Posez votre question Format imprimable Liste des forums Aidez-les Statistiques Rechercher Charte Forum Virus-Sécurité

Trojan-virus MSIVX

Dernière réponse le 21 jun 2009 à 23:30:47 jean-charles, le 18 jun 2009 à 18:20:31

Signaler ce message aux modérateurs

Bonjour,
Voici le topo : j'ai un virus que Nod32 et Malarewarebytes me détecte mais ne parvienne pas à supprimer.

Son action : redirection google; interdiction de certains sites (ceux d'antivirius et certains forums) ; empêche d'utiliser certains programme antirus et anti trojan (Hijackthis, malawarebytes, spybot, mise à jour adware ...).

Mon action : J'ai réussi à faire fonctionner hijakthis en le renommant à l'intallation et en modifiant certains paramètres, pareil pour malarebytes.

Nod 32 et Malaware bytes détecte un trojan/virus appelé MSIVX count mais ne parvienne pas à le supprimer même en mode sans échec ou au redémarrage.

voici les rapports de Hijackthis puis celui de Malarebytes

Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:50:26, on 2009-06-18
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Soft4Ever\looknstop\_looknstop.exe
C:\Program Files\UberIcon\UberIcon Manager.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Documents and Settings\Hola\Bureau\9.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Documents and Settings\Hola\Bureau\contre attaque\contre-attaque.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = XP Ultimate Edition 3.0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\RunOnce: [CleanUp!] C:\Program Files\CleanUp!\Cleanup.exe /WindowsRestart
O4 - HKUS\S-1-5-19\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,I (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_08] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_09] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_04] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
End of file - 5859 bytes

Malawarebytes :

Malwarebytes' Anti-Malware 1.38
Version de la base de données: 2297
Windows 5.1.2600 Service Pack 3

2009-06-17 18:39:53
mbam-log-2009-06-17 (18-39-53).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 130620
Temps écoulé: 38 minute(s), 55 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 4

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
\\?\globalroot\systemroot\system32\MSIVXplstkrpfeenxtnirqpkcsscedfcampkr.dll (Spyware.Agent) -> Delete on reboot.

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
\\?\globalroot\systemroot\system32\MSIVXplstkrpfeenxtnirqpkcsscedfcampkr.dll (Spyware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\rundll32.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\rundll.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\MSIVXcount (Trojan.Agent) -> Delete on reboot.

Configuration: Windows XP sp3
Firefox 3

Meilleures réponses pour « Trojan virus MSIVX » dans :

[Trojan-Virus] Vundo-gen et Agent-HZR (Résolu) Voir

Virus heur trojan.generic (Résolu) Voir

Differences entre virus,trojan et vers Voir

Virus et Malwares ... Le truc pour les éliminer Voir

Virus Win32:Trojan-gen. {Other} Voir

Infecté par backdoor.Trojan (Résolu) Voir

Virus trojan -Downloader et plus (Résolu) Voir

Posez votre question Répondre

Destrio5, le 18 jun 2009 à 18:26:18

Bonjour,

/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\

--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix

Répondre à Destrio5

jean-charles, le 21 jun 2009 à 14:29:08

Voici la le log de combofix :

ComboFix 09-06-20.02 - Administrateur 21/06/2009 7:49.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.894.687 [GMT -4:00]
Lancé depuis: c:\documents and settings\Hola\Bureau\contre.exe
AV: NOD32 Antivirus System 2.51 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Look 'n' Stop 2.05p2 (Soft4Ever) *enabled* {2A530F53-4A99-4EE0-8471-4A00BA4A47B0}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-1387277286-5703448151-961713424-9132
c:\recycler\S-1-5-21-1387277286-5703448151-961713424-9132\Desktop.ini
c:\windows\system32\drivers\MSIVXwtyevbrntoyddxodldoyojdxbiynadmr.sys
c:\windows\system32\MSIVXcount
c:\windows\system32\MSIVXlqwafgcainpdnljubufgrkmlajcgipev.dll
c:\windows\system32\MSIVXplstkrpfeenxtnirqpkcsscedfcampkr.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MSIVXserv.sys

((((((((((((((((((((((((((((( Fichiers créés du 2009-05-21 au 2009-06-21 ))))))))))))))))))))))))))))))))))))
.

2009-06-21 11:36 . 2009-06-21 11:36 -------- d-sh--w- c:\documents and settings\Administrateur.741117707EAE430\IETldCache
2009-06-19 20:50 . 2009-06-19 20:50 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-06-19 20:50 . 2009-06-19 20:50 -------- d-sh--w- c:\documents and settings\Hola\IETldCache
2009-06-18 21:53 . 2009-04-30 21:16 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-18 21:53 . 2009-04-30 21:16 1985024 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-06-18 21:53 . 2009-04-30 21:16 11064832 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-06-18 21:53 . 2009-04-30 21:16 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-18 21:53 . 2009-06-18 21:53 -------- d-----w- c:\windows\ie8updates
2009-06-18 21:53 . 2009-05-12 05:11 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-18 21:52 . 2009-06-18 21:52 -------- dc-h--w- c:\windows\ie8
2009-06-18 12:45 . 2009-06-18 12:45 -------- d-----w- c:\documents and settings\Administrateur.741117707EAE430\Application Data\Malwarebytes
2009-06-18 11:34 . 2008-10-16 18:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-06-17 21:59 . 2009-06-18 12:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-17 21:59 . 2009-06-17 22:03 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-17 21:38 . 2009-06-17 21:38 -------- d-----w- c:\program files\CCleaner
2009-06-17 21:31 . 2009-06-17 21:31 -------- d-----w- c:\program files\CleanUp!
2009-06-17 21:24 . 2009-06-17 21:24 -------- d-----w- c:\documents and settings\Hola\Application Data\Malwarebytes
2009-06-17 21:17 . 2009-06-17 22:02 -------- d-----w- c:\program files\Panda Security
2009-06-17 19:43 . 2009-06-17 19:43 -------- d-----w- c:\documents and settings\NetworkService\Bureau
2009-06-17 19:27 . 2009-06-17 15:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 19:27 . 2009-06-17 21:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-17 19:27 . 2009-06-17 19:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-17 19:27 . 2009-06-17 15:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-17 19:25 . 2009-06-17 19:25 -------- d-----w- c:\program files\Trend Micro
2009-06-17 18:54 . 2009-06-17 18:54 -------- d-----w- c:\documents and settings\Hola\Local Settings\Application Data\Adobe
2009-06-17 13:51 . 2009-06-17 13:51 0 ----a-w- c:\windows\nsreg.dat
2009-06-17 13:51 . 2009-06-17 13:51 -------- d-----w- c:\documents and settings\Hola\Local Settings\Application Data\Mozilla
2009-06-17 13:44 . 2009-06-17 18:51 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-06-17 13:43 . 1998-10-07 17:08 327168 ----a-w- c:\windows\IsUn040c.exe
2009-06-16 22:51 . 2009-06-17 21:54 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-06-16 22:30 . 2009-06-16 22:30 -------- d-----w- c:\documents and settings\LocalService\Bureau
2009-06-16 20:06 . 2009-06-17 21:54 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-16 20:04 . 2009-06-16 20:04 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-16 20:04 . 2009-03-12 08:17 2902048 -c--a-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
2009-06-16 20:04 . 2009-06-16 20:04 -------- d-----w- c:\program files\Lavasoft
2009-06-16 20:04 . 2009-06-16 20:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-06-16 18:48 . 2009-06-19 20:49 -------- d-----w- c:\windows\system32\fr-fr
2009-06-16 18:47 . 2009-06-16 18:48 -------- d-----w- c:\windows\l2schemas
2009-06-16 18:47 . 2009-06-16 18:47 -------- d-----w- c:\windows\system32\bits
2009-06-16 18:43 . 2009-06-16 18:50 -------- d-----w- c:\windows\ServicePackFiles
2009-06-16 18:38 . 2009-06-16 18:38 -------- d-----w- c:\documents and settings\Hola\Application Data\Lavasoft
2009-06-16 18:27 . 2009-06-16 18:27 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-06-16 18:27 . 2009-06-16 18:27 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2009-06-16 18:27 . 2009-06-16 18:27 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-06-16 18:25 . 2009-06-16 18:25 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-06-16 18:25 . 2009-06-16 18:29 -------- d-----w- c:\documents and settings\Hola\Application Data\DAEMON Tools Lite
2009-06-16 18:21 . 2009-06-16 18:21 -------- d-----w- c:\program files\Microsoft Works
2009-06-16 18:21 . 2009-06-16 18:21 -------- d-----w- c:\program files\Microsoft.NET
2009-06-16 18:19 . 2009-06-16 18:19 -------- d-----w- c:\documents and settings\Hola\Local Settings\Application Data\Microsoft Help
2009-06-16 18:19 . 2009-06-18 21:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-06-16 18:19 . 2009-06-16 18:19 -------- d--h--r- C:\MSOCache
2009-06-16 18:14 . 2009-06-16 18:14 -------- d-----w- c:\documents and settings\Hola\Application Data\Ahead
2009-06-16 17:52 . 2009-06-16 19:52 20880 ----a-w- c:\documents and settings\Hola\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-16 16:30 . 2004-08-03 19:41 13776 ------w- c:\windows\system32\drivers\recagent.sys
2009-06-16 16:29 . 2008-04-14 02:33 61440 ------w- c:\windows\system32\kmsvc.dll
2009-06-16 16:23 . 2001-08-17 17:19 36992 ----a-w- c:\windows\system32\drivers\aztw2320.sys
2009-06-16 16:13 . 2009-06-16 16:13 -------- d-----w- c:\windows\OPTIONS
2009-06-16 10:05 . 2009-06-16 10:05 -------- d-----w- c:\program files\DIFX
2009-06-16 10:05 . 2009-06-17 21:56 -------- dc----w- c:\windows\system32\DRVSTORE
2009-06-16 10:03 . 2009-06-16 10:03 10134 ----a-r- c:\documents and settings\Hola\Application Data\Microsoft\Installer\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}\ARPPRODUCTICON.exe
2009-06-16 10:03 . 2009-06-16 10:03 -------- d-----w- c:\program files\HP
2009-06-16 10:03 . 2009-06-16 10:03 -------- d-----w- c:\windows\Downloaded Installations
2009-06-16 10:02 . 2008-06-14 17:33 272768 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-06-16 10:02 . 2008-06-14 17:33 272768 ------w- c:\windows\system32\drivers\bthport.sys
2009-06-16 10:00 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2009-06-16 10:00 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-06-16 10:00 . 2008-06-10 05:07 2376760 -c----w- c:\windows\system32\dllcache\WMVCore.dll
2009-06-16 10:00 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2009-06-16 10:00 . 2008-05-01 14:36 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2009-06-16 09:59 . 2008-04-11 19:05 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2009-06-16 09:59 . 2008-12-16 12:31 354304 -c----w- c:\windows\system32\dllcache\winhttp.dll
2009-06-16 09:59 . 2008-10-03 10:03 247326 -c----w- c:\windows\system32\dllcache\strmdll.dll
2009-06-16 09:59 . 2008-10-15 16:35 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2009-06-16 09:59 . 2008-09-04 17:16 1106944 -c----w- c:\windows\system32\dllcache\msxml3.dll
2009-06-16 09:59 . 2008-04-21 21:15 219136 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-06-16 09:56 . 2009-06-16 09:56 1915520 ----a-w- c:\documents and settings\Hola\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-06-16 09:56 . 2009-06-16 09:56 -------- d-s---w- c:\documents and settings\Hola\UserData
2009-06-15 16:31 . 2009-06-16 10:06 1294200 ----a-w- c:\windows\system32\drivers\BCMWL5.SYS
2009-06-15 16:31 . 2009-06-15 16:30 87328 ----a-w- c:\windows\system32\bcmwlcoi.dll
2009-06-15 16:31 . 2009-06-15 16:31 -------- d-----w- c:\program files\Broadcom
2009-06-15 16:31 . 2009-06-15 16:31 -------- d-----w- c:\documents and settings\Hola\Application Data\InstallShield
2009-06-15 16:29 . 2009-06-15 16:30 -------- d-----w- c:\program files\ATI Technologies
2009-06-15 16:28 . 2009-06-16 16:31 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-15 16:28 . 2009-06-16 09:55 -------- d-----w- c:\program files\HPQ
2009-06-15 16:28 . 2009-06-15 16:29 -------- d-----w- c:\program files\Fichiers communs\InstallShield

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-21 11:53 . 2001-08-28 12:00 469840 ----a-w- c:\windows\system32\perfh00C.dat
2009-06-21 11:53 . 2001-08-28 12:00 76272 ----a-w- c:\windows\system32\perfc00C.dat
2009-06-16 18:59 . 2009-06-15 11:24 86331 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-16 18:52 . 2009-06-16 16:31 -------- d-----w- c:\program files\CONEXANT
2009-06-16 18:30 . 2009-06-15 11:30 -------- d-----w- c:\program files\Eset
2009-06-15 11:40 . 2009-06-15 11:40 127 ----a-w- c:\documents and settings\Hola\Local Settings\Application Data\fusioncache.dat
2009-06-15 11:39 . 2009-06-15 11:39 -------- d-----w- c:\program files\JDoe Tools
2009-06-15 11:30 . 2009-06-15 11:30 -------- d-----w- c:\program files\microsoft frontpage
2009-06-15 11:30 . 2009-06-15 11:30 502368 ----a-w- c:\windows\system32\drivers\amon.sys
2009-06-15 11:30 . 2009-06-15 11:30 274432 ----a-w- c:\windows\system32\imon.dll
2009-06-15 11:29 . 2009-06-15 11:29 -------- d-----w- c:\program files\Fichiers communs\Ahead
2009-06-15 11:28 . 2009-06-15 11:28 76160 ----a-w- c:\windows\system32\drivers\lnsfw1.sys
2009-06-15 11:28 . 2009-06-15 11:28 46208 ----a-w- c:\windows\system32\drivers\lnsfw.sys
2009-06-15 11:28 . 2009-06-15 11:28 36924 ----a-w- c:\windows\system32\fwapi.dll
2009-06-15 11:28 . 2009-06-15 11:28 -------- d-----w- c:\program files\Real Alternative
2009-06-15 11:28 . 2009-06-15 11:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-06-15 11:28 . 2009-06-15 11:28 -------- d-----w- c:\program files\QuickTime Alternative
2009-06-15 11:28 . 2009-06-15 11:28 -------- d-----w- c:\program files\Media Player Classic
2009-06-15 11:28 . 2009-06-15 11:28 2678 ----a-w- c:\windows\java\Packages\Data\2G4G0RXZ.DAT
2009-06-15 11:28 . 2009-06-15 11:28 2678 ----a-w- c:\windows\java\Packages\Data\C4NT7BBR.DAT
2009-06-15 11:28 . 2009-06-15 11:28 2678 ----a-w- c:\windows\java\Packages\Data\C17ZVLJV.DAT
2009-06-15 11:28 . 2009-06-15 11:28 2678 ----a-w- c:\windows\java\Packages\Data\TV3XBP7P.DAT
2009-06-15 11:28 . 2009-06-15 11:28 2678 ----a-w- c:\windows\java\Packages\Data\1V57DR5J.DAT
2009-06-15 11:26 . 2009-06-15 11:26 -------- d-----w- c:\program files\Windows Media Connect 2
2009-06-15 11:24 . 2009-06-15 11:24 -------- d-----w- c:\program files\Services en ligne
2009-06-15 11:22 . 2009-06-15 11:22 21892 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-13 05:04 . 2006-05-23 09:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:33 . 2006-04-15 19:59 348672 ----a-w- c:\windows\system32\localspl.dll
2009-04-19 19:50 . 2006-03-25 11:11 1847296 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:53 . 2006-03-25 11:13 585216 ----a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UberIcon"="c:\program files\UberIcon\UberIcon Manager.exe" [2005-08-12 180224]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"nlpo_04"="md %USERPROFILE%\Local Settings\Temp" [X]
"nlpo_07"="move" [X]
"nlpo_05"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]
"nlpo_06"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]
"nlpo_08"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]
"nlpo_09"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Look 'n' Stop"="c:\program files\Soft4Ever\looknstop\looknstop.exe" [2006-03-27 25474]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-06-15 921600]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-12-01 344064]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-17 518488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"UberIcon"="c:\program files\UberIcon\UberIcon Manager.exe" [2005-08-12 180224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [16/06/2009 16:06 64160]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 15:06 1003344]
S1 lnsfw1;lnsfw1;c:\windows\system32\drivers\lnsfw1.sys [15/06/2009 07:28 76160]
S3 azt2320;Pilote audio Aztech 2320 (WDM);c:\windows\system32\drivers\aztw2320.sys [16/06/2009 12:23 36992]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-06-16 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 21:54]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr
mStart Page = hxxp://www.google.fr
LSP: c:\windows\system32\imon.dll
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-21 07:57
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(252)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2009-06-21 8:01
ComboFix-quarantined-files.txt 2009-06-21 12:00

Avant-CF: 46 388 723 712 octets libres
Après-CF: 46 378 340 352 octets libres

205 --- E O F --- 2009-06-18 21:54

Répondre à jean-charles

Destrio5, le 21 jun 2009 à 16:06:58

--> Menu Démarrer > Exécuter > Tape combofix /u et valide.

--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)

--> Clique sur Continue à l'écran Disclaimer.

--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : les rapports sont sauvegardés dans le dossier C:\rsit.

Répondre à Destrio5

jean-charles, le 21 jun 2009 à 17:24:44

Voici les rapports :

INFO

info.txt logfile of random's system information tool 1.06 2009-06-21 11:09:26

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware-->"C:\Documents and Settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->C:\Documents and Settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Photoshop Elements 2.0-->C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\Adobe\Photoshop Elements 2\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop Elements 2\Uninst.dll"
Adobe Reader 9.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
CAB Tool-->rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\CABTOOL.INF,DefaultUninstall
Carte réseau local sans fil 802.11 Broadcom-->"C:\Program Files\Broadcom\Broadcom 802.11\Driver\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Broadcom\Broadcom 802.11\Driver"
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CleanUp!-->C:\Program Files\CleanUp!\uninstall.exe
Conexant AC-Link Audio-->C:\Program Files\CONEXANT\CNXT_AUDIO\UIU32a.exe -U -ICPL309BA.INF
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
DAEMON Tools Toolbar-->C:\Program Files\DAEMON Tools Toolbar\uninst.exe
HijackThis 2.0.2-->"C:\Documents and Settings\Hola\Bureau\contre attaque\HijackThis.exe" /uninstall
HP Product Detection-->MsiExec.exe /X{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}
K-Lite Codec Pack 2.72 Basic-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Look 'n' Stop 2.05p2-->"C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -uninst
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall WORD /dll OSETUP.DLL
Microsoft Office Word 2007-->MsiExec.exe /X{90120000-001B-0000-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs-->MsiExec.exe /X{90120000-00B2-0409-0000-0000000FF1CE}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB969897)-->"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969897)-->"C:\WINDOWS\$NtUninstallKB969897$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB971180)-->"C:\WINDOWS\ie8updates\KB971180-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Mozilla Firefox (3.0.11)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Nero 7.2.0.3-->"C:\Program Files\Nero\unins000.exe"
NOD32 Antivirus System-->C:\Program Files\Eset\Setup\setup.exe /UNINSTALL
NOD32 FiX v2.1-->"C:\Program Files\Eset\unins000.exe"
Panneau de contrôle ATI-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
QuickTime Alternative 1.69-->"C:\Program Files\QuickTime Alternative\unins000.exe"
Real Alternative 1.48-->"C:\Program Files\Real Alternative\unins000.exe"
REALTEK Gigabit and Fast Ethernet NIC Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94FB906A-CF42-4128-A509-D353026A607E}\Setup.exe" -l0xc0c REMOVE
SmartAudio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AEF7A12C-CD9B-4773-8AD1-6916138CA7EA}\setup.exe" -l0x40c -removeonly
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
Windows Driver Package - Intel (NETw4x32) net (03/13/2008 11.5.1.15)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u C:\WINDOWS\system32\DRVSTORE\netw4x32_21C0199BF50662EE493A66C790D8938F76DE5E41\netw4x32.inf
Windows Driver Package - Intel (w29n51) net (12/19/2007 9.0.4.39)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u C:\WINDOWS\system32\DRVSTORE\w29n51_AEF466EE116FDF742A02BFF75E6143DB4A91003C\w29n51.inf
Windows Driver Package - Intel net (03/13/2008 11.5.1.15)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u C:\WINDOWS\system32\DRVSTORE\netw4k32_C857013C12E9C9273689AE0C204C2E76D45D888E\netw4k32.inf
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

Hosts File Missing
======Security center information======

AV: NOD32 Antivirus System 2.51
FW: Look 'n' Stop 2.05p2 (Soft4Ever)

======System event log======

Computer Name: 741117707EAE430
Event Code: 20
Message: Le pilote d'imprimante Microsoft Shared Fax Driver pour Windows NT x86 Version-3 a été ajouté ou mis à jour. Fichiers :- FXSDRV.DLL, FXSUI.DLL, FXSUI.DLL, FXSWZRD.DLL, FXSTIFF.DLL, FXSRES.DLL, FXSAPI.DLL.

Record Number: 5
Source Name: Print
Time Written: 20090615072139.000000-240
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: 741117707EAE430
Event Code: 3260
Message: Cet ordinateur a correctement été joint au workgroup 'MSHOME'.

Record Number: 4
Source Name: Workstation
Time Written: 20090615072044.000000-240
Event Type: Informations
User:

Computer Name: 741117707EAE430
Event Code: 6011
Message: Le nom NetBIOS et le nom de l'hôte DNS de cet ordinateur ont été modifiés de MACHINENAME vers 741117707EAE430.

Record Number: 3
Source Name: EventLog
Time Written: 20090615072011.000000-240
Event Type: Informations
User:

Computer Name: MACHINENAME
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 2
Source Name: EventLog
Time Written: 20090615091341.000000-240
Event Type: Informations
User:

Computer Name: MACHINENAME
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Uniprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20090615091341.000000-240
Event Type: Informations
User:

=====Application event log=====

Computer Name: 741117707EAE430
Event Code: 1000
Message: Les compteurs de performances pour le service fax (fax) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 5
Source Name: LoadPerf
Time Written: 20090615072138.000000-240
Event Type: Informations
User:

Computer Name: 741117707EAE430
Event Code: 1000
Message: Les compteurs de performances pour le service TermService (Services Terminal Server) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 4
Source Name: LoadPerf
Time Written: 20090615072138.000000-240
Event Type: Informations
User:

Computer Name: 741117707EAE430
Event Code: 1000
Message: Les compteurs de performances pour le service RemoteAccess (Routage et accès distant) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 3
Source Name: LoadPerf
Time Written: 20090615072041.000000-240
Event Type: Informations
User:

Computer Name: 741117707EAE430
Event Code: 1000
Message: Les compteurs de performances pour le service PSched (PSched) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 2
Source Name: LoadPerf
Time Written: 20090615072027.000000-240
Event Type: Informations
User:

Computer Name: 741117707EAE430
Event Code: 1000
Message: Les compteurs de performances pour le service RSVP (QoS RSVP) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 1
Source Name: LoadPerf
Time Written: 20090615072017.000000-240
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\ATI Technologies\ATI Control Panel
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 36 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=2402
"NUMBER_OF_PROCESSORS"=1
"TEMP"=%USERPROFILE%\Local Settings\Temp
"TMP"=%USERPROFILE%\Local Settings\Temp
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

-----------------EOF-----------------

LOG
Logfile of random's system information tool 1.06 (written by random/random)
Run by Hola at 2009-06-21 11:21:46
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 44 GB (57%) free of 76 GB
Total RAM: 894 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:21:46, on 2009-06-21
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\UberIcon\UberIcon Manager.exe
C:\Program Files\Soft4Ever\looknstop\_looknstop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Eset\nod32kui.exe
C:\Documents and Settings\Hola\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Hola.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = XP Ultimate Edition 3.0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,I (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_08] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_09] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-18\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
End of file - 5464 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Look 'n' Stop"=C:\Program Files\Soft4Ever\looknstop\looknstop.exe [2006-03-27 25474]
"nod32kui"=C:\Program Files\Eset\nod32kui.exe [2009-06-15 921600]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-12-01 344064]
"Ad-Watch"=C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe [2009-06-17 518488]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"UberIcon"=C:\Program Files\UberIcon\UberIcon Manager.exe [2005-08-12 180224]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"ccleaner"=C:\Program Files\CCleaner\CCleaner.exe [2009-05-27 1573104]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
C:\WINDOWS\SOUNDMAN.EXE [2006-05-22 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-12-01 47104]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 3 months======

2009-06-21 11:15:17 ----A---- C:\WINDOWS\system32\CF6581.exe
2009-06-21 11:09:17 ----D---- C:\rsit
2009-06-21 09:15:18 ----D---- C:\Program Files\MSECache
2009-06-21 08:11:03 ----SHD---- C:\RECYCLER
2009-06-21 08:01:54 ----D---- C:\WINDOWS\temp
2009-06-21 08:01:51 ----A---- C:\ComboFix.txt
2009-06-21 07:38:44 ----SD---- C:\contre
2009-06-20 22:06:14 ----D---- C:\WINDOWS\ERDNT
2009-06-18 17:54:15 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-06-18 17:53:22 ----D---- C:\WINDOWS\ie8updates
2009-06-18 17:53:10 ----D---- C:\WINDOWS\WBEM
2009-06-18 17:52:12 ----HDC---- C:\WINDOWS\ie8
2009-06-18 17:50:42 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-06-18 07:34:30 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2009-06-18 07:34:29 ----A---- C:\WINDOWS\system32\mucltui.dll
2009-06-17 17:59:30 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-06-17 17:59:30 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-17 17:38:48 ----D---- C:\Program Files\CCleaner
2009-06-17 17:31:44 ----D---- C:\Program Files\CleanUp!
2009-06-17 17:24:27 ----D---- C:\Documents and Settings\Hola\Application Data\Malwarebytes
2009-06-17 17:17:39 ----D---- C:\Program Files\Panda Security
2009-06-17 15:27:26 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-06-17 15:27:26 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-06-17 15:25:01 ----D---- C:\Program Files\Trend Micro
2009-06-17 14:51:31 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-06-17 09:51:14 ----D---- C:\Documents and Settings\Hola\Application Data\Mozilla
2009-06-17 09:51:04 ----D---- C:\Program Files\Mozilla Firefox
2009-06-17 09:44:49 ----D---- C:\Program Files\Fichiers communs\Adobe
2009-06-17 09:44:45 ----D---- C:\Program Files\Adobe
2009-06-17 09:43:31 ----A---- C:\WINDOWS\IsUn040c.exe
2009-06-16 18:51:46 ----A---- C:\WINDOWS\system32\lsdelete.exe
2009-06-16 16:04:21 ----HDC---- C:\Documents and Settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-16 16:04:11 ----D---- C:\Program Files\Lavasoft
2009-06-16 16:04:11 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2009-06-16 16:02:17 ----D---- C:\WINDOWS\pss
2009-06-16 15:18:48 ----D---- C:\WINDOWS\system32\appmgmt
2009-06-16 15:13:05 ----D---- C:\WINDOWS\Prefetch
2009-06-16 15:10:33 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-06-16 15:10:15 ----HDC---- C:\WINDOWS\$NtUninstallKB969897$
2009-06-16 15:10:03 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-06-16 15:09:47 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-06-16 15:09:29 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-06-16 15:09:21 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2009-06-16 15:09:00 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-06-16 15:08:45 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-06-16 15:08:33 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-06-16 15:08:26 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-06-16 15:08:16 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-06-16 15:08:07 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-06-16 15:08:00 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-06-16 15:07:45 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-06-16 15:07:15 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-06-16 15:06:51 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-06-16 15:06:37 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-06-16 15:06:26 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-06-16 15:06:15 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-06-16 15:06:01 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-06-16 15:05:43 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-06-16 15:05:27 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-06-16 15:05:17 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-06-16 15:05:04 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-06-16 15:04:53 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-06-16 15:04:43 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-06-16 15:04:32 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-06-16 15:04:18 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-06-16 14:48:26 ----D---- C:\WINDOWS\system32\fr-fr
2009-06-16 14:48:04 ----D---- C:\Program Files\msn
2009-06-16 14:47:59 ----D---- C:\WINDOWS\l2schemas
2009-06-16 14:47:55 ----D---- C:\WINDOWS\system32\bits
2009-06-16 14:46:47 ----A---- C:\WINDOWS\system32\config.bak
2009-06-16 14:46:47 ----A---- C:\WINDOWS\system32\autoexec.bak
2009-06-16 14:43:47 ----D---- C:\WINDOWS\ServicePackFiles
2009-06-16 14:42:02 ----D---- C:\WINDOWS\network diagnostic
2009-06-16 14:38:53 ----D---- C:\Documents and Settings\Hola\Application Data\Lavasoft
2009-06-16 14:36:43 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-06-16 14:27:56 ----D---- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
2009-06-16 14:27:35 ----D---- C:\Program Files\DAEMON Tools Toolbar
2009-06-16 14:27:21 ----D---- C:\Program Files\DAEMON Tools Lite
2009-06-16 14:25:43 ----D---- C:\Documents and Settings\Hola\Application Data\DAEMON Tools Lite
2009-06-16 14:21:25 ----D---- C:\Program Files\Microsoft Works
2009-06-16 14:21:13 ----D---- C:\Program Files\Fichiers communs\DESIGNER
2009-06-16 14:21:00 ----D---- C:\Program Files\Microsoft.NET
2009-06-16 14:19:27 ----D---- C:\Program Files\Microsoft Office
2009-06-16 14:19:27 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-06-16 14:19:06 ----RHD---- C:\MSOCache
2009-06-16 14:14:35 ----D---- C:\Documents and Settings\Hola\Application Data\Ahead
2009-06-16 14:08:01 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
2009-06-16 14:07:55 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
2009-06-16 14:07:46 ----HDC---- C:\WINDOWS\$NtUninstallKB959426_0$
2009-06-16 14:07:39 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$
2009-06-16 14:07:31 ----HDC---- C:\WINDOWS\$NtUninstallKB961373_0$
2009-06-16 14:07:22 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$
2009-06-16 14:07:13 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2009-06-16 14:06:55 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
2009-06-16 14:06:47 ----HDC---- C:\WINDOWS\$NtUninstallKB960225_0$
2009-06-16 14:06:11 ----HDC---- C:\WINDOWS\$NtUninstallKB956572_0$
2009-06-16 14:06:00 ----HDC---- C:\WINDOWS\$NtUninstallKB961501_0$
2009-06-16 14:05:41 ----HDC---- C:\WINDOWS\$NtUninstallKB969897_0$
2009-06-16 14:05:31 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2_0$
2009-06-16 14:05:24 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-06-16 14:05:08 ----HDC---- C:\WINDOWS\$NtUninstallKB952004_0$
2009-06-16 14:04:47 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$
2009-06-16 14:03:47 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2009-06-16 14:03:30 ----HDC---- C:\WINDOWS\$NtUninstallKB950762_0$
2009-06-16 14:03:22 ----HDC---- C:\WINDOWS\$NtUninstallKB957097_0$
2009-06-16 14:03:14 ----HDC---- C:\WINDOWS\$NtUninstallKB923689$
2009-06-16 14:02:58 ----HDC---- C:\WINDOWS\$NtUninstallKB958687_0$
2009-06-16 14:02:51 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
2009-06-16 14:02:18 ----HDC---- C:\WINDOWS\$NtUninstallKB967715_0$
2009-06-16 14:02:07 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
2009-06-16 14:02:01 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
2009-06-16 14:01:50 ----HDC---- C:\WINDOWS\$NtUninstallKB951748_0$
2009-06-16 14:01:41 ----HDC---- C:\WINDOWS\$NtUninstallKB970238_0$
2009-06-16 14:01:32 ----HDC---- C:\WINDOWS\$NtUninstallKB960803_0$
2009-06-16 14:01:23 ----HDC---- C:\WINDOWS\$NtUninstallKB968537_0$
2009-06-16 14:01:16 ----HDC---- C:\WINDOWS\$NtUninstallKB954600_0$
2009-06-16 14:01:09 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2009-06-16 14:01:01 ----HDC---- C:\WINDOWS\$NtUninstallKB955069_0$
2009-06-16 14:00:54 ----HDC---- C:\WINDOWS\$NtUninstallKB956802_0$
2009-06-16 14:00:46 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2009-06-16 14:00:36 ----HDC---- C:\WINDOWS\$NtUninstallKB923561_0$
2009-06-16 14:00:25 ----HDC---- C:\WINDOWS\$NtUninstallKB936782_WMP10$
2009-06-16 13:57:25 ----HDC---- C:\WINDOWS\$NtUninstallKB935448$
2009-06-16 12:31:53 ----A---- C:\WINDOWS\system32\xmllite.dll
2009-06-16 12:31:47 ----N---- C:\WINDOWS\system32\wmphoto.dll
2009-06-16 12:31:44 ----N---- C:\WINDOWS\system32\wlanapi.dll
2009-06-16 12:31:41 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
2009-06-16 12:31:41 ----N---- C:\WINDOWS\system32\windowscodecs.dll
2009-06-16 12:31:29 ----N---- C:\WINDOWS\system32\tspkg.dll
2009-06-16 12:31:29 ----N---- C:\WINDOWS\system32\tsgqec.dll
2009-06-16 12:31:18 ----N---- C:\WINDOWS\system32\spupdwxp.exe
2009-06-16 12:31:17 ----N---- C:\WINDOWS\system32\spnpinst.exe
2009-06-16 12:31:17 ----A---- C:\WINDOWS\system32\spdwnwxp.exe
2009-06-16 12:31:16 ----A---- C:\WINDOWS\SmartAudio.INI
2009-06-16 12:31:14 ----N---- C:\WINDOWS\system32\slserv.exe
2009-06-16 12:31:14 ----N---- C:\WINDOWS\system32\slrundll.exe
2009-06-16 12:31:14 ----N---- C:\WINDOWS\system32\slgen.dll
2009-06-16 12:31:14 ----N---- C:\WINDOWS\slrundll.exe
2009-06-16 12:31:13 ----N---- C:\WINDOWS\system32\slextspk.dll
2009-06-16 12:31:13 ----N---- C:\WINDOWS\system32\slcoinst.dll
2009-06-16 12:31:11 ----N---- C:\WINDOWS\system32\setupn.exe
2009-06-16 12:31:04 ----N---- C:\WINDOWS\system32\s3gnb.dll
2009-06-16 12:31:04 ----N---- C:\WINDOWS\system32\rundll32.exe
2009-06-16 12:31:01 ----D---- C:\Program Files\CONEXANT
2009-06-16 12:31:00 ----N---- C:\WINDOWS\system32\rhttpaa.dll
2009-06-16 12:30:55 ----N---- C:\WINDOWS\system32\rasqec.dll
2009-06-16 12:30:54 ----N---- C:\WINDOWS\system32\qutil.dll
2009-06-16 12:30:50 ----N---- C:\WINDOWS\system32\qcliprov.dll
2009-06-16 12:30:49 ----N---- C:\WINDOWS\system32\qagentrt.dll
2009-06-16 12:30:49 ----N---- C:\WINDOWS\system32\qagent.dll
2009-06-16 12:30:47 ----N---- C:\WINDOWS\system32\pnrpnsp.dll
2009-06-16 12:30:47 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
2009-06-16 12:30:45 ----N---- C:\WINDOWS\system32\p2psvc.dll
2009-06-16 12:30:45 ----N---- C:\WINDOWS\system32\p2pnetsh.dll
2009-06-16 12:30:45 ----N---- C:\WINDOWS\system32\p2pgraph.dll
2009-06-16 12:30:45 ----N---- C:\WINDOWS\system32\p2pgasvc.dll
2009-06-16 12:30:45 ----N---- C:\WINDOWS\system32\p2p.dll
2009-06-16 12:30:44 ----N---- C:\WINDOWS\system32\onex.dll
2009-06-16 12:30:41 ----N---- C:\WINDOWS\system32\nv4_disp.dll
2009-06-16 12:30:30 ----N---- C:\WINDOWS\system32\napstat.exe
2009-06-16 12:30:30 ----N---- C:\WINDOWS\system32\napmontr.dll
2009-06-16 12:30:30 ----N---- C:\WINDOWS\system32\napipsec.dll
2009-06-16 12:30:30 ----N---- C:\WINDOWS\system32\mtxparhd.dll
2009-06-16 12:30:29 ----N---- C:\WINDOWS\system32\msxml6r.dll
2009-06-16 12:30:28 ----N---- C:\WINDOWS\system32\msxml6.dll
2009-06-16 12:30:26 ----N---- C:\WINDOWS\system32\msshavmsg.dll
2009-06-16 12:30:26 ----N---- C:\WINDOWS\system32\mssha.dll
2009-06-16 12:30:05 ----N---- C:\WINDOWS\system32\mdmxsdk.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\l2gpstore.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kmsvc.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdukx.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdsmsno.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdsmsfi.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdpash.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdno1.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdnepr.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdmlt48.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdmlt47.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdmaori.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdiultn.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdinmal.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdinben.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdinbe1.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdfi1.dll
2009-06-16 12:29:52 ----N---- C:\WINDOWS\system32\kbdbhc.dll
2009-06-16 12:29:48 ----N---- C:\WINDOWS\system32\smtpapi.dll
2009-06-16 12:29:48 ----N---- C:\WINDOWS\system32\rwnh.dll
2009-06-16 12:29:45 ----N---- C:\WINDOWS\system32\comsdupd.exe
2009-06-16 12:29:42 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
2009-06-16 12:29:36 ----N---- C:\WINDOWS\system32\faxpatch.exe
2009-06-16 12:29:36 ----A---- C:\WINDOWS\002522_.tmp
2009-06-16 12:29:34 ----N---- C:\WINDOWS\system32\eapsvc.dll
2009-06-16 12:29:34 ----N---- C:\WINDOWS\system32\eapqec.dll
2009-06-16 12:29:34 ----N---- C:\WINDOWS\system32\eappprxy.dll
2009-06-16 12:29:34 ----N---- C:\WINDOWS\system32\eapphost.dll
2009-06-16 12:29:34 ----N---- C:\WINDOWS\system32\eappgnui.dll
2009-06-16 12:29:34 ----N---- C:\WINDOWS\system32\eappcfg.dll
2009-06-16 12:29:34 ----N---- C:\WINDOWS\system32\eapp3hst.dll
2009-06-16 12:29:34 ----N---- C:\WINDOWS\system32\eapolqec.dll
2009-06-16 12:29:32 ----N---- C:\WINDOWS\system32\dot3ui.dll
2009-06-16 12:29:32 ----N---- C:\WINDOWS\system32\dot3svc.dll
2009-06-16 12:29:32 ----N---- C:\WINDOWS\system32\dot3msm.dll
2009-06-16 12:29:32 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
2009-06-16 12:29:32 ----N---- C:\WINDOWS\system32\dot3dlg.dll
2009-06-16 12:29:32 ----N---- C:\WINDOWS\system32\dot3cfg.dll
2009-06-16 12:29:32 ----N---- C:\WINDOWS\system32\dot3api.dll
2009-06-16 12:29:31 ----N---- C:\WINDOWS\system32\dimsroam.dll
2009-06-16 12:29:31 ----N---- C:\WINDOWS\system32\dimsntfy.dll
2009-06-16 12:29:31 ----N---- C:\WINDOWS\system32\dhcpqec.dll
2009-06-16 12:29:29 ----N---- C:\WINDOWS\system32\credssp.dll
2009-06-16 12:29:24 ----N---- C:\WINDOWS\system32\bitsprx4.dll
2009-06-16 12:29:24 ----N---- C:\WINDOWS\system32\azroles.dll
2009-06-16 12:29:24 ----N---- C:\WINDOWS\system32\ativtmxx.dll
2009-06-16 12:29:24 ----N---- C:\WINDOWS\system32\ati3d1ag.dll
2009-06-16 12:29:23 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
2009-06-16 12:29:20 ----N---- C:\WINDOWS\system32\aaclient.dll
2009-06-16 12:13:02 ----D---- C:\WINDOWS\OPTIONS
2009-06-16 06:05:59 ----D---- C:\Program Files\DIFX
2009-06-16 06:05:52 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-06-16 06:03:56 ----D---- C:\Program Files\HP
2009-06-16 06:03:53 ----D---- C:\WINDOWS\Downloaded Installations
2009-06-16 05:56:49 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2009-06-16 05:56:49 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2009-06-16 05:56:48 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-06-16 05:56:48 ----D---- C:\Documents and Settings\Hola\Application Data\Adobe
2009-06-16 05:56:48 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2009-06-16 05:56:28 ----D---- C:\Documents and Settings\Hola\Application Data\Macromedia
2009-06-15 12:31:04 ----A---- C:\WINDOWS\system32\bcmwlcoi.dll
2009-06-15 12:31:03 ----D---- C:\Program Files\Broadcom
2009-06-15 12:31:01 ----D---- C:\Documents and Settings\Hola\Application Data\InstallShield
2009-06-15 12:29:39 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-06-15 12:29:33 ----D---- C:\Program Files\ATI Technologies
2009-06-15 12:28:56 ----HD---- C:\Program Files\InstallShield Installation Information
2009-06-15 12:28:56 ----D---- C:\Program Files\HPQ
2009-06-15 12:28:49 ----D---- C:\Program Files\Fichiers communs\InstallShield
2009-06-15 09:20:08 ----A---- C:\WINDOWS\system32\h323log.txt
2009-06-15 09:18:31 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-06-15 09:18:24 ----A---- C:\WINDOWS\system32\usbui.dll
2009-06-15 09:14:53 ----SHD---- C:\WINDOWS\Installer
2009-06-15 09:14:53 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-06-15 09:14:52 ----D---- C:\Program Files\Fichiers communs\ODBC
2009-06-15 09:14:52 ----A---- C:\WINDOWS\ODBCINST.INI
2009-06-15 09:14:47 ----D---- C:\Program Files\Fichiers communs\SpeechEngines
2009-06-15 09:14:46 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2009-06-15 09:14:46 ----D---- C:\Program Files\Fichiers communs
2009-06-15 09:14:46 ----D---- C:\Program Files
2009-06-15 09:14:40 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-06-15 09:14:40 ----A---- C:\WINDOWS\system32\irclass.dll
2009-06-15 09:14:40 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2009-06-15 09:14:40 ----A---- C:\WINDOWS\system32\dgsetup.dll
2009-06-15 09:14:40 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2009-06-15 09:14:37 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-06-15 09:14:37 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-06-15 09:14:37 ----A---- C:\WINDOWS\system32\batt.dll
2009-06-15 09:14:36 ----A---- C:\WINDOWS\system32\storprop.dll
2009-06-15 09:14:36 ----A---- C:\WINDOWS\notepad.exe
2009-06-15 09:14:28 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-06-15 09:14:08 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-15 09:14:08 ----D---- C:\WINDOWS\system32\CatRoot
2009-06-15 09:14:02 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-06-15 09:13:35 ----D---- C:\Documents and Settings
2009-06-15 09:13:34 ----SHD---- C:\System Volume Information
2009-06-15 09:12:48 ----SH---- C:\boot.ini
2009-06-15 09:03:48 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-06-15 09:03:48 ----D---- C:\WINDOWS\WinSxS
2009-06-15 09:03:48 ----D---- C:\WINDOWS\Web
2009-06-15 09:03:48 ----D---- C:\WINDOWS\twain_32
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\wins
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\wbem
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\usmt
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\spool
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\ShellExt
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\Setup
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\ras
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\PreInstall
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\oobe
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\npp
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\mui
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\inetsrv
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\IME
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\icsxml
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\ias
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\export
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\drivers
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\dhcp
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\config
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\3com_dmi
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\3076
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\2052
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\1054
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\1042
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\1041
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\1037
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\1036
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\1033
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\1031
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\1028
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32\1025
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system32
2009-06-15 09:03:48 ----D---- C:\WINDOWS\system
2009-06-15 09:03:48 ----D---- C:\WINDOWS\security
2009-06-15 09:03:48 ----D---- C:\WINDOWS\Resources
2009-06-15 09:03:48 ----D---- C:\WINDOWS\repair
2009-06-15 09:03:48 ----D---- C:\WINDOWS\Provisioning
2009-06-15 09:03:48 ----D---- C:\WINDOWS\PeerNet
2009-06-15 09:03:48 ----D---- C:\WINDOWS\pchealth
2009-06-15 09:03:48 ----D---- C:\WINDOWS\mui
2009-06-15 09:03:48 ----D---- C:\WINDOWS\msapps
2009-06-15 09:03:48 ----D---- C:\WINDOWS\msagent
2009-06-15 09:03:48 ----D---- C:\WINDOWS\Media
2009-06-15 09:03:48 ----D---- C:\WINDOWS\java
2009-06-15 09:03:48 ----D---- C:\WINDOWS\inf
2009-06-15 09:03:48 ----D---- C:\WINDOWS\ime
2009-06-15 09:03:48 ----D---- C:\WINDOWS\Help
2009-06-15 09:03:48 ----D---- C:\WINDOWS\Fonts
2009-06-15 09:03:48 ----D---- C:\WINDOWS\ehome
2009-06-15 09:03:48 ----D---- C:\WINDOWS\Driver Cache
2009-06-15 09:03:48 ----D---- C:\WINDOWS\Debug
2009-06-15 09:03:48 ----D---- C:\WINDOWS\Cursors
2009-06-15 09:03:48 ----D---- C:\WINDOWS\Connection Wizard
2009-06-15 09:03:48 ----D---- C:\WINDOWS\Config
2009-06-15 09:03:48 ----D---- C:\WINDOWS\AppPatch
2009-06-15 09:03:48 ----D---- C:\WINDOWS\addins
2009-06-15 09:03:48 ----D---- C:\WINDOWS
2009-06-15 07:39:47 ----D---- C:\Documents and Settings\Hola\Application Data\Identities
2009-06-15 07:39:45 ----HD---- C:\Program Files\Uninstall Information
2009-06-15 07:39:38 ----D---- C:\Program Files\JDoe Tools
2009-06-15 07:36:37 ----ASH---- C:\Documents and Settings\Hola\Application Data\desktop.ini
2009-06-15 07:36:36 ----D---- C:\Documents and Settings\Hola\Application Data\Real
2009-06-15 07:36:36 ----D---- C:\Documents and Settings\Hola\Application Data\Microsoft
2009-06-15 07:35:39 ----D---- C:\WINDOWS\SoftwareDistribution
2009-06-15 07:35:33 ----SD---- C:\WINDOWS\system32\Microsoft
2009-06-15 07:35:33 ----N---- C:\WINDOWS\SchedLgU.Txt
2009-06-15 07:30:51 ----D---- C:\WINDOWS\system32\xircom
2009-06-15 07:30:51 ----D---- C:\Program Files\xerox
2009-06-15 07:30:51 ----D---- C:\Program Files\msn gaming zone
2009-06-15 07:30:51 ----D---- C:\Program Files\movie maker
2009-06-15 07:30:51 ----D---- C:\Program Files\microsoft frontpage
2009-06-15 07:30:34 ----D---- C:\Program Files\Maxthon
2009-06-15 07:30:32 ----D---- C:\Program Files\UberIcon
2009-06-15 07:30:32 ----D---- C:\Program Files\RegSeeker
2009-06-15 07:30:31 ----D---- C:\Program Files\IE Privacy Keeper
2009-06-15 07:30:30 ----D---- C:\Program Files\Everest
2009-06-15 07:30:30 ----D---- C:\Program Files\Compare It!
2009-06-15 07:30:29 ----D---- C:\Program Files\Ad-Aware
2009-06-15 07:30:28 ----A---- C:\WINDOWS\system32\cpuz.ini
2009-06-15 07:30:28 ----A---- C:\WINDOWS\system32\cpuz.exe
2009-06-15 07:30:27 ----D---- C:\Program Files\WinRAR
2009-06-15 07:30:01 ----D---- C:\Program Files\Eset
2009-06-15 07:30:01 ----A---- C:\WINDOWS\system32\imon.dll
2009-06-15 07:29:11 ----A---- C:\WINDOWS\system32\mfc71u.dll
2009-06-15 07:29:10 ----D---- C:\Program Files\Fichiers communs\Ahead
2009-06-15 07:29:09 ----A---- C:\WINDOWS\system32\TwnLib4.dll
2009-06-15 07:29:09 ----A---- C:\WINDOWS\system32\imagXRA7.dll
2009-06-15 07:29:09 ----A---- C:\WINDOWS\system32\imagXR7.dll
2009-06-15 07:29:09 ----A---- C:\WINDOWS\system32\imagXpr7.dll
2009-06-15 07:29:08 ----A---- C:\WINDOWS\system32\msvcr71.dll
2009-06-15 07:29:08 ----A---- C:\WINDOWS\system32\msvcp71.dll
2009-06-15 07:29:08 ----A---- C:\WINDOWS\system32\imagX7.dll
2009-06-15 07:29:07 ----A---- C:\WINDOWS\system32\mfc71.dll
2009-06-15 07:29:06 ----D---- C:\Program Files\Nero
2009-06-15 07:28:58 ----D---- C:\Program Files\Soft4Ever
2009-06-15 07:28:58 ----A---- C:\WINDOWS\system32\fwapi.dll
2009-06-15 07:28:53 ----A---- C:\WINDOWS\system32\rmoc3260.dll
2009-06-15 07:28:53 ----A---- C:\WINDOWS\system32\pndx5032.dll
2009-06-15 07:28:53 ----A---- C:\WINDOWS\system32\pndx5016.dll
2009-06-15 07:28:53 ----A---- C:\WINDOWS\system32\pncrt.dll
2009-06-15 07:28:50 ----D---- C:\Program Files\Real Alternative
2009-06-15 07:28:50 ----D---- C:\Documents and Settings\All Users\Application Data\Real
2009-06-15 07:28:48 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2009-06-15 07:28:33 ----D---- C:\Program Files\QuickTime Alternative
2009-06-15 07:28:33 ----D---- C:\Program Files\Media Player Classic
2009-06-15 07:28:30 ----A---- C:\WINDOWS\system32\xvidcore.dll
2009-06-15 07:28:30 ----A---- C:\WINDOWS\system32\unrar.dll
2009-06-15 07:28:29 ----D---- C:\Program Files\K-Lite Codec Pack
2009-06-15 07:28:28 ----A---- C:\WINDOWS\system32\wnaspi32.dll
2009-06-15 07:28:22 ----A---- C:\WINDOWS\system32\jit.dll
2009-06-15 07:28:22 ----A---- C:\WINDOWS\system32\javaee.dll
2009-06-15 07:28:22 ----A---- C:\WINDOWS\system32\dx3j.dll
2009-06-15 07:28:22 ----A---- C:\WINDOWS\setdebug.exe
2009-06-15 07:28:19 ----A---- C:\WINDOWS\system32\wjview.exe
2009-06-15 07:28:19 ----A---- C:\WINDOWS\system32\vmhelper.dll
2009-06-15 07:28:19 ----A---- C:\WINDOWS\system32\msjdbc10.dll
2009-06-15 07:28:19 ----A---- C:\WINDOWS\system32\msjava.dll
2009-06-15 07:28:19 ----A---- C:\WINDOWS\system32\msawt.dll
2009-06-15 07:28:19 ----A---- C:\WINDOWS\system32\jview.exe
2009-06-15 07:28:19 ----A---- C:\WINDOWS\system32\jdbgmgr.exe
2009-06-15 07:28:18 ----A---- C:\WINDOWS\system32\javart.dll
2009-06-15 07:28:18 ----A---- C:\WINDOWS\system32\javaprxy.dll
2009-06-15 07:28:18 ----A---- C:\WINDOWS\system32\javacypt.dll
2009-06-15 07:28:18 ----A---- C:\WINDOWS\system32\clspack.exe
2009-06-15 07:27:08 ----RSD---- C:\WINDOWS\assembly
2009-06-15 07:27:08 ----D---- C:\WINDOWS\Microsoft.NET
2009-06-15 07:27:07 ----D---- C:\WINDOWS\system32\URTTemp
2009-06-15 07:26:33 ----D---- C:\Program Files\Windows Media Connect 2
2009-06-15 07:26:02 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-06-15 07:25:50 ----D---- C:\WINDOWS\system32\fr
2009-06-15 07:25:49 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-06-15 07:25:48 ----HD---- C:\WINDOWS\$hf_mig$
2009-06-15 07:25:47 ----N---- C:\WINDOWS\system32\mmcperf.exe
2009-06-15 07:25:47 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
2009-06-15 07:25:46 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2009-06-15 07:25:35 ----A---- C:\WINDOWS\control.ini
2009-06-15 07:25:35 ----A---- C:\AUTOEXEC.BAT
2009-06-15 07:25:19 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-06-15 07:24:28 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-06-15 07:24:28 ----RD---- C:\WINDOWS\Offline Web Pages
2009-06-15 07:24:28 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-06-15 07:24:20 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-06-15 07:24:13 ----HD---- C:\Program Files\WindowsUpdate
2009-06-15 07:24:10 ----D---- C:\Program Files\Services en ligne
2009-06-15 07:23:32 ----A---- C:\WINDOWS\system32\atrace.dll
2009-06-15 07:23:31 ----A---- C:\WINDOWS\system32\desktop.ini
2009-06-15 07:23:31 ----A---- C:\WINDOWS\desktop.ini
2009-06-15 07:23:30 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2009-06-15 07:23:28 ----A---- C:\WINDOWS\system32\acctres.dll
2009-06-15 07:23:27 ----D---- C:\Program Files\Fichiers communs\Services
2009-06-15 07:23:24 ----SD---- C:\WINDOWS\Tasks
2009-06-15 07:23:24 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-06-15 07:23:23 ----D---- C:\Program Files\Fichiers communs\MSSoap
2009-06-15 07:23:17 ----D---- C:\WINDOWS\srchasst
2009-06-15 07:23:16 ----D---- C:\WINDOWS\system32\Macromed
2009-06-15 07:23:12 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-06-15 07:23:12 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-06-15 07:23:12 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-06-15 07:23:12 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-06-15 07:23:11 ----A---- C:\WINDOWS\system32\wups.dll
2009-06-15 07:23:11 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-06-15 07:23:10 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-06-15 07:23:10 ----A---- C:\WINDOWS\system32\wuauclt.exe
2009-06-15 07:23:10 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-06-15 07:23:09 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-06-15 07:23:09 ----A---- C:\WINDOWS\system32\qmgr.dll
2009-06-15 07:23:09 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-06-15 07:23:09 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-06-15 07:23:04 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-06-15 07:23:04 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-06-15 07:23:04 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-06-15 07:23:04 ----A---- C:\WINDOWS\system32\racpldlg.dll
2009-06-15 07:22:57 ----D---- C:\WINDOWS\system32\Restore
2009-06-15 07:22:57 ----A---- C:\WINDOWS\system32\fltmc.exe
2009-06-15 07:22:57 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-06-15 07:22:56 ----A---- C:\WINDOWS\system32\srsvc.dll
2009-06-15 07:22:56 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-06-15 07:22:56 ----A---- C:\WINDOWS\system32\srclient.dll
2009-06-15 07:22:55 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2009-06-15 07:22:55 ----A---- C:\WINDOWS\system32\msconf.dll
2009-06-15 07:22:55 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-06-15 07:22:55 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-06-15 07:22:55 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2009-06-15 07:22:55 ----A---- C:\WINDOWS\system32\ils.dll
2009-06-15 07:22:51 ----D---- C:\Program Files\NetMeeting
2009-06-15 07:22:51 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-06-15 07:22:51 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-06-15 07:22:49 ----A---- C:\WINDOWS\system32\inetres.dll
2009-06-15 07:22:48 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-06-15 07:22:44 ----D---- C:\Program Files\Outlook Express
2009-06-15 07:22:44 ----A---- C:\WINDOWS\system32\schedsvc.dll
2009-06-15 07:22:44 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-06-15 07:22:44 ----A---- C:\WINDOWS\system32\mstask.dll
2009-06-15 07:22:43 ----A---- C:\WINDOWS\system32\isign32.dll
2009-06-15 07:22:43 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-06-15 07:22:43 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-06-15 07:22:43 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-06-15 07:22:35 ----D---- C:\Program Files\Fichiers communs\System
2009-06-15 07:22:29 ----D---- C:\Program Files\Internet Explorer
2009-06-15 07:21:57 ----D---- C:\Program Files\ComPlus Applications
2009-06-15 07:21:54 ----A---- C:\WINDOWS\vbaddin.ini
2009-06-15 07:21:54 ----A---- C:\WINDOWS\vb.ini
2009-06-15 07:21:49 ----D---- C:\WINDOWS\Registration
2009-06-15 07:21:41 ----D---- C:\Program Files\Windows Media Player
2009-06-15 07:21:40 ----D---- C:\WINDOWS\system32\FxsTmp
2009-06-15 07:21:40 ----A---- C:\WINDOWS\T30DebugLogFile.txt
2009-06-15 07:21:30 ----D---- C:\Program Files\Messenger
2009-06-15 07:21:30 ----A---- C:\WINDOWS\system32\write.exe
2009-06-15 07:21:30 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-06-15 07:21:30 ----A---- C:\WINDOWS\system32\hticons.dll
2009-06-15 07:21:29 ----A---- C:\WINDOWS\system32\avwav.dll
2009-06-15 07:21:29 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-06-15 07:21:29 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-06-15 07:21:24 ----A---- C:\WINDOWS\system32\getuname.dll
2009-06-15 07:21:24 ----A---- C:\WINDOWS\system32\charmap.exe
2009-06-15 07:21:23 ----A---- C:\WINDOWS\system32\sol.exe
2009-06-15 07:21:22 ----A---- C:\WINDOWS\system32\winmine.exe
2009-06-15 07:21:22 ----A---- C:\WINDOWS\system32\mshearts.exe
2009-06-15 07:21:22 ----A---- C:\WINDOWS\system32\freecell.exe
2009-06-15 07:21:21 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-06-15 07:21:21 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-06-15 07:21:21 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-06-15 07:21:21 ----A---- C:\WINDOWS\system32\tskill.exe
2009-06-15 07:21:21 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-06-15 07:21:21 ----A---- C:\WINDOWS\system32\tscon.exe
2009-06-15 07:21:21 ----A---- C:\WINDOWS\system32\shadow.exe
2009-06-15 07:21:21 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-06-15 07:21:21 ----A---- C:\WINDOWS\system32\reset.exe
2009-06-15 07:21:21 ----A---- C:\WINDOWS\system32\regini.exe
2009-06-15 07:21:21 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-06-15 07:21:21 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-06-15 07:21:20 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-06-15 07:21:20 ----A---- C:\WINDOWS\system32\msg.exe
2009-06-15 07:21:20 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-06-15 07:21:20 ----A---- C:\WINDOWS\system32\logoff.exe
2009-06-15 07:21:20 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-06-15 07:21:19 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-06-15 07:21:19 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-06-15 07:21:19 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-06-15 07:21:19 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-06-15 07:21:19 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-06-15 07:21:19 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-06-15 07:21:18 ----A---- C:\WINDOWS\system32\stclient.dll
2009-06-15 07:21:18 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-06-15 07:21:17 ----A---- C:\WINDOWS\system32\fxssend.exe
2009-06-15 07:21:17 ----A---- C:\WINDOWS\system32\fxsroute.dll
2009-06-15 07:21:17 ----A---- C:\WINDOWS\system32\fxsperf.ini
2009-06-15 07:21:17 ----A---- C:\WINDOWS\system32\fxsclntR.dll
2009-06-15 07:21:17 ----A---- C:\WINDOWS\system32\fxscfgwz.dll
2009-06-15 07:21:12 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-06-15 07:21:10 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-06-15 07:21:10 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-06-15 07:21:10 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-06-15 07:21:09 ----D---- C:\Program Files\Windows NT
2009-06-15 07:21:09 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-06-15 07:21:08 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-06-15 07:21:08 ----A---- C:\WINDOWS\system32\spider.exe
2009-06-15 07:21:07 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-06-15 07:21:06 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-06-15 07:21:06 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-06-15 07:21:06 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-06-15 07:21:06 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-06-15 07:21:06 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-06-15 07:21:06 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-06-15 07:21:05 ----A---- C:\WINDOWS\system32\tscupgrd.e

Répondre à jean-charles

Destrio5, le 21 jun 2009 à 17:26:08

Plus de souci ?

Répondre à Destrio5

Jean-charles, le 21 jun 2009 à 20:31:18

Salut,

Non plus de soucis.

Merci beaucoup, ça a été plutôt efficace.

Jean-Charles

Répondre à Jean-charles

Destrio5, le 21 jun 2009 à 20:52:52

1/

---> Désinstalle HijackThis.

---> Télécharge ToolsCleaner2 sur ton Bureau.
* Double-clique sur ToolsCleaner2.exe pour le lancer.
* Clique sur Recherche et laisse le scan agir.
* Clique sur Suppression pour finaliser.
* Tu peux, si tu le souhaites, te servir des Options Facultatives.
* Clique sur Quitter pour obtenir le rapport.
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

2/

---> Télécharge et installe CCleaner Slim.
* Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....
* Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage.

3/

---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger.

==Prévention==

Conserve MBAM. Il te servira à scanner les fichiers douteux en complément de l'antivirus et scanne le disque dur régulièrement.

Par rapport au P2P : Lien

Voici un dossier complet (A lire avec Adobe Reader ou Foxit Reader) : Lien

Sois plus vigilant(e) sur Internet ;)

Répondre à Destrio5

Jean-Charles, le 21 jun 2009 à 23:22:34

Voici mon rapport : toolcleaner :

[ Rapport ToolsCleaner version 2.3.6 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Hola\Bureau\Rsit.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\Documents and Settings\Hola\Bureau\Rsit.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Je pense que le désagrément est terminé.

Merci encore une fois.

Répondre à Jean-Charles

Destrio5, le 21 jun 2009 à 23:30:47

Tu peux supprimer ToolsCleaner ;)

Répondre à Destrio5

Posez votre question Répondre