High-Tech Santé Médecine Droit-Finances

Réalisation

vidéo numérique

Rechercher : dans
Par :

Infecté par marclesaint et autres.

Dernière réponse le 7 oct 2009 à 17:58:47 foxy_will, le 27 sep 2009 à 20:47:08 
 Signaler ce message aux modérateurs

Bonjour,
Voilà je suis en plein depannage et j'ai un soucis avec la machine infectée:
1/ le navigateur IE inscrit l'entete MARCLESAINT ENCORE CHEZ VOUS...MERCI DE ME FAIRE CONNAITRE...
2/ je n'ai pas accè aux commande usuelles genre REGEDIT, CTRL ALT SUPP...etc
3/ aucun logiciel de sécurité ne peut etre activé: NORTON INTERNET SECURITY, CCLEANER, SPYBOT,... l'antivirus sur cete machine est désactivé, et lorsque je lance ccleaner il disparait au bout de 2 sécondes (pareil pour les autres)
4/ impossible de passer en MODE SANS ECHEC au demarrage
5/ il bloque les comptes de messagerie
6/ j'ai fait un scan vec hijackthis je poste le log, mais en realité hijack n'arrive pas a fixer mais bon peut etre que vous avez d'autre astuces.
7/ pfffffffff j'en ai marre je cogite cogite et ça commence à durer alors si vous trouvez la solution avant moi faite moi signe merci
::::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 13:57:27, on 27/09/2002
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Windows\System32\bycool1\windo.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\System32\bycool\myapp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\WINDOWS\system32\wuauc1t.exe
C:\Documents and Settings\HP_Propriétaire\Bureau\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MARCLESAINT ENCORE CHEZ VOUS --- MERCI DE ME FAIRE CONNAITRE--- PARTAGEZ MON VIRUS AVEC VOS AMIS
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = MARCLESAINT ENCORE CHEZ VOUS --- MERCI DE ME FAIRE CONNAITRE--- PARTAGEZ MON VIRUS AVEC VOS AMIS
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IS CfgWiz] c:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [URLLSTCK.exe] c:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [DRIVESYS1] C:\Windows\System32\bycool1\windo.exe
O4 - HKLM\..\Run: [DRIVESYS] C:\Windows\System32\bycool\winacces.exe
O4 - HKLM\..\Run: [MARCLESAINT] C:\WINDOWS\MARCLESAINT.vbs
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Barre d'état système d'ATI CATALYST.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{89939DAA-FFF0-44C3-855E-96DF39B920E1}: NameServer = 213.136.96.2 213.136.96.37
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
End of file - 9670 bytes
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
kw ?on s'affole pas pour un malheureux script!!:)

Configuration: Windows XP Internet Explorer 6.0

Meilleures réponses pour « infecté par marclesaint et autres. » dans :
[Virus] Que faire quand on est infecté ? Voir Si vous savez ou vous pensez être infecté par un virus Si vous savez ou vous pensez être infecté par un virus, il faut s'en occuper le plus rapidement possible car l'infection peut inviter d'autres infections dans votre PC et votre système risque...
[Virus] Your computer is infected Voir
Infection Navipromo / Magic.Control / Instant Access / EgdAccess Voir Que faire en cas d'infection Navipromo/Magic.Control/Instant Access/EgdAccess ? Navipromo est une infection qui affiche des fenêtres publicitaires intempestives. Les programmes suivants installent cette infection : Funky Emoticons Games...
Infection Navipromo/Magic.control VoirQue faire en cas d'infection Navipromo/Magic.control/Instant Acces/EgdAcces Méthode préliminaire Si vous êtes sous vista : Désactiver le contrôle des comptes utilisateurs Ad-aware 2009 Spybot Search and Destroy 1.6 Navilog1 Option 1 :...
Désinfecter une clé USB ou un disque amovible Voir
[Spywares] Méthodes de désinfection Voir
Posez votre question Répondre

1

Xplode, le 27 sep 2009 à 20:52:41

Salut, télécharge ComboFix à cette adresse : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Puis suis les indications de ce tutoriel scrupuleusement : http://www.bleepingcomputer.com/combofix/fr/comment-utiliser­-combofix

Poste ensuite le rapport qui se trouve sous C:\Combofix.txt

   
Répondre à Xplode

2

foxy_will, le 27 sep 2009 à 21:26:33

Ok j'y vais à toute

   
Répondre à foxy_will

3

foxy_will, le 28 sep 2009 à 07:16:41

Salut!
quelques soucis avec ma connexion, bon voici le log de combofix
:::::::::
::::
ComboFix 09-09-25.01 - Pr DONGUI 28/09/2009 2:05.1.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1023.640 [GMT 0:00]
Lancé depuis: c:\documents and settings\Pr DONGUI\Bureau\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DAC970NT
-------\Service_dac970nt


((((((((((((((((((((((((((((( Fichiers créés du 2009-08-28 au 2009-09-28 ))))))))))))))))))))))))))))))))))))
.

2009-09-28 01:27 . 2009-09-28 01:27 -------- d-s---w- c:\documents and settings\Pr DONGUI\UserData
2009-09-28 01:12 . 2009-09-28 01:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-09-28 01:12 . 2009-09-28 01:12 -------- d-----w- c:\documents and settings\Pr DONGUI\Application Data\Yahoo!
2009-09-28 01:12 . 2009-09-28 01:14 -------- d-----w- c:\program files\Yahoo!
2009-09-28 01:12 . 2009-09-28 01:14 -------- d-----w- c:\program files\CCleaner
2009-09-28 01:06 . 2006-03-17 15:37 520192 ------w- c:\windows\system32\ati2sgag.exe
2009-09-27 23:31 . 2009-09-27 23:31 -------- d-----w- c:\program files\Microsoft Works
2009-09-27 23:30 . 2009-09-27 23:30 -------- d-----w- c:\program files\MSBuild
2009-09-27 23:27 . 2009-09-27 23:30 -------- d-----w- c:\windows\SHELLNEW
2009-09-27 23:27 . 2009-09-27 23:27 -------- d-----r- C:\MSOCache
2009-09-27 23:09 . 2009-09-27 23:09 12328 ----a-w- c:\documents and settings\Pr DONGUI\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-27 23:00 . 2009-09-27 23:00 -------- d-----w- c:\program files\DIFX
2009-09-27 23:00 . 2009-09-27 23:00 -------- dc----w- c:\windows\system32\DRVSTORE
2009-09-27 23:00 . 2009-09-27 23:00 -------- d-----w- c:\program files\USB TV
2009-09-27 22:59 . 2009-09-27 22:59 -------- d-----w- c:\program files\ATI Technologies
2009-09-27 22:58 . 2009-09-28 01:07 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-09-27 22:57 . 2009-09-27 22:57 -------- d-----w- C:\ATI
2009-09-27 22:46 . 2004-08-03 23:01 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.s­ys
2009-09-27 22:46 . 2004-08-03 23:01 25856 ----a-w- c:\windows\system32\drivers\usbprint.sy­s
2009-09-27 22:16 . 2009-09-27 22:16 -------- d-----w- C:\Pilotes-pciv92v4v4l
2009-09-27 21:58 . 2009-09-27 21:57 73728 ----a-w- c:\windows\system32\RtNicProp32.dll
2009-09-27 21:58 . 2009-09-27 21:57 130432 ----a-w- c:\windows\system32\drivers\Rtnicxp.sy­s
2009-09-27 21:58 . 2009-09-27 21:58 -------- d-----w- c:\program files\Realtek
2009-09-27 21:45 . 2009-09-27 21:45 -------- d-----w- c:\program files\ma-config.com
2009-09-27 21:45 . 2009-09-27 21:45 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2009-09-27 21:22 . 2009-09-27 21:22 -------- d-----w- c:\documents and settings\Pr DONGUI\Local Settings\Application Data\Microsoft Help
2009-09-27 21:22 . 2009-09-27 23:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-28 02:09 . 2009-09-27 20:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-09-28 02:08 . 2009-09-27 20:57 616480 --sha-w- c:\windows\system32\drivers\fidbox.dat­
2009-09-28 02:08 . 2009-09-27 20:57 5896 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-28 02:08 . 2009-09-27 20:57 1584 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-09-28 02:08 . 2009-09-27 20:57 147488 --sha-w- c:\windows\system32\drivers\fidbox2.da­t
2009-09-28 01:50 . 2009-09-27 20:57 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2009-09-28 01:50 . 2009-09-27 20:57 107547 ----a-w- c:\windows\system32\drivers\klin.dat
2009-09-28 01:06 . 2009-09-27 20:59 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-27 23:05 . 2008-01-29 17:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-09-27 22:30 . 2009-09-27 22:30 -------- d-----w- c:\program files\Hewlett-Packard
2009-09-27 22:30 . 2009-09-27 22:30 -------- d--h--w- c:\program files\Zenographics
2009-09-27 21:00 . 2009-09-27 21:00 32 ----a-w- c:\windows\system32\drivers\adidsl.cfg
2009-09-27 20:59 . 2009-09-27 20:59 -------- d-----w- c:\program files\SAGEM
2009-09-27 20:59 . 2009-09-27 20:59 -------- d-----w- c:\documents and settings\Pr DONGUI\Application Data\InstallShield
2009-09-27 20:57 . 2009-09-27 20:57 -------- d-----w- c:\program files\Kaspersky Lab
2009-09-27 20:54 . 2001-09-28 11:00 48616 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-27 20:54 . 2001-09-28 11:00 367658 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-27 20:49 . 2009-09-27 20:49 -------- d-----w- c:\program files\microsoft frontpage
2009-09-27 20:47 . 2009-09-27 20:47 -------- d-----w- c:\program files\Services en ligne
2009-09-27 20:46 . 2009-09-27 20:46 21892 ----a-w- c:\windows\system32\emptyregdb.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-09-27 208616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BDARemote.lnk - c:\program files\USB TV\EM28XX\BDARemote.exe [2009-9-27 81997]
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-9-27 1205840]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 17:29 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 18:02 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 17:06 24592]
S2 ELOADER;General Purpose USB Driver (adildr.sys);c:\windows\system32\drivers\adildr.sys [27/09/2009 21:00 56088]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [23/09/2009 14:50 238960]
.
.
------- Examen supplémentaire -------
.
IE: Ajouter à Kaspersky Anti-Bannière - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {B5F75EFF-DCD3-4F9C-9AD5-91AF0392189A} = 213.136.96.2 213.136.96.37
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-28 02:09
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1048)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
.
**************************************************************************
.
Heure de fin: 2009-09-28 2:10 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-09-28 02:10

Avant-CF: 147 074 240 512 octets libres
Après-CF: 147 203 145 728 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

143

Merci d'avance et à plus

   
Répondre à foxy_will

4

Xplode, le 28 sep 2009 à 13:09:13

Ok, fais ceci maintenant :

-----------------------------------

- Télécharge OTMoveIt (de Old_Timer) http://up.sur-la-toile.com/ik3a sur ton Bureau.

- Double-clique sur OTMoveIt.exe
- Assure toi que la case Unregister Dll's and Ocx's soit bien cochée
- Copie le texte en gras ci dessous et colle le dans le cadre de gauche de OTMoveIt nommé Paste List of Files/Folders to be moved

:processes
explorer.exe
windo.exe
myapp.exe
wuauc1t.exe

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio­n\Run]
"MARCLESAINT"=-
"DRIVESYS"=-
"DRIVESYS1"=-

:files
C:\WINDOWS\system32\wuauc1t.exe
C:\Windows\System32\bycool1\windo.exe
C:\Windows\System32\bycool\winacces.exe
C:\WINDOWS\MARCLESAINT.vbs

:commands
[emptytemp]
[purity]
[start explorer]


- Clique sur MoveIt! pour lancer la suppression.
- Si OTMoveIt propose de redémarrer ton PC, accepte.
- Lorsque un résultat apparaît dans le cadre Results, clique sur Exit.
- Dans ta future réponse, envoie le rapport de OTMoveIt situé sur C:\_OTMoveIt\MovedFiles

-----------------------------------

Malwarebyte's anti-malware ----->

[x] Télécharge Malwarebyte's anti-malware (MBAM) à cette adresse : http://www.malwarebytes.org/mbam/program/mbam-setup.exe

[x] Installe le

[x] Coche bien tout les éléments trouvés et supprime les !

[x] Un tutoriel pour son utilisation est disponible ici : http://www.malekal.com/tutorial_MalwareBytes_AntiMalware.php

[x] Suis les indications données sur le lien précédent puis copie/colle le rapport généré dans ton prochain message

   
Répondre à Xplode

5

foxy_will, le 28 sep 2009 à 20:28:37

D'accord
ben voici le premier log de OTmovelt
je te colle celui de malwarebyte à la suite : merci encore

========== PROCESSES ==========
Process explorer.exe killed successfully.
Unable to kill process: windo.exe
Unable to kill process: myapp.exe
Unable to kill process: wuauc1t.exe
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio­­n\Run not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio­­n\Run not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio­­n\Run not found.
========== FILES ==========
File/Folder C:\WINDOWS\system32\wuauc1t.exe not found.
File/Folder C:\Windows\System32\bycool1\windo.exe not found.
File/Folder C:\Windows\System32\bycool\winacces.exe not found.
File/Folder C:\WINDOWS\MARCLESAINT.vbs not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\hpodvd09.log scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\~DFD8AA.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\cch~5e986ebfb888.htp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\cch~5e986eda0548.htp scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 09282009_181847

Files moved on Reboot...
C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\hpodvd09.log moved successfully.
C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\~DFD8AA.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\cch~5e986ebfb888.htp not found!
File C:\WINDOWS\temp\cch~5e986eda0548.htp not found!
:::::::::::::::::::::::::::::::::::

   
Répondre à foxy_will

8

foxy_will, le 28 sep 2009 à 22:14:53

Le lien fonctionne pas je cherche une autre source je fais le travail et je poste le log a tte :)

   
Répondre à foxy_will

6

foxy_will, le 28 sep 2009 à 21:08:08

Slt!!!
voici le log de malwarebytes
::::::::::::::::::::::::::::::::::
Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2868
Windows 5.1.2600 Service Pack 2 (Safe Mode)

28/09/2009 19:02:27
mbam-log-2009-09-28 (19-02-27).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|)
Eléments examinés: 130641
Temps écoulé: 11 minute(s), 37 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::
merci encoe , la machine respire dejà mieux!

   
Répondre à foxy_will

7

Xplode, le 28 sep 2009 à 21:10:37

USBfix ------>

[x] Télécharge USBfix à cette adresse : http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe

[x] Un tutoriel est disponible ici : http://www.malekal.com/tutorial_USBFix.php

[x] Installe le

[x] Branche tout tes médias amovibles ( clés USB, DD externe )

[x] Lance USBfix en cliquant sur l'icône qui est sur ton bureau ( Clique droit -> Executer en tant qu'administrateur pour vista )

[x] Choisis l'option F ( pour français ) et valide en appuyant sur entrée.

[x] Au menu principal, choisi l'option 1

[x] Laisse l'outil travailler puis poste le rapport dans ton prochain message

   
Répondre à Xplode

9

foxy_will, le 28 sep 2009 à 22:37:53

Bon apparement usbfix n'est pas telechargeable actu, mais je dois l'avoir sur une de mes sauvegarde, me reste plus qu'a trouver!

   
Répondre à foxy_will

10

Xplode, le 29 sep 2009 à 17:21:54

Des nouvelles concernant USBfix ?

   
Répondre à Xplode

11

foxy-will, le 1 oct 2009 à 15:29:46

Non j'arrive pas a trouver usbfix.exe et là g tous les soucis maintenant avec les ports usb

   
Répondre à foxy-will

12

Xplode, le 1 oct 2009 à 16:52:18

Fais ceci :

[x] Lance hijackthis ( C:\Program Files\Trend Micro\Hijackthis.exe )

[x] Clique sur " None of the above, just start the program " puis sur " Scan "

[x] Coche les lignes en gras ci dessous :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MARCLESAINT ENCORE CHEZ VOUS --- MERCI DE ME FAIRE CONNAITRE--- PARTAGEZ MON VIRUS AVEC VOS AMIS
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = MARCLESAINT ENCORE CHEZ VOUS --- MERCI DE ME FAIRE CONNAITRE--- PARTAGEZ MON VIRUS AVEC VOS AMIS
O4 - HKLM\..\Run: [DRIVESYS1] C:\Windows\System32\bycool1\windo.exe
O4 - HKLM\..\Run: [DRIVESYS] C:\Windows\System32\bycool\winacces.exe
O4 - HKLM\..\Run: [MARCLESAINT] C:\WINDOWS\MARCLESAINT.vbs


[x] Clique ensuite sur " Fix checked "

-----------------

Trojan Remover ---->

[x] Télécharge Trojan Remover à cette adresse : http://dl.commentcamarche.net/www.commentcamarche.net/download/files/trjsetup681.exe

[x] Lance l'installation, coche " Créer un raccourci sur le bureau "

[x] A la fin de l'installation, laisse coché " Vérifier les MaJ " puis clique sur " Terminer "

[x] Clique ensuite sur " Update " , puis sur " Close " à la fin de la MaJ

[x] Lance Trojan Remover qui se trouve sur ton bureau, puis clique sur " Continue "

[x] Clique ensuite sur " Scan " et laisse le logiciel scanner ton PC

[x] A la fin du scan, supprime les trojans détectés.

[x] Clique enfin sur " File " puis " View logfile "

[x] Créer un nouveau document texte " Rapport.txt " et copie/colle le contenu du rapport de TrojanRemover dedans

[x] Enregistre le sur ton bureau

[x] Va ensuite sur ce site : http://www.cijoint.fr/

[x] Clique sur " Parcourir " et séléctionne le fichier Rapport.txt ( sur ton bureau )

[x] Clique ensuite sur " Cliquez ici pour déposer le fichier "

[x] Copie le lien qui s'affichera dans ton prochain post.

   
Répondre à Xplode

13

foxy_will, le 1 oct 2009 à 19:57:01

Slt!
je n'ai pas ces lignes
voici le nouveau lo de hijack

::::::::::::::::::::::::::::::::
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:55:10, on 01/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\USB TV\EM28XX\BDARemote.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Pr DONGUI\Bureau\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ci/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BDARemote.lnk = C:\Program Files\USB TV\EM28XX\BDARemote.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/MaConfig_3_5_3_0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5F75EFF-DCD3-4F9C-9AD5-91AF0392189A}: NameServer = 213.136.96.2 213.136.96.37
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Ma-Config Service (maconfservice) - Unknown owner - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
End of file - 7122 bytes

   
Répondre à foxy_will

14

Xplode, le 1 oct 2009 à 20:10:38

Le rapport de trojan remover ?

   
Répondre à Xplode

15

foxy_will, le 3 oct 2009 à 20:45:56

Slt
log de T-R
***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.8.0.2586. For information, email support@simplysup.com
[Unregistered version]
Scan started at: 18:26:27 03 oct. 2009
Using Database v7370
Operating System: Windows XP Professional (SP2) [Build: 5.1.2600]
File System: NTFS
UserData directory: C:\Documents and Settings\Pr DONGUI\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Documents and Settings\All Users\Application Data\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Documents and Settings\Pr DONGUI\Mes documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************­

************************************************************­
18:26:27: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************­
18:26:28: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [Explorer.exe]
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1036288 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\WINDOWS\system32\userinit.exe,]
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
25088 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
Key value: [logonui.exe]
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
515584 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: AVP
Value Data: "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
208616 bytes
Created: 11/11/2008 19:59
Modified: 27/09/2009 23:05
Company: Kaspersky Lab
--------------------
Value Name: Home Theater SchSvr
Value Data: "C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe"
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe
106496 bytes
Created: 28/09/2009 03:37
Modified: 20/10/2005 06:10
Company: InterVideo Inc.
--------------------
Value Name: WINREMOTE
Value Data: "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
262144 bytes
Created: 28/09/2009 03:38
Modified: 20/10/2005 05:02
Company: InterVideo Inc.
--------------------
Value Name: StartCCC
Value Data: "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
61440 bytes
Created: 21/07/2009 11:00
Modified: 21/07/2009 11:00
Company: Advanced Micro Devices, Inc.
--------------------
Value Name: HP Software Update
Value Data: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
49152 bytes
Created: 11/05/2005 23:12
Modified: 11/05/2005 23:12
Company: Hewlett-Packard Co.
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
35696 bytes
Created: 27/02/2009 17:10
Modified: 27/02/2009 17:10
Company: Adobe Systems Incorporated
--------------------
Value Name: Malwarebytes Anti-Malware (reboot)
Value Data: "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
1312080 bytes
Created: 28/09/2009 18:38
Modified: 10/09/2009 14:53
Company: Malwarebytes Corporation
--------------------
Value Name: AGRSMMSG
Value Data: AGRSMMSG.exe
C:\WINDOWS\AGRSMMSG.exe
88363 bytes
Created: 29/06/2004 09:06
Modified: 29/06/2004 09:06
Company: Agere Systems
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
1067912 bytes
Created: 03/10/2009 18:19
Modified: 03/08/2009 14:36
Company: Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty

************************************************************
18:26:30: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File: shell32.dll - this file is expected and has been left in place
----------

************************************************************
18:26:30: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
18:26:31: Scanning -----ACTIVE SCREENSAVER-----
No active ScreenSaver found to scan.

************************************************************
18:26:31: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----

************************************************************
18:26:31: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: srservice
Path: %SystemRoot%\system32\srsvc.dll
C:\WINDOWS\system32\srsvc.dll
171008 bytes
Created: 27/09/2009 20:46
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
--------------------
Key: wuauserv
Path: C1\WINDOWS\system32\wuauserv.dll
C1\WINDOWS\system32\wuauserv.dll - [file not found to scan]
--------------------

************************************************************
18:26:32: Scanning ----- SERVICES REGISTRY KEYS -----
Key: 3xHybrid
ImagePath: system32\DRIVERS\3xHybrid.sys
C:\WINDOWS\system32\DRIVERS\3xHybrid.sys
2825088 bytes
Created: 14/02/2006 18:07
Modified: 14/02/2006 18:07
Company: ASUSTek
----------
Key: adiusbaw
ImagePath: system32\DRIVERS\adiusbaw.sys
C:\WINDOWS\system32\DRIVERS\adiusbaw.sys
118552 bytes
Created: 03/10/2009 17:36
Modified: 07/02/2007 16:50
Company: Analog Devices Inc.
----------
Key: AVP
ImagePath: "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" -r
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
208616 bytes
Created: 11/11/2008 19:59
Modified: 27/09/2009 23:05
Company: Kaspersky Lab
----------
Key: catchme
ImagePath: \??\C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\catchme.sys - this file is globally excluded
----------
Key: driverhardwarev2
ImagePath: \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
14336 bytes
Created: 23/09/2009 14:53
Modified: 23/09/2009 14:53
Company: CybelSoft
----------
Key: ELOADER
ImagePath: System32\Drivers\adildr.sys
C:\WINDOWS\System32\Drivers\adildr.sys
56088 bytes
Created: 03/10/2009 17:36
Modified: 07/02/2007 16:50
Company: Analog Deivces
----------
Key: GMSIPCI
ImagePath: \??\J:\INSTALL\GMSIPCI.SYS - this file is globally excluded
----------
Key: HPZid412
ImagePath: system32\DRIVERS\HPZid412.sys
C:\WINDOWS\system32\DRIVERS\HPZid412.sys
-R- 51120 bytes
Created: 28/09/2009 10:48
Modified: 08/03/2005 04:43
Company: HP
----------
Key: HPZipr12
ImagePath: system32\DRIVERS\HPZipr12.sys
C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
-R- 16496 bytes
Created: 28/09/2009 10:48
Modified: 08/03/2005 04:43
Company: HP
----------
Key: HPZius12
ImagePath: system32\DRIVERS\HPZius12.sys
C:\WINDOWS\system32\DRIVERS\HPZius12.sys
-R- 21744 bytes
Created: 28/09/2009 10:47
Modified: 08/03/2005 04:43
Company: HP
----------
Key: ImapiService
ImagePath: %systemroot%\system32\imapi.exe
C:\WINDOWS\system32\imapi.exe
150016 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------
Key: klbg
ImagePath: system32\drivers\klbg.sys
C:\WINDOWS\system32\drivers\klbg.sys
33808 bytes
Created: 29/01/2008 17:29
Modified: 27/09/2009 23:05
Company: Kaspersky Lab
----------
Key: KLFLTDEV
ImagePath: system32\DRIVERS\klfltdev.sys
C:\WINDOWS\system32\DRIVERS\klfltdev.sys
26640 bytes
Created: 13/03/2008 18:02
Modified: 13/03/2008 18:02
Company: Kaspersky Lab
----------
Key: maconfservice
ImagePath: "C:\Program Files\ma-config.com\maconfservice.exe"
C:\Program Files\ma-config.com\maconfservice.exe
238960 bytes
Created: 23/09/2009 14:50
Modified: 23/09/2009 14:50
Company: CybelSoft
----------
Key: odserv
ImagePath: "C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE"
C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE
441136 bytes
Created: 26/10/2006 19:49
Modified: 26/10/2006 19:49
Company: Microsoft Corporation
----------
Key: ose
ImagePath: "C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE"
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
145184 bytes
Created: 26/10/2006 14:03
Modified: 26/10/2006 14:03
Company: Microsoft Corporation
----------
Key: Pml Driver HPZ12
ImagePath: C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\HPZipm12.exe
73728 bytes
Created: 28/09/2009 10:39
Modified: 09/08/2007 07:27
Company: HP
----------
Key: Secdrv
ImagePath: system32\DRIVERS\secdrv.sys
C:\WINDOWS\system32\DRIVERS\secdrv.sys
27440 bytes
Created: 17/07/2004 11:36
Modified: 17/07/2004 11:36
Company: [no info]
----------
Key: SwPrv
ImagePath: C:\WINDOWS\system32\dllhost.exe /Processid:{5696AE86-18E0-4390-9E07-61C06B3CE898}
C:\WINDOWS\system32\dllhost.exe
5120 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------

************************************************************
18:26:35: Scanning -----VXD ENTRIES-----

************************************************************
18:26:35: Scanning ----- WINLOGON\NOTIFY DLLS -----

************************************************************
18:26:36: Scanning ----- CONTEXTMENUHANDLERS -----
Key: Kaspersky Anti-Virus
CLSID: {dd230880-495a-11d1-b064-008048ec2fc5}
Path: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ShellEx.dll
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ShellEx.dll
39688 bytes
Created: 11/11/2008 20:00
Modified: 11/11/2008 20:00
Company: Kaspersky Lab
----------
Key: ShellExtension
CLSID: [empty]
----------

************************************************************
18:26:36: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key: {F9DB5320-233E-11D1-9F84-707F02C10627}
File: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
378200 bytes
Created: 27/02/2009 12:16
Modified: 27/02/2009 12:16
Company: Adobe Systems, Inc.
----------

************************************************************
18:26:36: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}
BHO: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
62728 bytes
Created: 11/11/2008 19:59
Modified: 11/11/2008 19:59
Company: Kaspersky Lab
----------
Key: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
BHO: C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
160496 bytes
Created: 28/07/2008 10:47
Modified: 28/07/2008 10:47
Company: Yahoo! Inc
----------

************************************************************
18:26:37: Scanning ----- SHELLSERVICEOBJECTS -----
Key: SysTray
CLSID: {35CEC8A3-2BE6-11D2-8773-92E220524153}
Path: %systemroot%\system32\stobject.dll
C:\WINDOWS\system32\stobject.dll
122368 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
----------

************************************************************
18:26:37: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
18:26:37: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
18:26:37: Scanning ----- APPINIT_DLLS -----
No APPINIT_DLLS value found to check

************************************************************
18:26:37: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
18:26:37: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
The Common Startup Group attempts to load the following file(s) at boot time:
BDARemote.lnk - links to C:\PROGRA~1\USBTV~1\EM28XX\BDAREM~1.EXE
C:\PROGRA~1\USBTV~1\EM28XX\BDAREM~1.EXE
81997 bytes
Created: 27/09/2009 23:00
Modified: 26/06/2007 12:22
Company: [no info]
--------------------
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
-HS- 84 bytes
Created: 27/09/2002 19:36
Modified: 27/09/2009 20:49
Company: [no info]
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini - no action taken on this file
--------------------
DSLMON.lnk - links to C:\PROGRA~1\SAGEM\SAGEMF~1\dslmon.exe
C:\PROGRA~1\SAGEM\SAGEMF~1\dslmon.exe
1205840 bytes
Created: 03/10/2009 17:36
Modified: 13/02/2007 16:20
Company:
--------------------

************************************************************
No User Startup Groups were located to check

************************************************************
18:26:38: Scanning ----- SCHEDULED TASKS -----
No Scheduled Tasks found to scan

************************************************************
18:26:38: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

************************************************************
18:26:38: Scanning ----- DEVICE DRIVER ENTRIES -----

************************************************************
18:26:38: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Documents and Settings\Pr DONGUI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Pr DONGUI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
1440054 bytes
Created: 28/09/2009 02:18
Modified: 28/09/2009 02:19
Company: [no info]
----------
Web Desktop Wallpaper: %USERPROFILE%\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Pr DONGUI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
1440054 bytes
Created: 28/09/2009 02:18
Modified: 28/09/2009 02:19
Company: [no info]
----------
DNS Server information:
Interface:
NameServers: 213.136.96.2 213.136.96.37
Checks for rogue DNS NameServers completed
----------
Additional checks completed

************************************************************
18:26:39: Scanning ----- RUNNING PROCESSES -----

C:\WINDOWS\System32\smss.exe
50688 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\csrss.exe
6144 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\winlogon.exe
506368 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\services.exe
111104 bytes
Created: 19/08/2004 16:10
Modified: 09/02/2009 10:08
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\lsass.exe
13312 bytes
Created: 19/08/2004 16:09
Modified: 19/08/2004 16:09
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\Ati2evxx.exe
602112 bytes
Created: 22/03/2006 03:48
Modified: 21/07/2009 15:42
Company: ATI Technologies Inc.
--------------------
C:\WINDOWS\system32\svchost.exe
14336 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\Ati2evxx.exe - file already scanned
--------------------
C:\WINDOWS\system32\spoolsv.exe
57856 bytes
Created: 19/08/2004 16:10
Modified: 19/08/2004 16:10
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\Explorer.EXE - file already scanned
--------------------
C:\WINDOWS\system32\HPZipm12.exe - file already scanned
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe - file already scanned
--------------------
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe - file already scanned
--------------------
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
49152 bytes
Created: 18/12/2008 14:32
Modified: 18/12/2008 14:32
Company: Advanced Micro Devices Inc.
--------------------
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe - file already scanned
--------------------
C:\WINDOWS\AGRSMMSG.exe - file already scanned
--------------------
C:\Program Files\USB TV\EM28XX\BDARemote.exe
81997 bytes
Created: 27/09/2009 23:00
Modified: 26/06/2007 12:22
Company: [no info]
--------------------
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
1205840 bytes
Created: 03/10/2009 17:36
Modified: 13/02/2007 16:20
Company:
--------------------
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
49152 bytes
Created: 18/12/2008 13:19
Modified: 18/12/2008 13:19
Company: ATI Technologies Inc.
--------------------
C:\Program Files\Mozilla Firefox\firefox.exe
908280 bytes
Created: 29/09/2009 12:56
Modified: 24/08/2009 20:19
Company: Mozilla Corporation
--------------------
C:\WINDOWS\system32\wbem\wmiprvse.exe
227840 bytes
Created: 27/09/2009 20:44
Modified: 06/02/2009 16:39
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\wbem\wmiprvse.exe - file already scanned
--------------------
C:\Documents and Settings\Pr DONGUI\Application Data\Simply Super Software\Trojan Remover\mnw2A.exe
FileSize: 3036024
[This is a Trojan Remover component]
--------------------

************************************************************
18:26:44: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
=== NO CHANGES HAVE BEEN MADE TO YOUR SYSTEM FILES ===
Scan completed at: 18:26:44 03 oct. 2009
Total Scan time: 00:00:16
************************************************************

   
Répondre à foxy_will

16

Xplode, le 3 oct 2009 à 20:50:44

Réessaye USBfix maintenant.

   
Répondre à Xplode

17

foxy_will, le 4 oct 2009 à 15:55:55

Trouve pas de lien pour download usbfix

   
Répondre à foxy_will

18

Xplode, le 4 oct 2009 à 16:02:29

-+-+-+-> USBfix <-+-+-+-


[x] Télécharge USBfix à cette adresse : http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe

[x] Un tutoriel est disponible ici : http://www.malekal.com/tutorial_USBFix.php

[x] Installe le

[x] Branche tout tes médias amovibles ( clés USB, DD externe )

[x] Lance USBfix en cliquant sur l'icône qui est sur ton bureau ( Clique droit -> Executer en tant qu'administrateur pour vista )

[x] Choisis l'option F ( pour français ) et valide en appuyant sur entrée.

[x] Au menu principal, choisi l'option 1

[x] Laisse l'outil travailler puis poste le rapport dans ton prochain message

   
Répondre à Xplode

19

foxy_will, le 7 oct 2009 à 17:06:59

Merci Xplode! le pb est resolu
Que Dieu te garde, mais laisse beton usbfix les liens ne march pas avec mw!

   
Répondre à foxy_will

20

Xplode, le 7 oct 2009 à 17:13:01

Il faut que tu passes USBfix, tu as une infection usb..

   
Répondre à Xplode

21

foxy_will, le 7 oct 2009 à 17:17:46

Qauf que les liens que tu m'as mis passent pas, si tu l'as peut etre que tu p me l'envoyer par mail?

   
Répondre à foxy_will

22

Xplode, le 7 oct 2009 à 17:18:50

Essaie de le télécharger ici : http://usbfix.softonic.fr/

   
Répondre à Xplode

23

foxy_will, le 7 oct 2009 à 17:25:04

J'avais dejà essayer labas mais j'essaie encore

   
Répondre à foxy_will

24

Xplode, le 7 oct 2009 à 17:26:41

Ca te fais quoi comme message d'erreur ?

   
Répondre à Xplode

25

foxy_will, le 7 oct 2009 à 17:40:52

Oui je recois un message d'erreur quelque soit le site ou je vais le telecharger, mais jai pas ce pb avec les autres telechargements.

   
Répondre à foxy_will

26

foxy_will, le 7 oct 2009 à 17:41:34

Wi
C:\Documents and Settings\Pr DONGUI\Mes documents\Téléchargements\UsbFix.exe ne pourra être enregistré car le fichier source ne peut être lu.

Réessayez plus tard ou contactez l'administrateur du serveur.

   
Répondre à foxy_will

27

Xplode, le 7 oct 2009 à 17:43:58

Peux-tu refaire un rapport RSIT ?

   
Répondre à Xplode

29

 foxy_will, le 7 oct 2009 à 17:58:47

2eme log
info.txt logfile of random's system information tool 1.06 2009-10-07 15:51:38

======Uninstall list======

-->"C:\Program Files\InstallShield Installation Information\{1A91D1FA-B9B3-4556-9878-5C61059A19B2}\setup.exe" REMOVEALL
-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{89AD2814-AFA2-46AF-AE53-C27196D9FBE6}\setup.exe" REMOVEALL
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AAA4CCCE-78DB-47B0-A651-68270D838BD4}\setup.exe" REMOVEALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.65-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Agere Systems PCI Soft Modem-->agrsmdel
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ASUS Hybrid Capture Device-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6FB17451-D5A4-4651-AC17-A6713F7234BA}\Setup.exe" -l0x9
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI AVIVO Codecs-->MsiExec.exe /I{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x575c
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Catalyst Control Center - Branding-->MsiExec.exe /I{D9D93D74-107D-4BD3-87D0-AABCF7C98BD5}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Color LaserJet 2600n-->C:\Program Files\Zenographics\{189F866C-1589-4CFB-B8C4-C2EB5AF38F84}\setup.exe -u "HPCLJKCInstaller.dll=CLJ2600.INF"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
HP Extended Capabilities 5.3-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Image Zone Express-->MsiExec.exe /X{FE64AE29-0883-4C70-8388-DC026019C900}
HP Imaging Device Functions 5.3-->C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat
HP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC}
HP Product Detection-->MsiExec.exe /X{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}
HP PSC & OfficeJet 5.3.B-->"C:\Program Files\HP\Digital Imaging\{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}\setup\hpzscr01.exe" -datfile hposcr07.dat
HP Software Update-->MsiExec.exe /X{15EE79F4-4ED1-4267-9B0F-351009325D7D}
HP Solution Center & Imaging Support Tools 5.3-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
InterVideo Home Theater-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F7514465-E5F3-48E9-A952-327DAEF33DE6}\setup.exe" REMOVEALL
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
Ma-Config.com-->MsiExec.exe /X{425FFD94-36BD-4933-881B-FE0B9DADF2B7}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9L$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944338-v2)-->"C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958470)-->"C:\WINDOWS\$NtUninstallKB958470$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971032)-->"C:\WINDOWS\$NtUninstallKB971032$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB972260)-->"C:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Mozilla Firefox (3.5.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Package de pilotes Windows - Advanced Micro Devices, Inc. (USB28xxBGA) Media (08/31/2007 5.7.0831.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst32.exe /u C:\WINDOWS\system32\DRVSTORE\embda_754491038463AF55DC013DBF40581C2B1BFEE429\embda.inf
Package de pilotes Windows - eMPIA Technology Inc, (emAudio) MEDIA (08/31/2007 5.7.0831.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst32.exe /u C:\WINDOWS\system32\DRVSTORE\emaudio_754491038463AF55DC013DBF40581C2B1BFEE429\emaudio.inf
REALTEK GbE & FE Ethernet PCI NIC Driver-->C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe -runfromtemp -removeonly
SAGEM F@st 800-840-->C:\Program Files\InstallShield Installation Information\{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}\setup.exe -runfromtemp -l0x040c -removeonly
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Sonic Express Labeler-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Sonic MyDVD Plus-->MsiExec.exe /I{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic RecordNow Audio-->MsiExec.exe /I{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Outlook 2007 Junk Email Filter (kb973514)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {03B11C77-336F-43B4-9B43-79890BA84504}
USB Video Driver-->C:\Program Files\InstallShield Installation Information\{2758691A-2CDE-4942-A4AC-0E8F61FE2067}\setup.exe -runfromtemp -l0x040c -removeonly
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Support Tools-->MsiExec.exe /I{89B078C4-50B0-453E-BF53-3A7E6A0D85FA}
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE

======Security center information======

AV: Kaspersky Internet Security (outdated)
FW: Kaspersky Internet Security

======System event log======

Computer Name: CFC-035255AA9E8
Event Code: 7036
Message: Le service Téléphonie est entré dans l'état : en cours d'exécution.

Record Number: 257
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User:

Computer Name: CFC-035255AA9E8
Event Code: 7036
Message: Le service Service de découvertes SSDP est entré dans l'état : en cours d'exécution.

Record Number: 256
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User:

Computer Name: CFC-035255AA9E8
Event Code: 7036
Message: Le service NLA (Network Location Awareness) est entré dans l'état : en cours d'exécution.

Record Number: 255
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User:

Computer Name: CFC-035255AA9E8
Event Code: 7036
Message: Le service Compatibilité avec le Changement rapide d'utilisateur est entré dans l'état : en cours d'exécution.

Record Number: 254
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User:

Computer Name: CFC-035255AA9E8
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service de découvertes SSDP.

Record Number: 253
Source Name: Service Control Manager
Time Written: 20090927220459.000000+000
Event Type: Informations
User: AUTORITE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\Support Tools;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 3, GenuineIntel
"PROCESSOR_REVISION"=0403
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"SonicCentral"=C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\

-----------------EOF-----------------

   
Répondre à foxy_will

28

foxy_will, le 7 oct 2009 à 17:54:28

Logfile of random's system information tool 1.06 (written by random/random)
Run by Pr DONGUI at 2009-10-07 15:50:40
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 132 GB (90%) free of 146 GB
Total RAM: 1023 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:51:37, on 07/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\USB TV\EM28XX\BDARemote.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Pr DONGUI\Mes documents\Téléchargements\RSIT.exe
C:\Program Files\trend micro\Pr DONGUI.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ci/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINREMOTE] "C:\Program Files\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BDARemote.lnk = C:\Program Files\USB TV\EM28XX\BDARemote.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/MaConfig_3_5_3_0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5F75EFF-DCD3-4F9C-9AD5-91AF0392189A}: NameServer = 213.136.96.2 213.136.96.37
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
End of file - 6110 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2008-11-11 62728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [2008-07-28 160496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-09-27 208616]
"Home Theater SchSvr"=C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe [2005-10-20 106496]
"WINREMOTE"=C:\Program Files\InterVideo\Common\Bin\WinRemote.exe [2005-10-20 262144]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-07-21 61440]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2005-05-11 49152]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]
"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2004-06-29 88363]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-08-19 1667584]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-19 15360]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
BDARemote.lnk - C:\Program Files\USB TV\EM28XX\BDARemote.exe
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-07-21 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2008-11-11 218376]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDriveAutoRun"=
"NoDrives"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ma-config.com\maconfservice.exe"="C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\WINDOWS\system32\wscntfy.exe"="C:\WINDOWS\system32\wscntfy.exe:*:Enabled:ipsec"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{641f0f12-b205-11de-9c01-00142aeb0746}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL vIUOqU.EXe


======List of files/folders created in the last 1 months======

2009-10-07 15:50:40 ----D---- C:\rsit
2009-10-07 15:50:40 ----D---- C:\Program Files\trend micro
2009-10-03 18:26:09 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-10-03 17:36:18 ----A---- C:\WINDOWS\Fast800.ini
2009-10-03 17:36:18 ----A---- C:\WINDOWS\adidsl.ini
2009-10-03 17:36:10 ----A---- C:\WINDOWS\adirasx64.exe
2009-10-03 17:36:10 ----A---- C:\WINDOWS\adiras.exe
2009-10-03 17:36:09 ----A---- C:\WINDOWS\system32\IPDETECT.EXE
2009-10-03 17:36:09 ----A---- C:\WINDOWS\system32\adadix32.dll
2009-10-03 17:36:07 ----A---- C:\WINDOWS\system32\coclassfast.dll
2009-10-03 17:36:07 ----A---- C:\WINDOWS\enddisk32.exe
2009-10-03 17:36:07 ----A---- C:\WINDOWS\autoclk.exe
2009-10-03 17:36:06 ----A---- C:\WINDOWS\system32\unaddrv.x64.exe
2009-10-03 17:36:06 ----A---- C:\WINDOWS\system32\unaddrv.exe
2009-10-03 17:36:06 ----A---- C:\WINDOWS\system32\ADADIX2K.DLL
2009-10-03 17:36:06 ----A---- C:\WINDOWS\system32\ADADIX16.DLL
2009-10-03 17:35:58 ----D---- C:\Program Files\SAGEM
2009-10-03 17:35:55 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\InstallShield
2009-10-03 17:32:08 ----D---- C:\WINDOWS\system32\appmgmt
2009-10-03 17:10:39 ----SHD---- C:\RECYCLER
2009-10-03 17:02:23 ----D---- C:\WINDOWS\temp
2009-10-03 16:40:33 ----A---- C:\WINDOWS\system32\nircmd.exe
2009-10-03 16:31:06 ----A---- C:\WINDOWS\system32\MRT.exe
2009-10-02 23:30:18 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-10-02 23:30:07 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-10-02 23:30:00 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-10-02 23:29:54 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-10-02 23:29:45 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-10-02 23:29:39 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2009-10-02 23:29:32 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$
2009-10-02 23:29:10 ----HDC---- C:\WINDOWS\$NtUninstallKB972260$
2009-10-02 23:29:02 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-10-02 23:28:54 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2009-10-02 23:28:47 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2009-10-02 23:28:42 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-10-02 23:28:31 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$
2009-10-02 23:28:27 ----D---- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2009-10-02 23:28:07 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-10-02 23:27:58 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2009-10-02 23:27:52 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-10-02 23:27:44 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-10-02 23:27:39 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-10-02 23:27:34 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-10-02 23:27:28 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-10-02 23:27:21 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2009-10-02 23:27:12 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9L$
2009-10-02 23:27:06 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-10-02 23:26:57 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2009-10-02 23:26:41 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-10-02 23:26:32 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-10-02 23:26:27 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-10-02 23:26:21 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-10-02 23:26:14 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2009-10-02 23:26:02 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-10-02 23:25:55 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-10-02 23:25:23 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-10-02 23:25:17 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2009-10-02 23:25:10 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-10-02 23:25:01 ----D---- C:\WINDOWS\ServicePackFiles
2009-10-02 23:24:59 ----HDC---- C:\WINDOWS\$NtUninstallKB958470$
2009-10-02 23:24:53 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-10-02 23:24:47 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2009-10-02 23:24:39 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-10-02 23:24:28 ----HDC---- C:\WINDOWS\$NtUninstallKB971032$
2009-10-02 23:24:22 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-10-02 23:24:13 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-10-02 23:24:07 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-10-02 23:24:00 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-10-02 23:23:54 ----D---- C:\Program Files\MSXML 4.0
2009-10-01 22:31:33 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2009-10-01 22:31:25 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-10-01 22:31:15 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-10-01 20:22:46 ----D---- C:\WINDOWS\system32\CatRoot_bak
2009-10-01 18:38:19 ----N---- C:\WINDOWS\system32\tzchange.exe
2009-10-01 18:32:47 ----D---- C:\!KillBox
2009-10-01 18:26:49 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\WinRAR
2009-10-01 18:26:34 ----D---- C:\Program Files\WinRAR
2009-10-01 17:27:04 ----A---- C:\WINDOWS\system32\zlm.dll
2009-10-01 17:27:04 ----A---- C:\WINDOWS\system32\zlhp2600.dll
2009-10-01 17:27:03 ----A---- C:\WINDOWS\system32\ZSPOOL.DLL
2009-09-30 23:09:03 ----D---- C:\WINDOWS\system32\PreInstall
2009-09-30 23:09:02 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-09-30 23:09:01 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-09-30 23:09:01 ----HD---- C:\WINDOWS\$hf_mig$
2009-09-30 21:31:57 ----A---- C:\WINDOWS\system32\zSHP2600.EXE
2009-09-30 20:41:17 ----D---- C:\SoftPaq
2009-09-30 20:36:37 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2009-09-30 20:36:37 ----A---- C:\WINDOWS\system32\mucltui.dll
2009-09-30 15:16:17 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\WinBatch
2009-09-30 15:01:46 ----A---- C:\WINDOWS\system32\PsisDecd.dll
2009-09-30 15:01:45 ----A---- C:\WINDOWS\system32\vfwwdm32.dll
2009-09-30 15:01:45 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-09-30 12:00:37 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\HouseCall 6.6
2009-09-30 12:00:36 ----D---- C:\WINDOWS\system32\HouseCall 6.6
2009-09-30 11:28:25 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-09-30 10:26:28 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\Sonic
2009-09-30 10:26:12 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\Leadertech
2009-09-30 08:49:10 ----A---- C:\WINDOWS\system32\IMF32.DLL
2009-09-30 08:49:08 ----RA---- C:\WINDOWS\system32\vshp2600.dll
2009-09-30 08:49:08 ----RA---- C:\WINDOWS\system32\HP2600IR.dll
2009-09-30 08:49:08 ----A---- C:\WINDOWS\system32\ZTAG32.DLL
2009-09-29 16:04:54 ----D---- C:\Program Files\Real
2009-09-29 14:18:34 ----A---- C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
2009-09-29 14:18:02 ----A---- C:\WINDOWS\HP_48BitScanUpdatePatch.ini
2009-09-29 14:15:08 ----D---- C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2009-09-29 14:06:21 ----A---- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
2009-09-29 12:56:10 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\Mozilla
2009-09-29 12:56:03 ----D---- C:\Program Files\Mozilla Firefox
2009-09-29 12:28:30 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-09-29 11:25:06 ----D---- C:\Program Files\7-Zip
2009-09-29 06:54:29 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\Image Zone Express
2009-09-28 20:11:44 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\Adobe
2009-09-28 20:04:56 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2009-09-28 18:49:31 ----SHD---- C:\WINDOWS\CSC
2009-09-28 18:38:25 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\Malwarebytes
2009-09-28 18:38:19 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-09-28 18:38:19 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-09-28 18:21:17 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\ATI
2009-09-28 18:21:17 ----D---- C:\Documents and Settings\All Users\Application Data\ATI
2009-09-28 10:56:48 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-09-28 10:56:42 ----D---- C:\Program Files\Fichiers communs\Adobe
2009-09-28 10:56:42 ----D---- C:\Program Files\Adobe
2009-09-28 10:53:25 ----D---- C:\Documents and Settings\All Users\Application Data\HP
2009-09-28 10:53:00 ----D---- C:\Program Files\Fichiers communs\HP
2009-09-28 10:48:45 ----D---- C:\Program Files\Fichiers communs\Hewlett-Packard
2009-09-28 10:39:41 ----A---- C:\WINDOWS\system32\HPZipr12.dll
2009-09-28 10:39:41 ----A---- C:\WINDOWS\system32\HPZipm12.exe
2009-09-28 10:39:41 ----A---- C:\WINDOWS\system32\HPZinw12.exe
2009-09-28 10:39:41 ----A---- C:\WINDOWS\system32\HPZidr12.dll
2009-09-28 10:39:40 ----A---- C:\WINDOWS\IsUninst.exe
2009-09-28 10:37:47 ----D---- C:\Config.Msi
2009-09-28 10:37:07 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\HP
2009-09-28 10:15:51 ----A---- C:\WINDOWS\system32\ZTAG.DLL
2009-09-28 10:15:51 ----A---- C:\WINDOWS\system32\zIMF.DLL
2009-09-28 10:15:51 ----A---- C:\WINDOWS\system32\ZHHP2600.EXE
2009-09-28 10:15:51 ----A---- C:\WINDOWS\system32\AGISSI.DLL
2009-09-28 10:15:50 ----A---- C:\WINDOWS\system32\ZHHP_RES.DLL
2009-09-28 10:15:45 ----D---- C:\Program Files\Hewlett-Packard
2009-09-28 10:01:22 ----RSD---- C:\WINDOWS\assembly
2009-09-28 10:00:48 ----D---- C:\WINDOWS\Microsoft.NET
2009-09-28 09:25:41 ----A---- C:\WINDOWS\hpntwksetup.ini
2009-09-28 09:11:39 ----HD---- C:\WINDOWS\PIF
2009-09-28 07:47:07 ----D---- C:\WINDOWS\Cache
2009-09-28 07:39:34 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-09-28 07:39:18 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2009-09-28 05:53:18 ----D---- C:\Program Files\HP
2009-09-28 05:53:15 ----D---- C:\WINDOWS\Downloaded Installations
2009-09-28 05:28:39 ----D---- C:\Program Files\Fichiers communs\ATI Technologies
2009-09-28 05:09:21 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\Macromedia
2009-09-28 03:39:19 ----D---- C:\hp
2009-09-28 03:38:26 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\Intervideo
2009-09-28 03:38:16 ----A---- C:\WINDOWS\system32\gdiplus.dll
2009-09-28 03:38:01 ----A---- C:\WINDOWS\system32\iviIPLW7.dll
2009-09-28 03:38:01 ----A---- C:\WINDOWS\system32\iviIPLPX.dll
2009-09-28 03:38:01 ----A---- C:\WINDOWS\system32\iviIPLP6.dll
2009-09-28 03:38:01 ----A---- C:\WINDOWS\system32\iviIPLM6.dll
2009-09-28 03:38:00 ----A---- C:\WINDOWS\system32\iviIPLM5.dll
2009-09-28 03:38:00 ----A---- C:\WINDOWS\system32\iviIPLA6.dll
2009-09-28 03:38:00 ----A---- C:\WINDOWS\system32\iviIPL.dll
2009-09-28 03:37:55 ----D---- C:\Documents and Settings\All Users\Application Data\InterVideo
2009-09-28 03:37:51 ----A---- C:\WINDOWS\system32\WSTDEC.dll
2009-09-28 03:37:50 ----A---- C:\WINDOWS\system32\VbiCallback.dll
2009-09-28 03:37:50 ----A---- C:\WINDOWS\system32\IVIresizeW7.dll
2009-09-28 03:37:50 ----A---- C:\WINDOWS\system32\IVIresizePX.dll
2009-09-28 03:37:50 ----A---- C:\WINDOWS\system32\IVIresizeP6.dll
2009-09-28 03:37:50 ----A---- C:\WINDOWS\system32\IVIresizeM6.dll
2009-09-28 03:37:50 ----A---- C:\WINDOWS\system32\IVIresizeA6.dll
2009-09-28 03:37:50 ----A---- C:\WINDOWS\system32\IVIresize.dll
2009-09-28 03:37:49 ----D---- C:\Program Files\Fichiers communs\InterVideo
2009-09-28 03:37:41 ----D---- C:\Program Files\InterVideo
2009-09-28 03:36:37 ----D---- C:\Program Files\Support Tools
2009-09-28 03:32:08 ----D---- C:\Program Files\Fichiers communs\SureThing Shared
2009-09-28 03:29:34 ----A---- C:\WINDOWS\WININIT.INI
2009-09-28 03:28:51 ----D---- C:\Program Files\Fichiers communs\Roxio Shared
2009-09-28 03:28:47 ----D---- C:\Program Files\Fichiers communs\Sonic Shared
2009-09-28 03:28:40 ----D---- C:\Program Files\Sonic
2009-09-28 03:28:40 ----D---- C:\Program Files\Fichiers communs\TiVo Shared
2009-09-28 03:21:23 ----D---- C:\Program Files\Fichiers communs\Real
2009-09-28 03:20:45 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\Real
2009-09-28 02:05:04 ----A---- C:\Boot.bak
2009-09-28 02:05:00 ----RASHD---- C:\cmdcons
2009-09-28 01:58:49 ----A---- C:\WINDOWS\zip.exe
2009-09-28 01:58:49 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-09-28 01:58:49 ----A---- C:\WINDOWS\SWSC.exe
2009-09-28 01:58:49 ----A---- C:\WINDOWS\SWREG.exe
2009-09-28 01:58:49 ----A---- C:\WINDOWS\sed.exe
2009-09-28 01:58:49 ----A---- C:\WINDOWS\PEV.exe
2009-09-28 01:58:49 ----A---- C:\WINDOWS\NIRCMD.exe
2009-09-28 01:58:49 ----A---- C:\WINDOWS\grep.exe
2009-09-28 01:17:03 ----D---- C:\WINDOWS\ERDNT
2009-09-28 01:15:46 ----D---- C:\Qoobox
2009-09-28 01:12:54 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\Yahoo!
2009-09-28 01:12:54 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2009-09-28 01:12:51 ----D---- C:\Program Files\Yahoo!
2009-09-28 01:12:47 ----D---- C:\Program Files\CCleaner
2009-09-28 01:06:47 ----N---- C:\WINDOWS\system32\ati2sgag.exe
2009-09-27 23:31:02 ----D---- C:\Program Files\Microsoft Works
2009-09-27 23:30:55 ----D---- C:\Program Files\MSBuild
2009-09-27 23:30:46 ----D---- C:\Program Files\Microsoft Visual Studio
2009-09-27 23:30:46 ----D---- C:\Program Files\Fichiers communs\DESIGNER
2009-09-27 23:27:54 ----D---- C:\WINDOWS\SHELLNEW
2009-09-27 23:27:41 ----D---- C:\Program Files\Microsoft Office
2009-09-27 23:27:22 ----RD---- C:\MSOCache
2009-09-27 23:00:17 ----D---- C:\Program Files\DIFX
2009-09-27 23:00:16 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-09-27 23:00:14 ----D---- C:\Program Files\USB TV
2009-09-27 22:59:59 ----D---- C:\Program Files\ATI Technologies
2009-09-27 22:58:27 ----D---- C:\Program Files\Fichiers communs\InstallShield
2009-09-27 22:57:48 ----D---- C:\ATI
2009-09-27 22:30:13 ----HD---- C:\Program Files\Zenographics
2009-09-27 22:16:55 ----D---- C:\Pilotes-pciv92v4v4l
2009-09-27 21:58:14 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-09-27 21:58:05 ----A---- C:\WINDOWS\system32\RtNicProp32.dll
2009-09-27 21:58:04 ----D---- C:\Program Files\Realtek
2009-09-27 21:45:16 ----D---- C:\Program Files\ma-config.com
2009-09-27 21:45:16 ----D---- C:\Documents and Settings\All Users\Application Data\ma-config.com
2009-09-27 21:22:46 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-09-27 21:14:00 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-09-27 21:00:04 ----A---- C:\WINDOWS\adiras.ini
2009-09-27 20:59:59 ----HD---- C:\Program Files\InstallShield Installation Information
2009-09-27 20:57:03 ----D---- C:\Program Files\Kaspersky Lab
2009-09-27 20:57:02 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-09-27 20:54:33 ----D---- C:\Documents and Settings\Pr DONGUI\Application Data\Identities
2009-09-27 20:54:31 ----HD---- C:\Program Files\Uninstall Information
2009-09-27 20:54:26 ----SD---- C:\Documents and Settings\Pr DONGUI\Application Data\Microsoft
2009-09-27 20:54:26 ----ASH---- C:\Documents and Settings\Pr DONGUI\Application Data\desktop.ini
2009-09-27 20:52:58 ----D---- C:\WINDOWS\SoftwareDistribution
2009-09-27 20:52:57 ----D---- C:\WINDOWS\Prefetch
2009-09-27 20:52:56 ----SD---- C:\WINDOWS\system32\Microsoft
2009-09-27 20:49:19 ----D---- C:\WINDOWS\system32\xircom
2009-09-27 20:49:19 ----D---- C:\Program Files\xerox
2009-09-27 20:49:19 ----D---- C:\Program Files\microsoft frontpage
2009-09-27 20:49:03 ----A---- C:\WINDOWS\control.ini
2009-09-27 20:49:03 ----A---- C:\AUTOEXEC.BAT
2009-09-27 20:48:51 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-09-27 20:48:07 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-09-27 20:48:07 ----RD---- C:\WINDOWS\Offline Web Pages
2009-09-27 20:48:07 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-09-27 20:48:02 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-09-27 20:47:58 ----HD---- C:\Program Files\WindowsUpdate
2009-09-27 20:47:55 ----D---- C:\Program Files\Services en ligne
2009-09-27 20:47:39 ----D---- C:\WINDOWS\system32\DirectX
2009-09-27 20:47:19 ----A---- C:\WINDOWS\system32\atrace.dll
2009-09-27 20:47:16 ----A---- C:\WINDOWS\system32\desktop.ini
2009-09-27 20:47:16 ----A---- C:\WINDOWS\desktop.ini
2009-09-27 20:47:10 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2009-09-27 20:47:09 ----D---- C:\Program Files\Fichiers communs\Services
2009-09-27 20:47:09 ----A---- C:\WINDOWS\system32\acctres.dll
2009-09-27 20:47:06 ----SD---- C:\WINDOWS\Tasks
2009-09-27 20:47:06 ----D---- C:\Program Files\Fichiers communs\MSSoap
2009-09-27 20:47:06 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-09-27 20:47:01 ----D---- C:\WINDOWS\srchasst
2009-09-27 20:47:00 ----D---- C:\WINDOWS\system32\Macromed
2009-09-27 20:46:57 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-09-27 20:46:57 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-09-27 20:46:57 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-09-27 20:46:57 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-09-27 20:46:56 ----N---- C:\WINDOWS\system32\wuauclt.exe
2009-09-27 20:46:56 ----A---- C:\WINDOWS\system32\wups.dll
2009-09-27 20:46:56 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-09-27 20:46:56 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-09-27 20:46:56 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-09-27 20:46:56 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-09-27 20:46:56 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-09-27 20:46:55 ----N---- C:\WINDOWS\system32\qmgr.dll
2009-09-27 20:46:55 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-09-27 20:46:50 ----D---- C:\Program Files\Movie Maker
2009-09-27 20:46:47 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-09-27 20:46:47 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-09-27 20:46:47 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-09-27 20:46:47 ----A---- C:\WINDOWS\system32\racpldlg.dll
2009-09-27 20:46:42 ----D---- C:\WINDOWS\system32\Restore
2009-09-27 20:46:42 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-09-27 20:46:42 ----A---- C:\WINDOWS\system32\fltMc.exe
2009-09-27 20:46:42 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-09-27 20:46:41 ----N---- C:\WINDOWS\system32\srsvc.dll
2009-09-27 20:46:41 ----A---- C:\WINDOWS\system32\srclient.dll
2009-09-27 20:46:41 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-09-27 20:46:41 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2009-09-27 20:46:41 ----A---- C:\WINDOWS\system32\ils.dll
2009-09-27 20:46:40 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2009-09-27 20:46:40 ----A---- C:\WINDOWS\system32\msconf.dll
2009-09-27 20:46:40 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-09-27 20:46:37 ----D---- C:\Program Files\NetMeeting
2009-09-27 20:46:37 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-09-27 20:46:37 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-09-27 20:46:36 ----A---- C:\WINDOWS\system32\inetres.dll
2009-09-27 20:46:36 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-09-27 20:46:34 ----N---- C:\WINDOWS\system32\schedsvc.dll
2009-09-27 20:46:34 ----D---- C:\Program Files\Outlook Express
2009-09-27 20:46:34 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-09-27 20:46:34 ----A---- C:\WINDOWS\system32\mstask.dll
2009-09-27 20:46:33 ----A---- C:\WINDOWS\system32\isign32.dll
2009-09-27 20:46:33 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-09-27 20:46:33 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-09-27 20:46:33 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-09-27 20:46:27 ----D---- C:\Program Files\Fichiers communs\System
2009-09-27 20:46:26 ----D---- C:\Program Files\Internet Explorer
2009-09-27 20:45:57 ----D---- C:\Program Files\ComPlus Applications
2009-09-27 20:45:55 ----A---- C:\WINDOWS\vbaddin.ini
2009-09-27 20:45:55 ----A---- C:\WINDOWS\vb.ini
2009-09-27 20:45:51 ----D---- C:\WINDOWS\Registration
2009-09-27 20:45:46 ----D---- C:\Program Files\Online Services
2009-09-27 20:45:45 ----D---- C:\Program Files\Windows Media Player
2009-09-27 20:45:40 ----D---- C:\Program Files\Messenger
2009-09-27 20:45:37 ----D---- C:\Program Files\MSN Gaming Zone
2009-09-27 20:45:37 ----A---- C:\WINDOWS\system32\write.exe
2009-09-27 20:45:29 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-09-27 20:45:29 ----A---- C:\WINDOWS\system32\hticons.dll
2009-09-27 20:45:29 ----A---- C:\WINDOWS\system32\avwav.dll
2009-09-27 20:45:29 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-09-27 20:45:28 ----A---- C:\WINDOWS\system32\winchat.exe
2009-09-27 20:45:28 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-09-27 20:45:23 ----A---- C:\WINDOWS\system32\getuname.dll
2009-09-27 20:45:22 ----A---- C:\WINDOWS\system32\winmine.exe
2009-09-27 20:45:22 ----A---- C:\WINDOWS\system32\sol.exe
2009-09-27 20:45:22 ----A---- C:\WINDOWS\system32\charmap.exe
2009-09-27 20:45:22 ----A---- C:\WINDOWS\system32\calc.exe
2009-09-27 20:45:21 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-09-27 20:45:21 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-09-27 20:45:21 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-09-27 20:45:21 ----A---- C:\WINDOWS\system32\tskill.exe
2009-09-27 20:45:21 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-09-27 20:45:21 ----A---- C:\WINDOWS\system32\tscon.exe
2009-09-27 20:45:21 ----A---- C:\WINDOWS\system32\shadow.exe
2009-09-27 20:45:21 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-09-27 20:45:21 ----A---- C:\WINDOWS\system32\reset.exe
2009-09-27 20:45:21 ----A---- C:\WINDOWS\system32\mshearts.exe
2009-09-27 20:45:21 ----A---- C:\WINDOWS\system32\freecell.exe
2009-09-27 20:45:20 ----A---- C:\WINDOWS\system32\regini.exe
2009-09-27 20:45:20 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-09-27 20:45:20 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-09-27 20:45:20 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-09-27 20:45:20 ----A---- C:\WINDOWS\system32\msg.exe
2009-09-27 20:45:20 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-09-27 20:45:20 ----A---- C:\WINDOWS\system32\logoff.exe
2009-09-27 20:45:20 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-09-27 20:45:19 ----A---- C:\WINDOWS\system32\stclient.dll
2009-09-27 20:45:19 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-09-27 20:45:19 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-09-27 20:45:19 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-09-27 20:45:19 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-09-27 20:45:19 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-09-27 20:45:19 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-09-27 20:45:19 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-09-27 20:45:14 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-09-27 20:44:57 ----D---- C:\Program Files\MSN
2009-09-27 20:44:56 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-09-27 20:44:56 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-09-27 20:44:56 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-09-27 20:44:55 ----D---- C:\Program Files\Windows NT
2009-09-27 20:44:55 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-09-27 20:44:55 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-09-27 20:44:55 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-09-27 20:44:54 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-09-27 20:44:54 ----A---- C:\WINDOWS\system32\spider.exe
2009-09-27 20:44:53 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2009-09-27 20:44:53 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-09-27 20:44:53 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-09-27 20:44:53 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-09-27 20:44:53 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-09-27 20:44:53 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-09-27 20:44:53 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-09-27 20:44:53 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-09-27 20:44:52 ----N---- C:\WINDOWS\system32\termsrv.dll
2009-09-27 20:44:52 ----D---- C:\WINDOWS\system32\MsDtc
2009-09-27 20:44:52 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2009-09-27 20:44:52 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2009-09-27 20:44:52 ----A---- C:\WINDOWS\system32\rdpclip.exe
2009-09-27 20:44:52 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-09-27 20:44:52 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-09-27 20:44:52 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-09-27 20:44:52 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-09-27 20:44:51 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-09-27 20:44:51 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-09-27 20:44:51 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-09-27 20:44:51 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-09-27 20:44:51 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-09-27 20:44:51 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-09-27 20:44:50 ----D---- C:\WINDOWS\system32\Com
2009-09-27 20:44:50 ----A---- C:\WINDOWS\system32\colbact.dll
2009-09-27 20:44:50 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-09-27 20:44:50 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-09-27 20:44:49 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-09-27 20:44:49 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-09-27 20:44:49 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-09-27 20:44:48 ----A---- C:\WINDOWS\system32\comuid.dll
2009-09-27 20:44:48 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-09-27 20:44:42 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-09-27 20:44:42 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-09-27 20:44:42 ----A---- C:\WINDOWS\system32\licwmi.dll
2009-09-27 20:44:41 ----A---- C:\WINDOWS\system32\cmprops.dll

======List of files/folders modified in the last 1 months======

2009-10-07 15:50:40 ----RD---- C:\Program Files
2009-10-05 23:17:28 ----D---- C:\WINDOWS\system32\CatRoot2
2009-10-04 23:30:56 ----D---- C:\WINDOWS
2009-10-03 18:36:17 ----D---- C:\WINDOWS\system32
2009-10-03 17:36:24 ----D---- C:\WINDOWS\system32\CatRoot
2009-10-03 17:36:18 ----HD---- C:\WINDOWS\inf
2009-10-03 17:36:18 ----D---- C:\WINDOWS\system32\drivers
2009-10-03 17:01:19 ----A---- C:\WINDOWS\system.ini
2009-10-03 16:41:28 ----D---- C:\WINDOWS\Debug
2009-10-03 16:32:22 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-10-03 16:27:21 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-10-03 16:27:21 ----D---- C:\WINDOWS\system32\wbem
2009-10-03 16:27:20 ----D---- C:\WINDOWS\system32\Setup
2009-10-02 23:28:27 ----SHD---- C:\WINDOWS\Installer
2009-10-02 23:27:45 ----D---- C:\WINDOWS\WinSxS
2009-10-02 22:32:58 ----D---- C:\WINDOWS\Help
2009-10-02 15:19:09 ----D---- C:\WINDOWS\AppPatch
2009-09-30 20:54:21 ----D---- C:\Program Files\Fichiers communs
2009-09-28 18:21:17 ----D---- C:\WINDOWS\system32\config
2009-09-28 10:53:39 ----A---- C:\WINDOWS\win.ini
2009-09-28 10:49:36 ----D---- C:\WINDOWS\twain_32
2009-09-28 10:00:51 ----D---- C:\WINDOWS\system32\mui
2009-09-28 03:37:51 ----RSD---- C:\WINDOWS\Fonts
2009-09-28 02:05:04 ----RASH---- C:\boot.ini
2009-09-28 01:02:22 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-09-27 23:31:02 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2009-09-27 23:30:16 ----D---- C:\WINDOWS\pchealth
2009-09-27 21:16:20 ----D---- C:\WINDOWS\security
2009-09-27 20:54:26 ----D---- C:\Documents and Settings
2009-09-27 20:52:58 ----SHD---- C:\System Volume Information
2009-09-27 20:49:19 ----D---- C:\WINDOWS\repair
2009-09-27 20:49:19 ----D---- C:\WINDOWS\ime
2009-09-27 20:48:51 ----A---- C:\WINDOWS\ODBCINST.INI
2009-09-27 20:48:39 ----D---- C:\WINDOWS\system32\ias
2009-09-27 20:48:10 ----RD---- C:\WINDOWS\Web
2009-09-27 20:47:30 ----D---- C:\WINDOWS\system32\oobe
2009-09-27 20:45:33 ----D---- C:\WINDOWS\Cursors
2009-09-27 20:44:03 ----D---- C:\WINDOWS\system32\spool

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-19 40320]
R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-19 14848]
R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2009-09-27 226832]
R3 3xHybrid;3xHybrid service; C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-02-14 2825088]
R3 adiusbaw;USB ADSL WAN Adapter; C:\WINDOWS\system32\DRIVERS\adiusbaw.sys [2007-02-07 118552]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2004-06-29 1268204]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-19 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-07-21 3565056]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-09-28 9600]
R3 KLFLTDEV;Kaspersky Lab KLFltDev; C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-09-28 12288]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-19 61824]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2009-09-27 130432]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024]
R3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
R3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S2 ELOADER;General Purpose USB Driver (adildr.sys); C:\WINDOWS\System32\Drivers\adildr.sys [2007-02-07 56088]
S3 catchme;catchme; \??\C:\DOCUME~1\PRDONG~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys []
S3 GMSIPCI;GMSIPCI; \??\J:\INSTALL\GMSIPCI.SYS []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-03-08 51120]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-03-08 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-03-08 21744]
S3 MPE;Filtre BDA MPE; C:\WINDOWS\system32\DRIVERS\MPE.sys [2004-08-03 15360]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-07-21 602112]
R2 AVP;Kaspersky Internet Security; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-09-27 208616]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-07-21 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2009-09-23 238960]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

   
Répondre à foxy_will
Posez votre question Répondre
Ils ont besoin de votre aide