Pb google search daily

Ah non. J'aime pas Vista lol !

FillPCA

ok
FillPCA
hasta la vista

Re,

Sois rassuré car il n'y a rien qui permet de t'identifer dans ce qui précède.

FillPCA

ok
merci pour tout.
y a t il des données confidentiel me concernant dans tous mes post?
si oui, peut on supprimer une partie ou tte la discusion.
a+

Re,

* Lance OTmoveIT.
* Clique sur CleanUp! (le programme va télécharger un fichier texte qui servira a nettoyer les programmes que l'on a téléchargés).

NOTE : Normalement, ton firewall (parefeu) devrait te demander si OTmoveIT peut accéder à internet, Autorise le.

* Une liste apparaît dans la partie gauche d'OTmoveIT.
* Un message apparaît pour confirmer le nettoyage. Confirme.
* Les fichiers infectés qui se trouvent dans les quarantaines seront supprimés aussi.

1/ Il est fortement recommandé d'avoir tous ses logiciels de sécurité à jour, afin d'éviter les failles par lesquelles s'engouffrent les infections.
2/ Tu peux supprimer tous les logiciels que nous avons utilisés (Type: SmitFraufix, Blacklight, SDFix, lopxpMH, ect.....) qui traitent des infections spécifiques et qui sont mis à jour régulièrement. Il est inutile de les garder sur ton PC.
Tu peux par contre, garder AVG Antispyware et CCleaner.
3/ /!\ Maintenant que ton PC n'est plus infecté, désactive puis réactive ta "Restauration du système" afin de créer un point de restauration sain.
Pour désactiver ou activer la Restauration du système, tu dois ouvrir une session Administrateur sous Windows XP.
Désactivation:
Cliquer droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > cocher la case "Désactiver la Restauration du système sur tous les lecteurs"
> Appliquer et Ok.
Activation:
Suivre le même chemin ; décocher la case "Désactiver la Restauration du système sur tous les lecteurs"
> Appliquer et Ok. Redémarrer l'ordinateur.
4/ Comment faire pour...(lettre A): https://forum.pcastuces.com/sujet.asp?f=25&s=3902
Pour améliorer la sécurité de ton PC prend quelques instants pour lire:
Sécuriser son PC +WIFI (versions "hot" & "light"): https://forum.pcastuces.com/default.asp
5/ Dénonce ton infection pour faire condamner les auteurs.

Crée un message pour faire avancer les choses sur Malware-Complaints, nous devons être les plus nombreux possibles, alors rends compte de ton infection :
- Voir les règles du forum : https://malwarecomplaints.info/
- Après t'être enregistré à l'aide du bouton en haut se nommant "Register"
Si tu as plus de 13 ans, choisir : "I Agree to these terms and am over or exactly 13 years of age"
Si tu as moins, clique sur : "I Agree to these terms and am under 13 years of age"

Tu as alors, sous forme de liste, un sujet par type d'infection (Look2Me, Smitfraud, SpywareQuake etc..).

*** Ton infection : Delf ***
>> https://malwarecomplaints.info/
Si le malware que tu as eu n'apparaît pas dans la liste, ou si tu ne sais pas par quoi tu étais infecté(e), crée un message dans le sujet Autres infections, conforme au règle du forum (âge, ville, département etc..)
Indique aussi le nom du Forum qui t'a aidé : CCM
6/ Tu peux marquer ton sujet comme résolu en cliquant sur le bouton.
7/ Je te conseille enfin de défragmenter ton PC : http://www.coupdepoucepc.com/modules/news/article.php?storyid=218

Bon surf !

FillPCA

lu c'est pas https://www.dailymotion.com/fr
mickael

slt

C:\WINDOWS\system32\bidisp.1 moved successfully.
C:\WINDOWS\system32\bidisp.3 moved successfully.

Created on 12/13/2007 19:48:52

a priori ça va

a+

Salut,

1/ Vide ta quarantaine Norton.
2/
* Double-clique sur OTMoveIt.exe pour lancer le programme,
* Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste List Of Files/Folders to be moved" :

C:\WINDOWS\system32\bidisp.1
C:\WINDOWS\system32\bidisp.3

* Clique sur MoveIt! pour lancer la suppression,
* Le résultat appraraîtra dans le cadre Results.
* Clique sur Exit pour fermer le programme.
* Poste le rapport qui est situé ici : C:\\\_OTMoveIt\MovedFiles
* Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

3/ Après avoir édité le rapport OTMoveIt, peux-tu me dire comment le pc se porte ? S'il n'y a plus de problèmes, on passe à la dernière étape.

FillPCA

slt

C:\WINDOWS\system32\bidisp.4 moved successfully.

Created on 12/11/2007 22:49:43

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, December 13, 2007 11:33:47 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 13/12/2007
Kaspersky Anti-Virus database records: 450941
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 66923
Number of viruses found: 5
Number of infected objects: 9
Number of suspicious objects: 0
Duration of the scan process: 01:55:44

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\CyberLink\TinyDB\CurEPGEpisode Object is locked skipped
C:\Documents and Settings\All Users\Application Data\CyberLink\TinyDB\EPGSignal Object is locked skipped
C:\Documents and Settings\All Users\Application Data\CyberLink\TinyDB\iEPGChInfo Object is locked skipped
C:\Documents and Settings\All Users\Application Data\CyberLink\TinyDB\RecEpisode Object is locked skipped
C:\Documents and Settings\All Users\Application Data\CyberLink\TinyDB\Schedule Object is locked skipped
C:\Documents and Settings\All Users\Application Data\CyberLink\TinyDB\Series Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-12-13_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\xavier\Application Data\Microsoft\Modèles\Normal.dot Object is locked skipped
C:\Documents and Settings\xavier\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\xavier\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\xavier\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\xavier\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\xavier\Local Settings\Historique\History.IE5\MSHist012007121320071214\index.dat Object is locked skipped
C:\Documents and Settings\xavier\Local Settings\Temp\hpodvd09.log Object is locked skipped
C:\Documents and Settings\xavier\Local Settings\Temp\~DF2D0D.tmp Object is locked skipped
C:\Documents and Settings\xavier\Local Settings\Temp\~DF7F54.tmp Object is locked skipped
C:\Documents and Settings\xavier\Local Settings\Temporary Internet Files\Content.IE5\4O1DR4L7\hotline[1].doc Object is locked skipped
C:\Documents and Settings\xavier\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\xavier\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\xavier\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SNDALRT.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SNDCON.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SNDDBG.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SNDFW.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SNDIDS.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SNDSYS.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SPPolicy.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SPStart.log Object is locked skipped
C:\Program Files\Fichiers communs\Symantec Shared\SPStop.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped
C:\Program Files\Norton AntiVirus\Quarantine\27996492.htm Infected: Exploit.HTML.IESlice.p skipped
C:\Program Files\Norton AntiVirus\Quarantine\28FB3023 Infected: Trojan-Proxy.Win32.Agent.tf skipped
C:\Program Files\Norton AntiVirus\Quarantine\28FB3023.exe Infected: Trojan-Proxy.Win32.Agent.tf skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\drivers\apxokquz.dat.vir Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{E0D981A6-D3FA-4FDB-808C-A5F4B8F4E83C}\RP13\A0006841.dll Infected: Trojan-Downloader.Win32.Delf.dbo skipped
C:\System Volume Information\_restore{E0D981A6-D3FA-4FDB-808C-A5F4B8F4E83C}\RP21\change.log Object is locked skipped
C:\System Volume Information\_restore{E0D981A6-D3FA-4FDB-808C-A5F4B8F4E83C}\RP3\A0000090.dll Infected: Trojan-Spy.Win32.BZub.btx skipped
C:\System Volume Information\_restore{E0D981A6-D3FA-4FDB-808C-A5F4B8F4E83C}\RP8\A0005641.dll Infected: Trojan.Win32.BHO.yr skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\bidisp.1 Infected: Trojan-Spy.Win32.BZub.btx skipped
C:\WINDOWS\system32\bidisp.3 Infected: Trojan.Win32.BHO.yr skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\bidisp.4 Infected: Trojan-Downloader.Win32.Delf.dbo skipped
D:\mesDocs xavier\texte\texte21°03°2007\sketchs\hotline.doc Object is locked skipped
D:\mesDocs xavier\texte\texte21°03°2007\sketchs\~WRL0016.tmp Object is locked skipped
D:\mesDocs xavier\texte\texte21°03°2007\sketchs\~WRL0561.tmp Object is locked skipped
D:\mesDocs xavier\texte\texte21°03°2007\sketchs\~WRL3114.tmp Object is locked skipped
D:\mesDocs xavier\texte\texte21°03°2007\sketchs\~WRL3849.tmp Object is locked skipped
D:\mesDocs xavier\texte\texte21°03°2007\sketchs\~WRL3897.tmp Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

Salut,

1/ * Télécharge OTMoveIt (de Old_Timer) sur ton bureau,
* Double-clique sur OTMoveIt.exe pour lancer le programme,
* Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste List Of Files/Folders to be moved" :

C:\WINDOWS\system32\bidisp.4

* Clique sur MoveIt! pour lancer la suppression,
* Le résultat appraraîtra dans le cadre Results.
* Clique sur Exit pour fermer le programme.
* Poste le rapport qui est situé ici : C:\\\_OTMoveIt\MovedFiles
* Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

2/ * Fais un scan en ligne en cliquant ici : http://assiste.com.free.fr/...
* Choisis Kaspersky.
* Tu dois réaliser le scan en utilisant Internet explorer. Une information apparait en haut, près de la barre d'état. Tu dois accepter et installer l'activeX proposé. La mise à jour de l'antivirus se lance.
* Réalise un scan complet du système.
* Sauvegarde le rapport en mode texte à l'issue du scan.

Edite le rapport OTMOveIt et le rapport Kaspersky.

FillPCA

slt

ComboFix 07-11-19.4C - xavier 2007-12-10 21:27:35.3 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.40 [GMT 1:00]
Running from: C:\Documents and Settings\xavier\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\xavier\Bureau\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\System32\tmp06C1E.FOT
C:\WINDOWS\System32\tmp0B31E.FOT
C:\WINDOWS\System32\tmp11A1E.FOT
C:\WINDOWS\System32\tmp2DD1E.FOT
C:\WINDOWS\System32\tmp7602E.FOT
C:\WINDOWS\System32\tmp8421E.FOT
C:\WINDOWS\System32\tmp8B71E.FOT
C:\WINDOWS\System32\tmpAD81E.FOT
C:\WINDOWS\System32\tmpD251E.FOT
C:\WINDOWS\System32\tmpD3B1E.FOT
C:\WINDOWS\System32\tmpD661E.FOT
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-10 to 2007-12-10 ))))))))))))))))))))))))))))))))))))
.

2007-12-09 14:11 <REP> d-------- C:\Documents and Settings\ami\Application Data\Grisoft
2007-12-09 13:38 <REP> d-------- C:\Documents and Settings\lucien\Application Data\Grisoft
2007-12-06 18:05 <REP> d-------- C:\SIERRA
2007-12-06 18:05 <REP> d-------- C:\Program Files\Sierra On-Line
2007-12-06 18:04 <REP> d-------- C:\Documents and Settings\soraya\WINDOWS
2007-12-06 13:23 <REP> d-------- C:\Documents and Settings\soraya\Application Data\Grisoft
2007-12-04 09:36 <REP> d-------- C:\Documents and Settings\xavier\Application Data\Grisoft
2007-12-04 09:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-04 09:36 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-26 22:36 3,098,624 --a------ C:\pca.exe
2007-11-26 16:30 2,936 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-26 16:29 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-11-26 16:29 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-11-26 16:23 <REP> d-------- C:\Program Files\Trend Micro
2007-11-26 08:48 100 --a------ C:\WINDOWS\start.reg
2007-11-26 08:47 <REP> d-------- C:\Documents and Settings\xavier\WINDOWS
2007-11-23 08:55 <REP> d-------- C:\WINDOWS\system32\LogFiles
2007-11-21 17:57 <REP> d---s---- C:\Documents and Settings\ami\UserData
2007-11-18 03:07 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-18 03:07 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-18 03:07 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-17 10:33 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-17 10:14 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-11-16 09:37 <REP> d-------- C:\Program Files\Nvu
2007-11-16 09:37 <REP> d-------- C:\Documents and Settings\xavier\Application Data\Nvu
2007-11-14 23:19 108,288 --a------ C:\WINDOWS\system32\bidisp.4
2007-11-14 23:19 102,400 --a------ C:\WINDOWS\system32\bidisp.3
2007-11-14 23:19 100,096 --a------ C:\WINDOWS\system32\bidisp.2
2007-11-14 23:19 94,720 --a------ C:\WINDOWS\system32\bidisp.1
2007-11-14 17:08 <REP> d-------- C:\Program Files\Radio Fr Solo
2007-11-13 14:34 <REP> d-------- C:\Documents and Settings\LocalService\Menu Démarrer
2007-11-13 14:23 <REP> d-------- C:\WINDOWS\provisioning
2007-11-13 14:23 <REP> d-------- C:\WINDOWS\peernet
2007-11-13 14:19 <REP> d-------- C:\WINDOWS\ServicePackFiles
2007-11-13 14:10 <REP> d-------- C:\WINDOWS\EHome
2007-11-10 18:31 188,960 --a------ C:\WINDOWS\system32\WINGDE.DLL
2007-11-10 18:31 92,208 --a------ C:\WINDOWS\system32\WING.DLL
2007-11-10 18:31 12,800 --a------ C:\WINDOWS\system32\WING32.DLL
2007-11-10 18:31 6,736 --a------ C:\WINDOWS\system32\WINGDIB.DRV
2007-11-10 18:31 5,024 --a------ C:\WINDOWS\system32\WINGPAL.WND
2007-11-10 18:30 <REP> d-------- C:\Program Files\Mindscape

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-09 12:29 --------- d-----w C:\Program Files\Norton Security Scan
2007-12-06 12:29 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2007-11-19 18:51 --------- d-----w C:\Program Files\CamStudio
2007-11-05 16:04 --------- d-----w C:\Program Files\GALLIMARD
2007-11-05 14:35 --------- d-----w C:\Documents and Settings\soraya\Application Data\The Hobbit
2007-11-03 19:40 --------- d-----w C:\Program Files\MSXML 4.0
2007-11-03 16:29 --------- d-----w C:\Documents and Settings\lucien\Application Data\vlc
2007-11-03 16:26 --------- d-----w C:\Documents and Settings\lucien\Application Data\The Hobbit
2007-11-03 16:25 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-03 16:14 --------- d-----w C:\Program Files\Sierra
2007-11-01 15:11 --------- d-----w C:\Documents and Settings\lucien\Application Data\Mindscape
2007-10-31 15:31 --------- d-----w C:\Documents and Settings\xavier\Application Data\Image Zone Express
2007-10-24 21:45 --------- d-----w C:\Program Files\CCleaner
2007-10-24 17:27 --------- d-----w C:\Program Files\Artoonix
2007-07-07 17:02 29,992 ----a-w C:\Documents and Settings\xavier\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2007-11-28_23.13.34.11 )))))))))))))))))))))))))))))))))))))))))
.
+ 1998-03-05 10:25:08 1,022,976 ----a-w C:\WINDOWS\system32\SierraNW.dll
+ 1998-03-05 10:34:14 231,936 ----a-w C:\WINDOWS\system32\SNWValid.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PMXInit"="C:\WINDOWS\system32\pmxinit.exe" [2001-09-04 00:00]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-02-21 15:29]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-04-19 13:20]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 09:54]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 19:33]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-04-26 06:06 C:\WINDOWS\KHALMNPR.Exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"PCMService"="C:\Program Files\CyberLink\PowerCinema\PCMService.exe" [2007-03-02 16:55]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2007-04-12 13:48:49]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-22 23:01:50]
EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2007-04-20 08:42:51]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 00:48:20]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-07-17 19:17:28]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 08:01:04]

R2 litsgt;litsgt;C:\WINDOWS\system32\DRIVERS\litsgt.sys
R2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"
R2 tansgt;tansgt;C:\WINDOWS\system32\DRIVERS\tansgt.sys
R3 MTD80X;100/10M Ethernet PCI Adapter;C:\WINDOWS\system32\DRIVERS\FEAND5.SYS
R3 powervr;powervr;C:\WINDOWS\system32\DRIVERS\powervr.sys

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-12-01 19:54:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-07 19:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Analyser mon ordinateur - xavier.job"
- C:\PROGRA~1\NORTON~1\Navw32.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-10 21:31:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-10 21:33:45
C:\ComboFix2.txt ... 2007-12-04 09:21
C:\ComboFix3.txt ... 2007-11-28 23:15
.
--- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:19:51, on 10/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [PMXInit] C:\WINDOWS\system32\pmxinit.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: DeliveryManager.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {127698E4-E730-4E5C-A2B1-21490A70C8A1} (CEnroll Class) - https://static.impots.gouv.fr/abos/securite/xenroll.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

Salut,

Oui, j'aurais bien aimé avoir le rapport Combofix (C:\ComboFix.txt), le rapport AVGantispyware et un rapport Hijackthis afin que je puisse juger si l'infection a été éradiquée.

Ce n'est pas parce que les symptômes n'existent plus que l'infection a disparu.

FillPCA

slt
comme j'ai fait le travail en plusieurs fois, j'ai paumé le fil de l'histoire ( et aussi les rapports) alors j'ai tout recommencé mais ça ne se passe plus dans l'ordre que tu décris: par exemple, à la fin du travail de combofix il n'y a pas eu : " Une nouvelle fenêtre avec invite "Submit Files for further analysis" s'ouvrira. Clique "OK" "
par contre, la bonne nouvelle c'est que je n'ai plus le probleme initial avec search daily.
faut il que je t'envoie quand meme un rapport de quelque chose pour vérifier si le probleme est vraiment résolu
merci
a+

Salut,

1/
* Sélectionne le texte suivant :

* Copie le texte sélectionné (CTRL+C).
* Ouvre le bloc-note (programme>Accessoire>bloc-note).
* Colle le texte copié dans ce bloc-note (CTRL+V).
* Sauvegarde ce fichier sous le nom de CFScript.txt
* Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe

http://www.commentcamarche.net/forum/affich-4151694-pb-google-search-daily#0

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82DFE033-7809-40C8-8F5D-C106DA99BACF}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D695308F-9EBD-469D-B0D3-AB5A11DD3EB9}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\shwol]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\bidisp]

Driver::
emkudujt
bfastfao

Collect::
C:\WINDOWS\shwol.dll
C:\WINDOWS\system32\bidisp.dll
C:\Windows\system32\drivers\apxokquz.dat

File::
C:\WINDOWS\System32\tmp7602E.FOT
C:\WINDOWS\System32\tmpD3B1E.FOT
C:\WINDOWS\System32\tmp2DD1E.FOT
C:\WINDOWS\System32\tmp06C1E.FOT
C:\WINDOWS\System32\tmpAD81E.FOT
C:\WINDOWS\System32\tmp8B71E.FOT
C:\WINDOWS\System32\tmp11A1E.FOT
C:\WINDOWS\System32\tmpD661E.FOT
C:\WINDOWS\System32\tmpD251E.FOT
C:\WINDOWS\System32\tmp0B31E.FOT
C:\WINDOWS\System32\tmp8421E.FOT

De plus, ComboFix créera ces fichiers sur ton Bureau :

* Un fichier zippé nommé Submit [Date Time].zip
* Un second fichier nommé - CF-Submit.htm

ComboFix peut exiger un redémarrage pour compléter son travail. Accepte.

Lorsque l'outil aura terminé, un rapport ComboFix.log apparaîtra à l'écran.

Une nouvelle fenêtre avec invite "Submit Files for further analysis" s'ouvrira. Clique "OK"

Ton navigateur se lancera automatiquement avec le fichier CF-Submit.htm et une fenêtre s'ouvrira :

* Clique sur le bouton "Browse"("Parcourir") et navigue vers le fichier
Submit [Date Time].zip qui est sur ton Bureau.
* Clique sur le fichier afin de le sélectionner.
* Soumets le fichier en cliquant "OK"

Lorsque cette opération sera complétée, tu peux supprimer ces deux fichiers qui se trouvent sur ton Bureau.

Prière de poster les deux rapports suivants dans ta prochaine réponse :

- Combofix.txt
- Un nouveau rapport HijackThis

2/ Télécharge Ccleaner Basic https://www.ccleaner.com/ccleaner/download

Ouvre Ccleaner, clique sur "lancer le nettoyage".

3/ Télécharge AVGantispyware : https://www.avg.com/en-ww/free-antivirus-download
Tu l'installes.
Lance AVG Anti-Spyware et clique sur le bouton Mise à jour. Patiente.

Clique sur le bouton Analyse (de la barre d'outils)
Puis sur l'onglets Comment réagir, clique sur Actions recommandées. Sélectionne Quarantaine.
Reviens à l'onglet Analyse. Clique sur Analyse complète du système.
A la fin du scan, choisis l'option " Appliquer toutes les actions " en bas. Ensuite.
Clique sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.

Edite aussi le rapport AVGantispyware.

FillPCA

slt

ComboFix 07-11-19.4C - 2007-11-28 21:45:25.1 - NTFSx86
Running from: C:\Documents and Settings\\Bureau\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-28 to 2007-11-28 ))))))))))))))))))))))))))))))))))))
.

2007-11-26 22:36 3,098,624 --a------ C:\pca.exe
2007-11-26 16:30 2,936 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-26 16:29 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-11-26 16:29 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-11-26 16:23 <REP> d-------- C:\Program Files\Trend Micro
2007-11-26 08:48 100 --a------ C:\WINDOWS\start.reg
2007-11-26 08:47 <REP> d-------- C:\Documents and Settings\\WINDOWS
2007-11-23 08:55 <REP> d-------- C:\WINDOWS\system32\LogFiles
2007-11-21 17:57 <REP> d---s---- C:\Documents and Settings\ami\UserData
2007-11-18 03:07 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-18 03:07 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-18 03:07 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-17 10:33 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-17 10:14 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-11-16 09:37 <REP> d-------- C:\Program Files\Nvu
2007-11-16 09:37 <REP> d-------- C:\Documents and Settings\\Application Data\Nvu
2007-11-14 23:20 18,688 C:\WINDOWS\system32\drivers\apxokquz.dat
2007-11-14 23:19 108,288 --a------ C:\WINDOWS\system32\bidisp.dll
2007-11-14 23:19 102,400 --a------ C:\WINDOWS\system32\bidisp.3
2007-11-14 23:19 100,096 --a------ C:\WINDOWS\system32\bidisp.2
2007-11-14 23:19 94,720 --a------ C:\WINDOWS\system32\bidisp.1
2007-11-14 17:08 <REP> d-------- C:\Program Files\Radio Fr Solo
2007-11-13 14:34 <REP> d-------- C:\Documents and Settings\LocalService\Menu D‚marrer
2007-11-13 14:23 <REP> d-------- C:\WINDOWS\provisioning
2007-11-13 14:23 <REP> d-------- C:\WINDOWS\peernet
2007-11-13 14:19 <REP> d-------- C:\WINDOWS\ServicePackFiles
2007-11-13 14:10 <REP> d-------- C:\WINDOWS\EHome
2007-11-10 18:31 188,960 --a------ C:\WINDOWS\system32\WINGDE.DLL
2007-11-10 18:31 92,208 --a------ C:\WINDOWS\system32\WING.DLL
2007-11-10 18:31 12,800 --a------ C:\WINDOWS\system32\WING32.DLL
2007-11-10 18:31 6,736 --a------ C:\WINDOWS\system32\WINGDIB.DRV
2007-11-10 18:31 5,024 --a------ C:\WINDOWS\system32\WINGPAL.WND
2007-11-10 18:30 <REP> d-------- C:\Program Files\Mindscape
2007-11-05 17:04 <REP> d-------- C:\Program Files\GALLIMARD
2007-11-05 17:04 41,024 --a------ C:\WINDOWS\system\Hudsonb2.ttf
2007-11-05 17:04 39,636 --a------ C:\WINDOWS\system\Hudson2.ttf
2007-11-05 17:04 2,128 --a------ C:\WINDOWS\system\Starz___.ttf
2007-11-05 15:35 <REP> d-------- C:\Documents and Settings\\Application Data\The Hobbit
2007-11-03 20:51 1,284,608 --a------ C:\WINDOWS\system32\ole32.dll
2007-11-03 20:51 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2007-11-03 20:51 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2007-11-03 20:51 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2007-11-03 20:51 101,376 --a------ C:\WINDOWS\system32\txflog.dll
2007-11-03 20:51 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2007-11-03 20:51 66,560 --a------ C:\WINDOWS\system32\mtxclu.dll
2007-11-03 20:50 40,960 -----c--- C:\WINDOWS\system32\dllcache\evtgprov.dll
2007-11-03 20:40 <REP> d-------- C:\Program Files\MSXML 4.0
2007-11-03 20:38 <REP> d--h-c--- C:\WINDOWS\$xpsp1hfm$
2007-11-03 20:38 26,112 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2007-11-03 18:46 27,136 --a------ C:\WINDOWS\shwol.dll
2007-11-03 17:29 <REP> d-------- C:\Documents and Settings\lucien\Application Data\vlc
2007-11-03 17:26 <REP> d-------- C:\Documents and Settings\lucien\Application Data\The Hobbit
2007-11-03 17:14 <REP> d-------- C:\Program Files\Sierra
2007-11-01 16:11 <REP> d-------- C:\Documents and Settings\lucien\Application Data\Mindscape

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-28 00:58 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2007-11-19 18:51 --------- d-----w C:\Program Files\CamStudio
2007-11-16 14:00 --------- d-----w C:\Program Files\Norton Security Scan
2007-11-03 16:25 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-31 15:31 --------- d-----w C:\Documents and Settings\\Application Data\Image Zone Express
2007-10-24 21:45 --------- d-----w C:\Program Files\CCleaner
2007-10-24 17:27 --------- d-----w C:\Program Files\Artoonix
2007-07-07 17:02 29,992 ----a-w C:\Documents and Settings\\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82DFE033-7809-40C8-8F5D-C106DA99BACF}]
2007-11-03 18:46 27136 --a------ C:\WINDOWS\shwol.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D695308F-9EBD-469D-B0D3-AB5A11DD3EB9}]
2004-08-20 00:09 108288 --a------ C:\WINDOWS\system32\bidisp.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PMXInit"="C:\WINDOWS\system32\pmxinit.exe" [2001-09-04 00:00]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-02-21 15:29]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-04-19 13:20]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 09:54]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" []
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-04-26 06:06 C:\WINDOWS\KHALMNPR.Exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"PCMService"="C:\Program Files\CyberLink\PowerCinema\PCMService.exe" [2007-03-02 16:55]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09]

R0 emkudujt;emkudujt;C:\WINDOWS\system32\drivers\apxokquz.dat
R2 litsgt;litsgt;C:\WINDOWS\system32\DRIVERS\litsgt.sys
R2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"
R2 tansgt;tansgt;C:\WINDOWS\system32\DRIVERS\tansgt.sys
R3 MTD80X;100/10M Ethernet PCI Adapter;C:\WINDOWS\system32\DRIVERS\FEAND5.SYS
R3 powervr;powervr;C:\WINDOWS\system32\DRIVERS\powervr.sys
S3 bfastfao;bfastfao;\??\C:\DOCUME~1\lucien\LOCALS~1\Temp\bfastfao.sys

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-11-24 19:54:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-23 21:40:57 C:\WINDOWS\Tasks\Norton AntiVirus - Analyser mon ordinateur - xavier.job"
- C:\PROGRA~1\NORTON~1\Navw32.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-28 23:12:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PMXPCI0]
"ImagePath"="\??\C:\WINDOWS\system32\Drivers\pmxpci.sys"
.
Completion time: 2007-11-28 23:15:50 - machine was rebooted
.
--- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:00:51, on 29/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {82DFE033-7809-40C8-8F5D-C106DA99BACF} - C:\WINDOWS\shwol.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: (no name) - {D695308F-9EBD-469D-B0D3-AB5A11DD3EB9} - C:\WINDOWS\system32\bidisp.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [PMXInit] C:\WINDOWS\system32\pmxinit.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: DeliveryManager.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {127698E4-E730-4E5C-A2B1-21490A70C8A1} (CEnroll Class) - https://static.impots.gouv.fr/abos/securite/xenroll.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

Salut,
OK. C'est du delf donc du solide.

* Télécharge combofix.exe (par sUBs) sur ton Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
* Double clique combofix.exe et suis les invites.
* Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

Edite aussi un nouveau rapport Hijackthis.

FillPCA

slt

bidisp.dll

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.11.28.0 2007.11.27 -
AntiVir 7.6.0.34 2007.11.27 TR/Spy.BZub.NGP.4
Authentium 4.93.8 2007.11.27 -
Avast 4.7.1074.0 2007.11.27 -
AVG 7.5.0.503 2007.11.27 Downloader.Generic6.WCF
BitDefender 7.2 2007.11.27 -
CAT-QuickHeal 9.00 2007.11.27 TrojanDownloader.Delf.dbo
ClamAV 0.91.2 2007.11.28 -
DrWeb 4.44.0.09170 2007.11.27 Trojan.DownLoader.37340
eSafe 7.0.15.0 2007.11.21 -
eTrust-Vet 31.3.5332 2007.11.27 -
Ewido 4.0 2007.11.27 Downloader.Delf.dbo
FileAdvisor 1 2007.11.28 -
Fortinet 3.14.0.0 2007.11.27 -
F-Prot 4.4.2.54 2007.11.27 -
F-Secure 6.70.13030.0 2007.11.28 Trojan-Downloader.Win32.Delf.dbo
Ikarus T3.1.1.12 2007.11.27 Trojan-Downloader.Win32.Agent.aww
Kaspersky 7.0.0.125 2007.11.28 Trojan-Downloader.Win32.Delf.dbo
McAfee 5172 2007.11.27 -
Microsoft 1.3007 2007.11.28 Trojan:Win32/Boaxxe.B
NOD32v2 2688 2007.11.28 probably a variant of Win32/Adware.BHO.NBI
Norman 5.80.02 2007.11.27 W32/Delf.BCCW
Panda 9.0.0.4 2007.11.26 Adware/AVSystemCare
Prevx1 V2 2007.11.28 -
Rising 20.20.12.00 2007.11.27 -
Sophos 4.23.0 2007.11.28 -
Sunbelt 2.2.907.0 2007.11.27 -
Symantec 10 2007.11.28 -
TheHacker 6.2.9.144 2007.11.28 Trojan/Downloader.Delf.dbo
VBA32 3.12.2.5 2007.11.27 -
VirusBuster 4.3.26:9 2007.11.27 -
Webwasher-Gateway 6.6.2 2007.11.27 Trojan.Spy.BZub.NGP.4
Information additionnelle
File size: 108288 bytes
MD5: d276a6f11d881b5bcd3d4936ca8a790c
SHA1: f84a20c096431724b4647ae060a065c4504ff084
packers: UPX
packers: UPX
packers: PE_Patch.UPX, UPX

Fichier hwpsgt.sys reçu le 2007.11.28 01:34:44 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.11.28.0 2007.11.27 -
AntiVir 7.6.0.34 2007.11.27 -
Authentium 4.93.8 2007.11.27 -
Avast 4.7.1074.0 2007.11.27 -
AVG 7.5.0.503 2007.11.27 -
BitDefender 7.2 2007.11.27 -
CAT-QuickHeal 9.00 2007.11.27 -
ClamAV 0.91.2 2007.11.28 -
DrWeb 4.44.0.09170 2007.11.27 -
eSafe 7.0.15.0 2007.11.21 -
eTrust-Vet 31.3.5332 2007.11.27 -
Ewido 4.0 2007.11.27 -
FileAdvisor 1 2007.11.28 -
Fortinet 3.14.0.0 2007.11.27 -
F-Prot 4.4.2.54 2007.11.27 -
F-Secure 6.70.13030.0 2007.11.28 -
Ikarus T3.1.1.12 2007.11.27 -
Kaspersky 7.0.0.125 2007.11.28 -
McAfee 5172 2007.11.27 -
Microsoft 1.3007 2007.11.28 -
NOD32v2 2688 2007.11.28 -
Norman 5.80.02 2007.11.27 -
Panda 9.0.0.4 2007.11.26 -
Prevx1 V2 2007.11.28 -
Rising 20.20.12.00 2007.11.27 -
Sophos 4.23.0 2007.11.28 -
Sunbelt 2.2.907.0 2007.11.27 -
Symantec 10 2007.11.28 -
TheHacker 6.2.9.144 2007.11.28 -
VBA32 3.12.2.5 2007.11.27 -
VirusBuster 4.3.26:9 2007.11.27 -
Webwasher-Gateway 6.6.2 2007.11.28 -
Information additionnelle
File size: 137344 bytes
MD5: a439ebd90afdb1f516c875b9b317832f
SHA1: 43f407ecdc0d87a3713126b757ccaad07ade285f

Fichier lemsgt.sys reçu le 2007.11.28 01:36:49 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.11.28.0 2007.11.27 -
AntiVir 7.6.0.34 2007.11.27 -
Authentium 4.93.8 2007.11.27 -
Avast 4.7.1074.0 2007.11.27 -
AVG 7.5.0.503 2007.11.27 -
BitDefender 7.2 2007.11.27 -
CAT-QuickHeal 9.00 2007.11.27 -
ClamAV 0.91.2 2007.11.28 -
DrWeb 4.44.0.09170 2007.11.27 -
eSafe 7.0.15.0 2007.11.21 -
eTrust-Vet 31.3.5332 2007.11.27 -
Ewido 4.0 2007.11.27 -
FileAdvisor 1 2007.11.28 -
Fortinet 3.14.0.0 2007.11.27 -
F-Prot 4.4.2.54 2007.11.27 -
F-Secure 6.70.13030.0 2007.11.28 -
Ikarus T3.1.1.12 2007.11.27 -
Kaspersky 7.0.0.125 2007.11.28 -
McAfee 5172 2007.11.27 -
Microsoft 1.3007 2007.11.28 -
NOD32v2 2688 2007.11.28 -
Norman 5.80.02 2007.11.27 -
Panda 9.0.0.4 2007.11.26 -
Prevx1 V2 2007.11.28 -
Rising 20.20.12.00 2007.11.27 -
Sophos 4.23.0 2007.11.28 -
Sunbelt 2.2.907.0 2007.11.27 -
Symantec 10 2007.11.28 -
TheHacker 6.2.9.144 2007.11.28 -
VBA32 3.12.2.5 2007.11.27 -
VirusBuster 4.3.26:9 2007.11.27 -
Webwasher-Gateway 6.6.2 2007.11.28 -
Information additionnelle
File size: 9472 bytes
MD5: 057da656166893842dd401c25a058c4e
SHA1: 548dd6359abbcc8c84ce346d078664eeedc716f7

Fichier litsgt.sys reçu le 2007.11.28 01:48:54 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.11.28.0 2007.11.27 -
AntiVir 7.6.0.34 2007.11.27 -
Authentium 4.93.8 2007.11.27 -
Avast 4.7.1074.0 2007.11.27 -
AVG 7.5.0.503 2007.11.27 -
BitDefender 7.2 2007.11.28 -
CAT-QuickHeal 9.00 2007.11.27 -
ClamAV 0.91.2 2007.11.28 -
DrWeb 4.44.0.09170 2007.11.27 -
eSafe 7.0.15.0 2007.11.21 -
eTrust-Vet 31.3.5332 2007.11.27 -
Ewido 4.0 2007.11.27 -
FileAdvisor 1 2007.11.28 -
Fortinet 3.14.0.0 2007.11.27 -
F-Prot 4.4.2.54 2007.11.27 -
F-Secure 6.70.13030.0 2007.11.28 -
Ikarus T3.1.1.12 2007.11.28 -
Kaspersky 7.0.0.125 2007.11.28 -
McAfee 5172 2007.11.27 -
Microsoft 1.3007 2007.11.28 -
NOD32v2 2688 2007.11.28 -
Norman 5.80.02 2007.11.27 -
Panda 9.0.0.4 2007.11.26 -
Prevx1 V2 2007.11.28 -
Rising 20.20.12.00 2007.11.27 -
Sophos 4.23.0 2007.11.28 -
Sunbelt 2.2.907.0 2007.11.27 -
Symantec 10 2007.11.28 -
TheHacker 6.2.9.144 2007.11.28 -
VBA32 3.12.2.5 2007.11.27 -
VirusBuster 4.3.26:9 2007.11.27 -
Webwasher-Gateway 6.6.2 2007.11.28 -
Information additionnelle
File size: 137344 bytes
MD5: 454b6c19c69ea71e83be967ab5444c55
SHA1: 698cf0eba5813fac5ae419f62a99e3dd8ed030b6

Re,

Je décroche pour ce soir.

A demain.

FillPCA

Re,

On va faire sans.
1/ * Ouvrir l'explorateur windows (Démarrer>programmes>Accessoires>Explorateur windows ou Démarrer>programmes>Explorateur windows).
* Cliquer sur outils>options des dossiers>affichage.
* Sélectionner :
o afficher les fichiers et dossiers cachés,
o décocher "masquer les extensions des fichiers dont le type est connu",
o décocher masquer les fichiers protégés du système d'exploitation (recommandé)".

* "appliquer" et "ok"

2/ * Peux-tu tester ceci : C:\WINDOWS\system32\bidisp.dll
* Clique sur ce lien : http://www.virustotal.com/en/indexf.html
* Clique sur parcourir et indique le chemin du fichier que j’ai désigné.
* Clique sur send. Au bout de quelques minutes, un rapport est généré. Poste-le dans ta prochaine réponse.

Recommence avec ceci :
C:\WINDOWS\system32\bidisp.dll
C:\Windows\System32\DRIVERS\hwpsgt.sys
C:\Windows\System32\DRIVERS\lemsgt.sys
C:\Windows\System32\DRIVERS\litsgt.sys

Edite ces 5 rapports.

FillPCA

OK VOICI étape 3 (j'avais mis PCA sur mon bureau, peut etre est ce l'explication du bug?)

[CODE]

2007-11-26,21:51:05

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed

Follow item(s) have been choosed:
All Boot Items (Including Registry, Startup Folders, Services and so on)
Browser Add-ons
Runing Processes (Including process model information)
File Associations
Winsock Provider
Autorun.Inf
HOSTS File
Process Privileges Scan

Boot Items
Registry
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<CTFMON.EXE><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PMXInit><C:\WINDOWS\system32\pmxinit.exe> [Imagination Technologies Ltd.]
<ccApp><"C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"> [(Verified)Symantec Corporation]
<Symantec NetDriver Monitor><C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer> [(Verified)Symantec Corporation]
<HP Software Update><C:\Program Files\HP\HP Software Update\HPWuSchd2.exe> [Hewlett-Packard Development Company, L.P.]
<QuickTime Task><"C:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.]
<Adobe Photo Downloader><"C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"> [Adobe Systems Incorporated]
<Logitech Hardware Abstraction Layer><KHALMNPR.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<NeroFilterCheck><C:\WINDOWS\system32\NeroCheck.exe> [Ahead Software Gmbh]
<PCMService><"C:\Program Files\CyberLink\PowerCinema\PCMService.exe"> [CyberLink Corp.]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<Carnet d'adresses 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]

==================================
Startup Folders
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk --> C:\PROGRA~1\FICHIE~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
[Adobe Reader Synchronizer]
<C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Synchronizer.lnk --> C:\PROGRA~1\Adobe\READER~1.0\Reader\ADOBEC~1.EXE []><N>
[EPSON Status Monitor 3 Environment Check 2]
<C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\EPSON Status Monitor 3 Environment Check 2.lnk --> C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [SEIKO EPSON CORPORATION]><N>
[HP Digital Imaging Monitor]
<C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk --> C:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe [Hewlett-Packard Development Company, L.P.]><N>
[Lancement rapide d'Adobe Reader]
<C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk --> C:\PROGRA~1\Adobe\READER~1.0\Reader\READER~1.EXE [Adobe Systems Incorporated]><N>
[Logitech SetPoint]
<C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech SetPoint.lnk --> C:\PROGRA~1\Logitech\SetPoint\KEM.exe [Logitech Inc.]><N>
[Microsoft Office]
<C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office10\OSA.EXE [Microsoft Corporation]><N>
[DeliveryManager]
<C:\Documents and Settings\xavier\Menu Démarrer\Programmes\Démarrage\DeliveryManager.lnk --> [N/A]><N>

==================================
Services
[Gestion d'applications / AppMgmt][Stopped/Manual Start]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[Symantec Event Manager / ccEvtMgr][Running/Auto Start]
<"C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Password Validation / ccPwdSvc][Stopped/Manual Start]
<"C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr][Running/Auto Start]
<"C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[CyberLink Background Capture Service (CBCS) / CLCapSvc][Running/Auto Start]
<"C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe"><>
[CyberLink Task Scheduler (CTS) / CLSched][Stopped/Auto Start]
<"C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe"><>
[Crypkey License / Crypkey License][Running/Auto Start]
<crypserv.exe><CrypKey (Canada) Ltd.>
[EPSON Printer Status Agent2 / EPSONStatusAgent2][Running/Auto Start]
<C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe><SEIKO EPSON CORPORATION>
[Google Updater Service / gusvc][Stopped/Manual Start]
<"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
[Accès du périphérique d'interface utilisateur / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[LiveUpdate / LiveUpdate][Stopped/Manual Start]
<"C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"><Symantec Corporation>
[Service Norton AntiVirus Auto-Protect / navapsvc][Running/Auto Start]
<"C:\Program Files\Norton AntiVirus\navapsvc.exe"><Symantec Corporation>
[Norton AntiVirus Firewall Monitor Service / NPFMntor][Running/Auto Start]
<C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe><Symantec Corporation>
[Planificateur LiveUpdate automatique / Planificateur LiveUpdate automatique][Running/Auto Start]
<"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"><Symantec Corporation>
[Pml Driver HPZ12 / Pml Driver HPZ12][Stopped/Auto Start]
<C:\WINDOWS\System32\HPZipm12.exe><HP>
[Cyberlink RichVideo Service(CRVS) / RichVideo][Running/Auto Start]
<"C:\Program Files\CyberLink\Shared Files\RichVideo.exe"><>
[SAVScan / SAVScan][Stopped/Manual Start]
<C:\Program Files\Norton AntiVirus\SAVScan.exe><Symantec Corporation>
[ScriptBlocking Service / SBService][Stopped/Auto Start]
<C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe><Symantec Corporation>
[Symantec Network Drivers Service / SNDSrvc][Running/Auto Start]
<C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe><Symantec Corporation>
[Symantec SPBBCSvc / SPBBCSvc][Running/Auto Start]
<C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe><Symantec Corporation>
[Symantec Core LC / Symantec Core LC][Running/Auto Start]
<C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe><Symantec Corporation>
[Ulead Burning Helper / UleadBurningHelper][Running/Auto Start]
<C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe><Ulead Systems, Inc.>

==================================
Drivers
[Service d'installation du pilote audio Intel(r) 82801 (WDM) / ac97intc][Running/Manual Start]
<system32\drivers\ac97intc.sys><Intel Corporation>
[bfastfao / bfastfao][Stopped/Manual Start]
<\??\C:\DOCUME~1\lucien\LOCALS~1\Temp\bfastfao.sys><N/A>
[emkudujt / emkudujt][Running/Boot Start]
<\SystemRoot\system32\drivers\apxokquz.dat><N/A>
[IEEE-1284.4 Driver HPZid412 / HPZid412][Stopped/Manual Start]
<System32\DRIVERS\HPZid412.sys><HP>
[Print Class Driver for IEEE-1284.4 HPZipr12 / HPZipr12][Stopped/Manual Start]
<System32\DRIVERS\HPZipr12.sys><HP>
[USB to IEEE-1284.4 Translation Driver HPZius12 / HPZius12][Stopped/Manual Start]
<System32\DRIVERS\HPZius12.sys><HP>
[hwpsgt / hwpsgt][Running/Auto Start]
<System32\DRIVERS\hwpsgt.sys><N/A>
[Sony Ericsson 750 driver (WDM) / k750bus][Stopped/Manual Start]
<System32\DRIVERS\k750bus.sys><MCCI>
[Sony Ericsson 750 USB WMC Modem Filter / k750mdfl][Stopped/Manual Start]
<System32\DRIVERS\k750mdfl.sys><MCCI>
[Sony Ericsson 750 USB WMC Modem Drivers / k750mdm][Stopped/Manual Start]
<System32\DRIVERS\k750mdm.sys><MCCI>
[Sony Ericsson 750 USB WMC Device Management Drivers / k750mgmt][Stopped/Manual Start]
<System32\DRIVERS\k750mgmt.sys><MCCI>
[Sony Ericsson 750 USB WMC OBEX Interface Drivers / k750obex][Stopped/Manual Start]
<System32\DRIVERS\k750obex.sys><MCCI>
[Logitech SetPoint PS/2 Mouse Filter Driver / L8042mou][Stopped/Manual Start]
<System32\Drivers\L8042mou.sys><Logitech, Inc.>
[lemsgt / lemsgt][Running/Auto Start]
<System32\DRIVERS\lemsgt.sys><N/A>
[Logitech SetPoint HID Mouse Filter Driver / LHidKe][Stopped/Manual Start]
<System32\DRIVERS\LHidKE.Sys><Logitech, Inc.>
[Logitech SetPoint USB Receiver device driver / LHidUsbK][Stopped/Manual Start]
<System32\Drivers\LHidUsbK.Sys><Logitech, Inc.>
[litsgt / litsgt][Running/Auto Start]
<System32\DRIVERS\litsgt.sys><N/A>
[Logitech SetPoint Mouse Filter Driver / LMouKE][Stopped/Manual Start]
<System32\Drivers\LMouKE.sys><Logitech, Inc.>
[100/10M Ethernet PCI Adapter / MTD80X][Running/Manual Start]
<System32\DRIVERS\FEAND5.SYS><Myson Technology Inc>
[NAVENG / NAVENG][Running/Manual Start]
<\??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20071121.002\NAVENG.Sys><Symantec Corporation>
[NAVEX15 / NAVEX15][Running/Manual Start]
<\??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20071121.002\NavEx15.Sys><Symantec Corporation>
[NetworkX / NetworkX][Running/System Start]
<\SystemRoot\system32\ckldrv.sys><N/A>
[Padus ASPI Shell / pfc][Running/Manual Start]
<system32\drivers\pfc.sys><Padus, Inc.>
[powervr / powervr][Running/Manual Start]
<System32\DRIVERS\powervr.sys><Imagination Technologies Ltd.>
[Pilote de liaison parallèle directe / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[SAVRT / SAVRT][Running/Manual Start]
<\??\C:\Program Files\Norton AntiVirus\SAVRT.SYS><Symantec Corporation>
[SAVRTPEL / SAVRTPEL][Running/System Start]
<\??\C:\Program Files\Norton AntiVirus\SAVRTPEL.SYS><Symantec Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[SPBBCDrv / SPBBCDrv][Running/System Start]
<\??\C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCDrv.sys><Symantec Corporation>
[SYMDNS / SYMDNS][Running/Manual Start]
<\SystemRoot\System32\Drivers\SYMDNS.SYS><Symantec Corporation>
[SymEvent / SymEvent][Running/Manual Start]
<\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[SYMFW / SYMFW][Running/Manual Start]
<\SystemRoot\System32\Drivers\SYMFW.SYS><Symantec Corporation>
[SYMIDS / SYMIDS][Running/Manual Start]
<\SystemRoot\System32\Drivers\SYMIDS.SYS><Symantec Corporation>
[SYMIDSCO / SYMIDSCO][Running/Manual Start]
<\??\C:\PROGRA~1\FICHIE~1\SYMANT~1\SymcData\IDS-DI~1\20071122.001\symidsco.sys><Symantec Corporation>
[symlcbrd / symlcbrd][Running/Auto Start]
<\??\C:\WINDOWS\System32\drivers\symlcbrd.sys><Symantec Corporation>
[SYMNDIS / SYMNDIS][Running/Manual Start]
<\SystemRoot\System32\Drivers\SYMNDIS.SYS><Symantec Corporation>
[SYMREDRV / SYMREDRV][Running/Manual Start]
<\SystemRoot\System32\Drivers\SYMREDRV.SYS><Symantec Corporation>
[SYMTDI / SYMTDI][Running/System Start]
<\SystemRoot\System32\Drivers\SYMTDI.SYS><Symantec Corporation>
[tansgt / tansgt][Running/Auto Start]
<System32\DRIVERS\tansgt.sys><N/A>

==================================
Browser Add-ons
[Aide pour le lien d'Adobe PDF Reader]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[]
{82DFE033-7809-40C8-8F5D-C106DA99BACF} <C:\WINDOWS\shwol.dll, N/A>
[Google Toolbar Helper]
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[Google Toolbar Notifier BHO]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
[CNavExtBho Class]
{BDF3E430-B101-42AD-A544-FADC6B084872} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[PDFCreator Toolbar Helper]
{C451C08A-EC37-45DF-AAAD-18B51AB5E837} <C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll, >
[]
{D695308F-9EBD-469D-B0D3-AB5A11DD3EB9} <C:\WINDOWS\system32\bidisp.dll, N/A>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Norton AntiVirus]
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[&Google]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[PDFCreator Toolbar]
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} <C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll, >
[CEnroll Class]
{127698E4-E730-4E5C-A2B1-21490A70C8A1} <C:\WINDOWS\System32\xenroll.dll, Microsoft Corporation>
[ChkDVDCtl Class]
{54823A9D-6BAE-11D5-B519-0050BA2413EB} <C:\WINDOWS\DOWNLO~1\ChkDVD.dll, >
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\System32\wuweb.dll, Microsoft Corporation>
[AdSignerLCContrl Class]
{B79A53C0-1DAC-4636-BACE-FD086A7A79BF} <C:\WINDOWS\Downloaded Program Files\AdSignerADP.dll, Dictao SA>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
[Aide pour le lien d'Adobe PDF Reader]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[&Google]
{2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[PDFCreator Toolbar]
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} <C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll, >
[Norton AntiVirus]
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[]
{82DFE033-7809-40C8-8F5D-C106DA99BACF} <C:\WINDOWS\shwol.dll, N/A>
[Google Toolbar Helper]
{AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[Google Toolbar Notifier BHO]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\System32\shdocvw.dll, N/A>
[CNavExtBho Class]
{BDF3E430-B101-42AD-A544-FADC6B084872} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[PDFCreator Toolbar Helper]
{C451C08A-EC37-45DF-AAAD-18B51AB5E837} <C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
[]
{D695308F-9EBD-469D-B0D3-AB5A11DD3EB9} <C:\WINDOWS\system32\bidisp.dll, N/A>
[E&xporter vers Microsoft Excel]
<res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>

==================================
Running Processes
[PID: 432 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 480 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 504 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 548 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 572 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 720 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 776 / SERVICE RÉSEAU][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 840 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\System32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[PID: 892 / SERVICE RÉSEAU][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1016 / SERVICE LOCAL][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1140 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\E_SL2352.DLL] [SEIKO EPSON CORPORATION, 2, 15, 0, 0]
[C:\WINDOWS\system32\HpTcpMon.dll] [Hewlett Packard, 6.01.00.009]
[C:\WINDOWS\system32\hpzjrd01.dll] [Hewlett Packard, 2.01.00.005]
[C:\WINDOWS\system32\HPTcpMUI.dll] [Microsoft Corporation, 6.01.00.009]
[C:\WINDOWS\system32\hptcpmib.dll] [Hewlett Packard, 6.01.00.009]
[C:\WINDOWS\system32\hpz3l054.dll] [Hewlett-Packard Company, 60.054.45.00]
[C:\WINDOWS\system32\pdfcmnnt.dll] [N/A, ]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\hpzpp054.dll] [Hewlett-Packard Corporation, 60.054.45.00]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\UNIDRVUI.DLL] [Microsoft Corporation, 5.2.3790.120 (srv03_qfe.031205-1652)]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\UNIDRV.DLL] [Microsoft Corporation, 5.2.3790.184 (srv03_qfe.040410-1236)]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\hpzst054.dll] [Hewlett-Packard Corporation, 60.054.44.00]
[PID: 1488 / SYSTEM][C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe] [, 5.00.2510]
[C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapEngine.dll] [, 5.00.2510]
[C:\Program Files\CyberLink\PowerCinema\Kernel\TV\PCMRRec4.dll] [CyberLink Corp., 4.01.3730]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvcps.dll] [N/A, ]
[PID: 1500 / SYSTEM][C:\WINDOWS\system32\crypserv.exe] [CrypKey (Canada) Ltd., 1, 0, 1, 2]
[PID: 1516 / SYSTEM][C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe] [SEIKO EPSON CORPORATION, 1, 2, 0, 0]
[C:\WINDOWS\system32\EBAPI2.DLL] [SEIKO EPSON CORPORATION, 1, 1, 0, 0]
[C:\Program Files\Fichiers communs\EPSON\EBAPI\EBPLPT.DLL] [SEIKO EPSON CORPORATION, 2, 14, 0, 0]
[PID: 1800 / SYSTEM][C:\Program Files\CyberLink\Shared Files\RichVideo.exe] [, 2.0.0705 ]
[PID: 204 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 348 / SYSTEM][C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe] [Ulead Systems, Inc., 1, 0, 0, 4]
[PID: 1968 / SERVICE LOCAL][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2600 / xavier][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Norton AntiVirus\NavShExt.dll] [Symantec Corporation, 11.0.16.2]
[C:\WINDOWS\system32\ATL71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Fichiers communs\Symantec Shared\ccL30.dll] [Symantec Corporation, 103.0.9.2]
[C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA] [Adobe Systems, Inc., 8.0.0.0]
[C:\WINDOWS\system32\tssoft32.acm] [DSP GROUP, INC., 1.01]
[C:\WINDOWS\system32\tsd32.dll] [, ]
[C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200]
[C:\WINDOWS\shwol.dll] [N/A, ]
[C:\WINDOWS\system32\bidisp.dll] [N/A, ]
[C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 8.0.0.0]
[PID: 2796 / xavier][C:\Program Files\HP\HP Software Update\HPWuSchd2.exe] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[PID: 2804 / xavier][C:\Program Files\QuickTime\qttask.exe] [Apple Computer, Inc., 7.1.5]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[PID: 2812 / xavier][C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe] [Adobe Systems Incorporated, 3.0.0.50878]
[C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdboot.dll] [Adobe Systems Incorporated, 3.0.0.50878]
[C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[PID: 2848 / xavier][C:\Program Files\CyberLink\PowerCinema\PCMService.exe] [CyberLink Corp., 5, 0, 0, 0]
[C:\Program Files\CyberLink\PowerCinema\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\CyberLink\PowerCinema\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\CyberLink\PowerCinema\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MFC71FRA.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\CyberLink\PowerCinema\Kernel\Common\CLRCEngine3.dll] [CyberLink Corp., 5.00.1326]
[C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapX.dll] [Cyberlink, 5.00.2510]
[C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLAuMixer.dll] [CyberLink Corp., 1.00.1128 ]
[C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSchMgr.dll] [, 5.00.2510]
[C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvcps.dll] [N/A, ]
[C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapEngine.dll] [, 5.00.2510]
[C:\Program Files\CyberLink\PowerCinema\Kernel\TV\PCMRRec4.dll] [CyberLink Corp., 4.01.3730]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLTinyDB.dll] [, 1.00.1219]
[C:\Program Files\CyberLink\PowerCinema\Kernel\DV\PCMDV_dvrecorder.dll] [CyberLink corporate, 3, 0, 3, 3]
[C:\Program Files\CyberLink\PowerCinema\Kernel\DV\PCMDV_dvinf.dll] [CyberLink, 3, 0, 9, 13]
[PID: 2956 / xavier][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[PID: 3036 / xavier][C:\Program Files\Messenger\msmsgs.exe] [Microsoft Corporation, 4.7.3001]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[PID: 3144 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3268 / xavier][C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpqcxm08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpquio08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpqtra08.rsc] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpqtao08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpotra08.dll] [Hewlett-Packard Development Company, L.P., 70.0.219.000]
[C:\Program Files\HP\Digital Imaging\bin\hpotra08.rsc] [Hewlett-Packard Development Company, L.P., 70.0.219.000]
[C:\Program Files\HP\Digital Imaging\bin\hpqcob08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpodio08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[C:\Program Files\HP\Digital Imaging\bin\hpotradd.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpqrif08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\Unload\hpnkhTA.dll] [Hewlett-Packard, 7.0.0.229]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\ATL71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MFC71FRA.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\HP\Digital Imaging\bin\hpqmif08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpodvd09.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpoddcomm09.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\WINDOWS\system32\hpzipr12.dll] [HP, 10, 1, 1, 5]
[C:\Program Files\HP\Digital Imaging\bin\hpqusg.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\WINDOWS\system32\hpzidr12.dll] [HP, 10, 1, 1, 5]
[C:\Program Files\HP\Digital Imaging\bin\hpocxi08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[PID: 3288 / xavier][C:\Program Files\Logitech\SetPoint\KEM.exe] [Logitech Inc., 2.11.459]
[C:\Program Files\Logitech\SetPoint\KHALAPI.DLL] [Logitech Inc., 2.11.459]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[C:\Program Files\Logitech\SetPoint\KEMUI.dll] [Logitech Inc., 2.11.459]
[C:\Program Files\Logitech\SetPoint\Macros\MacroBT.dll] [Logitech Inc., 2.11.459]
[C:\Program Files\Logitech\SetPoint\KEMHook.dll] [Logitech, Inc., 1.0]
[C:\Program Files\Logitech\SetPoint\Macros\MacroCore.dll] [Logitech Inc., 2.11.459]
[PID: 3448 / xavier][C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE] [Logitech Inc., 2.11.427]
[C:\Program Files\Logitech\SetPoint\KHALAPI.DLL] [Logitech Inc., 2.11.459]
[C:\Program Files\Logitech\SetPoint\KHALITCH.DLL] [Logitech Inc., 2.11.459]
[C:\Program Files\Logitech\SetPoint\KHALMW.DLL] [Logitech Inc., 2.11.459]
[C:\Program Files\Logitech\SetPoint\KHALHPP.DLL] [Logitech Inc., 2.11.459]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[PID: 4044 / xavier][C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpqmfc09.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpqtap08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[C:\Program Files\HP\Digital Imaging\bin\hpqcxm08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.rsc] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpqsti08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpqcob08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpqstp08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpodio08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpocxi08.dll] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\Program Files\HP\Digital Imaging\bin\hpqsem08.rsc] [Hewlett-Packard Development Company, L.P., 70.0.170.000]
[C:\WINDOWS\system32\hpzipr12.dll] [HP, 10, 1, 1, 5]
[C:\Program Files\HP\Digital Imaging\bin\crm\hpqcrmcm.dll] [Hewlett-Packard Company, 70.0.78.000]
[C:\Program Files\HP\Digital Imaging\bin\crm\xmlparse.dll] [, 1, 0, 0, 1]
[C:\Program Files\HP\Digital Imaging\bin\crm\xmltok.dll] [, 1, 0, 0, 1]
[C:\Program Files\HP\Digital Imaging\bin\dbghelp.dll] [Microsoft Corporation, 6.2.0013.1 (DbgBuild.030619-2209)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2508 / xavier][C:\WINDOWS\system32\ntvdm.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\Symantec\S32EVNT1.DLL] [Symantec Corporation, 11.6.8.1]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[PID: 176 / xavier][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[C:\Program Files\Fichiers communs\Symantec Shared\Script Blocking\scrauth.dll] [Symantec Corporation, 11.0.16.2]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Fichiers communs\Symantec Shared\Script Blocking\ScrBlock.dll] [Symantec Corporation, 11.0.16.2]
[C:\Program Files\Fichiers communs\Symantec Shared\ccL30.dll] [Symantec Corporation, 103.0.9.2]
[C:\Program Files\Fichiers communs\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 103.0.9.2]
[C:\WINDOWS\shwol.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1264 / xavier][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll] [, 3,0,0,0]
[C:\Program Files\Fichiers communs\Symantec Shared\Script Blocking\scrauth.dll] [Symantec Corporation, 11.0.16.2]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Fichiers communs\Symantec Shared\Script Blocking\ScrBlock.dll] [Symantec Corporation, 11.0.16.2]
[C:\Program Files\Fichiers communs\Symantec Shared\ccL30.dll] [Symantec Corporation, 103.0.9.2]
[C:\Program Files\Fichiers communs\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 103.0.9.2]
[C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200]
[C:\WINDOWS\shwol.dll] [N/A, ]
[c:\program files\google\googletoolbar1.dll] [Google Inc., 4, 0, 1601, 4978]
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164]
[PID: 560 / xavier][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll] [, 3,0,0,0]
[C:\Program Files\Fichiers communs\Symantec Shared\Script Blocking\scrauth.dll] [Symantec Corporation, 11.0.16.2]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Fichiers communs\Symantec Shared\Script Blocking\ScrBlock.dll] [Symantec Corporation, 11.0.16.2]
[C:\Program Files\Fichiers communs\Symantec Shared\ccL30.dll] [Symantec Corporation, 103.0.9.2]
[C:\Program Files\Fichiers communs\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 103.0.9.2]
[C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200]
[C:\WINDOWS\shwol.dll] [N/A, ]
[c:\program files\google\googletoolbar1.dll] [Google Inc., 4, 0, 1601, 4978]
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164]
[C:\Program Files\Norton AntiVirus\NavShExt.dll] [Symantec Corporation, 11.0.16.2]
[C:\WINDOWS\system32\ATL71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\bidisp.dll] [N/A, ]
[C:\Program Files\Microsoft Office\Office10\msohev.dll] [Microsoft Corporation, 10.0.2609]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx] [Adobe Systems, Inc., 9,0,47,0]
[C:\WINDOWS\system32\xpsp3res.dll] [Microsoft Corporation, 5.1.2600.3243 (xpsp_sp2_gdr.071029-1246)]
[C:\WINDOWS\system32\Macromed\Common\SwSupport.dll] [Adobe Systems, Inc., 10.2r22]
[C:\Program Files\QuickTime\QTPlugin.ocx] [Apple Computer, Inc., 7.1.5]
[PID: 1588 / xavier][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll] [, 3,0,0,0]
[C:\Program Files\Fichiers communs\Symantec Shared\Script Blocking\scrauth.dll] [Symantec Corporation, 11.0.16.2]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Fichiers communs\Symantec Shared\Script Blocking\ScrBlock.dll] [Symantec Corporation, 11.0.16.2]
[C:\Program Files\Fichiers communs\Symantec Shared\ccL30.dll] [Symantec Corporation, 103.0.9.2]
[C:\Program Files\Fichiers communs\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 103.0.9.2]
[C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200]
[C:\WINDOWS\shwol.dll] [N/A, ]
[c:\program files\google\googletoolbar1.dll] [Google Inc., 4, 0, 1601, 4978]
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164]
[C:\Program Files\Norton AntiVirus\NavShExt.dll] [Symantec Corporation, 11.0.16.2]
[C:\WINDOWS\system32\ATL71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\bidisp.dll] [N/A, ]
[C:\Program Files\Microsoft Office\Office10\msohev.dll] [Microsoft Corporation, 10.0.2609]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx] [Adobe Systems, Inc., 9,0,47,0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\UNIDRVUI.DLL] [Microsoft Corporation, 5.2.3790.120 (srv03_qfe.031205-1652)]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\UNIDRV.DLL] [Microsoft Corporation, 5.2.3790.184 (srv03_qfe.040410-1236)]
[C:\WINDOWS\system32\Macromed\Common\SwSupport.dll] [Adobe Systems, Inc., 10.2r22]
[C:\WINDOWS\system32\xpsp3res.dll] [Microsoft Corporation, 5.1.2600.3243 (xpsp_sp2_gdr.071029-1246)]
[C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA] [Adobe Systems, Inc., 8.0.0.0]
[PID: 2116 / xavier][C:\WINDOWS\system32\cmd.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3692 / xavier][C:\WINDOWS\system32\ntvdm.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\Symantec\S32EVNT1.DLL] [Symantec Corporation, 11.6.8.1]
[PID: 2544 / xavier][C:\WINDOWS\system32\freecell.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[PID: 1188 / xavier][C:\WINDOWS\system32\NOTEPAD.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[PID: 2124 / xavier][C:\Documents and Settings\xavier\Bureau\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\Program Files\Logitech\SetPoint\lgscroll.dll] [N/A, ]
[C:\Documents and Settings\xavier\Bureau\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]

==================================
File Associations
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG Error. [Regedit.Document]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock Provider
N/A

==================================
Autorun.Inf
N/A

==================================
HOSTS File
127.0.0.1 localhost

==================================
Process Privileges Scan
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1488, C:\PROGRAM FILES\CYBERLINK\POWERCINEMA\KERNEL\TV\CLCAPSVC.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 2796, C:\PROGRAM FILES\HP\HP SOFTWARE UPDATE\HPWUSCHD2.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 2804, C:\PROGRAM FILES\QUICKTIME\QTTASK.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 2812, C:\PROGRAM FILES\ADOBE\PHOTOSHOP ALBUM EDITION DÉCOUVERTE\3.0\APPS\APDPROXY.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 2848, C:\PROGRAM FILES\CYBERLINK\POWERCINEMA\PCMSERVICE.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3288, C:\PROGRAM FILES\LOGITECH\SETPOINT\KEM.EXE]

==================================
API HOOK
N/A

==================================
Hidden Process
N/A

==================================

[/CODE]