/07/2006 21:37 <REP> NetMeeting
28/07/2006 18:07 <REP> ONES Trial (F)
23/07/2006 21:37 <REP> Outlook Express
08/07/2006 12:24 <REP> PC VGA Camer@
22/11/2006 18:29 <REP> Philips
03/09/2007 18:00 <REP> QuickTime
30/06/2006 19:50 <REP> SAGEM
30/06/2006 19:51 <REP> SAGEM Wi-Fi USB 802.11g
25/06/2006 14:15 <REP> Services en ligne
09/11/2007 17:31 <REP> Trend Micro
06/11/2007 14:04 <REP> Ubi Soft
19/06/2007 18:39 <REP> Windows Live
06/05/2007 12:36 <REP> Windows Media Player
25/06/2006 14:13 <REP> Windows NT
25/06/2006 14:17 <REP> xerox
1 fichier(s) 40 960 octets
45 Rép(s) 60 856 233 984 octets libres
C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.3.1.3\iTunesSetupAdmin.exe
C:\Documents and Settings\malka\Application Data\LimeWire\.NetworkShare\LimeWireWin4.14.10.exe
C:\Documents and Settings\malka\Application Data\Macromedia\Flash Player\#SharedObjects\L89GXBQ2\localhost\MainCD.exe
C:\Documents and Settings\malka\Bureau\OTMoveIt.exe
C:\Documents and Settings\malka\Bureau\VirtumundoBeGone.exe
C:\Documents and Settings\malka\Bureau\VundoFix.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\catchme.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\diff.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\dumphive.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\FilesInfoCmd.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\find2.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\Fport.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\grep.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\gzip.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\KProcCheck.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\LFiles.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\LISTDLLS.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\md5sums.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\pslist.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\sigcheck.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\streams.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\swreg.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\tar.exe
C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\msnchk.exe
C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\MD5File.exe
C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\msnchk.exe
C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\Process.exe
C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\swreg.exe
C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\zip.exe
C:\Documents and Settings\malka\Local Settings\Temporary Internet Files\Content.IE5\SLIBO9QJ\in23[1].exe
C:\Documents and Settings\malka\Mes documents\DVD_Player_5.0_XP.exe
C:\Documents and Settings\malka\Mes documents\JOANNE COURS\Nouveau dossier\iTunesSetup.exe
C:\Documents and Settings\malka\Mes documents\JOANNE COURS\Nouveau dossier\LimeWireWin.exe
C:\Documents and Settings\malka\Mes documents\JOANNE COURS\Nouveau dossier\MPSetup.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\HJTInstall.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\INSTALL_MSN_MESSENGER_NT.EXE
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\installer_fr.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\setup_fr.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\setupfre.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\MD5File.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\msnchk.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\Process.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\swreg.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\zip.exe
C:\Documents and Settings\malka\Mes documents\programmes\Avast4.exe
C:\Documents and Settings\malka\Mes documents\programmes\Install_Messenger.exe
C:\Documents and Settings\malka\Mes documents\programmes\INSTALL_MSN_MESSENGER_NT.EXE
C:\Documents and Settings\malka\Mes documents\programmes\nvidia_6085.exe
C:\Documents and Settings\malka\Mes documents\programmes\pb_alc650_5320.exe
C:\Documents and Settings\malka\Mes documents\programmes\viahyperion4in1448v.exe
C:\Documents and Settings\malka\Mes documents\programmes\viausb20xp.exe
C:\Documents and Settings\malka\Mes documents\programmes\wmp11-windowsxp-x86-FR-FR.exe
C:\Documents and Settings\malka\Mes documents\programmes\Office\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\Office XP.exe
C:\Documents and Settings\malka\Mes documents\programmes\Office\SETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\FILES\SYSTEM\EXTRACT.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\DCOM95.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\IE5COMP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\IE5SETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\OAINST.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\VRML2C.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OWC\SETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\PFILES\COMMON\MSSHARED\OFFICE10\DW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\PFILES\MSOFFICE\OFFICE10\OFFCLN.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\SUPPORT\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\SUPPORT\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\SUPPORT\Q282879.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\MSDE2000\SETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\MSDE2000\MSI\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\MSDE2000\MSI\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\SETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\ADMPACK\ADMPACK.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\HTMLHELP\HTMLHELP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\OCP\_ISDEL.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\OCP\SETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\PPTVIEW\PPVIEW97.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\SUPPORT\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\SUPPORT\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\SUPPORT\Q282879.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SETUPSE.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQLWRAP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\FILES\SUPPORT\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\FILES\SUPPORT\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\FILES\SUPPORT\Q282879.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\BCP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\CMDWRAP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\CNFGSVR.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\DCOMSCM.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\DISTRIB.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\DTSRUN.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\DTSWIZ.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\LOGREAD.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\ODBCCMPT.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\OSQL.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\REBUILDM.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\REGREBLD.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\REPLMERG.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SCM.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SNAPSHOT.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SQLAGENT.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SQLMANGR.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SQLSERVR.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SVRNETCN.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\VSWITCH.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\OTHER\DTCSETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SETUP\_ISDEL.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SETUP\MSETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SETUP\SETUPSQL.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SETUP\SQLSTP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SYSTEM\CLICONFG.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SYSTEM\REGSVR32.EXE
C:\Documents and Settings\malka\Mes documents\VIVRE APRES LA CHUTE DU MUR DE BERLIN\MsgPlusLive-411.exe
C:\Documents and Settings\malka\Mes documents\VIVRE APRES LA CHUTE DU MUR DE BERLIN\psa30se_ytb612_a708_DLM_en_us.exe

JO · Answer

FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
https://www.mcafee.com/en-us/index.html

Pid Process Port Proto Path
1540 -> 5000 TCP
4 System -> 1031 TCP
0 System -> 12080 TCP
4 System -> 139 TCP
0 System -> 1540 TCP
4 System -> 445 TCP
660 ashMaiSv -> 12025 TCP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
660 ashMaiSv -> 12110 TCP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
660 ashMaiSv -> 12119 TCP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
660 ashMaiSv -> 12143 TCP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
532 ashWebSv -> 12080 TCP C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
2452 jucheck -> 1530 TCP C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
520 jusched -> 1527 TCP C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
520 jusched -> 1528 TCP C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
1228 svchost -> 1026 TCP C:\WINDOWS\System32\svchost.exe
1100 svchost -> 135 TCP C:\WINDOWS\system32\svchost.exe

1540 -> 1406 UDP
4 System -> 1025 UDP
0 System -> 1445 UDP
4 System -> 1900 UDP
4 System -> 445 UDP
660 ashMaiSv -> 123 UDP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
660 ashMaiSv -> 137 UDP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
660 ashMaiSv -> 138 UDP C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
532 ashWebSv -> 1034 UDP C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
2452 jucheck -> 1391 UDP C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
520 jusched -> 1027 UDP C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
520 jusched -> 1036 UDP C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
520 jusched -> 15656 UDP C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
520 jusched -> 60315 UDP C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
1100 svchost -> 135 UDP C:\WINDOWS\system32\svchost.exe
1228 svchost -> 500 UDP C:\WINDOWS\System32\svchost.exe

PsList 1.26 - Process Information Lister
Copyright (C) 1999-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

Process information for MALKA-OPM3M753E:

Name Pid Pri Thd Hnd VM WS Priv
Idle 0 0 1 0 0 20 0
System 4 8 57 289 1876 80 0
smss 760 11 3 21 3796 80 164
csrss 836 13 12 489 24828 1724 1640
winlogon 860 13 20 448 45492 2320 5444
services 904 9 20 333 21680 1848 1464
spoolsv 168 8 14 154 45680 2008 3240
alg 512 8 3 68 13956 1000 480
ashWebSv 532 8 18 121 86684 6900 11444
nvsvc32 564 8 3 66 19368 600 500
ashMaiSv 660 8 8 83 52500 552 2884
PAStiSvc 668 8 2 23 7868 424 192
svchost 740 8 5 111 16572 1044 776
svchost 1100 8 9 285 31252 1756 1352
svchost 1228 8 58 1049 102200 11088 11276
CALMAIN 1280 8 7 116 22428 960 676
svchost 1508 8 6 93 29132 1368 1028
svchost 1540 8 13 155 30928 1028 1188
aswUpdSv 1756 8 3 31 16352 64 380
ashServ 1812 13 24 251 113608 12868 22828
usnsvc 2576 8 3 82 14624 1648 644
lsass 916 9 20 319 38516 460 3192
explorer 1692 8 15 388 86272 6420 12892
ACMonitor_X83 356 8 1 26 16204 1288 344
AcBtnMgr_X83 380 8 1 25 24212 784 432
WLANUTL 388 8 2 60 34692 1284 1132
printray 456 8 1 31 34992 888 756
SOUNDMAN 464 8 2 52 30280 900 580
jusched 520 8 3 152 53412 4656 1232
jucheck 2452 8 4 182 57664 5624 2400
ashDisp 600 8 7 76 42764 840 2276
stmon 616 8 2 104 56804 1752 1284
ctfmon 632 8 1 52 15080 788 348
IEXPLORE 720 8 19 533 197392 24256 35996
msnmsgr 2116 8 33 623 172936 14868 32708
cmd 3200 8 1 22 13376 1140 1384
pslist 3404 13 2 72 17408 1452 664

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 1692
Command line: C:\WINDOWS\Explorer.EXE

Base Size Version Path
0x01000000 0xf8000 6.00.2600.0000 C:\WINDOWS\Explorer.EXE
0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll
0x77290000 0x63000 6.00.2600.0000 C:\WINDOWS\system32\SHLWAPI.dll
0x77390000 0x802000 6.00.2600.0000 C:\WINDOWS\system32\SHELL32.dll
0x770e0000 0x8b000 3.50.5014.0000 C:\WINDOWS\system32\OLEAUT32.dll
0x75f10000 0xfc000 6.00.2600.0000 C:\WINDOWS\System32\BROWSEUI.dll
0x76960000 0x149000 6.00.2600.0000 C:\WINDOWS\System32\SHDOCVW.dll
0x5b090000 0x34000 6.00.2600.0000 C:\WINDOWS\System32\UxTheme.dll
0x78090000 0xe5000 6.00.2800.1816 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1816_x-ww_7d33ba0e\comctl32.dll
0x77300000 0x8b000 5.82.2600.0000 C:\WINDOWS\system32\comctl32.dll
0x7a170000 0x80000 2001.12.4414.0062 C:\WINDOWS\System32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0042 C:\WINDOWS\System32\COMRes.dll
0x5b950000 0x71000 6.00.2600.0000 C:\WINDOWS\System32\themeui.dll
0x71ca0000 0x1b000 6.00.2600.0000 C:\WINDOWS\System32\actxprxy.dll
0x76ac0000 0x15000 3.00.9238.0000 C:\WINDOWS\System32\ATL.DLL
0x76250000 0x8c000 5.131.2600.0000 C:\WINDOWS\system32\CRYPT32.dll
0x74aa0000 0x43000 6.00.2600.0000 C:\WINDOWS\System32\webcheck.dll
0x74a60000 0x9000 6.00.2600.0000 C:\WINDOWS\System32\BatMeter.dll
0x74a40000 0x7000 6.00.2600.0000 C:\WINDOWS\System32\POWRPROF.dll
0x76390000 0x1fb000 2.00.2600.0000 C:\WINDOWS\System32\msi.dll
0x76190000 0x98000 6.00.2600.0000 C:\WINDOWS\system32\WININET.dll
0x76100000 0x8e000 6.00.2600.0000 C:\WINDOWS\System32\shdoclc.dll
0x732d0000 0x51000 6.00.2600.0000 C:\WINDOWS\System32\zipfldr.dll
0x64f00000 0x12000 4.07.1043.0000 C:\Program Files\Alwil Software\Avast4\ashShell.dll
0x723a0000 0x13000 6.00.2600.0000 C:\WINDOWS\System32\browselc.dll
0x10000000 0xb000 6.00.0000.0878 C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
0x76080000 0x78000 6.00.2600.0000 C:\WINDOWS\system32\urlmon.dll
0x32520000 0x12000 10.00.2609.0000 C:\Program Files\Microsoft Office\Office10\msohev.dll
0x76be0000 0x2b000 5.131.2600.0000 C:\WINDOWS\System32\WINTRUST.dll
0x0ffd0000 0x22000 5.01.2518.0000 C:\WINDOWS\System32\rsaenh.dll
0x70ee0000 0x7000 1.01.0000.3917 C:\WINDOWS\System32\asfsipc.dll
0x60990000 0xd000 2.00.2600.0000 C:\WINDOWS\System32\MSISIP.DLL
0x74e10000 0x10000 5.06.0000.6626 C:\WINDOWS\System32\wshext.dll
0x76340000 0x46000 6.00.2600.0000 C:\WINDOWS\system32\comdlg32.dll
0x59000000 0xe000 5.06.0000.6626 C:\WINDOWS\System32\wshFR.DLL
0x365a0000 0x15000 10.00.2625.0000 C:\PROGRA~1\MICROS~2\Office10\MCPS.DLL
0x76010000 0x61000 6.00.8972.0000 C:\WINDOWS\System32\MSVCP60.DLL

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 860
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x6f000 \??\C:\WINDOWS\system32\winlogon.exe
0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll
0x76250000 0x8c000 5.131.2600.0000 C:\WINDOWS\system32\CRYPT32.dll
0x76be0000 0x2b000 5.131.2600.0000 C:\WINDOWS\system32\WINTRUST.dll
0x77390000 0x802000 6.00.2600.0000 C:\WINDOWS\system32\SHELL32.dll
0x77290000 0x63000 6.00.2600.0000 C:\WINDOWS\system32\SHLWAPI.dll
0x77300000 0x8b000 5.82.2600.0000 C:\WINDOWS\system32\COMCTL32.dll
0x1f7b0000 0x31000 3.520.7713.0000 C:\WINDOWS\system32\ODBC32.dll
0x76340000 0x46000 6.00.2600.0000 C:\WINDOWS\system32\comdlg32.dll
0x78090000 0xe5000 6.00.2800.1816 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1816_x-ww_7d33ba0e\comctl32.dll
0x1f850000 0x18000 3.520.7713.0000 C:\WINDOWS\system32\odbcint.dll
0x76b70000 0x1f000 6.00.2600.0000 C:\WINDOWS\system32\SHSVCS.dll
0x5b090000 0x34000 6.00.2600.0000 C:\WINDOWS\system32\uxtheme.dll
0x0ffd0000 0x22000 5.01.2518.0000 C:\WINDOWS\System32\rsaenh.dll
0x77000000 0xd4000 2001.12.4414.0042 C:\WINDOWS\system32\COMRes.dll
0x770e0000 0x8b000 3.50.5014.0000 C:\WINDOWS\system32\OLEAUT32.dll
0x7a170000 0x80000 2001.12.4414.0062 C:\WINDOWS\system32\CLBCATQ.DLL

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
IEXPLORE.EXE pid: 720
Command line: "C:\Program Files\Internet Explorer\IEXPLORE.EXE"

Base Size Version Path
0x00400000 0x19000 6.00.2600.0000 C:\Program Files\Internet Explorer\IEXPLORE.EXE
0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll
0x77290000 0x63000 6.00.2600.0000 C:\WINDOWS\system32\SHLWAPI.dll
0x76960000 0x149000 6.00.2600.0000 C:\WINDOWS\System32\SHDOCVW.dll
0x78090000 0xe5000 6.00.2800.1816 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1816_x-ww_7d33ba0e\comctl32.dll
0x77390000 0x802000 6.00.2600.0000 C:\WINDOWS\system32\SHELL32.dll
0x77300000 0x8b000 5.82.2600.0000 C:\WINDOWS\system32\comctl32.dll
0x5b090000 0x34000 6.00.2600.0000 C:\WINDOWS\system32\uxtheme.dll
0x75f10000 0xfc000 6.00.2600.0000 C:\WINDOWS\System32\BROWSEUI.dll
0x723a0000 0x13000 6.00.2600.0000 C:\WINDOWS\System32\browselc.dll
0x7a170000 0x80000 2001.12.4414.0062 C:\WINDOWS\System32\CLBCATQ.DLL
0x770e0000 0x8b000 3.50.5014.0000 C:\WINDOWS\system32\OLEAUT32.dll
0x77000000 0xd4000 2001.12.4414.0042 C:\WINDOWS\System32\COMRes.dll
0x76190000 0x98000 6.00.2600.0000 C:\WINDOWS\system32\WININET.dll
0x76250000 0x8c000 5.131.2600.0000 C:\WINDOWS\system32\CRYPT32.dll
0x10000000 0xb000 6.00.0000.0878 C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
0x6d7c0000 0x79000 6.00.0020.0006 C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
0x7c340000 0x56000 7.10.3052.0004 C:\Program Files\Java\jre1.6.0_02\bin\MSVCR71.dll
0x29500000 0x51000 4.00.0249.0001 C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
0x76080000 0x78000 6.00.2600.0000 C:\WINDOWS\system32\urlmon.dll
0x0ffd0000 0x22000 5.01.2518.0000 C:\WINDOWS\System32\rsaenh.dll
0x27500000 0xc9000 4.00.0249.0001 C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\msidcrl40.dll
0x76be0000 0x2b000 5.131.2600.0000 C:\WINDOWS\System32\WINTRUST.dll
0x02020000 0x28000 1.02.3000.1001 C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
0x72d50000 0x114000 8.20.8730.0001 C:\WINDOWS\System32\msxml3.dll
0x746e0000 0x8f000 6.00.2600.0000 C:\WINDOWS\System32\mlang.dll
0x73ca0000 0x10000 5.131.2600.0000 C:\WINDOWS\System32\cryptnet.dll
0x01e20000 0x49000 1.02.5000.1021 C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
0x01e90000 0x2c000 1.02.5000.1021 C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\mtbres.dll
0x76100000 0x8e000 6.00.2600.0000 C:\WINDOWS\System32\shdoclc.dll
0x76390000 0x1fb000 2.00.2600.0000 C:\WINDOWS\System32\msi.dll
0x76ac0000 0x15000 3.00.9238.0000 C:\WINDOWS\System32\ATL.DLL
0x74780000 0x2ad000 6.00.2600.0000 C:\WINDOWS\System32\mshtml.dll
0x74630000 0x27000 3.10.0349.0000 C:\WINDOWS\System32\MSLS31.DLL
0x75be0000 0x91000 5.06.0000.6626 C:\WINDOWS\System32\jscript.dll
0x66cc0000 0xa000 6.00.2600.0000 C:\WINDOWS\System32\imgutil.dll
0x5e680000 0xb000 6.00.2600.0000 C:\WINDOWS\System32\pngfilt.dll
0x73250000 0x75000 5.06.0000.6626 C:\WINDOWS\system32\vbscript.dll
0x30000000 0x2ef000 9.00.0047.0000 C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx
0x76340000 0x46000 6.00.2600.0000 C:\WINDOWS\system32\comdlg32.dll
0x65000000 0x9000 5.03.0000.0900 C:\WINDOWS\System32\ddrawex.dll
0x51000000 0x4d000 5.03.0000.0900 C:\WINDOWS\System32\DDRAW.dll
0x6c270000 0x33000 6.03.2600.0000 C:\WINDOWS\System32\dxtrans.dll
0x6c2b0000 0x55000 6.03.2600.0000 C:\WINDOWS\System32\dxtmsft.dll
0x672b0000 0x3b000 6.00.2600.0000 C:\WINDOWS\System32\iepeers.dll
0x74c20000 0x6f000 6.00.2600.0000 C:\WINDOWS\System32\mshtmled.dll
0x71ca0000 0x1b000 6.00.2600.0000 C:\WINDOWS\System32\actxprxy.dll
0x09a30000 0x61000 6.00.0000.0878 C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\ActiveX\pdf.ocx
0x66700000 0x91000 7.02.0000.0240 C:\Program Files\QuickTime\QTPlugin.ocx
0x09aa0000 0x472000 9.00.0000.2980 C:\WINDOWS\System32\wmp.dll
0x09f20000 0x2d9000 9.00.0000.2980 C:\WINDOWS\System32\wmploc.dll
0x72a70000 0x18000 6.00.2600.0000 C:\WINDOWS\System32\plugin.ocx

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
services.exe pid: 904
Command line: C:\WINDOWS\system32\services.exe

Base Size Version Path
0x77be0000 0x53000 7.00.2600.0000 C:\WINDOWS\system32\msvcrt.dll
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est AC18-51B2

Répertoire de C:\Program Files

21/11/2007 17:43 <REP> .
21/11/2007 17:43 <REP> ..
20/06/2001 15:19 40 960 ACMonitor_X83.exe
28/10/2006 12:06 <REP> Adobe
05/11/2007 20:58 <REP> Alwil Software
03/09/2007 17:58 <REP> Apple Software Update
22/07/2006 10:37 <REP> Canon
25/06/2006 14:14 <REP> ComPlus Applications
18/11/2007 21:20 <REP> Fichiers communs
20/11/2007 21:19 <REP> FoxTarot4
03/04/2007 19:38 <REP> FusionSoft DVD Player XP
23/07/2006 21:37 <REP> Internet Explorer
03/09/2007 18:01 <REP> iPod
03/09/2007 18:02 <REP> iTunes
14/09/2007 21:32 <REP> Java
01/07/2006 13:34 <REP> Lexmark
08/07/2006 12:33 <REP> LexmarkX83
14/09/2007 21:32 <REP> LimeWire
08/07/2006 12:42 <REP> Maxis
19/07/2006 08:25 <REP> Messenger
19/06/2007 18:39 <REP> Messenger Plus! Live
01/07/2006 13:41 <REP> MGI
25/06/2006 19:52 <REP> Microsoft ActiveSync
25/06/2006 14:17 <REP> microsoft frontpage
25/06/2006 19:51 <REP> Microsoft Office
23/07/2006 21:37 <REP> Movie Maker
23/07/2006 21:36 <REP> MSN
01/07/2006 13:23 <REP> MSN Apps
25/06/2006 14:13 <REP> MSN Gaming Zone
07/11/2007 18:10 <REP> MSN Messenger
01/07/2006 16:03 <REP> MSN Toolbar
23/07/2006 21:37 <REP> NetMeeting
28/07/2006 18:07 <REP> ONES Trial (F)
23/07/2006 21:37 <REP> Outlook Express
08/07/2006 12:24 <REP> PC VGA Camer@
22/11/2006 18:29 <REP> Philips
03/09/2007 18:00 <REP> QuickTime
30/06/2006 19:50 <REP> SAGEM
30/06/2006 19:51 <REP> SAGEM Wi-Fi USB 802.11g
25/06/2006 14:15 <REP> Services en ligne
09/11/2007 17:31 <REP> Trend Micro
06/11/2007 14:04 <REP> Ubi Soft
19/06/2007 18:39 <REP> Windows Live
06/05/2007 12:36 <REP> Windows Media Player
25/06/2006 14:13 <REP> Windows NT
25/06/2006 14:17 <REP> xerox
1 fichier(s) 40 960 octets
45 Rép(s) 60 856 233 984 octets libres
C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.3.1.3\iTunesSetupAdmin.exe
C:\Documents and Settings\malka\Application Data\LimeWire\.NetworkShare\LimeWireWin4.14.10.exe
C:\Documents and Settings\malka\Application Data\Macromedia\Flash Player\#SharedObjects\L89GXBQ2\localhost\MainCD.exe
C:\Documents and Settings\malka\Bureau\OTMoveIt.exe
C:\Documents and Settings\malka\Bureau\VirtumundoBeGone.exe
C:\Documents and Settings\malka\Bureau\VundoFix.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\catchme.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\diff.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\dumphive.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\FilesInfoCmd.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\find2.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\Fport.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\grep.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\gzip.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\KProcCheck.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\LFiles.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\LISTDLLS.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\md5sums.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\pslist.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\sigcheck.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\streams.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\swreg.exe
C:\Documents and Settings\malka\Bureau\DiagHelp\DiagHelp\tar.exe
C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\msnchk.exe
C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\MD5File.exe
C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\msnchk.exe
C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\Process.exe
C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\swreg.exe
C:\Documents and Settings\malka\Bureau\MSNFix\MSNFix\incl\zip.exe
C:\Documents and Settings\malka\Local Settings\Temporary Internet Files\Content.IE5\SLIBO9QJ\in23[1].exe
C:\Documents and Settings\malka\Mes documents\DVD_Player_5.0_XP.exe
C:\Documents and Settings\malka\Mes documents\JOANNE COURS\Nouveau dossier\iTunesSetup.exe
C:\Documents and Settings\malka\Mes documents\JOANNE COURS\Nouveau dossier\LimeWireWin.exe
C:\Documents and Settings\malka\Mes documents\JOANNE COURS\Nouveau dossier\MPSetup.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\HJTInstall.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\INSTALL_MSN_MESSENGER_NT.EXE
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\installer_fr.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\setup_fr.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\setupfre.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\MD5File.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\msnchk.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\Process.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\swreg.exe
C:\Documents and Settings\malka\Mes documents\Nouveau dossier\MSNFix\MSNFix\incl\zip.exe
C:\Documents and Settings\malka\Mes documents\programmes\Avast4.exe
C:\Documents and Settings\malka\Mes documents\programmes\Install_Messenger.exe
C:\Documents and Settings\malka\Mes documents\programmes\INSTALL_MSN_MESSENGER_NT.EXE
C:\Documents and Settings\malka\Mes documents\programmes\nvidia_6085.exe
C:\Documents and Settings\malka\Mes documents\programmes\pb_alc650_5320.exe
C:\Documents and Settings\malka\Mes documents\programmes\viahyperion4in1448v.exe
C:\Documents and Settings\malka\Mes documents\programmes\viausb20xp.exe
C:\Documents and Settings\malka\Mes documents\programmes\wmp11-windowsxp-x86-FR-FR.exe
C:\Documents and Settings\malka\Mes documents\programmes\Office\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\Office XP.exe
C:\Documents and Settings\malka\Mes documents\programmes\Office\SETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\FILES\SYSTEM\EXTRACT.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\DCOM95.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\IE5COMP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\IE5SETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\OAINST.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OSP\1033\IE5\EN\VRML2C.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\OWC\SETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\PFILES\COMMON\MSSHARED\OFFICE10\DW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\PFILES\MSOFFICE\OFFICE10\OFFCLN.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\SUPPORT\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\SUPPORT\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\FILES\SUPPORT\Q282879.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\MSDE2000\SETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\MSDE2000\MSI\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\MSDE2000\MSI\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\SETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\ADMPACK\ADMPACK.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\HTMLHELP\HTMLHELP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\OCP\_ISDEL.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\OCP\SETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\PFILES\ORKTOOLS\ORK10\TOOLS\PPTVIEW\PPVIEW97.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\SUPPORT\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\SUPPORT\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\ORK\FILES\SUPPORT\Q282879.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SETUPSE.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQLWRAP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\FILES\SUPPORT\INSTMSI.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\FILES\SUPPORT\INSTMSIW.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\FILES\SUPPORT\Q282879.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\BCP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\CMDWRAP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\CNFGSVR.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\DCOMSCM.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\DISTRIB.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\DTSRUN.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\DTSWIZ.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\LOGREAD.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\ODBCCMPT.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\OSQL.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\REBUILDM.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\REGREBLD.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\REPLMERG.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SCM.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SNAPSHOT.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SQLAGENT.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SQLMANGR.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SQLSERVR.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\SVRNETCN.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\BINN\VSWITCH.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\OTHER\DTCSETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SETUP\_ISDEL.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SETUP\MSETUP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SETUP\SETUPSQL.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SETUP\SQLSTP.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SYSTEM\CLICONFG.EXE
C:\Documents and Settings\malka\Mes documents\programmes\Office\SHAREPT\SQL\X86\SYSTEM\REGSVR32.EXE
C:\Documents and Settings\malka\Mes documents\VIVRE APRES LA CHUTE DU MUR DE BERLIN\MsgPlusLive-411.exe
C:\Documents and Settings\malka\Mes documents\VIVRE APRES LA CHUTE DU MUR DE BERLIN\psa30se_ytb612_a708_DLM_en_us.exe

Regis59 · Answer

Normalement combofix est de nouveau fonctionnel, tu peux faire un new rapport et apres je te dis quoi faire.

a+

JO · Answer

ComboFix 07-11-19.3 - malka 2007-11-22 22:21:57.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.68 [GMT 1:00]Running from: C:\Documents and Settings\malka\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\WINDOWS\cookies.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\poof

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-22 to 2007-11-22 ))))))))))))))))))))))))))))))))))))
.

2007-11-14 19:42 0 --a------ C:\WINDOWS\system32\mcrh.tmp
2007-11-11 11:59 <REP> d-------- C:\MSN FIXX
2007-11-11 02:19 <REP> d-------- C:\msnfix
2007-11-10 17:39 583,979 ---hs---- C:\WINDOWS\system32\eqwppmjv.ini
2007-11-09 17:31 <REP> d-------- C:\Program Files\Trend Micro
2007-11-09 16:41 583,679 ---hs---- C:\WINDOWS\system32\libhroqo.ini
2007-11-07 21:31 <REP> d--hs---- C:\found.000
2007-11-07 13:03 <REP> d-------- C:\Documents and Settings\malka\Application Data\[u]0[/u]7%2F06%2F2007
2007-11-07 12:56 681,984 --a------ C:\WINDOWS\is-P5HI2.exe
2007-11-07 12:54 681,984 --a------ C:\WINDOWS\is-NSG79.exe
2007-11-07 12:50 681,984 --a------ C:\WINDOWS\is-KJNGJ.exe
2007-11-07 12:39 681,984 --a------ C:\WINDOWS\is-LEKDT.exe
2007-11-07 12:36 681,984 --a------ C:\WINDOWS\is-DNTO1.exe
2007-11-07 12:34 681,984 --a------ C:\WINDOWS\is-BG01F.exe
2007-11-07 12:32 681,984 --a------ C:\WINDOWS\is-F0KPU.exe
2007-11-07 12:28 <REP> d-------- C:\Program Files\Fichiers communs\[u]0[/u]7%2F06%2F2007
2007-11-07 12:24 569,628 ---hs---- C:\WINDOWS\system32\uicpdmix.ini
2007-11-05 20:58 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-05 20:58 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-05 20:58 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-05 20:58 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-05 20:58 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-02 17:39 56,448 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2007-11-02 17:39 56,448 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2007-11-02 17:38 50,688 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-11-02 17:38 45,568 --a--c--- C:\WINDOWS\system32\dllcache\iyuv_32.dll
2007-11-02 17:38 8,192 --a------ C:\WINDOWS\system32\tsbyuv.dll
2007-11-02 17:38 8,192 --a--c--- C:\WINDOWS\system32\dllcache\tsbyuv.dll
2007-11-02 17:33 47,104 --a--c--- C:\WINDOWS\system32\dllcache\wstdecod.dll
2007-11-02 17:33 34,304 --a------ C:\WINDOWS\system32\mciqtz32.dll
2007-11-02 17:33 27,648 --a--c--- C:\WINDOWS\system32\dllcache\vbisurf.ax
2007-11-02 17:33 18,688 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys
2007-11-01 19:32 24,960 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-11-01 19:32 24,960 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-22 10:36 --------- d-----w C:\Documents and Settings\malka\Application Data\LimeWire
2007-11-20 20:19 --------- d-----w C:\Program Files\FoxTarot4
2007-11-07 17:10 --------- d-----w C:\Program Files\MSN Messenger
2007-11-06 13:04 --------- d-----w C:\Program Files\Ubi Soft
2007-11-05 19:58 --------- d-----w C:\Program Files\Alwil Software
2006-11-11 14:07 17,144 ----a-w C:\Documents and Settings\malka\Application Data\GDIPFONTCACHEV1.DAT
2001-06-20 14:19 40,960 ----a-w C:\Program Files\ACMonitor_X83.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-28 13:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2001-08-28 13:00 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2004-04-23 11:24 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2001-08-28 13:00 C:\WINDOWS\system32\rundll32.exe]
"Lexmark X83 Button Monitor"="C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe" [2001-10-12 17:36]
"Lexmark X83 Button Manager"="C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe" [2001-06-10 13:59]
"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2001-10-25 19:20]
"SoundMan"="SOUNDMAN.EXE" [2003-08-14 23:34 C:\WINDOWS\SOUNDMAN.EXE]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 08:18]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"Logical Disk Awareness"="mdasvc.exe" []
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"Salestart(1)"="C:\Program Files\Fichiers communs\[u]0[/u]7%2F06%2F2007\stmon.exe" [2007-10-11 15:21]
"Salestart(2)"="C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" []
"Salestart(3)"="C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" []
"ac18511d"="C:\WINDOWS\System32\slbaylia.dll" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 13:00]

R0 PzWDM;PzWDM;C:\WINDOWS\System32\Drivers\PzWDM.sys
R3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;C:\WINDOWS\System32\DRIVERS\WlanUIG.sys
S2 BulkUsb;Genesys Logic USB Scanner Controller NT 5.0;C:\WINDOWS\System32\Drivers\usbscan.sys
S3 PAC7311;VGA SoC PC-Camer@;C:\WINDOWS\System32\DRIVERS\PA707UCM.SYS

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-11-02 14:16:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-22 22:29:52
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-22 22:31:44 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-13 13:59
.
--- E O F ---

JO · Answer

il me reste qqch à faire?

Regis59 · Answer

Salut

Oui, desole.

Remet un Hijackthis et un combofix

A+

JO · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:37:21, on 02/12/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\malka\Local Settings	emp\Répertoire temporaire 1 pour HiJackThis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Logical Disk Awareness] mdasvc.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Fichiers communs\07%2F06%2F2007\stmon.exe" dm=http://apu03c0.audientia.net; ad=http://apu03c0.audientia.net
O4 - HKLM\..\Run: [Salestart(2)] "C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" dm=http://defensedudisque.com; ad=http://defensedudisque.com
O4 - HKLM\..\Run: [Salestart(3)] "C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" dm=http://moncontenuassistant.com; ad=http://moncontenuassistant.com
O4 - HKLM\..\Run: [ac18511d] rundll32.exe "C:\WINDOWS\System32\slbaylia.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

JO · Answer

encore une fois, combofix a expiré

Regis59 · Answer

ok retelecharge le et relance le alors.

A+

JO · Answer

ComboFix 07-12-02.6 - malka 2007-12-04 16:10:35.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.83 [GMT 1:00]
Running from: C:\Documents and Settings\malka\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor

.
((((((((((((((((((((((((((((( Fichiers créés 2007-11-04 to 2007-12-04 ))))))))))))))))))))))))))))))))))))
.

2007-11-28 17:17 . 2007-11-28 17:17 244 --ah----- C:\sqmnoopt10.sqm
2007-11-28 17:17 . 2007-11-28 17:17 232 --ah----- C:\sqmdata11.sqm
2007-11-21 17:29 . 2007-11-21 17:29 722,134 --a------ C:\upload_moi_MALKA-OPM3M753E.tar.gz
2007-11-14 19:42 . 2007-11-14 19:43 0 --a------ C:\WINDOWS\system32\mcrh.tmp
2007-11-14 10:14 . 2007-11-14 10:14 244 --ah----- C:\sqmnoopt09.sqm
2007-11-14 10:14 . 2007-11-14 10:14 232 --ah----- C:\sqmdata10.sqm
2007-11-12 17:40 . 2007-11-18 19:59 1,038,418 ---hs---- C:\WINDOWS\system32\ailyabls.ini
2007-11-11 17:41 . 2007-11-12 17:39 584,596 ---hs---- C:\WINDOWS\system32\isohspie.ini
2007-11-11 11:59 . 2007-11-11 11:59 <REP> d-------- C:\MSN FIXX
2007-11-11 02:19 . 2007-11-11 02:19 <REP> d-------- C:\msnfix
2007-11-10 17:39 . 2007-11-11 13:30 583,979 ---hs---- C:\WINDOWS\system32\eqwppmjv.ini
2007-11-09 17:31 . 2007-11-09 17:31 <REP> d-------- C:\Program Files\Trend Micro
2007-11-09 16:41 . 2007-11-10 17:38 583,679 ---hs---- C:\WINDOWS\system32\libhroqo.ini
2007-11-08 13:25 . 2007-11-09 16:40 584,182 ---hs---- C:\WINDOWS\system32\ocjolhyc.ini
2007-11-07 21:31 . 2007-11-07 21:31 <REP> d--hs---- C:\found.000
2007-11-07 13:03 . 2007-11-07 13:03 <REP> d-------- C:\Documents and Settings\malka\Application Data\[u]0[/u]7%2F06%2F2007
2007-11-07 12:56 . 2007-11-07 12:56 681,984 --a------ C:\WINDOWS\is-P5HI2.exe
2007-11-07 12:56 . 2007-11-07 12:56 10,551 --a------ C:\WINDOWS\is-P5HI2.msg
2007-11-07 12:56 . 2007-11-07 12:56 303 --a------ C:\WINDOWS\is-P5HI2.lst
2007-11-07 12:54 . 2007-11-07 12:54 681,984 --a------ C:\WINDOWS\is-NSG79.exe
2007-11-07 12:54 . 2007-11-07 12:54 10,551 --a------ C:\WINDOWS\is-NSG79.msg
2007-11-07 12:54 . 2007-11-07 12:54 303 --a------ C:\WINDOWS\is-NSG79.lst
2007-11-07 12:50 . 2007-11-07 12:50 681,984 --a------ C:\WINDOWS\is-KJNGJ.exe
2007-11-07 12:50 . 2007-11-07 12:50 10,551 --a------ C:\WINDOWS\is-KJNGJ.msg
2007-11-07 12:50 . 2007-11-07 12:50 303 --a------ C:\WINDOWS\is-KJNGJ.lst
2007-11-07 12:39 . 2007-11-07 12:39 681,984 --a------ C:\WINDOWS\is-LEKDT.exe
2007-11-07 12:39 . 2007-11-07 12:39 10,551 --a------ C:\WINDOWS\is-LEKDT.msg
2007-11-07 12:39 . 2007-11-07 12:39 303 --a------ C:\WINDOWS\is-LEKDT.lst
2007-11-07 12:36 . 2007-11-07 12:36 681,984 --a------ C:\WINDOWS\is-DNTO1.exe
2007-11-07 12:36 . 2007-11-07 12:36 10,551 --a------ C:\WINDOWS\is-DNTO1.msg
2007-11-07 12:36 . 2007-11-07 12:36 303 --a------ C:\WINDOWS\is-DNTO1.lst
2007-11-07 12:34 . 2007-11-07 12:34 681,984 --a------ C:\WINDOWS\is-BG01F.exe
2007-11-07 12:34 . 2007-11-07 12:34 10,551 --a------ C:\WINDOWS\is-BG01F.msg
2007-11-07 12:34 . 2007-11-07 12:34 303 --a------ C:\WINDOWS\is-BG01F.lst
2007-11-07 12:32 . 2007-11-07 12:32 681,984 --a------ C:\WINDOWS\is-F0KPU.exe
2007-11-07 12:32 . 2007-11-07 12:32 10,551 --a------ C:\WINDOWS\is-F0KPU.msg
2007-11-07 12:32 . 2007-11-07 12:32 303 --a------ C:\WINDOWS\is-F0KPU.lst
2007-11-07 12:28 . 2007-11-11 21:44 <REP> d-------- C:\Program Files\Fichiers communs\[u]0[/u]7%2F06%2F2007
2007-11-07 12:24 . 2007-11-08 13:25 569,628 ---hs---- C:\WINDOWS\system32\uicpdmix.ini
2007-11-05 20:58 . 2007-09-06 12:09 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-11-05 20:58 . 2004-01-09 11:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-11-05 20:58 . 2007-09-06 12:00 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-11-05 20:58 . 2007-09-06 12:05 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-05 20:58 . 2007-09-06 12:05 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-05 20:58 . 2007-09-06 12:02 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-05 20:58 . 2007-09-06 12:00 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-05 20:58 . 2007-09-06 12:03 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-03 19:22 --------- d-----w C:\Program Files\FoxTarot4
2007-11-30 19:59 --------- d-----w C:\Documents and Settings\malka\Application Data\LimeWire
2007-11-07 17:10 --------- d-----w C:\Program Files\MSN Messenger
2007-11-06 13:04 --------- d-----w C:\Program Files\Ubi Soft
2007-11-05 19:58 --------- d-----w C:\Program Files\Alwil Software
2006-11-11 14:07 17,144 ----a-w C:\Documents and Settings\malka\Application Data\GDIPFONTCACHEV1.DAT
2001-06-20 14:19 40,960 ----a-w C:\Program Files\ACMonitor_X83.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-28 13:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2001-08-28 13:00 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2004-04-23 11:24 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2001-08-28 13:00 C:\WINDOWS\system32\rundll32.exe]
"Lexmark X83 Button Monitor"="C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe" [2001-10-12 17:36]
"Lexmark X83 Button Manager"="C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe" [2001-06-10 13:59]
"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2001-10-25 19:20]
"SoundMan"="SOUNDMAN.EXE" [2003-08-14 23:34 C:\WINDOWS\SOUNDMAN.EXE]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 08:18]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"Logical Disk Awareness"="mdasvc.exe" []
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"Salestart(1)"="C:\Program Files\Fichiers communs\[u]0[/u]7%2F06%2F2007\stmon.exe" [2007-10-11 15:21]
"Salestart(2)"="C:\Program Files\Fichiers communs\DefenseDuDisque\strpmon.exe" []
"Salestart(3)"="C:\Program Files\Fichiers communs\MonContenuassistant\mc.exe" []
"ac18511d"="C:\WINDOWS\System32\slbaylia.dll" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 13:00]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]
Sagem - Utilitaire r‚seau pour Cl‚ USB Wi-Fi 802.11g.lnk - C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe [2006-06-30 19:51:02]

R0 PzWDM;PzWDM;C:\WINDOWS\System32\Drivers\PzWDM.sys
R3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;C:\WINDOWS\System32\DRIVERS\WlanUIG.sys
S2 BulkUsb;Genesys Logic USB Scanner Controller NT 5.0;C:\WINDOWS\System32\Drivers\usbscan.sys
S3 PAC7311;VGA SoC PC-Camer@;C:\WINDOWS\System32\DRIVERS\PA707UCM.SYS

*Newly Created Service* - PCANDIS5
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-11-02 14:16:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-04 16:14:33
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-12-04 16:15:38
C:\ComboFix2.txt ... 2007-11-22 22:31
C:\ComboFix3.txt ... 2007-11-13 13:59
.
--- E O F ---

JO · Answer

voilà...
en tt cas jte remercie pr ton aide jusqu'ici, le problème semble être parti.
il me reste encore bcp à faire?

VIRUS

39 réponses

Discussions similaires

Newsletters