Aide pour trojan

Question

Bonjour,
 
Voila mon soucis. Lors d'une manœuvre sur internet j'ai reçu plein de trojan ( win32/adware.sectoolbar application , win/adwareavsystemcare application et j'en passe ) j'ai donc essayé les techniques que vous avez donné pour des personne ayant mes soucis mais rien ne change ils sont toujours la. J'espère avoir votre aide. Merci d'avance

jlpjlp · Answer

slt

colle un rapport hijackthis 
 
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :

https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html


Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo. 

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste 

Ensuite avec Explorer créer un dossier c:\hijackthis 
Décompresser Hijackthis dans ce dossier. 
C'est important pour les sauvegardes."

Adeline02 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:22, on 13/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Nod32
od32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nod32
od32kui.exe
C:\WINDOWS\system32\Prismsta.exe
C:\WINDOWS\system32\Prismsvr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\UberIcon\UberIcon Manager.exe
C:\Windows\System32\VisualTaskTips.exe
C:\Program Files\TweakRAM\TweakRAM.exe
C:\Program Files\LClock\lclock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WowCartographe\WowCartographe.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {08C525F4-2EBD-396D-B12A-005661A8CF95} - C:\Program Files\Ujgmrkuf\bckqxcyn.dll
O2 - BHO: (no name) - {1C9E5966-B6FF-4146-9E34-811C9DFD4F6F} - (no file)
O2 - BHO: (no name) - {2037842F-B6FC-94F5-49E2-04A07E581D4A} - C:\Program Files\Rkbldmnn
vafmhbi.dll
O2 - BHO: (no name) - {2D628D87-D0A3-6203-4E86-09D91C6DD614} - C:\Program Files\Ruvbbfhb\woibizcw.dll
O2 - BHO: (no name) - {3BE02A32-3699-4974-A6CD-D3FE6016C063} - (no file)
O2 - BHO: (no name) - {3BFD0013-2F6A-4060-9A8E-A76CE054F49C} - (no file)
O2 - BHO: (no name) - {3C847F45-3908-46B2-8499-6DA346CA4929} - (no file)
O2 - BHO: (no name) - {469644C1-EAD0-4BE8-8FB4-E4A219EF9CC3} - (no file)
O2 - BHO: (no name) - {5159791b-b229-44d8-b82a-49b8e3cbe811} - (no file)
O2 - BHO: {18c0c79e-6387-0a18-3164-d601ed876106} - {601678de-106d-4613-81a0-7836e97c0c81} - C:\WINDOWS\system32\ewfsyqcy.dll
O2 - BHO: (no name) - {620c19dd-dd5e-4582-9d43-89fdd00e6355} - (no file)
O2 - BHO: (no name) - {6C4D39B5-E92C-45C2-B705-87655CCE146F} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8CEDE431-82B3-4968-BDC2-D497C8B6E694} - (no file)
O2 - BHO: (no name) - {8F5B8039-1FB8-4818-AE01-FCD9978464FE} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9CEB2735-47BE-4968-89D2-D11ECA76E030} - (no file)
O2 - BHO: (no name) - {A8B1EC63-C834-44AA-AD40-966A96988815} - (no file)
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\hufszctx.dll
O2 - BHO: (no name) - {ab51a63c-569b-4185-aba7-7d70a5f8119b} - (no file)
O2 - BHO: (no name) - {b336e14a-27e2-47ff-bf2f-7643913a4fde} - (no file)
O2 - BHO: (no name) - {b63072df-7c6f-434c-8325-8744b461b61a} - (no file)
O2 - BHO: (no name) - {C409D2B7-E80D-46DF-A5D6-D118C09F8409} - (no file)
O2 - BHO: (no name) - {DA2EF1B4-A71C-4278-BFC8-8E0BE1F34840} - (no file)
O2 - BHO: (no name) - {E2E2D0C8-801E-4866-8CE9-04CB1665DABC} - (no file)
O2 - BHO: (no name) - {ed6fd6ff-38f8-4717-ae45-b8180c3533a4} - (no file)
O2 - BHO: (no name) - {f6ac28ef-867c-4c86-9b85-2419c0a1ff87} - (no file)
O2 - BHO: (no name) - {fb58d224-4a63-47c1-8f40-c32daf4c217a} - (no file)
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\hufszctx.dll
O4 - HKLM\..\Run: [Vistadrv] C:\WINDOWS\system32\Vistadrive\vsdrv.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Nod32
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [PRISMSTA.EXE] Prismsta.exe /START
O4 - HKLM\..\Run: [PRISMSVR.EXE] Prismsvr.exe /APPLY
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [18035c72] rundll32.exe "C:\WINDOWS\system32\hugcbfjs.dll",b
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKCU\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
O4 - HKCU\..\Run: [TweakRAM] C:\Program Files\TweakRAM\TweakRAM.exe
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [TweakRAM] C:\Program Files\TweakRAM\TweakRAM.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [LClock] C:\Program Files\LClock\lclock.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{662FA424-F11F-4016-A903-7A9AE2404143}: NameServer = 80.10.246.1,80.10.246.139
O20 - Winlogon Notify: gqxqnebs - gqxqnebs.dll (file missing)
O20 - Winlogon Notify: hufszctx - C:\WINDOWS\SYSTEM32\hufszctx.dll
O20 - Winlogon Notify: winpsa32 - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Nod32
od32krn.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

jlpjlp · Answer

parfait tu es inféctées par vundo/virtumonde, fais tout ce qui suis et colle bien les rapports meme si cela prend un peu de temps...



scan avec vundofix (colle le rapport)

Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4

Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.

Quand c'est fini, il vous sera demandé de redémarrer votre ordinateur, cliquez
OK.

__________________
puis :




virtumondebegone (colle le rapport)

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

_________________

combofix (colle le rapport)
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

_________________

recolle ensuite un rapport hijackthis et dis tes soucis

Adeline02 · Answer

[11/12/2007, 21:54:33] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrateur\Bureau\VirtumundoBeGone.exe" ) [11/12/2007, 21:54:41] - User choose NOT to continue. Exiting... [11/12/2007, 21:59:00] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrateur\Bureau\VirtumundoBeGone.exe" ) [11/12/2007, 21:59:07] - Detected System Information: [11/12/2007, 21:59:07] - Windows Version: 5.1.2600, Service Pack 2 [11/12/2007, 21:59:07] - Current Username: Administrateur (Admin) [11/12/2007, 21:59:07] - Windows is in NORMAL mode. [11/12/2007, 21:59:07] - Searching for Browser Helper Objects: [11/12/2007, 21:59:07] - BHO 1: {08C525F4-2EBD-396D-B12A-005661A8CF95} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - Checking for HKLM\...\Winlogon\Notify\glhqftan [11/12/2007, 21:59:07] - Key not found: HKLM\...\Winlogon\Notify\glhqftan, continuing. [11/12/2007, 21:59:07] - BHO 2: {1C9E5966-B6FF-4146-9E34-811C9DFD4F6F} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - Checking for HKLM\...\Winlogon\Notify\vtuts [11/12/2007, 21:59:07] - Key not found: HKLM\...\Winlogon\Notify\vtuts, continuing. [11/12/2007, 21:59:07] - BHO 3: {2037842F-B6FC-94F5-49E2-04A07E581D4A} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - Checking for HKLM\...\Winlogon\Notify vafmhbi [11/12/2007, 21:59:07] - Key not found: HKLM\...\Winlogon\Notify vafmhbi, continuing. [11/12/2007, 21:59:07] - BHO 4: {2D628D87-D0A3-6203-4E86-09D91C6DD614} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - Checking for HKLM\...\Winlogon\Notify\woibizcw [11/12/2007, 21:59:07] - Key not found: HKLM\...\Winlogon\Notify\woibizcw, continuing. [11/12/2007, 21:59:07] - BHO 5: {3BE02A32-3699-4974-A6CD-D3FE6016C063} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - Checking for HKLM\...\Winlogon\Notify\vtuts [11/12/2007, 21:59:07] - Key not found: HKLM\...\Winlogon\Notify\vtuts, continuing. [11/12/2007, 21:59:07] - BHO 6: {3BFD0013-2F6A-4060-9A8E-A76CE054F49C} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - No filename found. Continuing. [11/12/2007, 21:59:07] - BHO 7: {3C847F45-3908-46B2-8499-6DA346CA4929} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - No filename found. Continuing. [11/12/2007, 21:59:07] - BHO 8: {469644C1-EAD0-4BE8-8FB4-E4A219EF9CC3} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - No filename found. Continuing. [11/12/2007, 21:59:07] - BHO 9: {5159791b-b229-44d8-b82a-49b8e3cbe811} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - No filename found. Continuing. [11/12/2007, 21:59:07] - BHO 10: {620c19dd-dd5e-4582-9d43-89fdd00e6355} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - No filename found. Continuing. [11/12/2007, 21:59:07] - BHO 11: {6C4D39B5-E92C-45C2-B705-87655CCE146F} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - No filename found. Continuing. [11/12/2007, 21:59:07] - BHO 12: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class) [11/12/2007, 21:59:07] - BHO 13: {7E853D72-626A-48EC-A868-BA8D5E23E045} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - No filename found. Continuing. [11/12/2007, 21:59:07] - BHO 14: {8CEDE431-82B3-4968-BDC2-D497C8B6E694} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - No filename found. Continuing. [11/12/2007, 21:59:07] - BHO 15: {8F5B8039-1FB8-4818-AE01-FCD9978464FE} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - No filename found. Continuing. [11/12/2007, 21:59:07] - BHO 16: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live) [11/12/2007, 21:59:07] - BHO 17: {9CEB2735-47BE-4968-89D2-D11ECA76E030} () [11/12/2007, 21:59:07] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:07] - No filename found. Continuing. [11/12/2007, 21:59:07] - BHO 18: {A8B1EC63-C834-44AA-AD40-966A96988815} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 19: {A95B2816-1D7E-4561-A202-68C0DE02353A} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - Checking for HKLM\...\Winlogon\Notify\gqxqnebs [11/12/2007, 21:59:08] - Found: HKLM\...\Winlogon\Notify\gqxqnebs - This is probably Virtumundo. [11/12/2007, 21:59:08] - Assigning {A95B2816-1D7E-4561-A202-68C0DE02353A} MSEvents Object [11/12/2007, 21:59:08] - BHO list has been changed! Starting over... [11/12/2007, 21:59:08] - BHO 1: {08C525F4-2EBD-396D-B12A-005661A8CF95} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - Checking for HKLM\...\Winlogon\Notify\glhqftan [11/12/2007, 21:59:08] - Key not found: HKLM\...\Winlogon\Notify\glhqftan, continuing. [11/12/2007, 21:59:08] - BHO 2: {1C9E5966-B6FF-4146-9E34-811C9DFD4F6F} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - Checking for HKLM\...\Winlogon\Notify\vtuts [11/12/2007, 21:59:08] - Key not found: HKLM\...\Winlogon\Notify\vtuts, continuing. [11/12/2007, 21:59:08] - BHO 3: {2037842F-B6FC-94F5-49E2-04A07E581D4A} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - Checking for HKLM\...\Winlogon\Notify vafmhbi [11/12/2007, 21:59:08] - Key not found: HKLM\...\Winlogon\Notify vafmhbi, continuing. [11/12/2007, 21:59:08] - BHO 4: {2D628D87-D0A3-6203-4E86-09D91C6DD614} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - Checking for HKLM\...\Winlogon\Notify\woibizcw [11/12/2007, 21:59:08] - Key not found: HKLM\...\Winlogon\Notify\woibizcw, continuing. [11/12/2007, 21:59:08] - BHO 5: {3BE02A32-3699-4974-A6CD-D3FE6016C063} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - Checking for HKLM\...\Winlogon\Notify\vtuts [11/12/2007, 21:59:08] - Key not found: HKLM\...\Winlogon\Notify\vtuts, continuing. [11/12/2007, 21:59:08] - BHO 6: {3BFD0013-2F6A-4060-9A8E-A76CE054F49C} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 7: {3C847F45-3908-46B2-8499-6DA346CA4929} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 8: {469644C1-EAD0-4BE8-8FB4-E4A219EF9CC3} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 9: {5159791b-b229-44d8-b82a-49b8e3cbe811} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 10: {620c19dd-dd5e-4582-9d43-89fdd00e6355} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 11: {6C4D39B5-E92C-45C2-B705-87655CCE146F} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 12: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class) [11/12/2007, 21:59:08] - BHO 13: {7E853D72-626A-48EC-A868-BA8D5E23E045} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 14: {8CEDE431-82B3-4968-BDC2-D497C8B6E694} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 15: {8F5B8039-1FB8-4818-AE01-FCD9978464FE} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 16: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live) [11/12/2007, 21:59:08] - BHO 17: {9CEB2735-47BE-4968-89D2-D11ECA76E030} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 18: {A8B1EC63-C834-44AA-AD40-966A96988815} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 19: {A95B2816-1D7E-4561-A202-68C0DE02353A} (MSEvents Object) [11/12/2007, 21:59:08] - ALERT: Found MSEvents Object! [11/12/2007, 21:59:08] - BHO 20: {ab51a63c-569b-4185-aba7-7d70a5f8119b} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 21: {b336e14a-27e2-47ff-bf2f-7643913a4fde} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - Checking for HKLM\...\Winlogon\Notify\pmubjglu [11/12/2007, 21:59:08] - Key not found: HKLM\...\Winlogon\Notify\pmubjglu, continuing. [11/12/2007, 21:59:08] - BHO 22: {b63072df-7c6f-434c-8325-8744b461b61a} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 23: {DA2EF1B4-A71C-4278-BFC8-8E0BE1F34840} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 24: {E2E2D0C8-801E-4866-8CE9-04CB1665DABC} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 25: {ed6fd6ff-38f8-4717-ae45-b8180c3533a4} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - BHO 26: {fb58d224-4a63-47c1-8f40-c32daf4c217a} () [11/12/2007, 21:59:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:08] - No filename found. Continuing. [11/12/2007, 21:59:08] - Finished Searching Browser Helper Objects [11/12/2007, 21:59:08] - *** Detected MSEvents Object [11/12/2007, 21:59:08] - Trying to remove MSEvents Object... [11/12/2007, 21:59:09] - Terminating Process: IEXPLORE.EXE [11/12/2007, 21:59:10] - Terminating Process: RUNDLL32.EXE [11/12/2007, 21:59:10] - Disabling Automatic Shell Restart [11/12/2007, 21:59:10] - Terminating Process: EXPLORER.EXE [11/12/2007, 21:59:10] - Suspending the NT Session Manager System Service [11/12/2007, 21:59:10] - Terminating Windows NT Logon/Logoff Manager [11/12/2007, 21:59:11] - Re-enabling Automatic Shell Restart [11/12/2007, 21:59:11] - File to disable: C:\WINDOWS\system32\gqxqnebs.dll [11/12/2007, 21:59:11] - Renaming C:\WINDOWS\system32\gqxqnebs.dll -> C:\WINDOWS\system32\gqxqnebs.dll.vir [11/12/2007, 21:59:11] - ! File rename was unsucessful. [11/12/2007, 21:59:11] - Attempting to Deny Access to C:\WINDOWS\system32\gqxqnebs.dll [11/12/2007, 21:59:11] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work. [11/12/2007, 21:59:11] - ERROR: Le mappage entre les noms de compte et les ID de sécurité n'a pas été effectué. [11/12/2007, 21:59:11] - *** IMPORTANT: The file is disabled and will need to be deleted by the user. [11/12/2007, 21:59:11] - Removing HKLM\...\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A} [11/12/2007, 21:59:12] - Removing HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A} [11/12/2007, 21:59:12] - Adding Kill Bit for ActiveX for GUID: {A95B2816-1D7E-4561-A202-68C0DE02353A} [11/12/2007, 21:59:12] - Deleting ATLEvents/MSEvents Registry entries [11/12/2007, 21:59:12] - Removing HKLM\...\Winlogon\Notify\gqxqnebs [11/12/2007, 21:59:12] - Searching for Browser Helper Objects: [11/12/2007, 21:59:12] - BHO 1: {08C525F4-2EBD-396D-B12A-005661A8CF95} () [11/12/2007, 21:59:12] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:12] - Checking for HKLM\...\Winlogon\Notify\glhqftan [11/12/2007, 21:59:12] - Key not found: HKLM\...\Winlogon\Notify\glhqftan, continuing. [11/12/2007, 21:59:12] - BHO 2: {1C9E5966-B6FF-4146-9E34-811C9DFD4F6F} () [11/12/2007, 21:59:13] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:13] - Checking for HKLM\...\Winlogon\Notify\vtuts [11/12/2007, 21:59:14] - Key not found: HKLM\...\Winlogon\Notify\vtuts, continuing. [11/12/2007, 21:59:14] - BHO 3: {2037842F-B6FC-94F5-49E2-04A07E581D4A} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - Checking for HKLM\...\Winlogon\Notify vafmhbi [11/12/2007, 21:59:14] - Key not found: HKLM\...\Winlogon\Notify vafmhbi, continuing. [11/12/2007, 21:59:14] - BHO 4: {2D628D87-D0A3-6203-4E86-09D91C6DD614} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - Checking for HKLM\...\Winlogon\Notify\woibizcw [11/12/2007, 21:59:14] - Key not found: HKLM\...\Winlogon\Notify\woibizcw, continuing. [11/12/2007, 21:59:14] - BHO 5: {3BE02A32-3699-4974-A6CD-D3FE6016C063} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - Checking for HKLM\...\Winlogon\Notify\vtuts [11/12/2007, 21:59:14] - Key not found: HKLM\...\Winlogon\Notify\vtuts, continuing. [11/12/2007, 21:59:14] - BHO 6: {3BFD0013-2F6A-4060-9A8E-A76CE054F49C} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - No filename found. Continuing. [11/12/2007, 21:59:14] - BHO 7: {3C847F45-3908-46B2-8499-6DA346CA4929} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - No filename found. Continuing. [11/12/2007, 21:59:14] - BHO 8: {469644C1-EAD0-4BE8-8FB4-E4A219EF9CC3} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - No filename found. Continuing. [11/12/2007, 21:59:14] - BHO 9: {5159791b-b229-44d8-b82a-49b8e3cbe811} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - No filename found. Continuing. [11/12/2007, 21:59:14] - BHO 10: {620c19dd-dd5e-4582-9d43-89fdd00e6355} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - No filename found. Continuing. [11/12/2007, 21:59:14] - BHO 11: {6C4D39B5-E92C-45C2-B705-87655CCE146F} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - No filename found. Continuing. [11/12/2007, 21:59:14] - BHO 12: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class) [11/12/2007, 21:59:14] - BHO 13: {7E853D72-626A-48EC-A868-BA8D5E23E045} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - No filename found. Continuing. [11/12/2007, 21:59:14] - BHO 14: {8CEDE431-82B3-4968-BDC2-D497C8B6E694} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - No filename found. Continuing. [11/12/2007, 21:59:14] - BHO 15: {8F5B8039-1FB8-4818-AE01-FCD9978464FE} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - No filename found. Continuing. [11/12/2007, 21:59:14] - BHO 16: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live) [11/12/2007, 21:59:14] - BHO 17: {9CEB2735-47BE-4968-89D2-D11ECA76E030} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - No filename found. Continuing. [11/12/2007, 21:59:14] - BHO 18: {A8B1EC63-C834-44AA-AD40-966A96988815} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - No filename found. Continuing. [11/12/2007, 21:59:14] - BHO 19: {ab51a63c-569b-4185-aba7-7d70a5f8119b} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - No filename found. Continuing. [11/12/2007, 21:59:14] - BHO 20: {b336e14a-27e2-47ff-bf2f-7643913a4fde} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - Checking for HKLM\...\Winlogon\Notify\pmubjglu [11/12/2007, 21:59:14] - Key not found: HKLM\...\Winlogon\Notify\pmubjglu, continuing. [11/12/2007, 21:59:14] - BHO 21: {b63072df-7c6f-434c-8325-8744b461b61a} () [11/12/2007, 21:59:14] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:14] - No filename found. Continuing. [11/12/2007, 21:59:15] - BHO 22: {DA2EF1B4-A71C-4278-BFC8-8E0BE1F34840} () [11/12/2007, 21:59:16] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:16] - No filename found. Continuing. [11/12/2007, 21:59:16] - BHO 23: {DA2EF1B4-A71C-4278-BFC8-8E0BE1F34840} () [11/12/2007, 21:59:16] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:16] - No filename found. Continuing. [11/12/2007, 21:59:16] - BHO 24: {E2E2D0C8-801E-4866-8CE9-04CB1665DABC} () [11/12/2007, 21:59:16] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:16] - No filename found. Continuing. [11/12/2007, 21:59:16] - BHO 25: {ed6fd6ff-38f8-4717-ae45-b8180c3533a4} () [11/12/2007, 21:59:16] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:16] - No filename found. Continuing. [11/12/2007, 21:59:16] - BHO 26: {fb58d224-4a63-47c1-8f40-c32daf4c217a} () [11/12/2007, 21:59:16] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/12/2007, 21:59:16] - No filename found. Continuing. [11/12/2007, 21:59:16] - Finished Searching Browser Helper Objects [11/12/2007, 21:59:16] - Finishing up... [11/12/2007, 21:59:16] - A restart is needed. [11/12/2007, 21:59:16] - Automatic Reboot on STOP Error is not set. User will have to manually restart. [11/12/2007, 21:59:26] - Attempting to Restart via STOP error (Blue Screen!) [11/12/2007, 22:03:38] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrateur\Bureau\VirtumundoBeGone.exe" ) [11/12/2007, 22:03:39] - User choose NOT to continue. Exiting... [11/13/2007, 14:42:29] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrateur\Bureau\VirtumundoBeGone.exe" ) [11/13/2007, 14:42:35] - Detected System Information: [11/13/2007, 14:42:35] - Windows Version: 5.1.2600, Service Pack 2 [11/13/2007, 14:42:35] - Current Username: Administrateur (Admin) [11/13/2007, 14:42:35] - Windows is in NORMAL mode. [11/13/2007, 14:42:35] - Searching for Browser Helper Objects: [11/13/2007, 14:42:35] - BHO 1: {08C525F4-2EBD-396D-B12A-005661A8CF95} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - Checking for HKLM\...\Winlogon\Notify\bckqxcyn [11/13/2007, 14:42:35] - Key not found: HKLM\...\Winlogon\Notify\bckqxcyn, continuing. [11/13/2007, 14:42:35] - BHO 2: {1C9E5966-B6FF-4146-9E34-811C9DFD4F6F} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 3: {2037842F-B6FC-94F5-49E2-04A07E581D4A} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - Checking for HKLM\...\Winlogon\Notify vafmhbi [11/13/2007, 14:42:35] - Key not found: HKLM\...\Winlogon\Notify vafmhbi, continuing. [11/13/2007, 14:42:35] - BHO 4: {2D628D87-D0A3-6203-4E86-09D91C6DD614} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - Checking for HKLM\...\Winlogon\Notify\woibizcw [11/13/2007, 14:42:35] - Key not found: HKLM\...\Winlogon\Notify\woibizcw, continuing. [11/13/2007, 14:42:35] - BHO 5: {3BE02A32-3699-4974-A6CD-D3FE6016C063} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 6: {3BFD0013-2F6A-4060-9A8E-A76CE054F49C} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 7: {3C847F45-3908-46B2-8499-6DA346CA4929} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 8: {469644C1-EAD0-4BE8-8FB4-E4A219EF9CC3} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 9: {5159791b-b229-44d8-b82a-49b8e3cbe811} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 10: {601678de-106d-4613-81a0-7836e97c0c81} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - Checking for HKLM\...\Winlogon\Notify\ewfsyqcy [11/13/2007, 14:42:35] - Key not found: HKLM\...\Winlogon\Notify\ewfsyqcy, continuing. [11/13/2007, 14:42:35] - BHO 11: {620c19dd-dd5e-4582-9d43-89fdd00e6355} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 12: {6C4D39B5-E92C-45C2-B705-87655CCE146F} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 13: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class) [11/13/2007, 14:42:35] - BHO 14: {7E853D72-626A-48EC-A868-BA8D5E23E045} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 15: {8CEDE431-82B3-4968-BDC2-D497C8B6E694} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 16: {8F5B8039-1FB8-4818-AE01-FCD9978464FE} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 17: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live) [11/13/2007, 14:42:35] - BHO 18: {9CEB2735-47BE-4968-89D2-D11ECA76E030} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 19: {A8B1EC63-C834-44AA-AD40-966A96988815} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 20: {A95B2816-1D7E-4561-A202-68C0DE02353A} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 21: {ab51a63c-569b-4185-aba7-7d70a5f8119b} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 22: {b336e14a-27e2-47ff-bf2f-7643913a4fde} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 23: {b63072df-7c6f-434c-8325-8744b461b61a} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 24: {C409D2B7-E80D-46DF-A5D6-D118C09F8409} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 25: {DA2EF1B4-A71C-4278-BFC8-8E0BE1F34840} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 26: {E2E2D0C8-801E-4866-8CE9-04CB1665DABC} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 27: {ed6fd6ff-38f8-4717-ae45-b8180c3533a4} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 28: {f6ac28ef-867c-4c86-9b85-2419c0a1ff87} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - BHO 29: {fb58d224-4a63-47c1-8f40-c32daf4c217a} () [11/13/2007, 14:42:35] - WARNING: BHO has no default name. Checking for Winlogon reference. [11/13/2007, 14:42:35] - No filename found. Continuing. [11/13/2007, 14:42:35] - Finished Searching Browser Helper Objects [11/13/2007, 14:42:35] - Finishing up... [11/13/2007, 14:42:35] - Nothing found! Exiting ... ComboFix 07-11-08.1 - Administrateur 2007-11-13 14:45:35.3 - NTFSx86 Running from: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\hufszctx.dllbox . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-13 to 2007-11-13 )))))))))))))))))))))))))))))))))))) . 2007-11-13 14:27 d-------- C:\VundoFix Backups 2007-11-13 12:09 d-------- C:\Program Files\Ujgmrkuf 2007-11-12 22:09 144,480 --a------ C:\WINDOWS\system32\vpkbwurf.dll 2007-11-12 22:06 89,664 --a------ C:\WINDOWS\system32\wtuwlckd.dll 2007-11-12 22:04 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-12 22:03 81,472 --a------ C:\WINDOWS\system32\ewfsyqcy.dll 2007-11-12 21:26 144,480 --a------ C:\WINDOWS\system32\gqxqnebs.dll.vir 2007-11-12 21:25 144,480 --a------ C:\WINDOWS\system32\vfhbmpbj.dll 2007-11-12 21:22 81,472 --a------ C:\WINDOWS\system32\pmubjglu.dll 2007-11-12 21:20 d-------- C:\Program Files\Kioktkzo 2007-11-12 20:51 d-------- C:\Program Files\Trend Micro 2007-11-12 19:44 81,472 --a------ C:\WINDOWS\system32\jjsxlxfk.dll 2007-11-12 19:41 144,480 --a------ C:\WINDOWS\system32\bsukvomq.dll 2007-11-11 21:20 d-------- C:\Program Files\Rkbldmnn 2007-11-10 22:15 85,056 --a------ C:\WINDOWS\system32\xfijmybl.dll 2007-11-10 22:12 81,472 --a------ C:\WINDOWS\system32 arcawfn.dll 2007-11-09 21:13 77,888 --a------ C:\WINDOWS\system32\lejhuotq.dll 2007-11-09 21:10 88,128 --a------ C:\WINDOWS\system32\gsesrcem.dll 2007-11-08 21:08 80,448 --a------ C:\WINDOWS\system32\hsfnrbvl.dll 2007-11-07 21:08 79,936 --a------ C:\WINDOWS\system32\bxgxkprn.dll 2007-11-07 21:05 86,080 --a------ C:\WINDOWS\system32\bieqdilb.dll 2007-11-07 19:07 d-------- C:\Program Files\WowCartographe 2007-11-05 20:43 d-------- C:\Program Files\Ruvbbfhb 2007-11-05 13:34 83,008 --a------ C:\WINDOWS\system32\wmjnrrma.dll 2007-11-04 19:15 d-------- C:\WINDOWS\Sun 2007-11-04 18:19 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-04 16:13 d-------- C:\Program Files\CCleaner 2007-11-04 16:09 d-------- C:\Documents and Settings\Administrateur\Application Data\Grisoft 2007-11-04 16:09 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-11-04 16:08 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-11-04 15:59 78,912 --a------ C:\WINDOWS\system32\xoklcvak.dll 2007-11-04 15:00 d-------- C:\Temp 2007-11-04 15:00 d-------- C:\Documents and Settings\All Users\Application Data\Prevx 2007-11-04 14:33 d-------- C:\Program Files\Java 2007-11-04 14:33 d-------- C:\Program Files\Fichiers communs\Java 2007-11-04 12:57 d-------- C:\WINDOWS\pss 2007-11-04 11:29 d-------- C:\Program Files\Lavasoft 2007-11-04 11:29 d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard 2007-11-04 11:29 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-11-04 11:15 d-------- C:\Program Files\kxktshoz 2007-11-04 11:15 36,864 --a------ C:\WINDOWS\system32\gebawwu.dll 2007-11-04 11:15 0 --a------ C:\WINDOWS\system32\vvgeowbv.exe 2007-11-04 11:14 104,960 --a------ C:\WINDOWS\system32\drvfog.dll 2007-11-02 20:24 d-------- C:\Program Files\Microsoft Works 2007-11-02 20:23 d-------- C:\Program Files\MSBuild 2007-11-02 20:22 d-------- C:\Program Files\Microsoft.NET 2007-11-02 20:20 d-------- C:\Program Files\Microsoft Visual Studio 8 2007-11-02 20:19 d-------- C:\WINDOWS\SHELLNEW 2007-11-02 20:18 dr-h----- C:\MSOCache 2007-11-02 20:18 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2007-11-01 10:55 d-------- C:\Program Files\Shareaza 2007-11-01 10:55 d-------- C:\Documents and Settings\Administrateur\Application Data\Shareaza 2007-10-31 17:07 d-------- C:\Documents and Settings\Administrateur\Application Data\Apple Computer 2007-10-31 15:26 d-------- C:\Program Files\QuickTime 2007-10-31 15:26 d-------- C:\Program Files\Apple Software Update 2007-10-31 15:26 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-10-31 15:26 d-------- C:\Documents and Settings\All Users\Application Data\Apple 2007-10-31 13:05 d-------- C:\Program Files\Fichiers communs\Adobe 2007-10-31 13:04 d-------- C:\Program Files\Adobe Photoshop CS3 2007-10-31 13:04 44,814,336 --a------ C:\Program Files\Photoshop.exe 2007-10-31 13:04 724,432 --a------ C:\Program Files\unins000.exe 2007-10-31 13:04 270,025 --a------ C:\Program Files\unins000.dat 2007-10-31 11:41 d-------- C:\Program Files\Dofus 2007-10-31 11:12 d-------- C:\Program Files\PhotoFiltre 2007-10-30 10:41 102,912 -ra------ C:\WINDOWS\system32\JPEGCODE.DLL 2007-10-29 19:22 d-------- C:\Documents and Settings\Administrateur\Application Data\OtakuSoftware 2007-10-19 20:51 d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ 2007-10-19 20:51 140,288 --a------ C:\WINDOWS\system32\CNMLM53.DLL 2007-10-19 20:51 90,112 --a------ C:\WINDOWS\system32\CNMCP53.exe 2007-10-19 20:51 8,704 --a------ C:\WINDOWS\system32\CNMVS53.DLL 2007-10-19 20:49 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-10-18 20:21 4,682 --a------ C:\WINDOWS\system32 pptNT2.sys 2007-10-18 19:46 d-------- C:\Program Files\GOA 2007-10-18 18:22 d-------- C:\Documents and Settings\Administrateur\Application Data\Electronic Arts 2007-10-17 17:29 d-------- C:\World of Warcraft 2007-10-17 17:14 d-------- C:\Program Files\GUILD WARS 2007-10-14 14:01 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-10-14 14:01 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-10-14 14:01 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2007-10-14 14:01 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2007-10-14 13:56 d-------- C:\Program Files\Ubisoft 2007-10-13 12:51 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-10-13 08:27 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys 2007-10-13 08:27 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS 2007-10-13 08:27 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys 2007-10-13 08:27 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys 2007-10-13 08:27 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys 2007-10-13 08:27 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys 2007-10-13 08:27 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-04 17:21 --------- d-----w C:\Program Files\Nod32 2007-10-31 10:32 --------- d-----w C:\Program Files\MSN Messenger 2007-10-31 10:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-10-30 09:41 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-17 16:29 --------- d-----w C:\Program Files\Fichiers communs\Blizzard Entertainment 2007-10-12 19:13 --------- d-----w C:\Program Files\DivX 2007-10-12 18:27 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Nero 2007-10-12 18:24 --------- d-----w C:\Program Files\Fichiers communs\Nero 2007-10-12 18:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero 2007-10-12 18:19 --------- d-----w C:\Program Files\Windows Live 2007-10-12 17:19 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Ahead 2007-10-12 16:37 --------- d-----w C:\Program Files\MSXML 6.0 2007-10-11 19:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd 2007-10-11 19:21 --------- d-----w C:\Program Files\Fichiers communs\Logitech 2007-10-11 19:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech 2007-10-11 19:20 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\InstallShield 2007-10-11 05:37 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Logitech 2007-10-10 20:35 --------- d-----w C:\Program Files\Logitech 2007-10-10 20:34 --------- d-----w C:\Program Files\Fichiers communs\InstallShield 2007-10-10 20:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2007-10-10 20:21 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-10-10 16:02 --------- d-----w C:\Program Files\Fichiers communs\ODBC 2007-10-10 15:53 --------- d-----w C:\Program Files\DAEMON Tools 2007-10-10 15:51 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-10 15:26 --------- d-----w C:\Program Files\PowerQuest 2007-10-10 14:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Prism 2007-10-10 14:29 --------- d-----w C:\Program Files\802.11g USB2.0 Adapter 2007-10-10 14:29 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Xentient 2007-10-10 14:27 --------- d-----w C:\Program Files\TweakRAM 2007-10-10 14:22 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-10-10 14:18 --------- d-----w C:\Program Files\Symantec 2007-10-10 14:18 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared 2007-10-10 14:18 --------- d-----w C:\Documents and Settings\Default User\Application Data\Symantec 2007-10-10 14:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2007-10-10 14:18 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Symantec 2007-10-10 14:14 76,160 ----a-w C:\WINDOWS\system32\drivers\lnsfw1.sys 2007-10-10 14:14 502,368 ----a-w C:\WINDOWS\system32\drivers\amon.sys 2007-10-10 14:14 46,208 ----a-w C:\WINDOWS\system32\drivers\lnsfw.sys 2007-10-10 14:14 --------- d-----w C:\Program Files\Fichiers communs\Ahead 2007-10-10 14:13 --------- d-----w C:\Program Files\Executive Software 2007-10-10 14:08 --------- d-----w C:\Program Files\Fichiers communs\MSSoap 2007-09-24 07:05 132,904 ----a-w C:\WINDOWS\system32\drivers\imagesrv.sys 2007-09-24 07:05 11,304 ----a-w C:\WINDOWS\system32\drivers\imagedrv.sys 2007-09-20 07:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe 2007-09-20 07:55 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe 2006-10-08 23:18 145,920 ----a-w C:\WINDOWS\inf\hdaudio.sys . ((((((((((((((((((((((((((((( snapshot@2007-11-12_22.24.11.48 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-13 13:51:22 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_6ec.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{08C525F4-2EBD-396D-B12A-005661A8CF95}] 2007-11-13 12:09 102400 --a------ C:\Program Files\Ujgmrkuf\bckqxcyn.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C9E5966-B6FF-4146-9E34-811C9DFD4F6F}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2037842F-B6FC-94F5-49E2-04A07E581D4A}] 2007-11-11 21:20 110592 --a------ C:\Program Files\Rkbldmnn vafmhbi.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2D628D87-D0A3-6203-4E86-09D91C6DD614}] 2007-11-05 20:43 106496 --a------ C:\Program Files\Ruvbbfhb\woibizcw.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3BE02A32-3699-4974-A6CD-D3FE6016C063}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3BFD0013-2F6A-4060-9A8E-A76CE054F49C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3C847F45-3908-46B2-8499-6DA346CA4929}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{469644C1-EAD0-4BE8-8FB4-E4A219EF9CC3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5159791b-b229-44d8-b82a-49b8e3cbe811}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{601678de-106d-4613-81a0-7836e97c0c81}] 2007-11-12 22:03 81472 --a------ C:\WINDOWS\system32\ewfsyqcy.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{620c19dd-dd5e-4582-9d43-89fdd00e6355}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6C4D39B5-E92C-45C2-B705-87655CCE146F}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CEDE431-82B3-4968-BDC2-D497C8B6E694}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8F5B8039-1FB8-4818-AE01-FCD9978464FE}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9CEB2735-47BE-4968-89D2-D11ECA76E030}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8B1EC63-C834-44AA-AD40-966A96988815}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ab51a63c-569b-4185-aba7-7d70a5f8119b}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b336e14a-27e2-47ff-bf2f-7643913a4fde}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b63072df-7c6f-434c-8325-8744b461b61a}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C409D2B7-E80D-46DF-A5D6-D118C09F8409}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DA2EF1B4-A71C-4278-BFC8-8E0BE1F34840}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E2E2D0C8-801E-4866-8CE9-04CB1665DABC}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ed6fd6ff-38f8-4717-ae45-b8180c3533a4}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f6ac28ef-867c-4c86-9b85-2419c0a1ff87}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fb58d224-4a63-47c1-8f40-c32daf4c217a}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Vistadrv"="C:\WINDOWS\system32\Vistadrive\vsdrv.exe" [2006-07-30 02:37] "DiskeeperSystray"="C:\Program Files\Executive Software\Diskeeper\DkIcon.exe" [2005-07-26 16:52] "nod32kui"="C:\Program Files\Nod32 od32kui.exe" [2007-10-10 15:14] "PRISMSTA.EXE"="Prismsta.exe" [2003-11-08 15:49 C:\WINDOWS\system32\PRISMSTA.exe] "PRISMSVR.EXE"="Prismsvr.exe" [2003-11-20 14:12 C:\WINDOWS\system32\PRISMSVR.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-10-09 00:34 C:\WINDOWS\RTHDCPL.EXE] "SkyTel"="SkyTel.EXE" [2006-10-09 00:34 C:\WINDOWS\SkyTel.exe] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 14:32 C:\WINDOWS\KHALMNPR.Exe] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57] "18035c72"="C:\WINDOWS\system32\hugcbfjs.dll" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [2005-08-12 19:52] "VisualTaskTips"="C:\Windows\System32\VisualTaskTips.exe" [2006-07-05 03:23] "TweakRAM"="C:\Program Files\TweakRAM\TweakRAM.exe" [2006-04-15 17:07] "LClock"="C:\Program Files\LClock\lclock.exe" [2004-09-19 19:27] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:54] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-09-20 16:38] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-09-20 14:35] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 15:16] [HKEY_USERS\.default\software\microsoft\windows\currentversion unonce] "nltide3"=cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C [HKEY_USERS\.default\software\microsoft\windows\currentversion un] "UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" "VisualTaskTips"=C:\Windows\System32\VisualTaskTips.exe "TweakRAM"=C:\Program Files\TweakRAM\TweakRAM.exe "LClock"=C:\Program Files\LClock\lclock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\gqxqnebs] gqxqnebs.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\hufszctx] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\winpsa32] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" R0 Si3112;Si3112;C:\WINDOWS\system32\drivers\Si3112.sys R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys R1 GhPciScan;GhostPciScanner;\??\C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys R1 lnsfw1;lnsfw1;C:\WINDOWS\system32\drivers\lnsfw1.sys R3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys R3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService WebClient LmHosts upnphost SSDPSRV [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ec39af41-773c-11dc-9912-000000000000}] \shell\AutoRun\command - F:\setupSNK.exe . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-11-09 19:58:27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-13 14:51:50 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2007-11-13 14:53:42 - machine was rebooted C:\ComboFix2.txt ... 2007-11-13 13:40 C:\ComboFix3.txt ... 2007-11-12 22:27 . --- E O F --- L'ordinateur va deja plus vite et je n'ai plus la fentre qui me proposait d'installer tout et n'importe quoi.As-tu detecté autre chose ou c'es parfait ? J'ai une petite question egalement. J'ai 2 systeme d'exploitation sur 2 partition ( 1 vista, l'autre xp ultimate). Ne voulant plus le choix des 2 systeme d'exploitation au demarage j'ai decidé de faire cela https://forum.zebulon.fr/topic/63120-choix-du-syst%C3%A8me-dexploitation-au-d%C3%A9marrage/ mais cela na rien changé j'ai eu toujours les 2 au demarage, j'ai desinstallé vista mais encore sans effet j'ai encore la proposition. Que puis-je faire ? Merci de ton aide :)

jlpjlp · Answer

recolle un rapport hijackthis

Adeline02 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:14, on 13/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Nod32
od32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nod32
od32kui.exe
C:\WINDOWS\system32\Prismsta.exe
C:\WINDOWS\system32\Prismsvr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\UberIcon\UberIcon Manager.exe
C:\Windows\System32\VisualTaskTips.exe
C:\Program Files\TweakRAM\TweakRAM.exe
C:\Program Files\LClock\lclock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
C:\Program Files\WowCartographe\WowCartographe.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {08C525F4-2EBD-396D-B12A-005661A8CF95} - C:\Program Files\Ujgmrkuf\bckqxcyn.dll
O2 - BHO: (no name) - {1C9E5966-B6FF-4146-9E34-811C9DFD4F6F} - (no file)
O2 - BHO: (no name) - {2037842F-B6FC-94F5-49E2-04A07E581D4A} - C:\Program Files\Rkbldmnn
vafmhbi.dll
O2 - BHO: (no name) - {2D628D87-D0A3-6203-4E86-09D91C6DD614} - C:\Program Files\Ruvbbfhb\woibizcw.dll
O2 - BHO: (no name) - {3BE02A32-3699-4974-A6CD-D3FE6016C063} - (no file)
O2 - BHO: (no name) - {3BFD0013-2F6A-4060-9A8E-A76CE054F49C} - (no file)
O2 - BHO: (no name) - {3C847F45-3908-46B2-8499-6DA346CA4929} - (no file)
O2 - BHO: (no name) - {469644C1-EAD0-4BE8-8FB4-E4A219EF9CC3} - (no file)
O2 - BHO: (no name) - {5159791b-b229-44d8-b82a-49b8e3cbe811} - (no file)
O2 - BHO: {18c0c79e-6387-0a18-3164-d601ed876106} - {601678de-106d-4613-81a0-7836e97c0c81} - C:\WINDOWS\system32\ewfsyqcy.dll
O2 - BHO: (no name) - {620c19dd-dd5e-4582-9d43-89fdd00e6355} - (no file)
O2 - BHO: (no name) - {6C4D39B5-E92C-45C2-B705-87655CCE146F} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8CEDE431-82B3-4968-BDC2-D497C8B6E694} - (no file)
O2 - BHO: (no name) - {8F5B8039-1FB8-4818-AE01-FCD9978464FE} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9CEB2735-47BE-4968-89D2-D11ECA76E030} - (no file)
O2 - BHO: (no name) - {A8B1EC63-C834-44AA-AD40-966A96988815} - (no file)
O2 - BHO: (no name) - {ab51a63c-569b-4185-aba7-7d70a5f8119b} - (no file)
O2 - BHO: (no name) - {b336e14a-27e2-47ff-bf2f-7643913a4fde} - (no file)
O2 - BHO: (no name) - {b63072df-7c6f-434c-8325-8744b461b61a} - (no file)
O2 - BHO: (no name) - {C409D2B7-E80D-46DF-A5D6-D118C09F8409} - (no file)
O2 - BHO: (no name) - {DA2EF1B4-A71C-4278-BFC8-8E0BE1F34840} - (no file)
O2 - BHO: (no name) - {E2E2D0C8-801E-4866-8CE9-04CB1665DABC} - (no file)
O2 - BHO: (no name) - {ed6fd6ff-38f8-4717-ae45-b8180c3533a4} - (no file)
O2 - BHO: (no name) - {f6ac28ef-867c-4c86-9b85-2419c0a1ff87} - (no file)
O2 - BHO: (no name) - {fb58d224-4a63-47c1-8f40-c32daf4c217a} - (no file)
O4 - HKLM\..\Run: [Vistadrv] C:\WINDOWS\system32\Vistadrive\vsdrv.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Nod32
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [PRISMSTA.EXE] Prismsta.exe /START
O4 - HKLM\..\Run: [PRISMSVR.EXE] Prismsvr.exe /APPLY
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [18035c72] rundll32.exe "C:\WINDOWS\system32\hugcbfjs.dll",b
O4 - HKLM\..\Run: [kxktshoz] rundll32.exe "C:\Program Files\kxktshoz\ahgpizof.dll",Init
O4 - HKLM\..\Run: [kpmzqxch] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\kpmzqxch.dll"
O4 - HKLM\..\Run: [fujivebg] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\fujivebg.dll"
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKCU\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
O4 - HKCU\..\Run: [TweakRAM] C:\Program Files\TweakRAM\TweakRAM.exe
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [TweakRAM] C:\Program Files\TweakRAM\TweakRAM.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [LClock] C:\Program Files\LClock\lclock.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{662FA424-F11F-4016-A903-7A9AE2404143}: NameServer = 80.10.246.1,80.10.246.139
O20 - Winlogon Notify: gqxqnebs - gqxqnebs.dll (file missing)
O20 - Winlogon Notify: hufszctx - C:\WINDOWS\
O20 - Winlogon Notify: winpsa32 - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Nod32
od32krn.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

jlpjlp · Answer

pour avoir une seule propsition au demarrage:

http://www.presence-pc.com/forum/ppc/Logiciels/supprimer-windows-demarrage-sujet-15920-1.htm



_________________________



Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {08C525F4-2EBD-396D-B12A-005661A8CF95} - C:\Program Files\Ujgmrkuf\bckqxcyn.dll
O2 - BHO: (no name) - {1C9E5966-B6FF-4146-9E34-811C9DFD4F6F} - (no file)
O2 - BHO: (no name) - {2037842F-B6FC-94F5-49E2-04A07E581D4A} - C:\Program Files\Rkbldmnn
vafmhbi.dll
O2 - BHO: (no name) - {2D628D87-D0A3-6203-4E86-09D91C6DD614} - C:\Program Files\Ruvbbfhb\woibizcw.dll
O2 - BHO: (no name) - {3BE02A32-3699-4974-A6CD-D3FE6016C063} - (no file)
O2 - BHO: (no name) - {3BFD0013-2F6A-4060-9A8E-A76CE054F49C} - (no file)
O2 - BHO: (no name) - {3C847F45-3908-46B2-8499-6DA346CA4929} - (no file)
O2 - BHO: (no name) - {469644C1-EAD0-4BE8-8FB4-E4A219EF9CC3} - (no file)
O2 - BHO: (no name) - {5159791b-b229-44d8-b82a-49b8e3cbe811} - (no file)
O2 - BHO: {18c0c79e-6387-0a18-3164-d601ed876106} - {601678de-106d-4613-81a0-7836e97c0c81} - C:\WINDOWS\system32\ewfsyqcy.dll
O2 - BHO: (no name) - {620c19dd-dd5e-4582-9d43-89fdd00e6355} - (no file)
O2 - BHO: (no name) - {6C4D39B5-E92C-45C2-B705-87655CCE146F} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8CEDE431-82B3-4968-BDC2-D497C8B6E694} - (no file)
O2 - BHO: (no name) - {8F5B8039-1FB8-4818-AE01-FCD9978464FE} - (no file)
O2 - BHO: (no name) - {9CEB2735-47BE-4968-89D2-D11ECA76E030} - (no file)
O2 - BHO: (no name) - {A8B1EC63-C834-44AA-AD40-966A96988815} - (no file)
O2 - BHO: (no name) - {ab51a63c-569b-4185-aba7-7d70a5f8119b} - (no file)
O2 - BHO: (no name) - {b336e14a-27e2-47ff-bf2f-7643913a4fde} - (no file)
O2 - BHO: (no name) - {b63072df-7c6f-434c-8325-8744b461b61a} - (no file)
O2 - BHO: (no name) - {C409D2B7-E80D-46DF-A5D6-D118C09F8409} - (no file)
O2 - BHO: (no name) - {DA2EF1B4-A71C-4278-BFC8-8E0BE1F34840} - (no file)
O2 - BHO: (no name) - {E2E2D0C8-801E-4866-8CE9-04CB1665DABC} - (no file)
O2 - BHO: (no name) - {ed6fd6ff-38f8-4717-ae45-b8180c3533a4} - (no file)
O2 - BHO: (no name) - {f6ac28ef-867c-4c86-9b85-2419c0a1ff87} - (no file)
O2 - BHO: (no name) - {fb58d224-4a63-47c1-8f40-c32daf4c217a} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [18035c72] rundll32.exe "C:\WINDOWS\system32\hugcbfjs.dll",b
O4 - HKLM\..\Run: [kxktshoz] rundll32.exe "C:\Program Files\kxktshoz\ahgpizof.dll",Init
O4 - HKLM\..\Run: [kpmzqxch] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\kpmzqxch.dll"
O4 - HKLM\..\Run: [fujivebg] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\fujivebg.dll"
O20 - Winlogon Notify: gqxqnebs - gqxqnebs.dll (file missing)
O20 - Winlogon Notify: hufszctx - C:\WINDOWS\
O20 - Winlogon Notify: winpsa32 - C:\WINDOWS\ 

________________________




télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau. 
double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

Citation : 

C:\Program Files\Ujgmrkuf\bckqxcyn.dll
C:\Program Files\Rkbldmnn
vafmhbi.dll
C:\Program Files\Ruvbbfhb\woibizcw.dll
C:\WINDOWS\system32\ewfsyqcy.dll
C:\Documents and Settings\All Users\Application Data\kpmzqxch.dll
C:\Documents and Settings\All Users\Application Data\fujivebg.dll


clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 


_________________

analyse ce ficheir sur virus total et colle moi le rapport:   https://www.virustotal.com/gui/

C:\WINDOWS\system32\Vistadrive\vsdrv.exe

Adeline02 · Answer

j'ai reussi a supprimé les lignes mais pour OtMoveIt quand je fait Moveit le logiciel se met en "ne repond pas" .

Merci pour le lien :)

Adeline02 · Answer

et voila le rapport ^^ 

http://www.virustotal.com/fr/resultado.html?32df80459e9314704e94b639092c2a98

jlpjlp · Answer

fix cette ligne avec hijackthis

O4 - HKLM\..\Run: [Vistadrv] C:\WINDOWS\system32\Vistadrive\vsdrv.exe 

___________________

Télécharge: Pocket Killbox ici 
http://www.downloads.subratam.org/KillBox.exe 

:: Démo d utilisation (merci a Balltrap34 pour cette réalisation) :: 
http://pageperso.aol.fr/balltrap34/killbox.htm 


Double clic sur killbox.exe (Pocket Killbox) 

- coche: delete on reboot 
- Dans "Full Path of File to Delete" 
- Sélectionne "single File" 
- copie et colle: 

C:\Program Files\Ujgmrkuf\bckqxcyn.dll
C:\Program Files\Rkbldmnn
vafmhbi.dll
C:\Program Files\Ruvbbfhb\woibizcw.dll
C:\WINDOWS\system32\ewfsyqcy.dll
C:\Documents and Settings\All Users\Application Data\kpmzqxch.dll
C:\Documents and Settings\All Users\Application Data\fujivebg.dll

- clique sur la croix rouge 
- une fenêtre va apparaître pour confirmation clique sur YES 
- une seconde fenêtre te demande si tu veux redémarrer clique sur YES 

Si ce message s’affiche ignore le : 
http://tinypic.com/images/goodbye.jpg 
Laisse le pc redémarrer. 

Et après reposte un log HijackThis.

_______________________


 colle le rapport d'un scan en ligne 
avec un des suivants: 


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

Panda en ligne : 
http://pandasoftware.fr

secuser en ligne :
http://www.secuser.com/outils/antivirus.htm

Adeline02 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:10, on 13/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Nod32
od32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nod32
od32kui.exe
C:\WINDOWS\system32\Prismsta.exe
C:\WINDOWS\system32\Prismsvr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\UberIcon\UberIcon Manager.exe
C:\Windows\System32\VisualTaskTips.exe
C:\Program Files\TweakRAM\TweakRAM.exe
C:\Program Files\LClock\lclock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WowCartographe\WowCartographe.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Nod32
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [PRISMSTA.EXE] Prismsta.exe /START
O4 - HKLM\..\Run: [PRISMSVR.EXE] Prismsvr.exe /APPLY
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe /auto
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKCU\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
O4 - HKCU\..\Run: [TweakRAM] C:\Program Files\TweakRAM\TweakRAM.exe
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [TweakRAM] C:\Program Files\TweakRAM\TweakRAM.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [LClock] C:\Program Files\LClock\lclock.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{662FA424-F11F-4016-A903-7A9AE2404143}: NameServer = 80.10.246.1,80.10.246.139
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Nod32
od32krn.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

Adeline02 · Answer

Des que j'ai finit le raport je le poste :)

jlpjlp · Answer

ok
killbox a marché?

Adeline02 · Answer

Oui cela a marché . Désolé pour le temps j'ai eu quelque petit soucis j'ai du recommencer plusieurs fois . 


;***********************************************************************************************************************************************************************************
ANALYSIS: 2007-11-13 17:42:21
PROTECTIONS: 1
MALWARE: 19
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
NOD32 Antivirus                              2.51.30                       No        Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Cookies\administrateur@doubleclick[1].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Cookies\administrateur@atdmt[2].txt
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Cookies\administrateur@tradedoubler[2].txt
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\xzenk219.default\cookies.txt[.247realmedia.com/]
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Cookies\administrateur@247realmedia[1].txt
00145460  Cookie/2o7                         TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Cookies\administrateur@2o7[2].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Cookies\administrateur@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\xzenk219.default\cookies.txt[.xiti.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\xzenk219.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\xzenk219.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\xzenk219.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\xzenk219.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\xzenk219.default\cookies.txt[.serving-sys.com/]
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\xzenk219.default\cookies.txt[.bs.serving-sys.com/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Cookies\administrateur@weborama[2].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\xzenk219.default\cookies.txt[.weborama.fr/]
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Cookies\administrateur@bluestreak[2].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\xzenk219.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\xzenk219.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\xzenk219.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\xzenk219.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Administrateur\Cookies\administrateur@smartadserver[1].txt
01262593  Application/NirCmd.A               HackTools           No        0         Yes            No           C:\WINDOWS\NirCmd.exe
01559636  Adware/WinAntiSpyware              Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/drvfogr.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/ammjprkp.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/bvhiqgen.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/__c00D8CFA.dat.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/catchme2007-11-12_222221.20.zip][__c00942B0.dat]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/hknjwrqm.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/hkwlcxwq.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/jejeuvsc.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/jkgcolfq.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/mcaliyxv.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/mqaowdqy.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/__c00D31C7.dat.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/__c00B8939.dat.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/__c00B7787.dat.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/myvfdblo.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/rjvhnpen.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/rtpsbjgv.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/rvgdnxiw.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/xiojlopx.dll.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/__c002E502.dat.vir]
02646028  Adware/PurityScan                  Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/__c00A4509.dat.vir]
02688266  Adware/UltimateDefender            Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/msvdprqe/msvdprqe2.exe.vir]
02688268  Adware/UltimateCleaner             Adware              No        1         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/msvdprqe/msvdprqe3.exe.vir]
02688351  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\bieqdilb.dll
02688352  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\WINDOWS\system32\bxgxkprn.dll
02688352  Spyware/Virtumonde                 Spyware             No        1         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][WINDOWS/System32/bxgxkprn.dll]
02690923  Adware/UltimateFixer               Adware              No        0         Yes            No           C:\upload_moi_ADELINE.tar.gz[upload_moi.tar][qoobox/Quarantine/C/WINDOWS/system32/msvdprqe/msvdprqe1.exe.vir]
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================

jlpjlp · Answer

vire tout ce qui est dans le fichier quarantine:

va dans poste de travail puis C puis prog files puis 

qoobox/Quarantine/


____________________



REFAIS POKET KILLBOX avec ces deux fichiers

Télécharge: Pocket Killbox ici
http://www.downloads.subratam.org/KillBox.exe

:: Démo d utilisation (merci a Balltrap34 pour cette réalisation) ::
http://pageperso.aol.fr/balltrap34/killbox.htm


Double clic sur killbox.exe (Pocket Killbox)

- coche: delete on reboot
- Dans "Full Path of File to Delete"
- Sélectionne "single File"
- copie et colle:

C:\WINDOWS\system32\bieqdilb.dll
C:\WINDOWS\system32\bxgxkprn.dll


- clique sur la croix rouge
- une fenêtre va apparaître pour confirmation clique sur YES
- une seconde fenêtre te demande si tu veux redémarrer clique sur YES

Si ce message s’affiche ignore le :
http://tinypic.com/images/goodbye.jpg
Laisse le pc redémarrer.

Et après reposte un log HijackThis.

________________________


Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau. 
Ensuite double clique sur navilog1.exe pour lancer l'installation. 
Une fois l'installation terminée, le fix s'exécutera automatiquement. 
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau). 

Laisse-toi guider. Au menu principal, choisis 1 et valides. 
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord) 

Patiente jusqu'au message : 
*** Analyse Termine le ..... *** 
Appuie sur une touche comme demandé, le blocnote va s'ouvrir. 
Copie-colle l'intégralité dans une réponse. Referme le blocnote. 
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt) 

_________________________
recolle un rapport COMBOFIX
et dis tes soucis

Adeline02 · Answer

je ne trouve pas qoobox dans Programme files :s

jlpjlp · Answer

FAIT DEMARREr puis RECHERCHER puis choisi chercher les fichiers   et tape    qoobox      dans la recherche puis clique dessus et vire ce qui est dans quarantine

Adeline02 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:12, on 13/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Nod32
od32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nod32
od32kui.exe
C:\WINDOWS\system32\Prismsta.exe
C:\WINDOWS\system32\Prismsvr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\UberIcon\UberIcon Manager.exe
C:\Windows\System32\VisualTaskTips.exe
C:\Program Files\TweakRAM\TweakRAM.exe
C:\Program Files\LClock\lclock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\WowCartographe\WowCartographe.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Nod32
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [PRISMSTA.EXE] Prismsta.exe /START
O4 - HKLM\..\Run: [PRISMSVR.EXE] Prismsvr.exe /APPLY
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe /auto
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKCU\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
O4 - HKCU\..\Run: [TweakRAM] C:\Program Files\TweakRAM\TweakRAM.exe
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [TweakRAM] C:\Program Files\TweakRAM\TweakRAM.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [LClock] C:\Program Files\LClock\lclock.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{662FA424-F11F-4016-A903-7A9AE2404143}: NameServer = 80.10.246.1,80.10.246.139
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Nod32
od32krn.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

jlpjlp · Answer

vas sur virus total et analyse ces fichiers et dis moi lequels sont inféctés:  

https://www.virustotal.com/gui/



C:\WINDOWS\system32\vpkbwurf.dll
C:\WINDOWS\system32\wtuwlckd.dll
C:\WINDOWS\system32\vfhbmpbj.dll
C:\WINDOWS\system32\pmubjglu.dll
C:\WINDOWS\system32\jjsxlxfk.dll
C:\WINDOWS\system32\bsukvomq.dll
C:\WINDOWS\system32\xfijmybl.dll
C:\WINDOWS\system32\rarcawfn.dll
C:\WINDOWS\system32\lejhuotq.dll
C:\WINDOWS\system32\gsesrcem.dll
C:\WINDOWS\system32\hsfnrbvl.dll
C:\WINDOWS\system32\wmjnrrma.dll

Adeline02 · Answer

Pour chaque fichier j'ai collé les lignes des anti-virus qui annonçait un problème : 


C:\WINDOWS\system32\vpkbwurf.dll 

AVG	7.5.0.503	2007.11.13	Obfustat.YUY
Panda	9.0.0.4	2007.11.13	Suspicious file
Prevx1	V2	2007.11.13	Trojan.Vundo
Webwasher-Gateway	6.0.1	2007.11.13	Win32.Malware.gen (suspicious)

C:\WINDOWS\system32\wtuwlckd.dll 

AVG	7.5.0.503	2007.11.13	BHO.CNU
F-Secure	6.70.13030.0	2007.11.13	Vundo.gen49
Norman	5.80.02	2007.11.13	Vundo.gen49
Panda	9.0.0.4	2007.11.13	Suspicious file
Prevx1	V2	2007.11.13	Trojan.Vundo

C:\WINDOWS\system32\vfhbmpbj.dll 

AVG	7.5.0.503	2007.11.13	Obfustat.YUY
Panda	9.0.0.4	2007.11.13	Suspicious file
Prevx1	V2	2007.11.13	Trojan.Vundo
Webwasher-Gateway	6.0.1	2007.11.13	Win32.Malware.gen (suspicious)

C:\WINDOWS\system32\pmubjglu.dll 

AVG	7.5.0.503	2007.11.13	Lop
McAfee	5161	2007.11.12	Vundo
Norman	5.80.02	2007.11.13	W32/Virtumonde.IJR
Panda	9.0.0.4	2007.11.13	Suspicious file
Prevx1	V2	2007.11.13	Trojan.Vundo

C:\WINDOWS\system32\jjsxlxfk.dll 

AVG	7.5.0.503	2007.11.13	Lop
McAfee	5161	2007.11.12	Vundo
Norman	5.80.02	2007.11.13	W32/Virtumonde.IJR
Panda	9.0.0.4	2007.11.13	Suspicious file
Prevx1	V2	2007.11.13	Trojan.Vundo


C:\WINDOWS\system32\bsukvomq.dll 

AVG	7.5.0.503	2007.11.13	Obfustat.YUY
Panda	9.0.0.4	2007.11.13	Suspicious file
Prevx1	V2	2007.11.13	Trojan.Vundo
Webwasher-Gateway	6.0.1	2007.11.13	Win32.Malware.gen (suspicious)


C:\WINDOWS\system32\xfijmybl.dll 

AVG	7.5.0.503	2007.11.13	BHO.CNM
F-Secure	6.70.13030.0	2007.11.13	Vundo.gen49
Norman	5.80.02	2007.11.13	Vundo.gen49
Panda	9.0.0.4	2007.11.13	Suspicious file
Prevx1	V2	2007.11.13	Trojan.Vundo
Webwasher-Gateway	6.0.1	2007.11.13	Win32.Malware.gen!88 (suspicious)


C:\WINDOWS\system32\rarcawfn.dll 

AVG	7.5.0.503	2007.11.13	Lop
McAfee	5162	2007.11.13	Vundo
Norman	5.80.02	2007.11.13	W32/Virtumonde.IJL
Panda	9.0.0.4	2007.11.13	Suspicious file
Prevx1	V2	2007.11.13	Trojan.Vundo
Webwasher-Gateway	6.0.1	2007.11.13	Win32.Malware.gen (suspicious)


C:\WINDOWS\system32\lejhuotq.dll 

AntiVir	7.6.0.34	2007.11.13	TR/BHO.SK
AVG	7.5.0.503	2007.11.13	BHO.CNG
BitDefender	7.2	2007.11.13	Trojan.Agent.AFTJ
Norman	5.80.02	2007.11.13	W32/Virtumonde.IJG
Panda	9.0.0.4	2007.11.13	Suspicious file
Prevx1	V2	2007.11.13	Trojan.Vundo
McAfee	5162	2007.11.13	Vundo
Webwasher-Gateway	6.0.1	2007.11.13	Trojan.BHO.SK


C:\WINDOWS\system32\gsesrcem.dll 

AntiVir	7.6.0.34	2007.11.13	TR/Agent.AFTJ
AVG	7.5.0.503	2007.11.13	Lop.3.J
BitDefender	7.2	2007.11.13	Trojan.Agent.AFTJ
F-Secure	6.70.13030.0	2007.11.13	Vundo.gen49
Norman	5.80.02	2007.11.13	Vundo.gen49
Panda	9.0.0.4	2007.11.13	Suspicious file
Prevx1	V2	2007.11.13	Trojan.Vundo
Webwasher-Gateway	6.0.1	2007.11.13	Trojan.Agent.AFTJ



C:\WINDOWS\system32\hsfnrbvl.dll 

AVG	7.5.0.503	2007.11.13	BHO.CNA
DrWeb	4.44.0.09170	2007.11.13	Trojan.Juan.25
McAfee	5162	2007.11.13	VundoNorman	5.80.02	2007.11.13	W32/Virtumonde.IJF
Panda	9.0.0.4	2007.11.13	Suspicious file
Prevx1	V2	2007.11.13	Trojan.Vundo
Webwasher-Gateway	6.0.1	2007.11.13	Win32.Malware.gen (suspicious)


C:\WINDOWS\system32\wmjnrrma.dll

AntiVir	7.6.0.34	2007.11.13	ADSPY/Agent.83008
eTrust-Vet	31.2.5291	2007.11.13	Win32/Darksma.FW
McAfee	5162	2007.11.13	Vundo
Norman	5.80.02	2007.11.13	W32/Virtumonde.IJD
Panda	9.0.0.4	2007.11.13	Suspicious file
Prevx1	V2	2007.11.13	Malware.Gen
Symantec	10	2007.11.13	Trojan Horse
Webwasher-Gateway	6.0.1	2007.11.13	Ad-Spyware.Agent.83008

jlpjlp · Answer

REFAIS POKET KILLBOX avec ces deux fichiers

Télécharge: Pocket Killbox ici
http://www.downloads.subratam.org/KillBox.exe

:: Démo d utilisation (merci a Balltrap34 pour cette réalisation) ::
http://pageperso.aol.fr/balltrap34/killbox.htm


Double clic sur killbox.exe (Pocket Killbox)

- coche: delete on reboot
- Dans "Full Path of File to Delete"
- Sélectionne "single File"
- copie et colle:

C:\WINDOWS\system32\vpkbwurf.dll 
C:\WINDOWS\system32\wmjnrrma.dll
C:\WINDOWS\system32\hsfnrbvl.dll 
 C:\WINDOWS\system32\gsesrcem.dll 
C:\WINDOWS\system32\rarcawfn.dll 
C:\WINDOWS\system32\lejhuotq.dll 
C:\WINDOWS\system32\xfijmybl.dll 
C:\WINDOWS\system32\vpkbwurf.dll
C:\WINDOWS\system32\wtuwlckd.dll
C:\WINDOWS\system32\vfhbmpbj.dll
C:\WINDOWS\system32\pmubjglu.dll
C:\WINDOWS\system32\jjsxlxfk.dll
C:\WINDOWS\system32\bsukvomq.dll 


- clique sur la croix rouge
- une fenêtre va apparaître pour confirmation clique sur YES
- une seconde fenêtre te demande si tu veux redémarrer clique sur YES

Si ce message s’affiche ignore le :
http://tinypic.com/images/goodbye.jpg
Laisse le pc redémarrer.


___________________

recolle ensuite un rapport combofix et 


Télécharge ceci: (by Moe) : 

http://sosvirus.changelog.fr/Green_day/Lopxpsetup.exe 

Double clic sur Lopxpsetup.exe pour lancer l'installation 
Au menu, choisir l'option 1 
Patienter jusqu'à que l'on demande d'appuyer sur une touche, appuyer ! 
Une rapport sera alors crée, à copie/colle en entier sur le forum.

Adeline02 · Answer

Rapport Lopxp fait le 13/11/2007 à 19:33:29
Exécuté dans : C:\Program Files\Lopxp

___________________________________________________________________________

[Threads Internet Explorer]




___________________________________________________________________________

[Tâches planifiées]


C:\WINDOWS	asks\AppleSoftwareUpdate.job 

Fichier exécuté :  C\Program Files\Apple Software Update\SoftwareUpdate.exe -task
Tâche crée le : 31/10/2007 à 15:26
Dernière modification le : 09/11/2007 à 20:58



___________________________________________________________________________

[Listing des dossiers Application Data]


Cr = Date Création | Mo = Date Modification


C:\Documents and Settings\Administrateur\Application Data

Cr: 31/10/2007 15:04:44 | Mo: 31/10/2007 15:05:23 - - Adobe
Cr: 12/10/2007 18:19:45 | Mo: 12/10/2007 18:19:45 - - Ahead
Cr: 31/10/2007 17:07:54 | Mo: 31/10/2007 17:07:54 - - Apple Computer
Cr: 18/10/2007 18:22:53 | Mo: 18/10/2007 18:22:53 - - Electronic Arts
Cr: 04/11/2007 16:09:11 | Mo: 04/11/2007 16:09:11 - - Grisoft
Cr: 10/10/2007 15:27:25 | Mo: 10/10/2007 15:27:25 - - Identities
Cr: 11/10/2007 20:20:57 | Mo: 11/10/2007 20:20:57 - - InstallShield
Cr: 11/10/2007 06:37:49 | Mo: 11/10/2007 06:37:49 - - Logitech
Cr: 10/10/2007 15:49:22 | Mo: 10/10/2007 15:49:22 - - Macromedia
Cr: 10/10/2007 15:20:47 | Mo: 02/11/2007 20:52:18 - - Microsoft
Cr: 10/10/2007 21:29:21 | Mo: 10/10/2007 21:29:21 - - Mozilla
Cr: 12/10/2007 19:27:01 | Mo: 12/10/2007 19:27:01 - - Nero
Cr: 29/10/2007 19:22:30 | Mo: 29/10/2007 19:22:30 - - OtakuSoftware
Cr: 01/11/2007 10:55:38 | Mo: 01/11/2007 10:55:38 - - Shareaza
Cr: 04/11/2007 19:15:29 | Mo: 04/11/2007 19:15:29 - - Sun
Cr: 10/10/2007 15:20:47 | Mo: 10/10/2007 15:18:37 - - Symantec
Cr: 10/10/2007 15:29:11 | Mo: 10/10/2007 15:29:11 - - Xentient

C:\Documents and Settings\Administrateur\Local Settings\Application Data

Cr: 31/10/2007 15:04:54 | Mo: 31/10/2007 16:46:00 - - Adobe
Cr: 12/10/2007 19:51:07 | Mo: 12/10/2007 19:51:07 - - Ahead
Cr: 31/10/2007 15:26:36 | Mo: 31/10/2007 15:26:36 - - Apple
Cr: 31/10/2007 15:26:23 | Mo: 31/10/2007 15:26:23 - - Apple Computer
Cr: 10/10/2007 15:27:52 | Mo: 10/10/2007 15:27:55 - - ApplicationHistory
Cr: 10/10/2007 19:28:44 | Mo: 30/10/2007 13:29:47 - - Axialis
Cr: 10/10/2007 15:20:46 | Mo: 07/11/2007 14:56:38 - - Microsoft
Cr: 02/11/2007 20:19:06 | Mo: 02/11/2007 20:19:06 - - Microsoft Help
Cr: 10/10/2007 21:29:20 | Mo: 10/10/2007 21:29:20 - - Mozilla
Cr: 01/11/2007 10:55:38 | Mo: 01/11/2007 10:55:38 - - Shareaza
Cr: 06/11/2007 22:47:10 | Mo: 06/11/2007 22:47:10 - - Stardock
Cr: 17/10/2007 17:08:11 | Mo: 17/10/2007 17:08:11 - - Steam

C:\Documents and Settings\All Users\Application Data

Cr: 31/10/2007 15:26:32 | Mo: 31/10/2007 15:26:32 - - Apple
Cr: 31/10/2007 15:26:50 | Mo: 31/10/2007 15:26:50 - - Apple Computer
Cr: 19/10/2007 20:51:48 | Mo: 19/10/2007 20:51:48 - - CanonBJ
Cr: 04/11/2007 16:08:56 | Mo: 04/11/2007 16:08:56 - - Grisoft
Cr: 04/11/2007 11:29:32 | Mo: 04/11/2007 11:29:32 - - Lavasoft
Cr: 11/10/2007 20:22:21 | Mo: 11/10/2007 20:22:21 - - LogiShrd
Cr: 11/10/2007 20:21:10 | Mo: 11/10/2007 20:21:10 - - Logitech
Cr: 10/10/2007 21:27:06 | Mo: 10/10/2007 21:27:06 - - Messenger Plus!
Cr: 10/10/2007 17:01:22 | Mo: 18/11/2006 12:47:07 - - Microsoft
Cr: 02/11/2007 20:18:51 | Mo: 02/11/2007 22:16:13 - - Microsoft Help
Cr: 12/10/2007 19:22:50 | Mo: 13/11/2007 15:25:58 - - Nero
Cr: 04/11/2007 15:00:50 | Mo: 04/11/2007 15:00:50 - - Prevx
Cr: 10/10/2007 15:31:03 | Mo: 10/10/2007 15:31:04 - - Prism
Cr: 04/11/2007 18:19:23 | Mo: 04/11/2007 19:03:56 - - Spybot - Search & Destroy
Cr: 10/10/2007 15:18:32 | Mo: 10/10/2007 15:18:32 - - Symantec
Cr: 10/10/2007 15:23:41 | Mo: 10/10/2007 15:23:41 - - Windows Genuine Advantage
Cr: 12/10/2007 19:19:28 | Mo: 31/10/2007 11:24:36 - - WLInstaller

C:\Documents and Settings\Default User\Application Data

Cr: 10/10/2007 17:01:22 | Mo: 23/08/2005 22:36:20 - - Microsoft
Cr: 10/10/2007 15:18:37 | Mo: 10/10/2007 15:18:37 - - Symantec

C:\Documents and Settings\Default User\Local Settings\Application Data

Cr: 10/10/2007 15:10:34 | Mo: 10/10/2007 15:10:37 - - Microsoft

___________________________________________________________________________

[Listing du dossier Program Files]

C:\Program Files

Cr: 10/10/2007 15:29:47 | Mo: 10/10/2007 15:29:47 - - 802.11g USB2.0 Adapter
Cr: 10/10/2007 15:14:53 | Mo: 14/06/2006 17:46:14 - - Ad-Aware
Cr: 31/10/2007 13:04:05 | Mo: 31/10/2007 13:05:12 - - Adobe Photoshop CS3
Cr: 31/10/2007 15:26:32 | Mo: 31/10/2007 15:26:33 - - Apple Software Update
Cr: 04/11/2007 16:13:46 | Mo: 04/11/2007 16:13:47 - - CCleaner
Cr: 10/10/2007 15:14:53 | Mo: 14/06/2006 17:46:16 - - Compare It!
Cr: 10/10/2007 15:07:30 | Mo: 10/10/2007 15:07:30 - - ComPlus Applications
Cr: 10/10/2007 16:53:53 | Mo: 10/10/2007 16:53:55 - - DAEMON Tools
Cr: 12/10/2007 20:10:18 | Mo: 12/10/2007 20:13:19 - - DivX
Cr: 31/10/2007 11:41:52 | Mo: 31/10/2007 11:43:15 - - Dofus
Cr: 10/10/2007 15:14:53 | Mo: 24/10/2006 06:44:14 - - Everest
Cr: 10/10/2007 15:13:43 | Mo: 10/10/2007 15:13:43 - - Executive Software
Cr: 10/10/2007 17:02:02 | Mo: 13/11/2007 15:25:59 - - Fichiers communs
Cr: 10/10/2007 15:14:53 | Mo: 15/10/2006 23:08:06 - - FoxitReader
Cr: 18/10/2007 19:46:19 | Mo: 18/10/2007 19:46:19 - - GOA
Cr: 04/11/2007 16:08:54 | Mo: 04/11/2007 16:08:54 - - Grisoft
Cr: 17/10/2007 17:14:19 | Mo: 17/10/2007 17:14:20 - - GUILD WARS
Cr: 10/10/2007 15:14:53 | Mo: 14/06/2006 17:46:21 - - IE Privacy Keeper
Cr: 10/10/2007 15:30:01 | Mo: 30/10/2007 10:41:29 - - InstallShield Installation Information
Cr: 10/10/2007 15:08:08 | Mo: 12/10/2007 18:15:47 - - Internet Explorer
Cr: 04/11/2007 14:33:59 | Mo: 04/11/2007 14:34:40 - - Java
Cr: 10/10/2007 15:14:16 | Mo: 25/07/2006 21:29:51 - - K-Lite Codec Pack
Cr: 12/11/2007 21:20:08 | Mo: 12/11/2007 21:20:08 - - Kioktkzo
Cr: 04/11/2007 11:29:34 | Mo: 04/11/2007 11:29:34 - - Lavasoft
Cr: 10/10/2007 15:14:53 | Mo: 27/07/2006 23:02:42 - - LClock
Cr: 10/10/2007 21:35:02 | Mo: 10/10/2007 21:35:02 - - Logitech
Cr: 13/11/2007 19:32:05 | Mo: 13/11/2007 19:33:32 - - Lopxp
Cr: 10/10/2007 15:14:53 | Mo: 04/11/2006 00:44:24 - - Maxthon
Cr: 10/10/2007 15:26:01 | Mo: 10/10/2007 21:21:44 - - Messenger Plus! Live
Cr: 02/11/2007 20:18:53 | Mo: 02/11/2007 20:23:39 - - Microsoft Office
Cr: 02/11/2007 20:23:34 | Mo: 02/11/2007 20:23:34 - - Microsoft Visual Studio
Cr: 02/11/2007 20:20:22 | Mo: 02/11/2007 20:20:24 - - Microsoft Visual Studio 8
Cr: 02/11/2007 20:24:06 | Mo: 02/11/2007 20:24:06 - - Microsoft Works
Cr: 02/11/2007 20:22:36 | Mo: 02/11/2007 20:22:36 - - Microsoft.NET
Cr: 10/10/2007 21:29:01 | Mo: 13/11/2007 17:10:12 - - Mozilla Firefox
Cr: 02/11/2007 20:23:52 | Mo: 02/11/2007 20:23:52 - - MSBuild
Cr: 10/10/2007 15:25:42 | Mo: 31/10/2007 11:32:35 - - MSN Messenger
Cr: 12/10/2007 17:37:52 | Mo: 12/10/2007 17:37:52 - - MSXML 6.0
Cr: 13/11/2007 18:07:46 | Mo: 13/11/2007 18:10:18 - - Navilog1
Cr: 10/10/2007 15:14:39 | Mo: 04/11/2007 18:21:44 - - Nod32
Cr: 10/10/2007 15:08:16 | Mo: 12/10/2007 17:37:17 - - Outlook Express
Cr: 13/11/2007 16:18:00 | Mo: 13/11/2007 16:19:03 - - Panda Security
Cr: 31/10/2007 11:12:24 | Mo: 31/10/2007 11:14:23 - - PhotoFiltre
Cr: 10/10/2007 16:26:44 | Mo: 10/10/2007 16:26:44 - - PowerQuest
Cr: 31/10/2007 15:26:51 | Mo: 31/10/2007 15:27:14 - - QuickTime
Cr: 10/10/2007 15:14:53 | Mo: 14/06/2006 17:46:22 - - RegSeeker
Cr: 01/11/2007 10:55:38 | Mo: 01/11/2007 10:56:12 - - Shareaza
Cr: 10/10/2007 15:14:47 | Mo: 14/06/2006 21:53:32 - - Soft4Ever
Cr: 04/11/2007 18:19:23 | Mo: 04/11/2007 18:19:29 - - Spybot - Search & Destroy
Cr: 10/10/2007 15:18:32 | Mo: 10/10/2007 15:18:46 - - Symantec
Cr: 12/11/2007 20:51:48 | Mo: 12/11/2007 20:51:48 - - Trend Micro
Cr: 10/10/2007 15:14:53 | Mo: 10/10/2007 15:27:37 - - TweakRAM
Cr: 10/10/2007 15:14:53 | Mo: 14/06/2006 17:46:22 - - UberIcon
Cr: 14/10/2007 13:56:46 | Mo: 14/10/2007 13:56:46 - - Ubisoft
Cr: 10/10/2007 15:27:05 | Mo: 10/10/2007 15:27:05 - - Uninstall Information
Cr: 04/11/2007 15:43:45 | Mo: 04/11/2007 18:03:50 - - Unlocker
Cr: 10/10/2007 21:21:43 | Mo: 12/10/2007 19:19:44 - - Windows Live
Cr: 10/10/2007 15:22:26 | Mo: 10/10/2007 15:22:26 - - Windows Media Connect 2
Cr: 10/10/2007 15:07:14 | Mo: 10/10/2007 15:22:25 - - Windows Media Player
Cr: 10/10/2007 15:09:15 | Mo: 10/10/2007 15:09:15 - - WindowsUpdate
Cr: 10/10/2007 15:15:11 | Mo: 10/10/2007 15:15:12 - - WinRAR
Cr: 07/11/2007 19:07:57 | Mo: 07/11/2007 21:36:38 - - WowCartographe

___________________________________________________________________________

[Recherche programmes connus, liés à CiD]


Présent : C:\Program Files\Messenger Plus! Live

___________________________________________________________________________

[Clés registre de démarrage]


___________________________________________________________________________

[Popups autorisés]


[-] Internet Explorer :

PopupMgr

[-] Mozilla Firefox

host	popup	2	febay.it
host	popup	2	www.asecurevalue.com
host	popup	2	kmpads.com
host	popup	2	bernaolatwin.com
host	popup	2	unknownip.com
host	popup	2	www.seproger.com
host	popup	2	fileprotector.com
host	popup	2	www.treniutalia.it
host	popup	2	li9bero.it
host	popup	2	www.malwarealarm.com
host	popup	2	bravesentry.com
host	popup	2	asecurevalue.com
host	popup	2	010402.com
host	popup	2	mp3bearshare.com
host	popup	2	glbdf.org
host	popup	2	www.bestmanage4.org
host	popup	2	virusburst.com
host	popup	2	www.toolbar3.trafficgeneration.biz
host	popup	2	winshow.biz
host	popup	2	www.dbdecicated.com
host	popup	2	katasweb.it
host	popup	2	libsero.it
host	popup	2	wwww.2211.net
host	popup	2	www.fastpspdownloads.com
host	popup	2	securitywarnings.net
host	popup	2	rrenitalia.it
host	popup	2	fp.gad-network.com
host	popup	2	supeeva.it
host	popup	2	www.core.psyche-evolution.com
host	popup	2	x-webdesign.com
host	popup	2	spereva.it
host	popup	2	prostactive.com
host	popup	2	wm.buhartes.info
host	popup	2	www.tuttograis.it
host	popup	2	www.hobbypesca.com.br
host	popup	2	notify.ifeelyou.info
host	popup	2	aitalia.it
host	popup	2	vac-soft.com
host	popup	2	www.rebay.it
host	popup	2	www.acemedic.com
host	popup	2	www.ebsy.it
host	popup	2	tixscali.it
host	popup	2	www.fgoogle.it
host	popup	2	ferrasri.it
host	popup	2	www.pochta.ru
host	popup	2	www.curepcsolutions.com
host	popup	2	pizdato.biz
host	popup	2	www.worldsecurityonline.biz
host	popup	2	www.gazzxetta.it
host	popup	2	playon.play3w.com
host	popup	2	golftennis.net
host	popup	2	de.errorsafe.com
host	popup	2	www.downloadanysong.com
host	popup	2	pcopschoningsstel.com
host	popup	2	rosssoalice.it
host	popup	2	good-mortgages-calculator.com
host	popup	2	www.vi4rgilio.it
host	popup	2	kzdh.com
host	popup	2	www.xorriere.it
host	popup	2	www.free-download-place.com
host	popup	2	www.googld.it
host	popup	2	www.gqazzetta.it
host	popup	2	www.onerateld.com
host	popup	2	freebookmarks.net
host	popup	2	www.vifgilio.it
host	popup	2	search.psn.cn
host	popup	2	www.digikeygen.com
host	popup	2	getfreepornvideo.com
host	popup	2	spysoldier.com
host	popup	2	www.bestxclips.com
host	popup	2	Antiworm2008.com
host	popup	2	hardcorepornmag.com
host	popup	2	www.little-help.com
host	popup	2	kataaweb.it
host	popup	2	bins.media-motor.net
host	popup	2	www.error404site.com
host	popup	2	chips-4-free.com
host	popup	2	onlysex.ws
host	popup	2	www-spybot.net
host	popup	2	www.xsremover.com
host	popup	2	s4.bestmanage.org
host	popup	2	libereo.it
host	popup	2	www.systemupdates.net
host	popup	2	www.advcash.biz
host	popup	2	marketing-know-how.com
host	popup	2	airtleworld.com
host	popup	2	tisfcali.it
host	popup	2	hk.winantivirus.com
host	popup	2	www.paghinebianche.it
host	popup	2	turtogratis.it
host	popup	2	www.incredimail-download-now.com
host	popup	2	www.dvdcodec.net
host	popup	2	bestporngate.com
host	popup	2	virfgilio.it
host	popup	2	unie.it
host	popup	2	crriere.it
host	popup	2	downloadfreeway.com
host	popup	2	bearsharepro2007.com
host	popup	2	www.unie.it
host	popup	2	www.znext.com
host	popup	2	www.hiscali.it
host	popup	2	qmex.psyche-evolution.com
host	popup	2	kilosex.com
host	popup	2	www.frrrari.it
host	popup	2	enitinvest.net
host	popup	2	web-homepage.net
host	popup	2	securityprecaution.net
host	popup	2	metafora.ru
host	popup	2	katawevb.it
host	popup	2	utils.winantivirus.com
host	popup	2	gootle.it
host	popup	2	missingcommand.com
host	popup	2	easysearchingtips.com
host	popup	2	ez-searching.com
host	popup	2	www.win-anti-virus-pro.com
host	popup	2	marketdart.com
host	popup	2	antispamdeluxe.com
host	popup	2	click-codec.com
host	popup	2	www.incredimailpro.com
host	popup	2	sexpatriot.net
host	popup	2	ibm.dmcast.com
host	popup	2	www.clckm.com
host	popup	2	www.securityupdatesite.com
host	popup	2	errorsafe.com
host	popup	2	acjp.com
host	popup	2	www.maturetoolbar.com
host	popup	2	www.lkbero.it
host	popup	2	www.truecodec.com
host	popup	2	dvdbank.org
host	popup	2	loweradult.com
host	popup	2	sbee.com
host	popup	2	www.rossoalic.it
host	popup	2	www.privatexclips.com
host	popup	2	chrisswasey.com
host	popup	2	pagionebianche.it
host	popup	2	www.reepubblica.it
host	popup	2	www.traffbest.biz
host	popup	2	www.get-realplayer.com
host	popup	2	corruiere.it
host	popup	2	www.avpcheckupdate.com
host	popup	2	mediaactivexobject.com
host	popup	2	proadware.com
host	popup	2	www.fr.drivecleaner.com
host	popup	2	antispywarexp.com
host	popup	2	clearsearch.net
host	popup	2	www.sipereva.it
host	popup	2	www.qmex.psyche-evolution.com
host	popup	2	www.alldnserrors.com
host	popup	2	new2sh.net
host	popup	2	www.supeteva.it
host	popup	2	www.pornxxxfilm.com
host	popup	2	tutttogratis.it
host	popup	2	www.sharedmoviesite.com
host	popup	2	shopnav.com
host	popup	2	whitescat.com
host	popup	2	www.lightspeedsearch.net
host	popup	2	adsniffer.com
host	popup	2	iunito.it
host	popup	2	sbnt.com
host	popup	2	sacitylife.com
host	popup	2	www.asafebrowser.com
host	popup	2	www.tixscali.it
host	popup	2	forexcredit.com
host	popup	2	www.paginebiamnche.it
host	popup	2	montgomeryhospitalanesthesia.com
host	popup	2	download.contextplus.net
host	popup	2	advertising.paltalk.com
host	popup	2	www.gazzettsa.it
host	popup	2	irfanview-download-now.com
host	popup	2	paginegiallew.it
host	popup	2	www.hitsdriving.com
host	popup	2	www.gfazzetta.it
host	popup	2	www.1stpagehere.com
host	popup	2	coirriere.it
host	popup	2	apsua.com
host	popup	2	sharedgamesite.com
host	popup	2	www.anti-virus-pro.com
host	popup	2	www.pornclipstube.com
host	popup	2	www.sef516.greatbahamas.com
host	popup	2	repubblivca.it
host	popup	2	www.all-edonkey.com
host	popup	2	yops.biz
host	popup	2	www.anti-vermins.com
host	popup	2	www.yoogee.com
host	popup	2	gazzett.it
host	popup	2	mokead.com
host	popup	2	www.exaccess.ru
host	popup	2	scanandrepair.com
host	popup	2	www.directporta.info
host	popup	2	paidsurveys.com
host	popup	2	971searchbox.com
host	popup	2	site1.ru
host	popup	2	www.zpwebsource.com
host	popup	2	advertisemoney.info
host	popup	2	yim-stop.com
host	popup	2	internetanonymizer.com
host	popup	2	www.katawaeb.it
host	popup	2	medicare-supplemental.com
host	popup	2	www.superevaq.it
host	popup	2	cameup.com
host	popup	2	spybot-uk.com
host	popup	2	www.free-spybot.com
host	popup	2	www.worldbestadult.com
host	popup	2	buttejazz.org
host	popup	2	dietpills4free.com
host	popup	2	www.tuuttogratis.it
host	popup	2	www.tuttoogratis.it
host	popup	2	www.reossoalice.it
host	popup	2	adsextend.net
host	popup	2	eases.net
host	popup	2	www.download-zone-free.com
host	popup	2	70-music.com
host	popup	2	goohle.it
host	popup	2	udefender.com
host	popup	2	sbvr.com
host	popup	2	movietooklit.com
host	popup	2	www.orriere.it
host	popup	2	paginebioanche.it
host	popup	2	www.uniformpornmag.com
host	popup	2	www.movietooklit.com
host	popup	2	www.download-winrar.com
host	popup	2	fined.biz
host	popup	2	all-bittorrent.com
host	popup	2	www.toolbardollars.biz
host	popup	2	gfoogle.it
host	popup	2	pagiinebianche.it
host	popup	2	www.linero.it
host	popup	2	www.sh.ncast.cn
host	popup	2	getpatytoday.info
host	popup	2	oneclicksearches.com
host	popup	2	www.rrepubblica.it
host	popup	2	www.mwsn.it
host	popup	2	sexmaniack.com
host	popup	2	adultzoneworld.com
host	popup	2	www.refpubblica.it
host	popup	2	www.repubbklica.it
host	popup	2	asiankingkong.com
host	popup	2	00hq.com
host	popup	2	www.karachun.biz
host	popup	2	www.mmohsix.com
host	popup	2	calcioturris.com
host	popup	2	burgerkingbigscreen.com
host	popup	2	www.fixerantispy.com
host	popup	2	moviesdvds.net
host	popup	2	mirarsearch.com
host	popup	2	only-virgins.com
host	popup	2	www.corriuere.it
host	popup	2	www.webinvestigator.com
host	popup	2	www.sexolymp.com
host	popup	2	spywareknight.com
host	popup	2	www.accessthefuture.net
host	popup	2	www.spywarezapper.com
host	popup	2	sex2person.info
host	popup	2	ert0003.e76.163ns.com
host	popup	2	esafetypage.com
host	popup	2	passtosites.net
host	popup	2	googlre.it
host	popup	2	sisdotnet.com
host	popup	2	superebva.it
host	popup	2	www.glogle.it
host	popup	2	develip.com
host	popup	2	www.www-audacity.com
host	popup	2	access-dvd.com
host	popup	2	paginebuianche.it
host	popup	2	www.grepubblica.it
host	popup	2	ignphrases.com
host	popup	2	tracktraff.cc
host	popup	2	holidayautostr.com
host	popup	2	ie-search.com
host	popup	2	ipo.net
host	popup	2	allvideoactivex.com
host	popup	2	www.trenitaliia.it
host	popup	2	irfanview-center.com
host	popup	2	www.softcodec.com
host	popup	2	spybot-sd.net
host	popup	2	es0-www.5zgmu7o20kt5d8yq.com
host	popup	2	pastubes.com
host	popup	2	www.virgioio.it
host	popup	2	gazzertta.it
host	popup	2	fastssearch.com
host	popup	2	msupdater.net
host	popup	2	gad-network.com
host	popup	2	enay.it
host	popup	2	full-search.net
host	popup	2	www.pornissex.com
host	popup	2	vapochille.com
host	popup	2	www.ebazy.it
host	popup	2	www.portal-ticket.com
host	popup	2	axsoftwaretool.com
host	popup	2	engineplay.com
host	popup	2	www.multi-pops.com
host	popup	2	downloadxmoveis.com
host	popup	2	www.gazzertta.it
host	popup	2	www.repibblica.it
host	popup	2	es9-www.5zgmu7o20kt5d8yq.com
host	popup	2	www.photoshop.downloadzcentral.com
host	popup	2	pharmalocator.com
host	popup	2	download.searchtabs.net
host	popup	2	www.activexsource.com
host	popup	2	www.onlineinvestigator.com
host	popup	2	tiscal9.it
host	popup	2	superbgirlz.com
host	popup	2	www.mylimewirenetwork.com
host	popup	2	www.popunder.adtrgt.com
host	popup	2	adwareprotectionsite.com
host	popup	2	allhyperlinks.com
host	popup	2	rocketsearch.com
host	popup	2	ezdvdx.com
host	popup	2	girls-porn-life.com
host	popup	2	ebjp.com
host	popup	2	casalemedia.com
host	popup	2	poker-casino-free.com
host	popup	2	www.rrossoalice.it
host	popup	2	best-counter.com
host	popup	2	www.antivirusgereedschap.com
host	popup	2	myfuncards.smileycentral.com
host	popup	2	www.virgtilio.it
host	popup	2	emch.com
host	popup	2	www.mp3-morpheus.com
host	popup	2	liberpo.it
host	popup	2	dogproblemswebsite.com
host	popup	2	fetrrari.it
host	popup	2	www.ebwmanufacture.com
host	popup	2	scripts.downloadv3.com
host	popup	2	www.spycontra.com
host	popup	2	dancingbabycd.com
host	popup	2	www.msan.it
host	popup	2	www.zippy-lookup.com
host	popup	2	www.hugeinvention.com
host	popup	2	sharempeg.com
host	popup	2	bb-search.com
host	popup	2	www.loibero.it
host	popup	2	www.mksn.it
host	popup	2	dl5.spywarestrike.com
host	popup	2	chriswallace.net
host	popup	2	corrierw.it
host	popup	2	adobe-reader-8.fr
host	popup	2	esupereva.it
host	popup	2	download.jupitersatellites.biz
host	popup	2	kataweeb.it
host	popup	2	www.bearshare.download-me.info
host	popup	2	ga31.com
host	popup	2	lesbianspornmag.com
host	popup	2	zabywjwzlr.biz.biz
host	popup	2	access.Navinetwork.com
host	popup	2	gazxetta.it
host	popup	2	www.bestmanage6.org
host	popup	2	www.googloe.it
host	popup	2	ljibero.it
host	popup	2	www.sitesticket.net
host	popup	2	idbl.idblg.com
host	popup	2	www.unionseek.com
host	popup	2	www.katqaweb.it
host	popup	2	xbeta69.com
host	popup	2	www.p2p-heute.de
host	popup	2	www.downloadmax.net
host	popup	2	exportplay.com
host	popup	2	netyellowpages.info
host	popup	2	www.kibero.it
host	popup	2	www.wintvguide.com
host	popup	2	sureadult.com
host	popup	2	www.virgjilio.it
host	popup	2	yahoo.downloadznow.net
host	popup	2	truttogratis.it
host	popup	2	www.kataewb.it
host	popup	2	tkiscali.it
host	popup	2	ferreari.it
host	popup	2	thenewsearch.com
host	popup	2	www.alitralia.it
host	popup	2	winzip-hq.com
host	popup	2	vidaccess.net
host	popup	2	male4free.com
host	popup	2	www.corriwre.it
host	popup	2	www.download-all-4-free.com
host	popup	2	oborot.com
host	popup	2	www.katazweb.it
host	popup	2	engine-ticket.com
host	popup	2	superteva.it
host	popup	2	tvcodec.com
host	popup	2	corrierse.it
host	popup	2	downloadznow.net
host	popup	2	avforce.com
host	popup	2	www.kaaweb.it
host	popup	2	www.kimsoftware.com
host	popup	2	www.unubo.it
host	popup	2	paginebianchee.it
host	popup	2	find4u.net
host	popup	2	www.dl.targetsaver.com
host	popup	2	www.x-pornmoviez.com
host	popup	2	www.tossoalice.it
host	popup	2	libewro.it
host	popup	2	bearshare.click-new-download.com
host	popup	2	www.rossoaslice.it
host	popup	2	www.spywareremoversite.com
host	popup	2	download.systemdoctor.com
host	popup	2	searchexpander.com
host	popup	2	www.tikscali.it
host	popup	2	smds.com
host	popup	2	www.winmx-music-download.com
host	popup	2	sexmoviesnet.com
host	popup	2	x-ratedclips.com
host	popup	2	hand-book.com
host	popup	2	xlola.underagehost.com
host	popup	2	alitaliua.it
host	popup	2	kyoishusei.com
host	popup	2	installvaxobject.com
host	popup	2	getfound.com
host	popup	2	tax-refund4you.com
host	popup	2	search123forme.com
host	popup	2	www.libeeo.it
host	popup	2	www.free-music-network.com
host	popup	2	www.rzvonporn.com
host	popup	2	sexfiles.nu
host	popup	2	infport.com
host	popup	2	www.4softget.com
host	popup	2	www.searchtab.net
host	popup	2	kmataweb.it
host	popup	2	software-club.com
host	popup	2	repubblpica.it
host	popup	2	mediaplayer-2007.com
host	popup	2	download.winfixer.com
host	popup	2	y-e-l-l-o-w.com
host	popup	2	rephubblica.it
host	popup	2	goodsexs.com
host	popup	2	igetnet.com
host	popup	2	www.go0ogle.it
host	popup	2	accessthefuture.net
host	popup	2	libergo.it
host	popup	2	www.reverseindexlookup.com
host	popup	2	goovle.it
host	popup	2	chelancatering.com
host	popup	2	free-bearshares.com
host	popup	2	virgiklio.it
host	popup	2	corriegre.it
host	popup	2	www.errorsafe.com
host	popup	2	art-xxx.com
host	popup	2	www.anjpnzqav.biz
host	popup	2	new-incest.com
host	popup	2	www.dailypornmag.com
host	popup	2	kliksoftware.com
host	popup	2	libnero.it
host	popup	2	www.greatadultvideo.com
host	popup	2	tisclai.it
host	popup	2	008i.com
host	popup	2	signupprocess.com
host	popup	2	www.vikrgilio.it
host	popup	2	incredimailpro.com
host	popup	2	bannedhost.net
host	popup	2	www.repubnlica.it
host	popup	2	bullseye-network.com
host	popup	2	vigrilio.it
host	popup	2	www.liberol.it
host	popup	2	www.lordoftibia.pl
host	popup	2	www.pcadprotector.cc
host	popup	2	clackamasliteraryreview.com
host	popup	2	attackware.com
host	popup	2	www.malwarewiped.com
host	popup	2	tutogratis.it
host	popup	2	avast-downloads.com
host	popup	2	yboeragu.com
host	popup	2	hao123.com
host	popup	2	onlineinvestigator.com
host	popup	2	www.myfuncards.smileycentral.com
host	popup	2	www.virusranger.com
host	popup	2	www.rossolice.it
host	popup	2	www.emcodec.com
host	popup	2	jkataweb.it
host	popup	2	www.nibo.it
host	popup	2	ad-ware.cc
host	popup	2	eepubblica.it
host	popup	2	www.ligbero.it
host	popup	2	www.videosfan.com
host	popup	2	www.yoursearchspace.com
host	popup	2	global-finder.com
host	popup	2	acrobat-2007.com
host	popup	2	actionbreastcancer.org
host	popup	2	www.paginebiancge.it
host	popup	2	robbsproshop.com
host	popup	2	mrtg.jps.ru
host	popup	2	oddsjackpot.info
host	popup	2	www.net-nucleus.com
host	popup	2	oridian.com
host	popup	2	tiscalil.it
host	popup	2	virgfilio.it
host	popup	2	www.tiscalui.it
host	popup	2	www.mp3review.biz
host	popup	2	leannalovelace.com
host	popup	2	antispywaredownloads.com
host	popup	2	www.tiscalil.it
host	popup	2	www.addictivetechnologies.net
host	popup	2	www.libdero.it
host	popup	2	www.v9rgilio.it
host	popup	2	globe-finder.cc
host	popup	2	file1.qqhelper.com
host	popup	2	www.securityfeature.com
host	popup	2	www.asecureboard.com
host	popup	2	klikadvertising.com
host	popup	2	dcfitusa.com
host	popup	2	incredimail-download-now.com
host	popup	2	download-antivir.com
host	popup	2	trenitslia.it
host	popup	2	www.nerdwareinc.com
host	popup	2	download13.spywarequake.com
host	popup	2	filetretporn.com
host	popup	2	virvilio.it
host	popup	2	www.youriesecure.com
host	popup	2	secret-crush.com
host	popup	2	www.mediaplayer-download.org
host	popup	2	www.yoogle.it
host	popup	2	www.mediaplayer-download-now.com
host	popup	2	www.suppereva.it
host	popup	2	www.content.ireit.com
host	popup	2	katfaweb.it
host	popup	2	www.searchweb2.com
host	popup	2	googel.it
host	popup	2	readagreement.net
host	popup	2	www.spyheal.com
host	popup	2	www.abrp.net
host	popup	2	paginebiamnche.it
host	popup	2	www.ace-webmaster.com
host	popup	2	exeupdate.com
host	popup	2	www.googlf.it
host	popup	2	popunder.adtrgt.com
host	popup	2	www.my-ipodaccess.com
host	popup	2	www.searchingbooth.com
host	popup	2	tiscaki.it
host	popup	2	www.xtravideos.com
host	popup	2	www.my-software-space.com
host	popup	2	newtopsites.com
host	popup	2	hostance.net
host	popup	2	azzetta.it
host	popup	2	cpvfeed.com
host	popup	2	cryptdrive.com
host	popup	2	www.suypereva.it
host	popup	2	www.my-dedik-one.com
host	popup	2	hervam.com
host	popup	2	kataqeb.it
host	popup	2	get.hitvirus.com
host	popup	2	busysearch.net
host	popup	2	univo.it
host	popup	2	www.bardownload.com
host	popup	2	xic-bs.com
host	popup	2	cdn.drivecleaner.com
host	popup	2	accesskeygenerator.com
host	popup	2	www.Antispionagepro.com
host	popup	2	www.adultzoneworld.com
host	popup	2	www.cliks.org
host	popup	2	mshn.it
host	popup	2	www.libvero.it
host	popup	2	www.2every.net
host	popup	2	www.superevba.it
host	popup	2	www.vidaccess.net
host	popup	2	yourbookmarks.info
host	popup	2	www.repubblicva.it
host	popup	2	www.buytraff.biz
host	popup	2	medcodec.com
host	popup	2	porncamz.com
host	popup	2	mediaobjectguide.com
host	popup	2	treniralia.it
host	popup	2	www.roissoalice.it
host	popup	2	unig.it
host	popup	2	hotcodec.net
host	popup	2	diskretter.com
host	popup	2	www.mega-adult.com
host	popup	2	traffstats.biz
host	popup	2	www.36site.com
host	popup	2	activexvideotool.com
host	popup	2	mp3downloadin.net
host	popup	2	www.libwro.it
host	popup	2	www.vaxobjectinstall.com
host	popup	2	www.mt-download.com
host	popup	2	adulthyperlinks.com
host	popup	2	teens4free.net
host	popup	2	pandadownload-now.com
host	popup	2	www.repubblpica.it
host	popup	2	stop-tracking.biz
host	popup	2	www.adshttp.com
host	popup	2	googlus.com
host	popup	2	browserwise.com
host	popup	2	jackpotcheck.info
host	popup	2	www.spyaxe.biz
host	popup	2	the-ticket.net
host	popup	2	www.enterthesearch.com
host	popup	2	www.search101online.com
host	popup	2	eager-sex.com
host	popup	2	supwereva.it
host	popup	2	easymp3musicnow.com
host	popup	2	www.adultmovieplus.com
host	popup	2	www.spylog.com
host	popup	2	www.rossoalie.it
host	popup	2	wabq.com
host	popup	2	toolbartraff.biz
host	popup	2	www.2search.com
host	popup	2	gtiscali.it
host	popup	2	www.freedownloadzone.com
host	popup	2	www.k-litegold.com
host	popup	2	Lastsoftwares.com
host	popup	2	www.ipoddownloadingpro.com
host	popup	2	ads183.com
host	popup	2	accessvid.net
host	popup	2	rtuttogratis.it
host	popup	2	autobargains.org
host	popup	2	Backstripgirls.com
host	popup	2	wwwpokerplayers.com
host	popup	2	security-warning.biz
host	popup	2	www.mp3easyplay.com
host	popup	2	www.zonealarm-download-now.com
host	popup	2	www.getpcmusic.com
host	popup	2	gazzettaq.it
host	popup	2	sexunique.net
host	popup	2	www.rosspoalice.it
host	popup	2	qiudheadsd.com
host	popup	2	www.musicmatch.free-software-center.com
host	popup	2	photoshop.softwarecenterz.com
host	popup	2	cl55.biz
host	popup	2	www.Backstripgirls.com
host	popup	2	xsremover.com
host	popup	2	secure.winantispam.com
host	popup	2	www.costrike.com
host	popup	2	lesbianpornmag.com
host	popup	2	corriedre.it
host	popup	2	the818search-co.com
host	popup	2	www.katzaweb.it
host	popup	2	repbblica.it
host	popup	2	tv-auf-dem-pc.de
host	popup	2	karleyt.narod.ru
host	popup	2	www.sigmadown.biz
host	popup	2	malwarewipesupport.com
host	popup	2	msnb.it
host	popup	2	www.downloads-free.org
host	popup	2	www.gokogle.it
host	popup	2	low-taxes.com
host	popup	2	www.superwva.it
host	popup	2	www7.logih.com
host	popup	2	www.riscali.it
host	popup	2	freedownloadpage.com
host	popup	2	www.nowsearchonline.org
host	popup	2	www.virgi9lio.it
host	popup	2	vfirgilio.it
host	popup	2	almanah.biz
host	popup	2	www.katawrb.it
host	popup	2	www.iesecurepage.com
host	popup	2	j10.wrs.mcboo.com
host	popup	2	logerau11.com
host	popup	2	www.ebaxy.it
host	popup	2	smetsys.net
host	popup	2	www.rossoalixe.it
host	popup	2	www.katawseb.it
host	popup	2	www.virgili9.it
host	popup	2	goofgle.it
host	popup	2	dnl.mabou.org
host	popup	2	registrydebug.com
host	popup	2	rossoaice.it
host	popup	2	ad-w-a-r-e.com
host	popup	2	ulink7.dudu.com
host	popup	2	www.yiscali.it
host	popup	2	baygraphicsllc.com
host	popup	2	lilbero.it
host	popup	2	filevoom.com
host	popup	2	www.corrirre.it
host	popup	2	avideoaxaccess.com
host	popup	2	ebayt.it
host	popup	2	www.urgentsystemupdate.com
host	popup	2	www.turtogratis.it
host	popup	2	imiserver.com
host	popup	2	www.alitalioa.it
host	popup	2	ads.kw.revenue.net
host	popup	2	nevest.net
host	popup	2	tiscalli.it
host	popup	2	ebkb.com
host	popup	2	www.free-avg.org
host	popup	2	www.supeereva.it
host	popup	2	www.supeeva.it
host	popup	2	www.fullsoftwaredownloadz.com
host	popup	2	bearshare-download.org
host	popup	2	suereva.it
host	popup	2	fullsoftwarecenter.com
host	popup	2	downloadxvids.com
host	popup	2	bearshare.download-me.info
host	popup	2	getdvdshrink2007.com
host	popup	2	liberro.it
host	popup	2	xyzlimited.com
host	popup	2	www.3ebay.it
host	popup	2	www.google4.it
host	popup	2	www.paginebianvhe.it
host	popup	2	www.thelimewiredownload.com
host	popup	2	www.reoubblica.it
host	popup	2	2020search.com
host	popup	2	ads.marketingsector.com
host	popup	2	asiantoolbar.com
host	popup	2	uralitel.ru
host	popup	2	msnm.it
host	popup	2	dailyteenspic.com
host	popup	2	nunah.info
host	popup	2	www.seektheglobe.com
host	popup	2	www.msnm.it
host	popup	2	imageaxaccesssoft.com
host	popup	2	www.spybot-now.com
host	popup	2	www.paginebiancche.it
host	popup	2	searchdom.net
host	popup	2	fvirgilio.it
host	popup	2	www.corrierse.it
host	popup	2	www.alialia.it
host	popup	2	www.seorganisation.com
host	popup	2	superevsa.it
host	popup	2	katawegb.it
host	popup	2	www.games.de.ag
host	popup	2	artachnid.com
host	popup	2	www.searchwebzone.com
host	popup	2	libertyonlinehosting.com
host	popup	2	dl2.spyheal.com
host	popup	2	himen.biz
host	popup	2	www.fidoproblems.com
host	popup	2	www.SpyShield.org
host	popup	2	www.deskwizz.com
host	popup	2	www.kaztaweb.it
host	popup	2	www.repuibblica.it
host	popup	1	www.nanoscan.com
host	popup	2	warnomore.org
host	popup	2	www.tns-counter.ru
host	popup	2	verkaufen.wegvonviren.com
host	popup	2	ebayg.it
host	popup	2	tdak.com
host	popup	2	spermatrix.com
host	popup	2	www.gaszzetta.it
host	popup	2	www.search200.com
host	popup	2	mmcodec.com
host	popup	2	hotmp3music.com
host	popup	2	love-pix.com
host	popup	2	did.i-used.cc
host	popup	2	porn-party.net
host	popup	2	downloadlost.tv
host	popup	2	20x2p.com
host	popup	2	www.powerdvd-7.com
host	popup	2	www.imageaxaccesssoft.com
host	popup	2	www.Antiespionspack.com
host	popup	2	awmdabest.com
host	popup	2	wm.vother.info
host	popup	2	www.tuttogrratis.it
host	popup	2	emule.mp3-muzic.com
host	popup	2	adultan.com
host	popup	2	corroere.it
host	popup	2	galpostgirls.com
host	popup	2	www.gszzetta.it
host	popup	2	3322.org
host	popup	2	www.gaxzzetta.it
host	popup	2	dvdxgold.com
host	popup	2	www.gerrari.it
host	popup	2	virusscansite.com
host	popup	2	superwva.it
host	popup	2	mp3downloadsnow.com
host	popup	2	gimnasiaer.com
host	popup	2	googkle.it
host	popup	2	www.virgilijo.it
host	popup	2	www.coolwebsearch.com
host	popup	2	saveli.com
host	popup	2	www.adsonwww.com
host	popup	2	teensact.com
host	popup	2	exclusivexxxclips.com
host	popup	2	musicsite.com
host	popup	2	gazzetya.it
host	popup	2	www.ferrtari.it
host	popup	2	www.gazzettaq.it
host	popup	2	hi.studioaperto.net
host	popup	2	avadvance.com
host	popup	2	alitalisa.it
host	popup	2	supereba.it
host	popup	2	overpro.com
host	popup	2	www.paginnebianche.it
host	popup	2	remedyantispy.com
host	popup	2	www.kmataweb.it
host	popup	2	adnetserver.com
host	popup	2	getpornmag.com
host	popup	2	www.aaabesthomepage.com
host	popup	2	cirriere.it
host	popup	2	virgiljio.it
host	popup	2	www.paginevbianche.it
host	popup	2	msnguard.cc
host	popup	2	host-codec.com
host	popup	2	www.cinemadownload.com
host	popup	2	www.win-virus-pro.com
host	popup	2	www.supernet.speedserv.com
host	popup	2	www.cvirgilio.it
host	popup	2	p2psoft.biz
host	popup	2	cdn.winsoftware.com
host	popup	2	realarea.biz
host	popup	2	spywareno.com
host	popup	2	www.activexemedia.com
host	popup	2	macrovirus.com
host	popup	2	www.painegialle.it
host	popup	2	rtrenitalia.it
host	popup	2	topsite.us
host	popup	2	bearsharelive.co.uk
host	popup	2	www.tiscalli.it
host	popup	2	www.wanfuchina.com
host	popup	2	nospywaresoft.com
host	popup	2	www.zfxaqzkevi.com
host	popup	2	katawweb.it
host	popup	2	libwero.it
host	popup	2	sex-coach.com
host	popup	2	www.wonder-context.com
host	popup	2	mircosoftantispy.com
host	popup	2	amediasource.com
host	popup	2	www.xbxxrvnyes.com
host	popup	2	www.repubblicaa.it
host	popup	2	rossdoalice.it
host	popup	2	paginefialle.it
host	popup	2	www.rossoallice.it
host	popup	2	www.find-find-777.net
host	popup	2	www.unto.it
host	popup	2	prostol.com
host	popup	2	www.bigwww.com
host	popup	2	paginebiancher.it
host	popup	2	tbvg.com
host	popup	2	www.asdeykuddq.com
host	popup	2	player-codec.net
host	popup	2	www.mshn.it
host	popup	2	www.spyot.info
host	popup	2	www.supereeva.it
host	popup	2	urgentsystemupdate.com
host	popup	2	matcash.com
host	popup	2	www.jkataweb.it
host	popup	2	goo0gle.it
host	popup	2	categories.mygeek.com
host	popup	2	www.musicaccess.com
host	popup	2	giscali.it
host	popup	2	www.firgilio.it
host	popup	2	adobe-downloads.com
host	popup	2	umnibo.it
host	popup	2	repubbliva.it
host	popup	2	malwarealarm.com
host	popup	2	www.trernitalia.it
host	popup	2	razespyware.net
host	popup	2	review-play.com
host	popup	2	www.Pc-on-internet.com
host	popup	2	www.downloadv3.com
host	popup	2	s9.truth-is-out-there.org
host	popup	2	sintrader.com
host	popup	2	ads.k8l.info
host	popup	2	www.thesafetytool.com
host	popup	2	Defensaantimalware.com
host	popup	2	seobiz.us
host	popup	2	www.cortiere.it
host	popup	2	download.winantispyware.com
host	popup	2	www.e3bay.it
host	popup	2	www.asidseiupc.com
host	popup	2	Web-mediaplayer.com
host	popup	2	www.pardize-search.net
host	popup	2	www.TBCODE.COM
host	popup	2	www.mediaplayer-2007.com
host	popup	2	dewis.us
host	popup	2	cache.ysbweb.com
host	popup	2	removeearthkeepers.org
host	popup	2	foxmin.com
host	popup	2	dcurtis.com
host	popup	2	dload.contextplus.net
host	popup	2	kataeweb.it
host	popup	2	gazzettsa.it
host	popup	2	Navi-recherche.com
host	popup	2	smutarchive.net
host	popup	2	virgiliop.it
host	popup	2	www.nicecodec.net
host	popup	2	www.rossoalicre.it
host	popup	2	nettracker.jps.ru
host	popup	2	adlogix.com
host	popup	2	www.msen.it
host	popup	2	msmn.it
host	popup	2	www.easycdrip.com
host	popup	2	mygeek.com
host	popup	2	www.ivideocodec.com
host	popup	2	ossoalice.it
host	popup	2	reopubblica.it
host	popup	2	livegambling.com
host	popup	2	casino2win.net
host	popup	2	www.analcord.com
host	popup	2	www.katawefb.it
host	popup	2	madisonoilco.com
host	popup	2	tiscaoli.it
host	popup	2	gkoogle.it
host	popup	2	toolbardollars.biz
host	popup	2	www.malwarewipeupdate.com
host	popup	2	helpcodec.com
host	popup	2	www.bqgate.com
host	popup	2	katawebg.it
host	popup	2	media.matcash.com
host	popup	2	f5.truth-is-out-there.org
host	popup	2	www.trafficroup.com
host	popup	2	ibsprogram.com
host	popup	2	www.googler.it
host	popup	2	psn.cn
host	popup	2	debay.it
host	popup	2	the.007guard.com
host	popup	2	www.lijbero.it
host	popup	2	gbazzetta.it
host	popup	2	file5.qqhelper.com
host	popup	2	dutch-sex.com
host	popup	2	stacistaxx.com
host	popup	2	www.spybotdownload-now.com
host	popup	2	securityupdatesite.com
host	popup	2	rossoalicew.it
host	popup	2	vegas-free.com
host	popup	2	www.smartprotect.info
host	popup	2	lunitaweb.net
host	popup	2	www.did.i-used.cc
host	popup	2	www.giangho.biz
host	popup	2	cc.panet.org
host	popup	2	kr62.com
host	popup	2	www.huoche.com.cn
host	popup	2	searchdot.net
host	popup	2	mp3musicdirect.com
host	popup	2	topconverting.com
host	popup	2	100sexlinks.com
host	popup	2	Gomusic.com
host	popup	2	mmmike.com
host	popup	2	www.Goldenantispy.com
host	popup	2	www.Hot-tv.com
host	popup	2	br.errorsafe.com
host	popup	2	zenotecnico2.com
host	popup	2	videosaccess.net
host	popup	2	www.antivirusadvance.com
host	popup	2	fr.winfixer.com
host	popup	2	burnsrecyclinginc.com
host	popup	2	www.repiubblica.it
host	popup	2	searchmiracle.com
host	popup	2	www.Trojansfilter.com
host	popup	2	www.goldcodec.com
host	popup	2	internet-optimizer.com
host	popup	2	ssby.com
host	popup	2	exflow.org
host	popup	2	logih.com
host	popup	2	download-this.us
host	popup	2	imagemediaax.com
host	popup	2	rc.rizalof.com
host	popup	2	www.repbblica.it
host	popup	2	excellentsckin.com
host	popup	2	www.netspyprotector.com
host	popup	2	www.ebzay.it
host	popup	2	lovelysearch.com
host	popup	2	hentai4u.net
host	popup	2	www.trenitalias.it
host	popup	2	trenitakia.it
host	popup	2	ferrri.it
host	popup	2	mabou.org
host	popup	2	www.goo0gle.it
host	popup	2	httpwwwads.com
host	popup	2	www.tremnitalia.it
host	popup	2	virgoilio.it
host	popup	2	katawebv.it
host	popup	2	www.mpegcodec.net
host	popup	2	repuvbblica.it
host	popup	2	www.allstarsvideos.net
host	popup	2	www.libegro.it
host	popup	2	error404site.com
host	popup	2	porn-screen.com
host	popup	2	search-exe.com
host	popup	2	c.centralmedia.ws
host	popup	2	www.search-empire.info
host	popup	2	www.virgbilio.it
host	popup	2	fastmetasearch.com
host	popup	2	goclick.com
host	popup	2	www.treniyalia.it
host	popup	2	approvedlinks.com
host	popup	2	www.rtuttogratis.it
host	popup	2	www.erepubblica.it
host	popup	2	newcracks.com
host	popup	2	www.catch-dc.info
host	popup	2	ss.panet.org
host	popup	2	www.ozonung.biz
host	popup	2	www.toolbar5.trafficgeneration.biz
host	popup	2	anin.org
host	popup	2	www.newvidscodec.net
host	popup	2	net-nucleus.com
host	popup	2	tuttogeratis.it
host	popup	2	www.fulltvdownloading.com
host	popup	2	mmohsix.com
host	popup	2	www.click-codec.com
host	popup	2	www.febay.it
host	popup	2	www.2search.org
host	popup	2	webaccelerating.com
host	popup	2	www.virgiliko.it
host	popup	2	www.katawesb.it
host	popup	2	www.saupereva.it
host	popup	2	www.supererva.it
host	popup	2	www.netdogtrainer.com
host	popup	2	hitvirus.com
host	popup	2	www.liberlo.it
host	popup	2	virtgilio.it
host	popup	2	acrobat-8.com
host	popup	2	roossoalice.it
host	popup	2	www.6sek.com
host	popup	2	k-lined.com
host	popup	2	anarchylolita.com
host	popup	2	find-itnow.com
host	popup	2	dl1.spydawn.com
host	popup	2	www.bestmanage9.org
host	popup	2	superevw.it
host	popup	2	www.websearch24.com
host	popup	2	teenpornosex.com
host	popup	2	www.4repubblica.it
host	popup	2	tvshowcollection.com
host	popup	2	mega-adult.com
host	popup	2	www.bestxxxmpegs.com
host	popup	2	searcher.tgpie.com
host	popup	2	www.vidscodec.com
host	popup	2	www.mediaaxsetup.com
host	popup	2	sebot.com
host	popup	2	thehuy.net
host	popup	2	loibero.it
host	popup	2	www.bm.theaimonline.com
host	popup	2	www.videoaxdata.com
host	popup	2	ampmsearch.com
host	popup	2	tfil.com
host	popup	2	search345quest.com
host	popup	2	www.musicsite.com
host	popup	2	pestguardian.com
host	popup	2	www.archiviosex.net
host	popup	2	dvdxpremium.com
host	popup	2	iednserror.com
host	popup	2	nownames.org
host	popup	2	getxmovies.com
host	popup	2	www.surfaccuracy.com
host	popup	2	suprnova.cn
host	popup	2	freepcsecure.com
host	popup	2	you-search.com
host	popup	2	securityfeature.com
host	popup	2	gvoogle.it
host	popup	2	hugefreevids.com
host	popup	2	command.adservs.com
host	popup	2	www.movscodec.com
host	popup	2	syserrors.com
host	popup	2	testosterone-birth-control.com
host	popup	2	www.tvscodec.com
host	popup	2	www.erossoalice.it
host	popup	2	settings.iconnectyou.biz
host	popup	2	www.gootle.it
host	popup	2	www.coolwwwsearch.com
host	popup	2	www.powerdvd2007.info
host	popup	2	download-zone-free.net
host	popup	2	sploso.com
host	popup	2	x-google.net
host	popup	2	searchdot.com
host	popup	2	dl1.antivermins.com
host	popup	2	www.avxiz-ueorn.biz
host	popup	2	aliotalia.it
host	popup	2	www.globesearch.com
host	popup	2	www.americancarbargains.com
host	popup	2	www.asafetypage.com
host	popup	2	www.repoubblica.it
host	popup	2	www.l9ibero.it
host	popup	2	firstbookmark.net
host	popup	2	asafetypage.com
host	popup	2	www.onlinesecuritynet.com
host	popup	2	advertising-money.info
host	popup	2	coolpornsearch.com
host	popup	2	sixroads.com
host	popup	2	www.download-limewire.org
host	popup	2	paginebiancche.it
host	popup	2	www.atruesecurity.com
host	popup	2	umimi.it
host	popup	2	cotriere.it
host	popup	2	insuranceall.net
host	popup	2	matureporngate.com
host	popup	2	ayb.netbios-wait.com
host	popup	2	www.easyspyware.com
host	popup	2	good-casino.net
host	popup	2	www.mxsn.it
host	popup	2	meta-adult.com
host	popup	2	www.alitlia.it
host	popup	2	www.gazzrtta.it
host	popup	2	www.mediaaxsolution.com
host	popup	2	www.crapsgold.info
host	popup	2	omega-search.com
host	popup	2	softwaresite.com
host	popup	2	trenittalia.it
host	popup	2	go9ogle.it
host	popup	2	mediaplayer-download.org
host	popup	2	alitali.it
host	popup	2	www.tuttogrstis.it
host	popup	2	www.gfxgraphics.net
host	popup	2	tliscali.it
host	popup	2	repubblicda.it
host	popup	2	gazzettas.it
host	popup	2	corriiere.it
host	popup	2	es1-www.5zgmu7o20kt5d8yq.com
host	popup	2	www.gpoogle.it
host	popup	2	extremeseek.net
host	popup	2	libero0.it
host	popup	2	sexarena.org
host	popup	2	sipereva.it
host	popup	2	burningsite.com
host	popup	2	searchaccurate.com
host	popup	2	tuytogratis.it
host	popup	2	upspiral.com
host	popup	2	supeteva.it
host	popup	2	onlinevideoset.com
host	popup	2	www.suoereva.it
host	popup	2	rtossoalice.it
host	popup	2	googlebar.jps.ru
host	popup	2	web-entrance.co
host	popup	2	www.amaena.com
host	popup	2	www.Defensaantimalware.com
host	popup	2	www.idblg.com
host	popup	2	www.lbero.it
host	popup	2	theproxy.org
host	popup	2	www.new2sh.net
host	popup	2	tuiscali.it
host	popup	2	www.adlogix.com
host	popup	2	www.findanyshow.org
host	popup	2	www.kartaweb.it
host	popup	2	www.wowsearch.org
host	popup	2	virusnuke.com
host	popup	2	www.accessactivexvideo.com
host	popup	2	www.mybestsearch2007.com
host	popup	2	www.traffweb1.biz
host	popup	2	sterva.com
host	popup	2	www.dgbusiness.com
host	popup	2	www.fastmetasearch.com
host	popup	2	dvicodec.com
host	popup	2	gl.secdep.info
host	popup	2	tuttogrratis.it
host	popup	2	www.multimediaobject.com
host	popup	2	gologle.it
host	popup	2	gocodec.com
host	popup	2	gazzedtta.it
host	popup	2	www.securityplugins.com
host	popup	2	www.vac-soft.com
host	popup	2	antivirus-hq.net
host	popup	2	ultimateprotect.com
host	popup	2	www.mp3bearshare.com
host	popup	2	7search.com
host	popup	2	topbrowsing.com
host	popup	2	l9bero.it
host	popup	2	gtazzetta.it
host	popup	2	limewire.click-new-download.com
host	popup	2	ecpm.com
host	popup	2	www.pginegialle.it
host	popup	2	www.g9oogle.it
host	popup	2	www.vlirgilio.it
host	popup	2	www.gazzedtta.it
host	popup	2	mainstreamdollars.com
host	popup	2	www.3abetterinternet.com
host	popup	2	zero.serverc.org
host	popup	2	rightfinder.net
host	popup	2	www.downloadvax.com
host	popup	2	imergeyou.com
host	popup	2	paginegoalle.it
host	popup	2	domains-for-you-online.com
host	popup	2	www.tisxcali.it
host	popup	2	repubbvlica.it
host	popup	2	lavasoftupdate.com
host	popup	2	libe5ro.it
host	popup	2	www.helpcodec.com
host	popup	2	www.download.bravesentry.com
host	popup	2	computerpcgames.net
host	popup	2	searchfastnet.com
host	popup	2	www.katawdeb.it
host	popup	2	search-motor.com
host	popup	2	virgiloo.it
host	popup	2	virgiio.it
host	popup	2	www.ampmsearch.com
host	popup	2	windupdates.com
host	popup	2	www.adwarebazooka.com
host	popup	2	mediaaxproject.com
host	popup	2	www.burnsrecyclinginc.com
host	popup	2	www.katfaweb.it
host	popup	2	spy-bot.com
host	popup	2	www.adwarepatrol.com
host	popup	2	tjiscali.it
host	popup	2	www.activesearcher.info
host	popup	2	www.search345quest.com
host	popup	2	Crazygirls-world.com
host	popup	2	adwareplatinum.com
host	popup	2	registryassistant.com
host	popup	2	www.tuksolution.com
host	popup	2	www.protectionwarn.com
host	popup	2	www.activexvideo.com
host	popup	2	hotmp3now.com
host	popup	2	urlstat.com
host	popup	2	www.trenitaalia.it
host	popup	2	linksummary.com
host	popup	2	www.f1organizer.com
host	popup	2	www.freeimageheaven.com
host	popup	2	www.cache.surfaccuracy.com
host	popup	2	wolfpacracing.com
host	popup	2	www.unge.it
host	popup	2	www.rossosalice.it
host	popup	2	freecoolhost.com
host	popup	2	www.aklitalia.it
host	popup	2	domain-your-registration.com
host	popup	2	wwwroulette.net
host	popup	2	buy-find.info
host	popup	2	methasearch.info
host	popup	2	www.corroere.it
host	popup	2	www.vi8rgilio.it
host	popup	2	mesn.it
host	popup	2	www.umnibo.it
host	popup	2	lightcodec.com
host	popup	2	virglilio.it
host	popup	2	gazzettqa.it
host	popup	2	pestrap.com
host	popup	2	myseachexplorer.com
host	popup	2	www.spytrooper.com
host	popup	2	www.paginebuanche.it
host	popup	2	filesharing-downloads.com
host	popup	2	repubbllica.it
host	popup	2	www.gpogle.it
host	popup	2	video-clips.in
host	popup	2	www.tscodec.com
host	popup	2	searchmeta.md
host	popup	2	ad.mokead.com
host	popup	2	sitesticket.net
host	popup	2	www.igetnet.com
host	popup	2	virgiolio.it
host	popup	2	www.gazzettya.it
host	popup	2	rossoalicr.it
host	popup	2	klataweb.it
host	popup	2	xbxxrvnyes.com
host	popup	2	www.countdutycall.info
host	popup	2	traffsale1.biz
host	popup	2	winantispam.com
host	popup	2	google.panet.org
host	popup	2	www.supereba.it
host	popup	2	iconnectyou.biz
host	popup	2	www.googvle.it
host	popup	2	www.cooldeskalert.com
host	popup	2	masterbar.com
host	popup	2	www.gazzettas.it
host	popup	2	frepubblica.it
host	popup	2	antispyadvanced.com
host	popup	2	vicodec.com
host	popup	2	www.tuiscali.it
host	popup	2	vcirgilio.it
host	popup	2	www.asecurityissue.com
host	popup	2	ppaginebianche.it
host	popup	2	www.keygenguru.com
host	popup	2	marketingsector.com
host	popup	2	www.zdrqmpad.com
host	popup	2	winamp2007.com
host	popup	2	www.libreo.it
host	popup	2	offers.ukiee.com
host	popup	2	ksataweb.it
host	popup	2	mir.100888290cs.com
host	popup	2	rossoaslice.it
host	popup	2	adult-host.org
host	popup	2	caxa.ru
host	popup	2	antispylab.com
host	popup	2	googlse.it
host	popup	2	www.fcorriere.it
host	popup	2	www.c4tdownload.com
host	popup	2	wwwsearch.biz
host	popup	2	www.engine-ticket.com
host	popup	2	www.pagnegialle.it
host	popup	2	s1s1s1search.com
host	popup	2	microantivirusxp.com
host	popup	2	www.imediacodec.com
host	popup	2	www.katsaweb.it
host	popup	2	7939.com
host	popup	2	www.buy-find.info
host	popup	2	rossoallice.it
host	popup	2	www.dogproblemswebsite.com
host	popup	2	xosearchox.com
host	popup	2	www.repuvblica.it
host	popup	2	acemedic.com
host	popup	2	kazaa-lite.ws
host	popup	2	ttrenitalia.it
host	popup	2	kzataweb.it
host	popup	2	www.hushware.com
host	popup	2	www.hastalavista.com
host	popup	2	f3.bestmanage.org
host	popup	2	hityou.com
host	popup	2	free-program-download.com
host	popup	2	gazzwtta.it
host	popup	2	iframe.biz
host	popup	2	www.medcodec.com
host	popup	2	s6.truth-is-out-there.org
host	popup	2	stopxxxpics.com
host	popup	2	shopknights.com
host	popup	2	redirect.msupdate.net
host	popup	2	vcodec2007.com
host	popup	2	www.libe5ro.it
host	popup	2	bdsmpornmag.com
host	popup	2	www.www7.logih.com
host	popup	2	dl9.spyfalcon.com
host	popup	2	click-now.net
host	popup	2	www.videoactivexsetup.com
host	popup	2	mmm.elitemediagroup.net
host	popup	2	5tiscali.it
host	popup	2	www.axmediaproject.com
host	popup	2	infoglobus.com
host	popup	2	nipd.it
host	popup	2	aaasexypics.com
host	popup	2	www.repubvlica.it
host	popup	2	gallerypictures.net
host	popup	2	www.axmediasoftware.com
host	popup	2	www.tutorial-hq.com
host	popup	2	www.tjiscali.it
host	popup	2	www.freedownloadhq.com
host	popup	2	specialoems.com
host	popup	2	imesh.click-new-download.com
host	popup	2	www.aloitalia.it
host	popup	2	spywarebot.com
host	popup	2	paginebiancge.it
host	popup	2	download10.spywarequake.com
host	popup	2	www.hachimitsu-lemon.com
host	install	2	popupnukerpro.com
host	popup	2	popupnukerpro.com
host	image	2	popupnukerpro.com
host	popup	2	find-52.com
host	popup	2	www.vgazzetta.it
host	popup	2	ware2006.com
host	popup	2	onlycunt.com
host	popup	2	tuttpgratis.it
host	popup	2	www.spyonthis.net
host	popup	2	fastfreedownload.com
host	popup	2	www.eba7y.it
host	popup	2	count.hitscount.net
host	popup	2	www.spydefenderpro.com
host	popup	2	www.acrobat-reader-8.de
host	popup	2	www.rizalof.com
host	popup	2	www.bettersearch.biz
host	popup	2	www.msantispy.com
host	popup	2	www.websearch.com
host	popup	2	www.watchonline.tv
host	popup	2	www.contentmatch.net
host	popup	2	www.download-itunes-now.com
host	popup	2	adulttds.com
host	popup	2	www.sisdotnet.com
host	popup	2	servedby.headlinesandnews.com
host	popup	2	www.netonlineinvestigators.com
host	popup	2	curepcsolutions.com
host	popup	2	f2.truth-is-out-there.org
host	popup	2	spywaresheriff.com
host	popup	2	iunipg.it
host	popup	2	siteentrance.net
host	popup	2	www.diskretter.com
host	popup	2	lauraroebuck.com
host	popup	2	www.googl3e.it
host	popup	2	www.librero.it
host	popup	2	ricenhancement.com
host	popup	2	www.ufixer.com
host	popup	2	sex.free4porno.net
host	popup	2	onlineclick.net
host	popup	2	bellabasketsfl.com
host	popup	2	www.clorriere.it
host	popup	2	www.ebaty.it
host	popup	2	www.install.007guard.com
host	popup	2	pinaccesscode.com
host	popup	2	liber5o.it
host	popup	2	www.cdorriere.it
host	popup	2	dcdl.dmcast.com
host	popup	2	www.searchfromyourbrowser.net
host	popup	2	rms.vapochille.com
host	popup	2	www.goo9gle.it
host	popup	2	trenotalia.it
host	popup	2	www.spybot-ib.com
host	popup	2	k9instructor.com
host	popup	2	www.hotfreebies.com
host	popup	2	8ad.com
host	popup	2	ebaxy.it
host	popup	2	tiscaoi.it
host	popup	2	www.dmcast.com
host	popup	2	veyyhlucwa.net
host	popup	2	tjdo.com
host	popup	2	pillsmall.com
host	popup	2	server-au.imrworldwide.com
host	popup	2	barnandfence.com
host	popup	2	www.elitemediagroup.net
host	popup	2	best-targeted-traffic.com
host	popup	2	full-tgp.net
host	popup	2	www.iconfessonline.com
host	popup	2	bestmanage1.org
host	popup	2	www.180searchassistant.com
host	popup	2	teen-biz.com
host	popup	2	hotlolitas.underagehost.com
host	popup	2	www.official--software.com
host	popup	2	allprotections.com
host	popup	2	instafinder.com
host	popup	2	hugeinvention.com
host	popup	2	replubblica.it
host	popup	2	ad45.com
host	popup	2	www.snipernet.biz
host	popup	2	bestcrawler.com
host	popup	2	www.promo.dollarrevenue.com
host	popup	2	paulhoover.com
host	popup	2	emediacodec.com
host	popup	2	iunipv.it
host	popup	2	cydom.com
host	popup	2	newcategories.com
host	popup	2	buytraff.biz
host	popup	2	www.webhancer.com
host	popup	2	www.irfanview-download-now.com
host	popup	2	download-zone-free.com
host	popup	2	www.corrierwe.it
host	popup	2	paginebisanche.it
host	popup	2	node2.ocslab.com
host	popup	2	li8bero.it
host	popup	2	www.limewirenetwork.com
host	popup	2	b.casalemedia.com
host	popup	2	www.xxxallvideo.com
host	popup	2	adprotect.com
host	popup	2	insurance-flood.net
host	popup	2	www.nbcsearch.com
host	popup	2	cashengines.com
host	popup	2	www.tioscali.it
host	popup	2	www.ebay6.it
host	popup	2	www.rosaoalice.it
host	popup	2	www.mp3downloadpro.com
host	popup	2	numb-soft.com
host	popup	2	search.shopnav.com
host	popup	2	ad86.com
host	popup	2	www.ALL1COUNT.NET
host	popup	2	www.golgle.it
host	popup	2	4klm.com
host	popup	2	onlineserverz.com
host	popup	2	ebaty.it
host	popup	2	spyheal.com
host	popup	2	www.ares-freebie.com
host	popup	2	addictivetechnologies.com
host	popup	2	jumptothat.com
host	popup	2	s3.bestmanage.org
host	popup	2	www.tisvcali.it
host	popup	2	aximageobject.com
host	popup	2	www.picturesspot.com
host	popup	2	www.imusicadvance.com
host	popup	2	vxebony.com
host	popup	2	www.frostwire.click-new-download.com
host	popup	2	www.maturespornmag.com
host	popup	2	bookedspace.com
host	popup	2	carsands.com
host	popup	2	repubblicza.it
host	popup	2	www.yourcodec.com
host	popup	2	www.master70.biz
host	popup	2	www.amediasource.com
host	popup	2	couldnotfind.com
host	popup	2	search.netzany.com
host	popup	2	www.tinybar.com
host	popup	2	www.ytiscali.it
host	popup	2	pagimnebianche.it
host	popup	2	vifrgilio.it
host	popup	2	keithgreenpro.com
host	popup	2	incest-host.com
host	popup	2	tgoogle.it
host	popup	2	sysnetsecurity.net
host	popup	2	supersexmachine.com
host	popup	2	www.securitybulletin.net
host	popup	2	repibblica.it
host	popup	2	videossoftware.com
host	popup	2	mp3winmx.com
host	popup	2	www.easypspdownloads.com
host	popup	2	www.surfsidekick.com
host	popup	2	gigaz.info
host	popup	2	www.vi9rgilio.it
host	popup	2	gohip.com
host	popup	2	ALL1COUNT.NET
host	popup	2	www.mcdial.biz
host	popup	2	www.lovezest.com
host	popup	2	x-library.com
host	popup	2	antivirusprotector.com
host	popup	2	metapoisk.ru
host	popup	2	viorgilio.it
host	popup	2	www.rossoalicce.it
host	popup	2	thiscali.it
host	popup	2	www.virgi8lio.it
host	popup	2	links4all.biz
host	popup	2	www.mediaobjectsource.com
host	popup	2	www.antivirgear.com
host	popup	2	netpaidsurveys.com
host	popup	2	crapsgold.info
host	popup	2	www.tisacli.it
host	popup	2	www.esecuritypage.com
host	popup	2	www.xxlblog.info
host	popup	2	www.starsdoor.com
host	popup	2	mediaaxobject.com
host	popup	2	downloadimesh.com
host	popup	2	doktorxxx.com
host	popup	2	webiphonedownloads.com
host	popup	2	bestweblinks.com
host	popup	2	exaccess.ru
host	popup	2	seorganisation.com
host	popup	2	type2find.com
host	popup	2	www.li8bero.it
host	popup	2	tisscali.it
host	popup	2	vitrgilio.it
host	popup	2	www.find-52.com
host	popup	2	ass-gals.com
host	popup	2	rich777.greatbahamas.com
host	popup	2	www.ultimatemp3player.com
host	popup	2	www.tuttogratos.it
host	popup	2	www.adwarefinder.com
host	popup	2	itunesfreebies.com
host	popup	2	searchadultweb.com
host	popup	2	www.errari.it
host	popup	2	bgoogle.it
host	popup	2	goldenfreehost.com
host	popup	2	goohgle.it
host	popup	2	googler.it
host	popup	2	www.ignphrases.com
host	popup	2	www.myvirusguardian.com
host	popup	2	www.Navi-recherche.com
host	popup	2	ebxay.it
host	popup	2	rossoaluce.it
host	popup	2	www.supwreva.it
host	popup	2	toolbar.azebar.com
host	popup	2	powercodec.com
host	popup	2	justcount.net
host	popup	2	mcboo.com
host	popup	2	mediaobjectsource.com
host	popup	2	fionasteel.com
host	popup	2	repubnblica.it
host	popup	2	cache.surfaccuracy.com
host	popup	2	casino-gambling-2.net
host	popup	2	adwarefinder.com
host	popup	2	quickipoddownloads.com
host	popup	2	www.goldenfreehost.com
host	popup	2	hardbodytgp.com
host	popup	2	www.topsecuritysite.net
host	popup	2	www.repuhbblica.it
host	popup	2	updatemysettings.com
host	popup	2	tiscfali.it
host	popup	2	okulta.com
host	popup	2	www.graceinthedesert.org
host	popup	2	onlybestpornmovies.com
host	popup	2	dvdsvideos.net
host	popup	2	www.tuttogratiis.it
host	popup	2	superevz.it
host	popup	2	spybot2007.com
host	popup	2	www.paginegalle.it
host	popup	2	www.pilotcodec.com
host	popup	2	adultsper.com
host	popup	2	www.goiogle.it
host	popup	2	www.corrieres.it
host	popup	2	www.1800searchonline.com
host	popup	2	www.mypspcenter.com
host	popup	2	klik.klikadvertising.com
host	popup	2	wwwyahoo.downloadznow.net
host	popup	2	easymovieplayer.com
host	popup	2	people.1gb.ru
host	popup	2	globalefinder.com
host	popup	2	www.xathzesocc.com
host	popup	2	4ebay.it
host	popup	2	itvdownload.com
host	popup	2	supereeva.it
host	popup	2	mediacodec.net
host	popup	2	www.silvercodec.com
host	popup	2	mustv.com
host	popup	2	www.80-music.com
host	popup	2	H24413.tfil.com
host	popup	2	imagesezine.com
host	popup	2	slotchbar.com
host	popup	2	photoshop-stop.com
host	popup	2	Trojanerfilter.com
host	popup	2	ukiee.com
host	popup	2	calendaralerts.net
host	popup	2	www.jumptothat.com
host	popup	2	www.trenitallia.it
host	popup	2	www.traffic-acc.com
host	popup	2	kliksearch.com
host	popup	2	trenitalias.it
host	popup	2	cyberrape.com
host	popup	2	huoche.com.cn
host	popup	2	www.rich777.greatbahamas.com
host	popup	2	ebaw.com
host	popup	2	www.goovgle.it
host	popup	2	katawesb.it
host	popup	2	www.paginebiianche.it
host	popup	2	cia-trjn.myvnc.com
host	popup	2	hugevideoszone.com
host	popup	2	www.supwereva.it
host	popup	2	nhlsportsbook.net
host	popup	2	s2.exocrew.com
host	popup	2	sbnl.com
host	popup	2	iconfessonline.com
host	popup	2	www.download-dvdshrink.com
host	popup	2	www.all-limewire.com
host	popup	2	msan.it
host	popup	2	www.ireit.com
host	popup	2	sysnetsecurity.com
host	popup	2	www.klataweb.it
host	popup	2	Teslaplus.com
host	popup	2	www.corrieree.it
host	popup	2	my-dedik-one.com
host	popup	2	ntcor.com
host	popup	2	www.katawebb.it

Adeline02 · Answer

ComboFix 07-11-08.1 - Administrateur 2007-11-13 18:15:19.4 - NTFSx86
Running from: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2007-10-13 to 2007-11-13 ))))))))))))))))))))))))))))))))))))
.

2007-11-13 18:07 <REP> d-------- C:\Program Files\Navilog1
2007-11-13 16:18 <REP> d-------- C:\WINDOWS\LastGood
2007-11-13 16:18 <REP> d-------- C:\Program Files\Panda Security
2007-11-13 14:27 <REP> d-------- C:\VundoFix Backups
2007-11-13 12:09 <REP> d-------- C:\Program Files\Ujgmrkuf
2007-11-12 22:09 144,480 --a------ C:\WINDOWS\system32\vpkbwurf.dll
2007-11-12 22:06 89,664 --a------ C:\WINDOWS\system32\wtuwlckd.dll
2007-11-12 22:04 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-12 21:26 144,480 --a------ C:\WINDOWS\system32\gqxqnebs.dll.vir
2007-11-12 21:25 144,480 --a------ C:\WINDOWS\system32\vfhbmpbj.dll
2007-11-12 21:22 81,472 --a------ C:\WINDOWS\system32\pmubjglu.dll
2007-11-12 21:20 <REP> d-------- C:\Program Files\Kioktkzo
2007-11-12 20:51 <REP> d-------- C:\Program Files\Trend Micro
2007-11-12 19:44 81,472 --a------ C:\WINDOWS\system32\jjsxlxfk.dll
2007-11-12 19:41 144,480 --a------ C:\WINDOWS\system32\bsukvomq.dll
2007-11-11 21:20 <REP> d-------- C:\Program Files\Rkbldmnn
2007-11-10 22:15 85,056 --a------ C:\WINDOWS\system32\xfijmybl.dll
2007-11-10 22:12 81,472 --a------ C:\WINDOWS\system32\rarcawfn.dll
2007-11-09 21:13 77,888 --a------ C:\WINDOWS\system32\lejhuotq.dll
2007-11-09 21:10 88,128 --a------ C:\WINDOWS\system32\gsesrcem.dll
2007-11-08 21:08 80,448 --a------ C:\WINDOWS\system32\hsfnrbvl.dll
2007-11-07 19:07 <REP> d-------- C:\Program Files\WowCartographe
2007-11-05 20:43 <REP> d-------- C:\Program Files\Ruvbbfhb
2007-11-05 13:34 83,008 --a------ C:\WINDOWS\system32\wmjnrrma.dll
2007-11-04 19:15 <REP> d-------- C:\WINDOWS\Sun
2007-11-04 18:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-04 16:13 <REP> d-------- C:\Program Files\CCleaner
2007-11-04 16:09 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Grisoft
2007-11-04 16:09 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-04 16:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-04 15:59 78,912 --a------ C:\WINDOWS\system32\xoklcvak.dll
2007-11-04 15:00 <REP> d-------- C:\Temp
2007-11-04 15:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2007-11-04 14:33 <REP> d-------- C:\Program Files\Java
2007-11-04 14:33 <REP> d-------- C:\Program Files\Fichiers communs\Java
2007-11-04 12:57 <REP> d-------- C:\WINDOWS\pss
2007-11-04 11:29 <REP> d-------- C:\Program Files\Lavasoft
2007-11-04 11:29 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-11-04 11:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-04 11:15 <REP> d-------- C:\Program Files\kxktshoz
2007-11-04 11:15 36,864 --a------ C:\WINDOWS\system32\gebawwu.dll
2007-11-04 11:15 0 --a------ C:\WINDOWS\system32\vvgeowbv.exe
2007-11-04 11:14 104,960 --a------ C:\WINDOWS\system32\drvfog.dll
2007-11-02 20:24 <REP> d-------- C:\Program Files\Microsoft Works
2007-11-02 20:23 <REP> d-------- C:\Program Files\MSBuild
2007-11-02 20:22 <REP> d-------- C:\Program Files\Microsoft.NET
2007-11-02 20:20 <REP> d-------- C:\Program Files\Microsoft Visual Studio 8
2007-11-02 20:19 <REP> d-------- C:\WINDOWS\SHELLNEW
2007-11-02 20:18 <REP> dr-h----- C:\MSOCache
2007-11-02 20:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-11-01 10:55 <REP> d-------- C:\Program Files\Shareaza
2007-11-01 10:55 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Shareaza
2007-10-31 17:07 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Apple Computer
2007-10-31 15:26 <REP> d-------- C:\Program Files\QuickTime
2007-10-31 15:26 <REP> d-------- C:\Program Files\Apple Software Update
2007-10-31 15:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-10-31 15:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-10-31 13:05 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2007-10-31 13:04 <REP> d-------- C:\Program Files\Adobe Photoshop CS3
2007-10-31 13:04 44,814,336 --a------ C:\Program Files\Photoshop.exe
2007-10-31 13:04 724,432 --a------ C:\Program Files\unins000.exe
2007-10-31 13:04 270,025 --a------ C:\Program Files\unins000.dat
2007-10-31 11:41 <REP> d-------- C:\Program Files\Dofus
2007-10-31 11:12 <REP> d-------- C:\Program Files\PhotoFiltre
2007-10-30 10:41 102,912 -ra------ C:\WINDOWS\system32\JPEGCODE.DLL
2007-10-29 19:22 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\OtakuSoftware
2007-10-19 20:51 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
2007-10-19 20:51 140,288 --a------ C:\WINDOWS\system32\CNMLM53.DLL
2007-10-19 20:51 90,112 --a------ C:\WINDOWS\system32\CNMCP53.exe
2007-10-19 20:51 8,704 --a------ C:\WINDOWS\system32\CNMVS53.DLL
2007-10-19 20:49 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-10-18 20:21 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2007-10-18 19:46 <REP> d-------- C:\Program Files\GOA
2007-10-18 18:22 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Electronic Arts
2007-10-17 17:29 <REP> d-------- C:\World of Warcraft
2007-10-17 17:14 <REP> d-------- C:\Program Files\GUILD WARS
2007-10-14 14:01 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2007-10-14 14:01 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2007-10-14 14:01 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2007-10-14 14:01 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2007-10-14 13:56 <REP> d-------- C:\Program Files\Ubisoft
2007-10-13 12:51 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-10-13 08:27 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-10-13 08:27 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2007-10-13 08:27 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2007-10-13 08:27 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2007-10-13 08:27 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2007-10-13 08:27 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2007-10-13 08:27 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 14:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2007-11-04 17:21 --------- d-----w C:\Program Files\Nod32
2007-10-31 10:32 --------- d-----w C:\Program Files\MSN Messenger
2007-10-31 10:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-10-30 09:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-17 16:29 --------- d-----w C:\Program Files\Fichiers communs\Blizzard Entertainment
2007-10-12 19:13 --------- d-----w C:\Program Files\DivX
2007-10-12 18:27 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Nero
2007-10-12 18:19 --------- d-----w C:\Program Files\Windows Live
2007-10-12 17:19 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Ahead
2007-10-12 16:37 --------- d-----w C:\Program Files\MSXML 6.0
2007-10-11 19:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2007-10-11 19:21 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2007-10-11 19:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2007-10-11 19:20 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\InstallShield
2007-10-11 05:37 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Logitech
2007-10-10 20:35 --------- d-----w C:\Program Files\Logitech
2007-10-10 20:34 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-10-10 20:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2007-10-10 20:21 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-10-10 16:02 --------- d-----w C:\Program Files\Fichiers communs\ODBC
2007-10-10 15:53 --------- d-----w C:\Program Files\DAEMON Tools
2007-10-10 15:51 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-10-10 15:26 --------- d-----w C:\Program Files\PowerQuest
2007-10-10 14:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Prism
2007-10-10 14:29 --------- d-----w C:\Program Files\802.11g USB2.0 Adapter
2007-10-10 14:29 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Xentient
2007-10-10 14:27 --------- d-----w C:\Program Files\TweakRAM
2007-10-10 14:22 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-10-10 14:18 --------- d-----w C:\Program Files\Symantec
2007-10-10 14:18 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2007-10-10 14:18 --------- d-----w C:\Documents and Settings\Default User\Application Data\Symantec
2007-10-10 14:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-10 14:18 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Symantec
2007-10-10 14:14 76,160 ----a-w C:\WINDOWS\system32\drivers\lnsfw1.sys
2007-10-10 14:14 502,368 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-10-10 14:14 46,208 ----a-w C:\WINDOWS\system32\drivers\lnsfw.sys
2007-10-10 14:14 36,924 ----a-w C:\WINDOWS\system32\fwapi.dll
2007-10-10 14:14 274,432 ----a-w C:\WINDOWS\system32\imon.dll
2007-10-10 14:14 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2007-10-10 14:13 --------- d-----w C:\Program Files\Executive Software
2007-10-10 14:08 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-08-22 02:09 352,256 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-08-22 02:07 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-08-22 02:07 268,800 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-08-22 01:59 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-08-22 01:59 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-08-22 01:58 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-08-22 01:58 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-08-22 01:57 487,424 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-08-22 01:56 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-08-22 01:48 8,306,688 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-08-22 01:47 3,091,392 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-08-22 01:35 1,586,816 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-08-22 01:21 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-08-22 01:19 266,240 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-08-22 01:17 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-08-22 01:15 172,032 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-08-22 01:11 450,560 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-08-21 06:17 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-16 15:17 51,568 ----a-w C:\WINDOWS\system32\sirenacm.dll
2006-10-08 23:18 145,920 ----a-w C:\WINDOWS\inf\hdaudio.sys
.

((((((((((((((((((((((((((((( snapshot@2007-11-12_22.24.11.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-13 16:05:45 4,138 ----a-w C:\WINDOWS\mozver.dat
+ 2007-11-13 13:51:22 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_6ec.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DiskeeperSystray"="C:\Program Files\Executive Software\Diskeeper\DkIcon.exe" [2005-07-26 16:52]
"nod32kui"="C:\Program Files\Nod32\nod32kui.exe" [2007-10-10 15:14]
"PRISMSTA.EXE"="Prismsta.exe" [2003-11-08 15:49 C:\WINDOWS\system32\PRISMSTA.exe]
"PRISMSVR.EXE"="Prismsvr.exe" [2003-11-20 14:12 C:\WINDOWS\system32\PRISMSVR.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-09 00:34 C:\WINDOWS\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-10-09 00:34 C:\WINDOWS\SkyTel.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 14:32 C:\WINDOWS\KHALMNPR.Exe]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" []
"MSConfig"="C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe" [2006-09-13 00:04]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [2005-08-12 19:52]
"VisualTaskTips"="C:\Windows\System32\VisualTaskTips.exe" [2006-07-05 03:23]
"TweakRAM"="C:\Program Files\TweakRAM\TweakRAM.exe" [2006-04-15 17:07]
"LClock"="C:\Program Files\LClock\lclock.exe" [2004-09-19 19:27]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:54]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-09-20 16:38]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" []
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 15:16]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide3"=cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe"
"VisualTaskTips"=C:\Windows\System32\VisualTaskTips.exe
"TweakRAM"=C:\Program Files\TweakRAM\TweakRAM.exe
"LClock"=C:\Program Files\LClock\lclock.exe

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-10-11 20:21:20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

R0 Si3112;Si3112;C:\WINDOWS\system32\drivers\Si3112.sys
R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys
R1 GhPciScan;GhostPciScanner;\??\C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys
R1 lnsfw1;lnsfw1;C:\WINDOWS\system32\drivers\lnsfw1.sys
R3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys
R3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService WebClient LmHosts upnphost SSDPSRV

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ec39af41-773c-11dc-9912-000000000000}]
\shell\AutoRun\command - F:\setupSNK.exe

*Newly Created Service* - RKPAVPROC
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-11-09 19:58:27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-13 18:19:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-13 18:21:28
C:\ComboFix2.txt ... 2007-11-13 14:53
C:\ComboFix3.txt ... 2007-11-13 13:40
.
--- E O F ---

Adeline02 · Answer

Grosse erreur de ma part voici celui que je viens de faire, je suis vraiment désolé

ComboFix 07-11-08.1 - Administrateur 2007-11-13 19:21:12.5 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.60 [GMT 1:00]Running from: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2007-10-13 to 2007-11-13 ))))))))))))))))))))))))))))))))))))
.

2007-11-13 18:07 <REP> d-------- C:\Program Files\Navilog1
2007-11-13 16:18 <REP> d-------- C:\WINDOWS\LastGood
2007-11-13 16:18 <REP> d-------- C:\Program Files\Panda Security
2007-11-13 14:27 <REP> d-------- C:\VundoFix Backups
2007-11-12 22:04 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-12 21:26 144,480 --a------ C:\WINDOWS\system32\gqxqnebs.dll.vir
2007-11-12 21:20 <REP> d-------- C:\Program Files\Kioktkzo
2007-11-12 20:51 <REP> d-------- C:\Program Files\Trend Micro
2007-11-07 19:07 <REP> d-------- C:\Program Files\WowCartographe
2007-11-04 19:15 <REP> d-------- C:\WINDOWS\Sun
2007-11-04 18:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-04 16:13 <REP> d-------- C:\Program Files\CCleaner
2007-11-04 16:09 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Grisoft
2007-11-04 16:09 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-04 16:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-04 15:59 78,912 --a------ C:\WINDOWS\system32\xoklcvak.dll
2007-11-04 15:00 <REP> d-------- C:\Temp
2007-11-04 15:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2007-11-04 14:33 <REP> d-------- C:\Program Files\Java
2007-11-04 14:33 <REP> d-------- C:\Program Files\Fichiers communs\Java
2007-11-04 12:57 <REP> d-------- C:\WINDOWS\pss
2007-11-04 11:29 <REP> d-------- C:\Program Files\Lavasoft
2007-11-04 11:29 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-11-04 11:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-04 11:15 36,864 --a------ C:\WINDOWS\system32\gebawwu.dll
2007-11-04 11:15 0 --a------ C:\WINDOWS\system32\vvgeowbv.exe
2007-11-04 11:14 104,960 --a------ C:\WINDOWS\system32\drvfog.dll
2007-11-02 20:24 <REP> d-------- C:\Program Files\Microsoft Works
2007-11-02 20:23 <REP> d-------- C:\Program Files\MSBuild
2007-11-02 20:22 <REP> d-------- C:\Program Files\Microsoft.NET
2007-11-02 20:20 <REP> d-------- C:\Program Files\Microsoft Visual Studio 8
2007-11-02 20:19 <REP> d-------- C:\WINDOWS\SHELLNEW
2007-11-02 20:18 <REP> dr-h----- C:\MSOCache
2007-11-02 20:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-11-01 10:55 <REP> d-------- C:\Program Files\Shareaza
2007-11-01 10:55 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Shareaza
2007-10-31 17:07 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Apple Computer
2007-10-31 15:26 <REP> d-------- C:\Program Files\QuickTime
2007-10-31 15:26 <REP> d-------- C:\Program Files\Apple Software Update
2007-10-31 15:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-10-31 15:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-10-31 13:05 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2007-10-31 13:04 <REP> d-------- C:\Program Files\Adobe Photoshop CS3
2007-10-31 13:04 44,814,336 --a------ C:\Program Files\Photoshop.exe
2007-10-31 13:04 724,432 --a------ C:\Program Files\unins000.exe
2007-10-31 13:04 270,025 --a------ C:\Program Files\unins000.dat
2007-10-31 11:41 <REP> d-------- C:\Program Files\Dofus
2007-10-31 11:12 <REP> d-------- C:\Program Files\PhotoFiltre
2007-10-30 10:41 102,912 -ra------ C:\WINDOWS\system32\JPEGCODE.DLL
2007-10-29 19:22 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\OtakuSoftware
2007-10-19 20:51 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
2007-10-19 20:51 140,288 --a------ C:\WINDOWS\system32\CNMLM53.DLL
2007-10-19 20:51 90,112 --a------ C:\WINDOWS\system32\CNMCP53.exe
2007-10-19 20:51 8,704 --a------ C:\WINDOWS\system32\CNMVS53.DLL
2007-10-19 20:49 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-10-18 20:21 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2007-10-18 19:46 <REP> d-------- C:\Program Files\GOA
2007-10-18 18:22 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Electronic Arts
2007-10-17 17:29 <REP> d-------- C:\World of Warcraft
2007-10-17 17:14 <REP> d-------- C:\Program Files\GUILD WARS
2007-10-14 14:01 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2007-10-14 14:01 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2007-10-14 14:01 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2007-10-14 14:01 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2007-10-14 13:56 <REP> d-------- C:\Program Files\Ubisoft
2007-10-13 12:51 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-10-13 08:27 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-10-13 08:27 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2007-10-13 08:27 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2007-10-13 08:27 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2007-10-13 08:27 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2007-10-13 08:27 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2007-10-13 08:27 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 14:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2007-11-04 17:21 --------- d-----w C:\Program Files\Nod32
2007-10-31 10:32 --------- d-----w C:\Program Files\MSN Messenger
2007-10-31 10:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-10-30 09:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-17 16:29 --------- d-----w C:\Program Files\Fichiers communs\Blizzard Entertainment
2007-10-12 19:13 --------- d-----w C:\Program Files\DivX
2007-10-12 18:27 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Nero
2007-10-12 18:19 --------- d-----w C:\Program Files\Windows Live
2007-10-12 17:19 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Ahead
2007-10-12 16:37 --------- d-----w C:\Program Files\MSXML 6.0
2007-10-11 19:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2007-10-11 19:21 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2007-10-11 19:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2007-10-11 19:20 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\InstallShield
2007-10-11 05:37 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Logitech
2007-10-10 20:35 --------- d-----w C:\Program Files\Logitech
2007-10-10 20:34 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-10-10 20:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2007-10-10 20:21 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-10-10 16:02 --------- d-----w C:\Program Files\Fichiers communs\ODBC
2007-10-10 15:53 --------- d-----w C:\Program Files\DAEMON Tools
2007-10-10 15:51 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-10-10 15:26 --------- d-----w C:\Program Files\PowerQuest
2007-10-10 14:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Prism
2007-10-10 14:29 --------- d-----w C:\Program Files\802.11g USB2.0 Adapter
2007-10-10 14:29 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Xentient
2007-10-10 14:27 --------- d-----w C:\Program Files\TweakRAM
2007-10-10 14:22 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-10-10 14:18 --------- d-----w C:\Program Files\Symantec
2007-10-10 14:18 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2007-10-10 14:18 --------- d-----w C:\Documents and Settings\Default User\Application Data\Symantec
2007-10-10 14:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-10 14:18 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Symantec
2007-10-10 14:14 76,160 ----a-w C:\WINDOWS\system32\drivers\lnsfw1.sys
2007-10-10 14:14 502,368 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-10-10 14:14 46,208 ----a-w C:\WINDOWS\system32\drivers\lnsfw.sys
2007-10-10 14:14 36,924 ----a-w C:\WINDOWS\system32\fwapi.dll
2007-10-10 14:14 274,432 ----a-w C:\WINDOWS\system32\imon.dll
2007-10-10 14:14 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2007-10-10 14:13 --------- d-----w C:\Program Files\Executive Software
2007-10-10 14:08 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-08-22 02:09 352,256 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-08-22 02:07 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-08-22 02:07 268,800 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-08-22 01:59 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-08-22 01:59 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-08-22 01:58 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-08-22 01:58 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-08-22 01:57 487,424 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-08-22 01:56 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-08-22 01:48 8,306,688 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-08-22 01:47 3,091,392 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-08-22 01:35 1,586,816 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-08-22 01:21 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-08-22 01:19 266,240 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-08-22 01:17 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-08-22 01:15 172,032 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-08-22 01:11 450,560 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-08-21 06:17 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-16 15:17 51,568 ----a-w C:\WINDOWS\system32\sirenacm.dll
2006-10-08 23:18 145,920 ----a-w C:\WINDOWS\inf\hdaudio.sys
.

((((((((((((((((((((((((((((( snapshot@2007-11-12_22.24.11.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-13 16:05:45 4,138 ----a-w C:\WINDOWS\mozver.dat
+ 2007-11-13 13:51:22 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_6ec.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DiskeeperSystray"="C:\Program Files\Executive Software\Diskeeper\DkIcon.exe" [2005-07-26 16:52]
"nod32kui"="C:\Program Files\Nod32\nod32kui.exe" [2007-10-10 15:14]
"PRISMSTA.EXE"="Prismsta.exe" [2003-11-08 15:49 C:\WINDOWS\system32\PRISMSTA.exe]
"PRISMSVR.EXE"="Prismsvr.exe" [2003-11-20 14:12 C:\WINDOWS\system32\PRISMSVR.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-09 00:34 C:\WINDOWS\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-10-09 00:34 C:\WINDOWS\SkyTel.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 14:32 C:\WINDOWS\KHALMNPR.Exe]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" []
"MSConfig"="C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe" [2006-09-13 00:04]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [2005-08-12 19:52]
"VisualTaskTips"="C:\Windows\System32\VisualTaskTips.exe" [2006-07-05 03:23]
"TweakRAM"="C:\Program Files\TweakRAM\TweakRAM.exe" [2006-04-15 17:07]
"LClock"="C:\Program Files\LClock\lclock.exe" [2004-09-19 19:27]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:54]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-09-20 16:38]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" []
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 15:16]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide3"=cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe"
"VisualTaskTips"=C:\Windows\System32\VisualTaskTips.exe
"TweakRAM"=C:\Program Files\TweakRAM\TweakRAM.exe
"LClock"=C:\Program Files\LClock\lclock.exe

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-10-11 20:21:20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

R0 Si3112;Si3112;C:\WINDOWS\system32\drivers\Si3112.sys
R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys
R1 GhPciScan;GhostPciScanner;\??\C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys
R1 lnsfw1;lnsfw1;C:\WINDOWS\system32\drivers\lnsfw1.sys
R3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys
R3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService WebClient LmHosts upnphost SSDPSRV

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ec39af41-773c-11dc-9912-000000000000}]
\shell\AutoRun\command - F:\setupSNK.exe

*Newly Created Service* - RKPAVPROC
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-11-09 19:58:27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-13 19:24:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-11-13 19:28:00
C:\ComboFix2.txt ... 2007-11-13 18:21
C:\ComboFix3.txt ... 2007-11-13 14:53
.
--- E O F ---

jlpjlp · Answer

encore ca a analyser sur virus total: 

https://www.virustotal.com/gui/

C:\WINDOWS\system32\xoklcvak.dll
C:\WINDOWS\system32\gebawwu.dll
C:\WINDOWS\system32\vvgeowbv.exe
C:\WINDOWS\system32\drvfog.dll 



si inféctés tu les vire avec killbox

_________________


dans DEMARRER puis PANNEAU DE CONFIGURATION puis AJOUT /SUPPRESSION DE PROGRAMME


cherche quelque chose comme CID et msn plus et desinstalle les 
si tu doit réinstaller msn plus fait le sans les sponsor surtout

___________________
en plus de nod 32:

1/
installe spywareblaster pour proteger ton ordi contre les infections vundo que tu avais (mettre a jour tous les mois)

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/28872.html


2/
installe aussi spybot

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html


3/
garde CCLEANER


4/
tu peux virer tout le reste que je t'ai fais mettre


______________________

recolle hijackthis pour voir, dis moi si tu as encore des problemes et dis moi lequels

je regarderai ton hijackthis mais ca devrait etre bon

je te felicite pour ta perseverance et ton efficacitée!!!

Adeline02 · Answer

Voila le dernier rapport :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:59, on 2007-11-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Nod32
od32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nod32
od32kui.exe
C:\WINDOWS\system32\Prismsta.exe
C:\WINDOWS\system32\Prismsvr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\UberIcon\UberIcon Manager.exe
C:\Windows\System32\VisualTaskTips.exe
C:\Program Files\TweakRAM\TweakRAM.exe
C:\Program Files\LClock\lclock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\WowCartographe\WowCartographe.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Administrateur\Bureau\spybotsd15.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-MFK8R.tmp\is-GJT1J.tmp
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Nod32
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [PRISMSTA.EXE] Prismsta.exe /START
O4 - HKLM\..\Run: [PRISMSVR.EXE] Prismsvr.exe /APPLY
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe /auto
O4 - HKLM\..\RunOnce: [MessengerPlusLiveUninstall] "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\MsgPlusUninstall.exe" /Cleanup
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKCU\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
O4 - HKCU\..\Run: [TweakRAM] C:\Program Files\TweakRAM\TweakRAM.exe
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [TweakRAM] C:\Program Files\TweakRAM\TweakRAM.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [LClock] C:\Program Files\LClock\lclock.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{662FA424-F11F-4016-A903-7A9AE2404143}: NameServer = 80.10.246.1,80.10.246.139
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Nod32
od32krn.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

jlpjlp · Answer

c'est bon! 



 msn plus est nefaste si tu l'installe avec les sponsors!

_______________




pour protéger ton ordi

http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

NOD 32 donc
-------------
des anti-espions:

 SPYBOT +  /-   avg antispyware en version gratuite

+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation  : il suffit de faire "update" pour mettre à jour tous les mois  et ensuite" enable all protection" pour immuniser)...


--------
un pare feu : celui de nod si c'est la suite avec parefeu ou sinon

celui de Windows ou mieux KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

-----------

CCLEANER pour effacer les traces de surf




bonne continuation

Aide pour trojan

27 réponses

Discussions similaires

Newsletters