Virus!!!!Résolu/Fermé

Question

Bonjour,


En faisant une bêtise sur le net j'ai attrapé des virus.

Dès que je me connectais, ils éteignaient mon pc donc j'ai fait la même chose que pour ma mère http://www.commentcamarche.net/forum/message 230200 le pc s allume et apres il s eteint

et depuis dès que je j'allume mon pc, il y a un message d'erreur qui s'affiche ( ce sont les virus ) et si je ferme ce message, mon pc se bloque.

De plus, dès que je me connecte a internet et je charge un site, ça me redirectionne vers un site pornographique.

Je  pose un rapport Hijackthis.

Utilisateur anonyme · Answer

Hi,

Oui poste ton rapport hijackthis.

Alut.

cynthia92 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:17:50, on 20/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\acs.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe­
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDETOOL\IDETOOL.EXE
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: C:\WINDOWS\system32\jsne87fidgf.dll - {C5BF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\jsne87fidgf.dll (file missing)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/default.aspx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/default.aspx
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com
O20 - AppInit_DLLs: karna.dat
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)
O22 - SharedTaskScheduler: mcb7uehuj3n8weuhejsw - {C5BF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\jsne87fidgf.dll (file missing)
O23 - Service: Service de configuration OLITEC (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slmdmsr.exe

Utilisateur anonyme · Answer

Hi,

Combofix. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...

Fais exactement ce qui suit :



Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide : 

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation (si jamais tu en as et que je ne les ai pas vu sur le rapport hijackthis....)

---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

Tuto ici : TUTO
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :

Double-clique sur C-Fix.exe (= combofix.exe ) .

Appuie sur une touche pour démarrer le scan .

Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp 

Refait un hijackthis.

Alut.

naruto · Answer

telecharge (AVG FREE francais ) sur (clubic) , installe le et laisse le tourner sur ta becanne puis dit nous ce qu'il en est

Utilisateur anonyme · Answer

Hi,

Cynthia,n'écoute que moi Drhouse1998.

Alut.

Utilisateur anonyme · Answer

Hi,

petit mot à dr house

j'ai monter ma boite de reparation informatique depuis 2ans

je répare en moyenne 15 rordi par semaine


donc le minable en informatique c'est bien toi

alors EVITE LES MAUVAISE INTERPRETATION DE CE GENRE

OKI.

Dit moi quelles lignes sont infecter monsieur le 15 pc par semaine?????

Alut.

Utilisateur anonyme · Answer

Hi,

Je ne vous donnerais jamais mon pc

Petit cours:

les lignes :

-02,
-20,
-22.
Sont infectées


Alut.

Utilisateur anonyme · Answer

Hi,


Je peut te soigner.

Drhouse........

Alut.

cynthia92 · Answer

Re DrHouse1998,

j'ai téléchargé ComboFix, mais il ne se lance pas, que faire stp? ( même en mode échec!)

Utilisateur anonyme · Answer

Hi, passe cela avant alors: ==>>Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.<<=== Toolbar-S&D !! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !! * double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ... * Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil . * Choisis l'option 1 ( "recherche") et tapes "entrée" . * Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité de son contenu dans ta prochaine réponse ... ( le rapport est en outre sauvegardé ici -> C:\TB.txt ) Alut.

cynthia92 · Answer

-----------\  ToolBar S&D 1.2.4   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) M processor         1.60GHz )
   BIOS : Insyde Software MobilePRO BIOS Version 4.20.10
   USER : Propriétaire ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVirus Firewall 7.03 7.03 (Not Activated)
   Firewall  : AntiVirus Firewall 7.03 7.03 (Not Activated)
   C:\ (Local Disk) - NTFS - Total:74 Go (Free:11 Go)
   D:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
   Option : [1] ( 20/11/2008|17:02 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp
ss4.tmp
   C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp
ss5.tmp

   -----------\  Extensions

   (Propriétaire) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.google.com/?gws_rd=ssl"
   "Search Page"="https://www.google.com/?gws_rd=ssl"
   "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"


   --------------------\  Recherche d'autres infections

   --------------------\  ROOTKIT !!

   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Enum\Root\LEGACY_TDSSSERV.SYS]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Enum\Root\LEGACY_TDSSSERV.SYS]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Enum\Root\LEGACY_TDSSSERV.SYS]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV.SYS]

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\PROPRI~1\Local Settings	emp\Driver_Genius_Professional_Edition_2008_v8_0_316___Keygen.torrent
   C:\DOCUME~1\PROPRI~1\Local Settings	emp\o{SUMOTorrent.com}o_Driver_Genius_Professional_Edition2008_v8.0.316_With_Keygen_ST2008804.torrent



   1 - "C:\ToolBar SD\TB_1.txt" - 20/11/2008|17:05 - Option : [1]

   -----------\  Fin du rapport a 17:05:39,50

cynthia92 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:07:03, on 20/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDETOOL\IDETOOL.EXE
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSLAUNCH.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: C:\WINDOWS\system32\jsne87fidgf.dll - {C5BF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\jsne87fidgf.dll (file missing)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O20 - AppInit_DLLs: karna.dat
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)
O22 - SharedTaskScheduler: mcb7uehuj3n8weuhejsw - {C5BF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\jsne87fidgf.dll (file missing)
O23 - Service: Service de configuration OLITEC (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slmdmsr.exe

Utilisateur anonyme · Answer

Hi,

Nettoyage avec ToolBar S&D :

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

Relances Toolbar-S&D en double-cliquant sur le raccourci.
-->Tapes sur l'option 2 ( "nettoyage" ) puis tapes sur "Entrée".

Note : ne touches à rien lors de la suppression !

Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse
accompagné d'un nouveau rapport hijackthis pour analyse ... 

Alut.

cynthia92 · Answer

Que faire maintenant stp???

Utilisateur anonyme · Answer

Nettoyage avec ToolBar S&D :

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

Relances Toolbar-S&D en double-cliquant sur le raccourci.
-->Tapes sur l'option 2 ( "nettoyage" ) puis tapes sur "Entrée".

Note : ne touches à rien lors de la suppression !

Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse
accompagné d'un nouveau rapport hijackthis pour analyse ...

cynthia92 · Answer

Ok, a tt de suite! et merci...

cynthia92 · Answer

-----------\  ToolBar S&D 1.2.4   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) M processor         1.60GHz )
   BIOS : Insyde Software MobilePRO BIOS Version 4.20.10
   USER : Propriétaire ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVirus Firewall 7.03 7.03 (Activated)
   Firewall  : AntiVirus Firewall 7.03 7.03 (Activated)
   C:\ (Local Disk) - NTFS - Total:74 Go (Free:11 Go)
   D:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
   Option : [2] ( 20/11/2008|17:22 )

   -----------\ SUPPRESSION

   Supprime! - C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp
ss4.tmp
   Supprime! - C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp
ss5.tmp

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  Extensions

   (Propriétaire) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.google.com/?gws_rd=ssl"
   "Search Page"="https://www.google.com/?gws_rd=ssl"
   "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"
   "Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"


   --------------------\  Recherche d'autres infections

   --------------------\  ROOTKIT !!

   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Enum\Root\LEGACY_TDSSSERV.SYS]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Enum\Root\LEGACY_TDSSSERV.SYS]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Enum\Root\LEGACY_TDSSSERV.SYS]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV.SYS]

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\PROPRI~1\Local Settings	emp\Driver_Genius_Professional_Edition_2008_v8_0_316___Keygen.torrent
   C:\DOCUME~1\PROPRI~1\Local Settings	emp\o{SUMOTorrent.com}o_Driver_Genius_Professional_Edition2008_v8.0.316_With_Keygen_ST2008804.torrent



   1 - "C:\ToolBar SD\TB_1.txt" - 20/11/2008|17:05 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 20/11/2008|17:24 - Option : [2]

   -----------\  Fin du rapport a 17:24:56,79

cynthia92 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:25:55, on 20/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDETOOL\IDETOOL.EXE
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {C5BF49A2-94F3-42BD-F434-3604812C897D} - (no file)
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O20 - AppInit_DLLs: karna.dat
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)
O22 - SharedTaskScheduler: mcb7uehuj3n8weuhejsw - {C5BF49A2-94F3-42BD-F434-3604812C897D} - (no file)
O23 - Service: Service de configuration OLITEC (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slmdmsr.exe

cynthia92 · Answer

Que faire maintenant stp???

Utilisateur anonyme · Answer

Hi,

Passe ceci :

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.


* Double-clique VundoFix.exe afin de le lancer
* Clique sur le bouton Scan for Vundo
* Lorsque le scan est complété, clique sur le bouton Remove Vundo
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

et post un log hijackthis , 

Alut.

cynthia92 · Answer

Même blème que pour ComboFix, ça me met Erreur de chargement ...

Utilisateur anonyme · Answer

Hi,

-Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte

- Mets le à jour

---
- Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
- Sélectionne Exécuter un examen complet si ce n'est pas déjà fait
- clique sur Rechercher

- Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

- Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.

- Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

- Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok

Alut.

cynthia92 · Answer

ça fait 6 minutes que j'ai finis l'installation, je le lance puis relance... il ne se déclenche pas!

Que faire Stp?

Utilisateur anonyme · Answer

Hi,

fait le en mode sans échec.

Alut.

cynthia92 · Answer

Même chose! 

...???

Utilisateur anonyme · Answer

Hi,

Télécharger VirtumundoBegone sur le bureau:


Double cliquer sur VirtumundoBeGone.exe et suivre les instructions.
Une fois terminé, redémarrer le PC, le rapport VBG.TXT sera crée sur le bureau .
(Si un message Ecran bleu "Erreur fatale" apparaît, pas d’inquiétude car c'est normal et attendu).
=*=*=*=*=*=*=*=*=*=*=**=*=*=*=*=**=*=*=**=*=*=**=*=*=**=*=*=**=*=*=*=**=*=*=**=*=
Relance hijack et clique sur "Do a system scan only"
Ensuite recherche ces lignes et coches les cases

O20 - AppInit_DLLs: karna.dat 
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing) 

O22 - SharedTaskScheduler: mcb7uehuj3n8weuhejsw - {C5BF49A2-94F3-42BD-F434-3604812C897D} - (no file) 

Ensuite clique sur "Fix checked"

cynthia92 · Answer

[11/20/2008, 14:53:27] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Propriétaire\Bureau\VirtumundoBeGone.exe" )
[11/20/2008, 14:53:43] - Detected System Information:
[11/20/2008, 14:53:43] -  Windows Version: 5.1.2600, Service Pack 2
[11/20/2008, 14:53:43] -  Current Username: Propriétaire (Admin)
[11/20/2008, 14:53:43] -  Windows is in SAFE mode with Networking.
[11/20/2008, 14:53:43] - Searching for Browser Helper Objects:
[11/20/2008, 14:53:43] -  BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} ()
[11/20/2008, 14:53:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/20/2008, 14:53:43] -  No filename found. Continuing.
[11/20/2008, 14:53:43] -  BHO 2: {C5BF49A2-94F3-42BD-F434-3604812C897D} (C:\WINDOWS\system32\jsne87fidgf.dll)
[11/20/2008, 14:53:43] - Finished Searching Browser Helper Objects
[11/20/2008, 14:53:43] - Finishing up...
[11/20/2008, 14:53:43] - Nothing found! Exiting...

[11/20/2008, 18:48:20] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Propriétaire\Bureau\VirtumundoBeGone.exe" )
[11/20/2008, 18:48:22] - Detected System Information:
[11/20/2008, 18:48:22] -  Windows Version: 5.1.2600, Service Pack 2
[11/20/2008, 18:48:22] -  Current Username: Propriétaire (Admin)
[11/20/2008, 18:48:22] -  Windows is in NORMAL mode.
[11/20/2008, 18:48:22] - Searching for Browser Helper Objects:
[11/20/2008, 18:48:22] -  BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} ()
[11/20/2008, 18:48:22] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/20/2008, 18:48:22] -  No filename found. Continuing.
[11/20/2008, 18:48:22] -  BHO 2: {C5BF49A2-94F3-42BD-F434-3604812C897D} ()
[11/20/2008, 18:48:22] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/20/2008, 18:48:22] -  No filename found. Continuing.
[11/20/2008, 18:48:22] - Finished Searching Browser Helper Objects
[11/20/2008, 18:48:22] - Finishing up...
[11/20/2008, 18:48:22] - Nothing found! Exiting...

cynthia92 · Answer

Que faire maintenant stp?

cynthia92 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:51:30, on 20/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDETOOL\IDETOOL.EXE
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {C5BF49A2-94F3-42BD-F434-3604812C897D} - (no file)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Service de configuration OLITEC (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slmdmsr.exe

cynthia92 · Answer

Ca y est, j'attends tes instructions!

Utilisateur anonyme · Answer

Hi,

Passe combofix,pour vraiment être assurer de cela.

Ensuite tu fait un scan avec Malwarebyte.

Alut.

Utilisateur anonyme · Answer

Hi,

Télécharges- FindyKill de Chiquitine29 :

FindyKill de Chiquitine29

->-Enregistres le sur ton bureau et pas ailleurs !

-!! Déconnectes toi et fermes toute applications en cours !!

( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...)

-> Cliques sur "-FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation.


-Notes importantes :
* si tu as le prg Elibagla sur ton PC , supprimes le ( risque de conflit entre les deux outils ) .

--> Double cliques sur le raccourci " FindyKill " qui est sur ton bureau .

-->choisis l'option 1 ( recherche ) . Puis laisses travailler l'outil sans rien toucher ...

Une fois terminé, postes le rapport FindyKill.txt qui est généré ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )

cynthia92 · Answer

----------------- FindyKill V4.705 ------------------

* User : Propriétaire - PORTABLE-6377DB
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 17/11/08 par Chiquitine29
* Recherche effectuée à 19:18:50 le 20/11/2008
* Windows XP - Internet Explorer 7.0.5730.13
 
((((((((((((((((( *** Recherche *** ))))))))))))))))))  
 
 
--------------- [ Processus actifs ] ----------------  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDETOOL\IDETOOL.EXE
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSLAUNCH.EXE
 
--------------- [ Fichiers/Dossiers infectieux ] ----------------  
 
 
»»»» Presence des fichiers dans C: 
 
 
»»»» Presence des fichiers dans C:\WINDOWS 
 
 
»»»» Presence des fichiers dans C:\WINDOWS\Prefetch 
 
 
»»»» Presence des fichiers dans C:\WINDOWS\system32 
 
 
»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers 
 
 
»»»» Presence des fichiers dans C:\Documents and Settings\Propriétaire\Application Data 
 
 
»»»» Presence des fichiers dans C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp 
 
Found ! - C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\Driver_Genius_Professional_Edition_2008_v8_0_316___Keygen.torrent  
Found ! - C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\o{SUMOTorrent.com}o_Driver_Genius_Professional_Edition2008_v8.0.316_With_Keygen_ST2008804.torrent  
 
»»»» Presence des fichiers dans C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5 
 
Found ! [13/10/2008 14:18] - C:\Documents and Settings\Propriétaire\Local Settings\Application Data\Microsoft\Media Player\Cache d’images\LocalMLS\{502783E9-530D-43BC-950F-28A9B42B644A}.jpg 
 
--------------- [ Registre / Startup ] ----------------  
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]

   swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
   IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}="C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
   ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]

   F-Secure Manager="C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
   F-Secure TNB="C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
   ACU="C:\Program Files\Atheros\ACU.exe" -nogui
   SystrayORAHSS="C:\Program Files\Orange\Systray\SystrayApp.exe"
   ORAHSSSessionManager=C:\Program Files\Orange\SessionManager\SessionManager.exe
   QuickTime Task="C:\Program Files\QuickTime\QTTask.exe" -atboottime
   VTTimer=VTTimer.exe
   VTTrayp=VTtrayp.exe
   LogitechCommunicationsManager="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
   NeroFilterCheck=C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
   NBKeyScan="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
   SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
   avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
   SoundMan=SOUNDMAN.EXE
 
--------------- [ Registre / Clés infectieuses ] ----------------  
 
 
 
--------------- [ Etat / Services ] ---------------- 
 


+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ] 

 Ndisuio - Type de démarrage = 3 
 
 EapHost - Type de démarrage = 3 
 
 Ip6Fw - Type de démarrage = 3 
 
 SharedAccess - Type de démarrage = 2 
 
 wuauserv - Type de démarrage = 2 
 
 wscsvc - Type de démarrage = 2 
 
 
 
--------------- [ Recherche dans supports amovibles] ----------------  
 
 
+- Informations : 

C: - Lecteur fixe

 
+- presence des fichiers :  

 
 
--------------- [ Registre / Mountpoint2 ] ----------------  
 
 
-> Not found ! 
 
 
------------------- ! Fin du rapport ! --------------------

cynthia92 · Answer

et maintenant???

Utilisateur anonyme · Answer

Hi,

pourquoi ne l'ai pas fait avant ?


--> Branche tes disques amovibles à ton PC (clefs USB, disque dur externe, etc...) sans les ouvrir

--> Double-clique sur le raccourci FindyKill sur ton bureau

--> Au menu principal, choisis l'option 2 (Suppression)

/!\ Il y aura 2 redémarrages, laisse travailler l'outil jusqu'à l'apparition du message "nettoyage effectué" /!\

--> Ensuite, poste le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.

Relance combofix.

Alut.

cynthia92 · Answer

----------------- FindyKill V4.705 ------------------

* User : Propri‚taire - PORTABLE-6377DB
* executed from : C:\Program Files\FindyKill
* Update on 17/11/08 par Chiquitine29
* Start at 19:34:38 the 20/11/2008
* Windows XP - Internet Explorer 7.0.5730.13
 
 
((((((((((((((( *** deleting *** ))))))))))))))))))  
 
 
--------------- [ Active Processes ] ----------------  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avwsc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsstm.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\svchost.exe
 
--------------- [ Infected files / folders ] ----------------  
 
 
»»»» Supression files in C: 
 
 
»»»» Supression files in C:\WINDOWS 
 
 
»»»» Supression files in C:\WINDOWS\Prefetch 
 
 
»»»» Supression files in C:\WINDOWS\system32 
 
 
»»»» Supression files in C:\WINDOWS\system32\drivers 
 
 
»»»» Supression files in C:\Documents and Settings\Propri‚taire\Application Data 
 
 
»»»» Supression files in C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp 
 
Deleted ! - C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\Driver_Genius_Professional_Edition_2008_v8_0_316___Keygen.torrent     
Deleted ! - C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\o{SUMOTorrent.com}o_Driver_Genius_Professional_Edition2008_v8.0.316_With_Keygen_ST2008804.torrent     
 
»»»» Supression files in C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5 
 
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{502783E9-530D-43BC-950F-28A9B42B644A}.jpg    
 
--------------- [  Registry / Infected keys ] ---------------- 
 
Deleted ! - HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA   
 
--------------- [ States / Restarting of services ] ---------------- 
 


+- Services : [ Auto=2 / Request=3 / Disable=4 ] 

 Ndisuio - Type of startup  = 3 
 
 EapHost - Type of startup  = 2 
 
 Ip6Fw - Type of startup  = 2 
 
 SharedAccess - Type of startup  = 2 
 
 wuauserv - Type of startup  = 2 
 
 wscsvc - Type of startup  = 2 
 
 
---------------   [ Cleaning removable drives ] ----------------  
 
+- Informations : 

C: - Lecteur fixe

 
+- deleting files : 
 
 
--------------- [ Registry / Mountpoint2 ] ----------------  
 
 
 -> Not found ! 
 
 
--------------- [ Searching Cracks / Keygen ] ----------------  
 
 
 
---------------- ! End of report ! ------------------

cynthia92 · Answer

Que faire maintenant?

Utilisateur anonyme · Answer

Hi,


fait combofix .

maintenant il devrait passer.

Alut.

cynthia92 · Answer

Désolée mais il ne passe toujours plus! ...

Utilisateur anonyme · Answer

Hi,


&#9654; Rends toi sur ce site :
http://www.zonavirus.com/datos/descargas/95/elibagla.asp
&#9654; tout en bas de cette page tu trouveras un outil
à télécharger,clique sur "escargar Elibagla" (le numéro de version change au fur et à mesure des mises à jour)
&#9654; installe ce fichier sur le Bureau.
&#9654; ensuite double-clic sur Elibagla.exe
&#9654; laisse la case "eliminar ficheros automaticamente" coché
&#9654; clique sur"explorar"
&#9654; laisse-le travailler

&#9654; Redémarre en mode sans échec,

*Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter.
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).

&#9654; relance 2 fois elibagla

&#9654; redémarre en mode normal

&#9654; poste le rapport final qui sera dans c:\infosat.txt

cynthia92 · Answer

rien d'anormal, j'ai vu le rapport mais ne le retrouve plus, dsl

cynthia92 · Answer

que faire maintenant?

Utilisateur anonyme · Answer

Hi,

Essai de nouveau combofix et malwarebyte.

Alut.

cynthia92 · Answer

Toujours rien... et je ne pense pas que tous les virus soient partis parce qu' il y a toujours le coup des sites pornographiques....???

Utilisateur anonyme · Answer

Hi,

installe NAVILOG1


Remarque concernant la détection de Navilog1 par certains programmes de sécurités :

Certains fichiers de Navilog1.exe peuvent être considérés comme dangereux et donc supprimés ou neutralisés par certains programmes de sécurités. Ce sont des faux positifs et dans certains cas, vous serez amener à désactiver votre protection le temps du téléchargement/utilisation de Navilog1.
/ !\ Déconnecte toi du net et désactive ton antivirus et antispyware résident pour que Navilog1 puisse s'exécuter normalement. / !\

Utilisateurs de Windows Vista :

* Afin que Navilog1 puisse fonctionner correctement, il est recommandé de désactiver l'UAC pendant l'utilisation de Navilog1 (Installation, Utilisation). N'oubliez pas dès l'utilisation de Navilog1 terminé à réactiver l'UAC sur votre Ordinateur.
comment faire pour désactiver l'UAC

* A chaque fois que vous êtes amené à exécuter Navilog1.bat ou Navilog1.exe pour l'installation, ne double-cliquez pas sur le fichier ou raccourci mais faites un clic droit dessus et dans le menu contextuel choisssez "Exécuter en tant qu'administrateur".

Le lancement de l'installation de Navilog1 se fait en exécutant Navilog1.exe

(Si vous avez téléchargé navilog1.zip, Veuillez auparavant décompresser ce fichier)

Une fois l'installation terminé, pour lancer le fix :

- en utilisant le raccourci crée sur le bureau : Navilog1
- Via le poste de travail, en exécutant le fichier Navilog1.bat se trouvant dans %program files%Navilog1

Après le choix de la langue et les messages d'avertissement, le menu s'affiche.

Faite le choix 1

Effectue la vérification du système à la recherche de l'adware. Un scan avec catchme de GMER est également éffectué pour Windows XP. Cette analyse peut durer une dizaine de minutes. Patientez alors jusqu'au message «Analyse terminée le ....». Appuyez sur une touche comme demandé et le bloc note va souvrir , Enregistrez-le sur votre disque. Puis Ouvrez-le et Copiez-Collez l'intégralité de ce rapport sur le forum qui vous l'auras demandé.

(si le bloc-note ne s'ouvre pas : Rendez-vous dans votre poste de travail, à la racine du disque C vous trouverez le rapport sous le nom de fixnavi.txt)

Attention : Ne lancez-pas la partie désinfection (choix 2, 3 ou 4) sans l'avis/accord express de l'Helper qui vous as pris en charge sur le forum d'aide ou vous aurez exposer votre problème.

cynthia92 · Answer

Search Navipromo version 3.6.9 commencé le 20/11/2008 à 21:19:39,32

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "PropriÚtaire" 

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.13 
Système de fichiers : 

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\PropriÚtaire\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\PropriÚtaire\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\PropriÚtaire\menudm~1\progra~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" *** 


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\PropriÚtaire\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\PropriÚtaire\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 20/11/2008 à 21:30:38,01 ***

Utilisateur anonyme · Answer

Hi,

As tu un nmessage d'erreur lorsque tu essai de faire combofix ou autres?

Alut.

cynthia92 · Answer

Non, le sablier reste 3 sec. environ puis tout est comme si de rien était. 

Comment on fait pour les sites...???

Utilisateur anonyme · Answer

Hi,

il, faut que tu supprimes tout tes cracks et keygens.

Ensuite refait un findykill.

Mais supprime ellibagla si tu l'as .

Alut.

cynthia92 · Answer

et comment puis-je faire pour ComboFix et Maleware...?

Utilisateur anonyme · Answer

Hi,

on verra sa après fait d'abord cela.

il, faut que tu supprimes tout tes cracks et keygens.

Ensuite refait un findykill.

Mais supprime ellibagla si tu l'as .

cynthia92 · Answer

et comment puis-je faire pour ComboFix et Maleware...???

Utilisateur anonyme · Answer

il, faut que tu supprimes tout tes cracks et keygens.

Ensuite refait un findykill.

cynthia92 · Answer

Ca y est, j'ai supprimé mais aucun changement...???

Utilisateur anonyme · Answer

Hi,

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
SDFix (créé par AndyManchesta)

ou http://downloads.andymanchesta.com/RemovalTools/SDFix.exe.

ou ici http://sdfix.net/SDFix.exe

--> Double-cliques sur SDFix.exe et choisis "Install" . 
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.

 Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

• Redémarre ton ordinateur

• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).

• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.

• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".

• Choisis ton compte.

• Puis, ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis. pour lancer le script.

• Appuie sur une touche pour commencer le processus de nettoyage.

• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.

• Appuie sur une touche pour redémarrer le PC.

• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.

• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.

• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.

• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.


• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau rapport Hijackthis !

•NOTE:Si SDFix ne se lance pas
Clique sur=> Démarrer => Exécuter
Copie/colle ceci :
%systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe

Clique sur Ok.

Redémarre et essaie de relance SDFix.

cynthia92 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:27:00, on 20/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Propriétaire\Bureau\ComboFix.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\systray\systrayapp.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {C5BF49A2-94F3-42BD-F434-3604812C897D} - (no file)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Service de configuration OLITEC (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slmdmsr.exe

Utilisateur anonyme · Answer

Hi,

passe sdfix.

l'infection et toujours la .

cynthia92 · Answer

et c'est quoi sdfix?

Utilisateur anonyme · Answer

Hi,

regarde le poste 59.

Alut.

cynthia92 · Answer

slt, rien a changé... toujours pareil

Utilisateur anonyme · Answer

Hi,

Fait ceci:

==>Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

==>Double clique sur RSIT.exe pour lancer l'outil.

==>Clique sur ' continue ' à l'écran Disclaimer.

==>Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

==>Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

cynthia92 · Answer

info.txt logfile of random's system information tool 1.04 2008-11-21 18:08:28

======Uninstall list======

-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Spyware Scanner"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Spyware"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Virus Client Security Installer"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Virus"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Automatic Update Agent"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure DAAS"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Diagnostics"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure E-mail Scanning"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure FWES"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure GateKeeper Interface"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Gemini"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure GUI"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Help"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure HIPS"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Internet Shield"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Localization API"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Management Agent"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Pegasus Engine"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Protocol Scanner"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Spam Control"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Spam Scanner"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure TNB"
-->"C:\Program Files\Orange\AntivirusFirewall\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Uninstall"
-->C:\Program Files\Nero\Nero8\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
AntiVirus Firewall-->"C:\Program Files\Orange\AntivirusFirewall\FSGUI\PostInstall.exe"  /tUnInstall
Apple Mobile Device Support-->MsiExec.exe /I{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
BitComet 1.04-->C:\Program Files\BitComet\uninst.exe
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
DVD Shrink 3.2-->"C:\Program Files\DVD Shrink\unins000.exe"
FindyKill-->C:\Program Files\FindyKill\Uninstal.exe
Free iPod Video Converter 1.34-->"C:\Program Files\Free iPod Video Converter\unins000.exe"
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_FE4264652A965D92.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
HijackThis 2.0.2-->"C:\Documents and Settings\Propriétaire\Bureau\HijackThis.exe" /uninstall
Hotfix for Windows XP (KB915865)-->"C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe"
HP Customer Participation Program 7.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Imaging Device Functions 7.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP Photosmart Essential-->MsiExec.exe /X{6994491D-D491-48F1-AE1F-E179C1FFFC2F}
HP Photosmart, Officejet and Deskjet 7.0.A-->C:\Program Files\HP\Digital Imaging\{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}\setup\hpzscr01.exe -datfile hposcr11.dat
HP Software Update-->MsiExec.exe /X{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}
HP Solution Center 7.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP USB Disk Storage Format Tool-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}\Setup.exe" -l0x9 
iTunes-->MsiExec.exe /I{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843}
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Java(TM) 6 Update 10-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
Labtec WebCam-->MsiExec.exe /X{995BF1A7-30E5-49E5-A0E4-AD3213D9E330}
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
livebox-->C:\Program Files\InstallShield Installation Information\{17342E3B-0818-4A6F-BFF8-99476605ADD6}\Setup.exe -runfromtemp -l0x040c -removeonly
Logitech Audio Echo Cancellation Component-->MsiExec.exe /X{BEF726DD-4037-4214-8C6A-E625C02D2870}
Logitech Video Enumerator-->MsiExec.exe /X{EA516024-D84D-41F1-814F-83175A6188F2}
Ma-Config.com-->MsiExec.exe /X{3A4EE7A4-356E-43B7-A4A3-9C55B22A05B3}
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Mozilla Firefox (3.0.4)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MVision-->MsiExec.exe /I{35725FBC-A136-4A46-9F29-091759D9BB93}
Nero 8-->MsiExec.exe /X{F296739D-AF5C-4426-972A-0DC916D11036}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NETGEAR  WG311T Wireless Adapter-->C:\Program Files\InstallShield Installation Information\{FC321AD2-48B4-4013-B997-A65D5FBBD006}\setup.exe -runfromtemp -l0x0409
NETGEAR WPN311 Wireless Adapter-->C:\Program Files\InstallShield Installation Information\{AB938897-211A-4999-9749-236D2E8E464A}\setup.exe -runfromtemp -l0x0409
O&O Defrag Professional Edition-->MsiExec.exe /I{E6CB18CD-04EF-4C6A-A5F3-5F49E7332895}
OCR Software by I.R.I.S 7.0-->C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
OpenOffice.org Installer 1.0-->MsiExec.exe /X{3A2AF807-9F9F-43C9-A24A-17B617238B74}
Orange - Logiciels Internet-->C:\Program Files\Orange\installation\core\Installgui.exe -u
Programme de gestion Camera de Labtec®-->"C:\Program Files\Fichiers communs\Labtec\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
Programme d'installation OLITEC Client-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{28006915-2739-4EBE-B5E8-49B25D32EB33}\setup.exe" -l0x40c  -removeonly
QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x40c  -removeonly
SAMSUNG Mobile Modem Driver Set-->C:\WINDOWS\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
Samsung Mobile phone USB driver Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
Samsung PC Studio 3 USB Driver Installer-->"C:\Program Files\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -runfromtemp -l0x040c -removeonly
Samsung PC Studio 3-->"C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -runfromtemp -l0x040c -removeonly
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB955936)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {1D94099C-2BBA-440E-BD5E-093BBDF8F028}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft Office Excel 2007 (KB955470)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {6E8637D8-10D6-4568-AA06-E2706F31685E}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB951808)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office Word 2007 (KB950113)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Smart Link 56K Voice Modem-->C:\WINDOWS\Modio\SLAMR2KV\Setup.exe /Remove
Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Office 2007 (KB932080)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {EDC9CA29-6BC1-471C-828C-7A36109005D7}
Update for Office 2007 (KB934391)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B3091818-7C56-4C45-BE7D-CA23027A5EA5}
Update for Office 2007 (KB946691)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb957829)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {07A1F6B6-4F1C-418C-A605-755A121C4A16}
VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
VIA Bus Master Ultra ATA Driver (Remove)-->RunDll32 VIAIDECO.dll,UninstallIDE
VIA Gestionnaire de périphériques de plate-forme-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169} 
VIA Rhine-Family Fast-Ethernet Adapter-->Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
VIA/S3G Display Driver 6.14.10.0342-->C:\PROGRA~1\S3\UChromeP\s3minset.exe /u UChromeP.uns
VideoLAN VLC media player 0.8.6a-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Installer Clean Up-->MsiExec.exe /X{121634B0-2F4B-11D3-ADA3-00C04F52DD52}
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
WinZip 12.0-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B7}

======Hosts File======

127.0.0.1 localhost

======Security center information======

AV: Avira AntiVir PersonalEdition (disabled)
AV: AntiVirus Firewall 7.03
FW: AntiVirus Firewall 7.03

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;C:\Program Files\QuickTime\QTSystem;C:\Program Files\Samsung\Samsung PC Studio 3
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel
"PROCESSOR_REVISION"=0d08
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip

-----------------EOF-----------------

cynthia92 · Answer

Logfile of random's system information tool 1.04 (written by random/random)
Run by Propriétaire at 2008-11-21 18:08:06
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 12 GB (15%) free of 76 GB
Total RAM: 447 MB (31% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:08:22, on 21/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\Atheros\ACU.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\IDETOOL\IDETOOL.EXE
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Documents and Settings\Propriétaire\Bureau\ComboFix.exe
C:\Documents and Settings\Propriétaire\Bureau\RSIT.exe
C:\Documents and Settings\Propriétaire\Bureau\Propriétaire.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Service de configuration OLITEC (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slmdmsr.exe

Utilisateur anonyme · Answer

Hi,

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.

http://www.atribune.org/ccount/click.php?id=4


* Double-clique VundoFix.exe afin de le lancer.

* Lorsque l'outil se lance à nouveau, clique sur le bouton Scan for Vundo

* Clique sur le bouton Scan for Vundo.

* Lorsque le scan est complété, clique sur le bouton Remove Vundo.

* Une invite te demandera si tu veux supprimer les fichiers, clique YES

* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.

* Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown" ); clique OK

* Démarre ton PC à nouveau.

* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

cynthia92 · Answer

VundoFix V7.0.6

Scan started at 18:24:02 21/11/2008

Listing files found while scanning....


VundoFix V7.0.6

Scan started at 18:58:49 21/11/2008

Listing files found while scanning....

No infected files were found.

cynthia92 · Answer

Voilà, que faire maintenant stp?

Utilisateur anonyme · Answer

Hi,

c'est quoi ton problème la?

Alut.

cynthia92 · Answer

dès le démmarage, il y a un message d'erreur : wlancfg5.exe - Point d'entrée introuvable

Le point d'entrée de procédure?AcsWsNotifyProfileChange@@YAHJPBD@Z est introuvable dans la bibibliothèque de liaisons dynamique athcfg11.dll.

C'est un virus!!? ou quelque chose dans ce genre? 

Et ce qui est bizzare c'est que dès que je passe "FindyKill" il disparait...

Ensuite dès que je lance Microsoft Update, cela me met un message d'erreur comme si je n'étais pas connecté.

Et en dernier dès que je lance un analyse antivirus en ligne, pareil : Message d'erreur.

Que faire pour ça stp??

Utilisateur anonyme · Answer

Hi,

c'est un processus de wifi.....

tu es alors en wifi.

Alut.

cynthia92 · Answer

Euh, attends je ne suis pas tout!

Tout ce que je t'ai dis est à cause du wifi?!

Utilisateur anonyme · Answer

Hi,

Oui je pense que ton wifi et à un problème .........

Relance hijack et clique sur "Do a system scan only"
Ensuite recherche ces lignes et coches les cases

C:\WINDOWS\SOUNDMAN.EXE     
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) 
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE     

Ensuite clique sur "Fix checked"

Alut.

cynthia92 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:41:51, on 21/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDETOOL\IDETOOL.EXE
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\Documents and Settings\Propriétaire\Bureau\Propriétaire.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Service de configuration OLITEC (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slmdmsr.exe

cynthia92 · Answer

Quel genre de problème penses-tu qu'il a?

Ne penses-tu pas que c'est un virus parce que tout passe sauf les mises à jour et les analyses antivirus...???

Utilisateur anonyme · Answer

Hi,

Ton rapport ne comporte plus a mes yeux d'infection.

Toutefois ,est ce la première fois que tu es ce genre de problème la?

Alut.

cynthia92 · Answer

Avec le wifi!? Jamais.

Utilisateur anonyme · Answer

Hi,

Peut tu faire au moins un scan complet de malwarebyte en mode sans échec.

Alut.

cynthia92 · Answer

J'éssaye et je te tiens au courant!

cynthia92 · Answer

J'ai réussi a démarrer ComboFix mais pas Malewarebytes...

Tiens le rapport!!!

cynthia92 · Answer

ComboFix 08-11-18.A2 - Propriétaire 2008-11-21 20:13:50.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.102 [GMT 1:00] * Resident AV is active [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\drivers\TDSSrvdc.sys c:\windows\system32\TDSSktkl.dll c:\windows\system32\TDSSlajf.dll c:\windows\system32\TDSSmxjt.log c:\windows\system32\TDSSnmxh.log c:\windows\system32\TDSSoity.log c:\windows\system32\TDSSoxum.dll c:\windows\system32\TDSSqkhc.dll c:\windows\system32\TDSSurxb.dll c:\windows\system32\TDSSweat.dat c:\windows\system32\TDSSxehr.dll . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_TDSSSERV.SYS -------\Legacy_TDSSSERV.SYS ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-21 au 2008-11-21 )))))))))))))))))))))))))))))))))))) . 2008-11-21 19:52 . 2008-11-21 19:52 664 --a------ c:\windows\system32\d3d9caps.dat 2008-11-21 18:24 . 2008-11-21 18:24 d-------- C:\VundoFix Backups 2008-11-21 18:08 . 2008-11-21 18:08 d-------- C: sit 2008-11-20 22:45 . 2008-11-20 22:45 d-------- c:\windows\ERUNT 2008-11-20 21:18 . 2008-11-20 21:30 d-------- c:\program files\Navilog1 2008-11-20 19:17 . 2008-11-21 17:46 d-------- c:\program files\FindyKill 2008-11-20 17:39 . 2008-11-20 17:39 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-20 17:39 . 2008-11-20 17:39 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-11-20 17:39 . 2008-09-08 00:16 38,528 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-20 17:39 . 2008-09-08 00:16 17,200 --a------ c:\windows\system32\drivers\mbam.sys 2008-11-20 17:01 . 2008-11-20 17:24 d-------- C:\ToolBar SD 2008-11-20 16:40 . 2008-11-21 20:12 4,004 --a------ c:\windows\system32\PerfStringBackup.TMP 2008-11-19 16:22 . 2008-11-19 16:22 d-------- C:\OEMSettings 2008-11-19 16:09 . 2008-11-19 16:09 17,801 --a------ c:\windows\system32\drivers\AegisP.sys 2008-11-19 16:08 . 2008-11-19 16:21 d-------- c:\program files\NETGEAR 2008-11-19 15:56 . 2008-11-19 15:56 d-------- c:\windows\Downloaded Installations 2008-11-19 14:32 . 2008-11-19 14:32 268 --ah----- C:\sqmdata00.sqm 2008-11-19 14:32 . 2008-11-19 14:32 244 --ah----- C:\sqmnoopt00.sqm 2008-11-18 21:53 . 2008-11-18 21:53 d-------- c:\program files\Realtek AC97 2008-11-18 21:21 . 2008-11-19 17:00 d-------- C:\Driver Download 2008-11-18 21:08 . 2004-08-05 13:00 28,288 --a--c--- c:\windows\system32\dllcache\xjis.nls 2008-11-18 21:06 . 2004-08-05 13:00 1,875,968 --a--c--- c:\windows\system32\dllcache\msir3jp.lex 2008-11-18 21:05 . 2004-08-05 13:00 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll 2008-11-18 21:04 . 2004-08-05 13:00 1,677,824 --a--c--- c:\windows\system32\dllcache\chsbrkr.dll 2008-11-18 21:03 . 2004-05-13 00:39 876,653 --a--c--- c:\windows\system32\dllcache\fp4awel.dll 2008-11-18 20:57 . 2008-11-18 20:57 749 -rah----- c:\windows\WindowsShell.Manifest 2008-11-18 20:57 . 2008-11-18 20:57 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest 2008-11-18 20:57 . 2008-11-18 20:57 749 -rah----- c:\windows\system32\sapi.cpl.manifest 2008-11-18 20:57 . 2008-11-18 20:57 749 -rah----- c:\windows\system32 cpa.cpl.manifest 2008-11-18 20:57 . 2008-11-18 20:57 488 -rah----- c:\windows\system32\logonui.exe.manifest 2008-11-18 20:56 . 2004-08-05 13:00 16,384 --a--c--- c:\windows\system32\dllcache\isignup.exe 2008-11-18 20:55 . 2004-08-05 13:00 218,624 --a--c--- c:\windows\system32\dllcache\icwconn1.exe 2008-11-18 20:55 . 2004-08-05 13:00 86,016 --a--c--- c:\windows\system32\dllcache\icwconn2.exe 2008-11-18 20:55 . 2004-08-05 13:00 32,768 --a--c--- c:\windows\system32\dllcache\icwdl.dll 2008-11-18 20:55 . 2004-08-05 13:00 20,480 --a--c--- c:\windows\system32\dllcache\inetwiz.exe 2008-11-18 20:42 . 2008-11-18 20:42 d---s---- c:\windows\system32\config\systemprofile\Historique 2008-11-18 18:11 . 2008-11-18 18:11 d-------- c:\documents and settings\All Users\Application Data\AntiVir PersonalEdition Classic 2008-11-18 18:06 . 2008-11-18 18:06 d-------- c:\program files\Avira 2008-11-18 18:04 . 2008-11-18 18:04 932 --a------ c:\windows\setupapi.old 2008-11-18 16:39 . 2007-09-02 20:56 1,686,016 --a------ c:\windows\system32\clinetsuitex6.ocx 2008-11-18 16:39 . 2004-03-09 16:45 662,288 --a------ c:\windows\system32\MSCOMCT2.OCX 2008-11-18 16:39 . 2004-06-14 14:56 427,864 --a------ c:\windows\system32\XceedZip.dll 2008-11-16 14:09 . 2008-11-16 14:09 d-------- c:\program files\Sun 2008-11-16 14:08 . 2008-11-16 14:04 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-16 13:18 . 2008-11-16 13:42 16,307,608 --a------ c:\program files\jre-6u10-windows-i586-p-s.exe 2008-11-16 13:18 . 2008-11-16 13:18 1,886,800 --a------ c:\program files\install_flash_player_10_active_x.exe 2008-11-12 12:57 . 2008-11-16 14:04 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-11 17:16 . 2008-11-11 17:16 d-------- c:\program files\WinZip.Pro.v12.0.8252{H33T}{JOHNCANADUDE} 2008-11-11 17:15 . 2008-11-11 17:16 d-------- c:\program files\WinRAR 3.71 Final French 2008-11-10 16:44 . 2008-11-10 16:44 d-------- c:\program files\NeroInstall.bak 2008-11-10 16:34 . 2008-11-10 16:34 d-------- c:\documents and settings\Propriétaire\Application Data\Nero 2008-11-10 16:23 . 2008-11-10 16:23 d-------- c:\program files\Nero 2008-11-10 16:23 . 2008-11-10 16:23 d-------- c:\documents and settings\All Users\Application Data\Nero 2008-11-09 11:17 . 2008-11-09 11:20 2,955,128 --a------ c:\program files\ccsetup213.exe 2008-11-07 19:35 . 2008-11-07 19:35 25,129,080 --a------ c:\program files\antivir_workstation_winu_en_h.exe 2008-11-07 17:50 . 2008-11-07 17:52 6,113,439 --a------ c:\program files\pci_filerecovery.exe 2008-11-07 17:42 . 2008-11-07 17:43 2,331,336 --a------ c:\program files ecuva_recuva_1.20.361_francais_31279.exe 2008-11-07 17:40 . 2008-11-07 17:43 7,261,864 --a------ c:\program files\RecoverMyFiles-Setup.exe 2008-11-05 18:18 . 2008-11-05 18:40 16,735,888 --a------ c:\program files\wg311t_5_0_setup.exe 2008-11-05 17:10 . 2008-11-18 19:24 d-------- c:\windows\Drivers 2008-11-05 17:10 . 2002-12-24 13:52 54,016 --a------ c:\windows\system32\drivers\ousb2hub.sys 2008-11-05 17:10 . 2002-12-24 13:52 39,040 --a------ c:\windows\system32\drivers\ousbehci.sys 2008-11-04 23:28 . 2008-11-04 23:44 15,689,944 --a------ c:\documents and settings\wpn311_2_0_setup.exe 2008-11-04 23:27 . 2008-11-04 23:44 16,735,888 --a------ c:\documents and settings\wg311t_5_0_setup.exe 2008-11-04 23:24 . 2008-11-04 23:26 1,435,845 --a------ c:\documents and settings\VIA_Hyperion 4in1_v456v.zip 2008-11-04 23:23 . 2008-11-04 23:34 13,301,758 --a------ c:\documents and settings\via_hyperionpro_v521a.zip 2008-11-04 23:21 . 2008-11-04 23:26 461,960 --a------ c:\documents and settings\MANUAL_CMP-USB2PCC10.zip 2008-11-04 23:20 . 2008-11-04 23:33 15,243,539 --a------ c:\documents and settings\VIA_USB2_V270p1-L-M.zip 2008-10-31 13:38 . 2008-10-31 13:38 d-------- c:\program files\Samsung 2008-10-28 14:01 . 2008-05-14 17:12 d-------- C:\META-INF 2008-10-28 13:35 . 2008-10-06 18:01 d--h----- c:\documents and settings\Administrateur\Voisinage réseau 2008-10-28 13:35 . 2008-10-06 18:01 d--h----- c:\documents and settings\Administrateur\Voisinage d'impression 2008-10-28 13:35 . 2008-10-06 16:07 d--h----- c:\documents and settings\Administrateur\Modèles 2008-10-28 13:35 . 2008-10-06 18:01 d-------- c:\documents and settings\Administrateur\Mes documents 2008-10-28 13:35 . 2008-10-06 18:01 dr------- c:\documents and settings\Administrateur\Menu Démarrer 2008-10-28 13:35 . 2008-10-06 18:01 d-------- c:\documents and settings\Administrateur\Favoris 2008-10-28 13:35 . 2008-10-06 16:17 d-------- c:\documents and settings\Administrateur\Bureau 2008-10-28 13:35 . 2008-10-28 13:35 d-------- c:\documents and settings\Administrateur 2008-10-28 12:19 . 2003-03-11 00:12 59,632 -ra------ c:\windows\system32\drivers\qcusbser.sys 2008-10-28 11:41 . 2003-03-11 00:12 59,632 -ra------ c:\windows\system32\drivers\qcusbmdm.sys 2008-10-25 19:34 . 2008-10-31 14:12 d-------- c:\documents and settings\Propriétaire\Application Data\Samsung 2008-10-25 19:30 . 2008-10-25 19:30 d-------- c:\program files\Fichiers communs\Adobe 2008-10-25 19:22 . 2006-05-03 21:53 174,592 --a------ c:\windows\system32\framedyn.dll 2008-10-25 19:22 . 2007-07-03 15:58 106,792 --a------ c:\windows\system32\drivers\sscdmdm.sys 2008-10-25 19:22 . 2007-07-03 15:54 80,552 --a------ c:\windows\system32\drivers\sscdbus.sys 2008-10-25 19:22 . 2007-07-03 15:57 11,944 --a------ c:\windows\system32\drivers\sscdmdfl.sys 2008-10-25 19:22 . 2007-07-03 16:00 9,256 --a------ c:\windows\system32\drivers\sscdwhnt.sys 2008-10-25 19:22 . 2007-07-03 16:00 9,256 --a------ c:\windows\system32\drivers\sscdwh.sys 2008-10-25 19:22 . 2007-07-03 15:56 9,256 --a------ c:\windows\system32\drivers\sscdcmnt.sys 2008-10-25 19:22 . 2007-07-03 15:56 9,256 --a------ c:\windows\system32\drivers\sscdcm.sys 2008-10-25 19:21 . 2008-10-25 19:22 d-------- c:\windows\system32\Samsung_USB_Drivers 2008-10-25 19:21 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico 2008-10-25 19:20 . 2008-10-31 14:09 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys 2008-10-25 11:53 . 2008-11-21 20:10 196,658 --a------ c:\windows\system32\oodbs.lor 2008-10-25 10:35 . 2008-10-25 10:35 d-------- c:\program files\OO Software 2008-10-23 15:04 . 2008-10-25 11:30 d-------- c:\windows\system32\oodag 2008-10-23 15:02 . 2008-10-23 15:02 0 --a------ c:\windows\OODCNT.INI 2008-10-23 11:21 . 2008-10-23 11:21 d-------- c:\program files\MSBuild 2008-10-23 11:21 . 2008-10-23 11:21 d-------- c:\program files\Microsoft Works 2008-10-23 11:18 . 2008-10-23 11:18 d-------- c:\program files\Microsoft.NET 2008-10-23 11:14 . 2008-10-23 11:14 d-------- c:\program files\Microsoft Visual Studio 8 2008-10-23 11:12 . 2008-10-23 11:20 d--h----- c:\windows\ShellNew 2008-10-23 11:08 . 2008-11-13 21:23 d-------- c:\documents and settings\All Users\Application Data\Microsoft Help 2008-10-23 11:07 . 2008-10-23 11:07 dr-h----- C:\MSOCache 2008-10-23 11:02 . 2008-10-23 11:04 d-------- c:\documents and settings\All Users\Application Data\WinZip 2008-10-23 10:53 . 2008-10-23 10:53 d-------- c:\program files\Free iPod Video Converter 2008-10-23 10:53 . 2004-05-25 16:06 417,792 --a------ c:\windows\system32\ac3filter.ax 2008-10-23 10:53 . 2005-02-27 20:48 356,352 --a------ c:\windows\system32\RealMediaSplitter.ax 2008-10-23 10:53 . 2004-01-10 16:02 258,048 --a------ c:\windows\system32\GplMpgDec.ax 2008-10-21 18:04 . 2008-10-22 15:16 d-------- c:\documents and settings\Propriétaire\Application Data\dvdcss 2008-10-21 17:50 . 2008-10-31 13:00 116 --a------ c:\windows\NeroDigital.ini 2008-10-21 17:39 . 2008-11-10 16:30 d-------- c:\program files\Fichiers communs\Nero 2008-10-21 17:34 . 2008-11-10 14:26 d-------- c:\program files\Ahead 2008-10-21 16:17 . 2008-10-22 15:34 d-------- c:\documents and settings\All Users\Application Data\DVD Shrink 2008-10-21 16:16 . 2008-10-21 16:16 d-------- c:\program files\DVD Shrink 2008-10-21 16:02 . 2007-06-27 08:31 1,734,996 --a------ c:\program files\free-ipod-video-converter_free_ipod_video_converter_1.32_anglais_18827.exe 2008-10-21 14:42 . 2008-10-21 14:42 d-------- c:\documents and settings\Propriétaire\Application Data\vlc 2008-10-21 14:30 . 2008-10-21 14:30 d-------- c:\program files\VideoLAN 2008-10-21 13:30 . 2008-10-21 13:31 d-------- c:\program files\Office 2007 Pro Edition _ Lyes dz . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-19 16:42 --------- d-----w c:\program files\Atheros 2008-11-19 16:31 --------- d-----w c:\program files\IDETOOL 2008-11-19 15:42 --------- d-----w c:\program files\DirectX 2008-11-19 15:22 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-18 20:35 --------- d-----w c:\program files\ma-config.com 2008-11-18 20:35 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com 2008-11-18 19:46 20,152 ----a-w c:\windows\system32\drivers\INFCACHE.1 2008-11-16 13:03 --------- d-----w c:\program files\Java 2008-10-30 08:51 51,072 ----a-w c:\windows\system32\drivers\fsdfw.sys 2008-10-30 08:51 30,016 ----a-w c:\windows\system32\drivers\fsndis5.sys 2008-10-23 09:00 --------- d-----w c:\program files\Microsoft Silverlight 2008-10-21 13:31 --------- d-----w c:\documents and settings\Propriétaire\Application Data\Apple Computer 2008-10-20 16:00 --------- d-----w c:\documents and settings\Propriétaire\Application Data\Image Zone Express 2008-10-20 08:28 --------- d-----w c:\program files\BitComet 2008-10-12 16:48 --------- d-----w c:\program files\Fichiers communs\InstallShield 2008-10-12 16:32 --------- d-----w c:\program files\Windows Installer Clean Up 2008-10-12 16:31 --------- d-----w c:\program files\MSECACHE 2008-10-12 16:30 359,656 ----a-w c:\program files\msicuu2.exe 2008-10-12 15:38 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2 2008-10-10 18:33 --------- d-----w c:\program files\Fichiers communs\Labtec 2008-10-10 18:31 --------- d-----w c:\program files\Fichiers communs\LogiShrd 2008-10-10 18:30 --------- d-----w c:\program files\Labtec 2008-10-09 14:40 --------- d-----w c:\documents and settings\Propriétaire\Application Data\HP 2008-10-08 17:42 1,495,112 ----a-w c:\program files\install_flash_player.exe 2008-10-07 17:52 --------- d-----w c:\program files\Windows Desktop Search 2008-10-07 17:31 --------- d-----w c:\program files\MSXML 4.0 2008-10-07 17:22 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus! 2008-10-07 17:20 --------- d-----w c:\program files\Windows Media Connect 2 2008-10-07 15:03 --------- d-----w c:\program files\NEW DRIVERS 2008-10-07 14:42 --------- d-----w c:\program files\S3 2008-10-07 14:30 --------- d-----w c:\program files\Messenger Plus! Live 2008-10-07 14:24 --------- d-----w c:\program files\Windows Live 2008-10-07 14:19 --------- dcsh--w c:\program files\Fichiers communs\WindowsLiveInstaller 2008-10-07 14:17 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller 2008-10-07 14:15 --------- d-----w c:\program files\iTunes 2008-10-07 14:15 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-07 14:14 --------- d-----w c:\program files\QuickTime 2008-10-07 14:14 --------- d-----w c:\program files\iPod 2008-10-07 14:14 --------- d-----w c:\program files\Bonjour 2008-10-07 14:14 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer 2008-10-07 14:12 --------- d-----w c:\program files\Fichiers communs\Apple 2008-10-07 14:11 --------- d-----w c:\program files\Apple Software Update 2008-10-07 14:09 --------- d-----w c:\documents and settings\All Users\Application Data\Apple 2008-10-07 14:07 --------- d-----w c:\program files\VIA 2008-10-07 12:58 67,167,528 ----a-w c:\program files\iTunes801Setup.exe 2008-10-06 19:27 --------- d-----w c:\program files\Orange 2008-10-06 19:24 25,752,376 ----a-w c:\program files\wmp11-windowsxp-x86-enu.exe 2008-10-06 19:22 --------- d-----w c:\program files\Fichiers communs\France Telecom 2008-10-06 19:21 --------- d-----w c:\documents and settings\Propriétaire\Application Data\F-Secure 2008-10-06 19:19 --------- d-----w c:\program files\SAGEM 2008-10-06 19:19 --------- d-----w c:\documents and settings\Propriétaire\Application Data\InstallShield 2008-10-06 19:18 --------- d-----w c:\program files\Securitoo 2008-10-06 17:35 4,865,872 ----a-w c:\program files\MsgPlusLive-470.exe 2008-10-06 17:29 --------- d-----w c:\documents and settings\All Users\Application Data\F-Secure 2008-10-06 17:27 2,402,832 ----a-w c:\program files\WLinstaller.exe 2008-10-06 17:27 14,648,672 ----a-w c:\program files\winzip120.exe 2008-10-06 17:27 --------- d-----w c:\documents and settings\All Users\Application Data\fssg 2008-10-06 17:25 69,235,448 ----a-w c:\program files\orange_avfw_513.exe 2008-10-06 16:43 1,234,120 ----a-w c:\program files\wrar380.exe 2008-10-06 16:41 --------- d-----w c:\program files\CCleaner 2008-10-06 16:38 1,885,208 ----a-w c:\program files\flashplayer10_install_activex_091508.exe 2008-10-06 16:36 2,934,168 ----a-w c:\program files\ccsetup212.exe 2008-10-06 16:36 1,014,272 ----a-w c:\program files\wlsetup-web.exe 2008-10-06 16:34 5,318,816 ----a-w c:\program files\bitcomet_setup.exe 2008-10-06 16:31 --------- d-----w c:\program files\Google 2008-10-06 16:30 166,560 ----a-w c:\program files\GoogleToolbarInstaller_download_signed.exe 2008-10-06 15:47 --------- d-----w c:\program files\DRIVERS 2008-10-06 15:46 9,388 ----a-w c:\windows\system32\drivers\iaStor.PNF 2008-10-06 15:46 7,280 ----a-w c:\windows\system32\drivers\viamraid.PNF 2008-10-06 15:46 63,240 ----a-w c:\windows\system32\drivers\Si3112r.PNF 2008-10-06 15:46 6,984 ----a-w c:\windows\system32\drivers\SiSRaid.PNF 2008-10-06 15:46 12,432 ----a-w c:\windows\system32\drivers\adpu320.PNF 2008-10-06 15:46 12,204 ----a-w c:\windows\system32\drivers vraid.PNF 2008-10-06 15:46 10,828 ----a-w c:\windows\system32\drivers\iaAHCI.PNF 2008-10-06 15:39 --------- d-----w c:\program files\HP 2008-10-06 15:39 --------- d-----w c:\program files\Fichiers communs\HP 2008-10-06 15:39 --------- d-----w c:\documents and settings\All Users\Application Data\HP 2008-10-06 15:36 --------- d-----w c:\program files\Hewlett-Packard 2008-10-06 15:35 --------- d-----w c:\program files\Fichiers communs\Hewlett-Packard 2008-10-06 15:17 --------- d-----w c:\program files\microsoft frontpage 2008-10-06 15:15 --------- d-----w c:\program files\Fichiers communs\Java 2008-10-06 15:10 --------- d-----w c:\program files\Services en ligne 2008-10-05 16:31 498 ----a-w c:\program files\DisparitionCD.inf 2008-10-01 11:01 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-24 09:40 4,122,368 ----a-r c:\windows\system32\drivers\alcxwdm.sys 2008-09-10 01:15 1,307,648 ----a-w c:\windows\system32\msxml6.dll 2008-09-04 04:02 730,368 ----a-w c:\windows\system32\oodsvct.exe 2008-09-04 04:02 1,295,616 ----a-w c:\windows\system32\oodag.exe 2008-09-04 04:01 2,524,416 ----a-w c:\windows\system32\oodtray.exe 2008-09-04 04:01 194,816 ----a-w c:\windows\system32\oodbs.exe 2008-09-04 03:58 9,984 ----a-w c:\windows\system32\oodbsrs.dll 2008-09-04 03:58 894,208 ----a-w c:\windows\system32\oodtrrs.dll 2008-09-04 03:58 8,448 ----a-w c:\windows\system32\oodagrs.dll 2008-09-04 03:58 15,616 ----a-w c:\windows\system32\oodagmg.dll 2008-08-30 03:20 15,104 ----a-w c:\windows\system32\ootmapi.dll 2008-08-29 08:18 87,336 ----a-w c:\windows\system32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w c:\windows\system32\dnssd.dll 2008-08-10 23:09 528,392 ----a-w c:\program files\DXSETUP.exe 2008-07-05 18:40 232,761,628 ----a-w c:\program files\Nero 8 Ultra Edition v8.3.2.1 [Multilanguage].rar . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-06 39408] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "F-Secure Manager"="c:\program files\Orange\AntivirusFirewall\Common\FSM32.EXE" [2008-04-23 182936] "F-Secure TNB"="c:\program files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" [2008-04-23 744032] "ACU"="c:\program files\Atheros\ACU.exe" [2005-11-25 307200] "SystrayORAHSS"="c:\program files\Orange\Systray\SystrayApp.exe" [2007-09-25 94208] "ORAHSSSessionManager"="c:\program files\Orange\SessionManager\SessionManager.exe" [2007-09-25 102400] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "LogitechCommunicationsManager"="c:\program files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-03-06 488984] "NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2008-02-28 570664] "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-16 136600] "VTTimer"="VTTimer.exe" [2006-09-21 c:\windows\system32\VTTimer.exe] "VTTrayp"="VTtrayp.exe" [2006-09-28 c:\windows\system32\VTTrayp.exe] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 c:\windows\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="c:\windows\system32 scupgrd.exe" [2004-08-05 44544] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ IDETool.lnk - c:\program files\IDETOOL\IDETOOL.EXE [2008-10-07 352256] NETGEAR WG311T Smart Wizard.lnk - c:\program files\NETGEAR\WG311T\wlancfg5.exe [2006-09-15 1503232] NETGEAR WPN311 Smart Wizard.lnk - c:\program files\NETGEAR\WPN311\wlancfg5.exe [2006-12-04 1503232] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winuy25.sys] @="Driver" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^WinZip Quick Pick.lnk] path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-05 13:00 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2006-02-19 01:41 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-10-01 17:57 289576 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon] --a------ 2007-03-06 16:58 1060376 c:\program files\Labtec\WebCam10\WebCam10.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray] --a------ 2008-09-04 05:01 2524416 c:\windows\system32\oodtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2008-10-06 17:31 39408 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "wscsvc"=2 (0x2) "UPS"=3 (0x3) "SharedAccess"=2 (0x2) "seclogon"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"= "c:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"= "c:\Program Files\HP\Digital Imaging\bin\hposid01.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"= "c:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"= "c:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"= "c:\Program Files\BitComet\BitComet.exe"= "c:\Program Files\Orange\Connectivity\ConnectivityManager.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\Bonjour\mDNSResponder.exe"= "c:\Program Files\iTunes\iTunes.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Windows Live\Messenger\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "18409:TCP"= 18409:TCP:BitComet 18409 TCP "18409:UDP"= 18409:UDP:BitComet 18409 UDP R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2008-10-06 51072] R0 viadsk;viadsk;c:\windows\system32\DRIVERS\viadsk.sys [2008-10-07 56576] R0 videX32;videX32;c:\windows\system32\DRIVERS\videX32.sys [2008-10-07 9216] R1 F-Secure HIPS;F-Secure HIPS;\??\c:\program files\Orange\AntivirusFirewall\HIPS\fshs.sys [2008-10-06 41184] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\c:\program files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys [2008-10-06 62048] R3 WSIMD;wsimd Service;c:\windows\system32\DRIVERS\wsimd.sys [2008-10-06 54432] S3 maconfservice;Ma-Config Service;"c:\program files\ma-config.com\maconfservice.exe" [2008-11-17 195752] S3 PCIENUM;PCIENUM;\??\c:\program files\IDETOOL\pcienum.sys [2008-10-07 281676] S3 qcusbmdm;Qualcomm Proprietary USB Driver (PID 3197);c:\windows\system32\DRIVERS\qcusbmdm.sys [2008-10-28 59632] S3 qcusbser;Qualcomm Diagnostic Port 3197;c:\windows\system32\DRIVERS\qcusbser.sys [2008-10-28 59632] S3 Winuy25;Winuy25;\??\c:\windows\System32\drivers\Winuy25.sys [] S4 F-Secure Filter;F-Secure File System Filter;\??\c:\program files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2008-10-06 39776] S4 F-Secure Recognizer;F-Secure File System Recognizer;\??\c:\program files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2008-10-06 25184] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6895251c-9f6a-11dd-8474-00c0a8b11f64}] \Shell\AutoRun\command - 1u0o8bnq.cmd \Shell\explore\Command - 1u0o8bnq.cmd \Shell\open\Command - 1u0o8bnq.cmd . Contenu du dossier 'Tâches planifiées' 2008-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2008-11-21 c:\windows\Tasks\Scheduled scanning task.job - c:\progra~1\Orange\ANTIVI~1\ANTI-V~1\fsav.exe [2008-04-23 17:11] . - - - - ORPHELINS SUPPRIMES - - - - HKLM-Run-avgnt - c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe MSConfigStartUp-NeroFilterCheck - c:\windows\system32\NeroCheck.exe . ------- Examen supplémentaire ------- . FireFox -: Profile - c:\documents and settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\k9uvb9u1.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF -: plugin - c:\documents and settings\PropriÃ©taire\Application Data\Mozilla\Firefox\Profiles\k9uvb9u1.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins phardwaredetection.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins pitunes.dll FF -: plugin - c:\program files\Java\jre6\bin ew_plugin pdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin ew_plugin pjp2.dll FF -: plugin - c:\program files\ma-config.com phardwaredetection.dll FF -: plugin - c:\program files\Microsoft Silverlight\2.0.30523.8 pctrl.dll FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0 pctrl.1.0.30716.0.dll FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0 pctrl.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins pdeploytk.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-21 20:18:48 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet006\Services\TDSSserv.sys] "imagepath"="\systemroot\system32\drivers\TDSSrvdc.sys" . Heure de fin: 2008-11-21 20:24:18 ComboFix-quarantined-files.txt 2008-11-21 19:23:58 Avant-CF: 12,131,594,240 octets libres Après-CF: 12,120,641,536 octets libres 391 --- E O F --- 2008-11-13 20:23:57

Utilisateur anonyme · Answer

Hi,

Très bien.

maintenant fait ceci:(Avec combofix)

Toujours avec toutes les protections désactivées, fais ceci :

Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

----------------------------------------------------------
Driver::
-------\Service_TDSSSERV.SYS
-------\Legacy_TDSSSERV.SYS


------------------------------------------------------------------

- Enregistre ce fichier sur ton bureau (et pas ailleurs !) sous le nom CFScript.txt
- Quitte le Bloc Notes

· Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) comme sur ce lien : http://apu.mabul.org/up/apu/2008/09/06/img-2258535my8h.gif

* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt




Aussitôt après, sans redémarrer ton ordinateur, fais ceci :

Passe Malwarebytes' Anti-Malware 

Alut.

cynthia92 · Answer

ComboFix 08-11-18.A2 - Propriétaire 2008-11-23 10:11:36.3 - NTFSx86 MINIMAL Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.275 [GMT 1:00] Lancé depuis: c:\documents and settings\Propriétaire\Bureau\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\Propriétaire\Bureau\CFScript.txt [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR] . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-23 au 2008-11-23 )))))))))))))))))))))))))))))))))))) . 2008-11-22 23:59 . 2008-11-23 00:08 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-22 23:59 . 2008-11-22 23:59 d-------- c:\documents and settings\Propriétaire\Application Data\Malwarebytes 2008-11-22 23:59 . 2008-11-22 23:59 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-11-22 23:59 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-22 23:59 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-11-22 23:49 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2008-11-22 23:04 . 2008-11-22 23:47 1,393 --a------ c:\windows\imsins.BAK 2008-11-22 22:33 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuapi.dll.mui 2008-11-21 21:30 . 2008-11-21 21:44 d-------- c:\windows\system32\CatRoot_bak 2008-11-21 21:26 . 2008-10-03 18:12 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2008-11-21 21:26 . 2007-04-17 10:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2008-11-21 21:26 . 2007-03-08 06:10 1,048,576 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2008-11-21 21:26 . 2008-08-26 09:11 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2008-11-21 21:26 . 2008-08-26 09:11 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2008-11-21 21:26 . 2008-08-26 09:11 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2008-11-21 21:26 . 2008-08-26 09:11 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2008-11-21 21:26 . 2008-08-26 09:11 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2008-11-21 21:25 . 2008-08-14 14:39 2,188,032 -----c--- c:\windows\system32\dllcache toskrnl.exe 2008-11-21 21:25 . 2008-08-14 14:39 2,144,768 -----c--- c:\windows\system32\dllcache tkrnlmp.exe 2008-11-21 21:25 . 2008-08-14 14:39 2,065,024 -----c--- c:\windows\system32\dllcache tkrnlpa.exe 2008-11-21 21:25 . 2008-08-14 14:39 2,022,912 -----c--- c:\windows\system32\dllcache tkrpamp.exe 2008-11-21 21:14 . 2008-06-14 18:59 272,768 -----c--- c:\windows\system32\dllcache\bthport.sys 2008-11-21 19:52 . 2008-11-21 19:52 664 --a------ c:\windows\system32\d3d9caps.dat 2008-11-21 18:24 . 2008-11-21 18:24 d-------- C:\VundoFix Backups 2008-11-21 18:08 . 2008-11-21 18:08 d-------- C: sit 2008-11-20 22:45 . 2008-11-20 22:45 d-------- c:\windows\ERUNT 2008-11-20 21:18 . 2008-11-20 21:30 d-------- c:\program files\Navilog1 2008-11-20 19:17 . 2008-11-21 17:46 d-------- c:\program files\FindyKill 2008-11-20 17:01 . 2008-11-20 17:24 d-------- C:\ToolBar SD 2008-11-20 16:40 . 2008-11-23 00:02 4,004 --a------ c:\windows\system32\PerfStringBackup.TMP 2008-11-19 16:22 . 2008-11-19 16:22 d-------- C:\OEMSettings 2008-11-19 16:09 . 2008-11-19 16:09 17,801 --a------ c:\windows\system32\drivers\AegisP.sys 2008-11-19 16:08 . 2008-11-19 16:21 d-------- c:\program files\NETGEAR 2008-11-19 15:56 . 2008-11-19 15:56 d-------- c:\windows\Downloaded Installations 2008-11-19 14:32 . 2008-11-19 14:32 268 --ah----- C:\sqmdata00.sqm 2008-11-19 14:32 . 2008-11-19 14:32 244 --ah----- C:\sqmnoopt00.sqm 2008-11-18 21:53 . 2008-11-18 21:53 d-------- c:\program files\Realtek AC97 2008-11-18 21:21 . 2008-11-19 17:00 d-------- C:\Driver Download 2008-11-18 21:08 . 2004-08-05 13:00 28,288 --a--c--- c:\windows\system32\dllcache\xjis.nls 2008-11-18 21:06 . 2004-08-05 13:00 1,875,968 --a--c--- c:\windows\system32\dllcache\msir3jp.lex 2008-11-18 21:05 . 2004-08-05 13:00 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll 2008-11-18 21:04 . 2004-08-05 13:00 1,677,824 --a--c--- c:\windows\system32\dllcache\chsbrkr.dll 2008-11-18 21:03 . 2004-05-13 00:39 876,653 --a--c--- c:\windows\system32\dllcache\fp4awel.dll 2008-11-18 20:57 . 2008-11-18 20:57 749 -rah----- c:\windows\WindowsShell.Manifest 2008-11-18 20:57 . 2008-11-18 20:57 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest 2008-11-18 20:57 . 2008-11-18 20:57 749 -rah----- c:\windows\system32\sapi.cpl.manifest 2008-11-18 20:57 . 2008-11-18 20:57 749 -rah----- c:\windows\system32 cpa.cpl.manifest 2008-11-18 20:57 . 2008-11-18 20:57 488 -rah----- c:\windows\system32\logonui.exe.manifest 2008-11-18 20:56 . 2004-08-05 13:00 16,384 --a--c--- c:\windows\system32\dllcache\isignup.exe 2008-11-18 20:55 . 2004-08-05 13:00 218,624 --a--c--- c:\windows\system32\dllcache\icwconn1.exe 2008-11-18 20:55 . 2004-08-05 13:00 86,016 --a--c--- c:\windows\system32\dllcache\icwconn2.exe 2008-11-18 20:55 . 2004-08-05 13:00 32,768 --a--c--- c:\windows\system32\dllcache\icwdl.dll 2008-11-18 20:55 . 2004-08-05 13:00 20,480 --a--c--- c:\windows\system32\dllcache\inetwiz.exe 2008-11-18 20:42 . 2008-11-18 20:42 d---s---- c:\windows\system32\config\systemprofile\Historique 2008-11-18 18:11 . 2008-11-18 18:11 d-------- c:\documents and settings\All Users\Application Data\AntiVir PersonalEdition Classic 2008-11-18 18:06 . 2008-11-18 18:06 d-------- c:\program files\Avira 2008-11-18 18:04 . 2008-11-18 18:04 932 --a------ c:\windows\setupapi.old 2008-11-18 16:39 . 2007-09-02 20:56 1,686,016 --a------ c:\windows\system32\clinetsuitex6.ocx 2008-11-18 16:39 . 2004-03-09 16:45 662,288 --a------ c:\windows\system32\MSCOMCT2.OCX 2008-11-18 16:39 . 2004-06-14 14:56 427,864 --a------ c:\windows\system32\XceedZip.dll 2008-11-16 14:09 . 2008-11-16 14:09 d-------- c:\program files\Sun 2008-11-16 14:08 . 2008-11-16 14:04 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-16 13:18 . 2008-11-16 13:42 16,307,608 --a------ c:\program files\jre-6u10-windows-i586-p-s.exe 2008-11-16 13:18 . 2008-11-16 13:18 1,886,800 --a------ c:\program files\install_flash_player_10_active_x.exe 2008-11-12 12:57 . 2008-11-16 14:04 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-11 17:16 . 2008-11-11 17:16 d-------- c:\program files\WinZip.Pro.v12.0.8252{H33T}{JOHNCANADUDE} 2008-11-11 17:15 . 2008-11-11 17:16 d-------- c:\program files\WinRAR 3.71 Final French 2008-11-10 16:44 . 2008-11-10 16:44 d-------- c:\program files\NeroInstall.bak 2008-11-10 16:34 . 2008-11-10 16:34 d-------- c:\documents and settings\Propriétaire\Application Data\Nero 2008-11-10 16:23 . 2008-11-10 16:23 d-------- c:\program files\Nero 2008-11-10 16:23 . 2008-11-10 16:23 d-------- c:\documents and settings\All Users\Application Data\Nero 2008-11-09 11:17 . 2008-11-09 11:20 2,955,128 --a------ c:\program files\ccsetup213.exe 2008-11-07 19:35 . 2008-11-07 19:35 25,129,080 --a------ c:\program files\antivir_workstation_winu_en_h.exe 2008-11-07 17:50 . 2008-11-07 17:52 6,113,439 --a------ c:\program files\pci_filerecovery.exe 2008-11-07 17:42 . 2008-11-07 17:43 2,331,336 --a------ c:\program files ecuva_recuva_1.20.361_francais_31279.exe 2008-11-07 17:40 . 2008-11-07 17:43 7,261,864 --a------ c:\program files\RecoverMyFiles-Setup.exe 2008-11-05 18:18 . 2008-11-05 18:40 16,735,888 --a------ c:\program files\wg311t_5_0_setup.exe 2008-11-05 17:10 . 2008-11-18 19:24 d-------- c:\windows\Drivers 2008-11-05 17:10 . 2002-12-24 13:52 54,016 --a------ c:\windows\system32\drivers\ousb2hub.sys 2008-11-05 17:10 . 2002-12-24 13:52 39,040 --a------ c:\windows\system32\drivers\ousbehci.sys 2008-11-04 23:28 . 2008-11-04 23:44 15,689,944 --a------ c:\documents and settings\wpn311_2_0_setup.exe 2008-11-04 23:27 . 2008-11-04 23:44 16,735,888 --a------ c:\documents and settings\wg311t_5_0_setup.exe 2008-11-04 23:24 . 2008-11-04 23:26 1,435,845 --a------ c:\documents and settings\VIA_Hyperion 4in1_v456v.zip 2008-11-04 23:23 . 2008-11-04 23:34 13,301,758 --a------ c:\documents and settings\via_hyperionpro_v521a.zip 2008-11-04 23:21 . 2008-11-04 23:26 461,960 --a------ c:\documents and settings\MANUAL_CMP-USB2PCC10.zip 2008-11-04 23:20 . 2008-11-04 23:33 15,243,539 --a------ c:\documents and settings\VIA_USB2_V270p1-L-M.zip 2008-10-31 13:38 . 2008-10-31 13:38 d-------- c:\program files\Samsung 2008-10-28 14:01 . 2008-05-14 17:12 d-------- C:\META-INF 2008-10-28 13:35 . 2008-10-06 18:01 d--h----- c:\documents and settings\Administrateur\Voisinage réseau 2008-10-28 13:35 . 2008-10-06 18:01 d--h----- c:\documents and settings\Administrateur\Voisinage d'impression 2008-10-28 13:35 . 2008-10-06 16:07 d--h----- c:\documents and settings\Administrateur\Modèles 2008-10-28 13:35 . 2008-10-06 18:01 d-------- c:\documents and settings\Administrateur\Mes documents 2008-10-28 13:35 . 2008-10-06 18:01 dr------- c:\documents and settings\Administrateur\Menu Démarrer 2008-10-28 13:35 . 2008-10-06 18:01 d-------- c:\documents and settings\Administrateur\Favoris 2008-10-28 13:35 . 2008-10-06 16:17 d-------- c:\documents and settings\Administrateur\Bureau 2008-10-28 13:35 . 2008-10-28 13:35 d-------- c:\documents and settings\Administrateur 2008-10-28 12:19 . 2003-03-11 00:12 59,632 -ra------ c:\windows\system32\drivers\qcusbser.sys 2008-10-28 11:41 . 2003-03-11 00:12 59,632 -ra------ c:\windows\system32\drivers\qcusbmdm.sys 2008-10-25 19:34 . 2008-10-31 14:12 d-------- c:\documents and settings\Propriétaire\Application Data\Samsung 2008-10-25 19:30 . 2008-10-25 19:30 d-------- c:\program files\Fichiers communs\Adobe 2008-10-25 19:22 . 2006-05-03 21:53 174,592 --a------ c:\windows\system32\framedyn.dll 2008-10-25 19:22 . 2007-07-03 15:58 106,792 --a------ c:\windows\system32\drivers\sscdmdm.sys 2008-10-25 19:22 . 2007-07-03 15:54 80,552 --a------ c:\windows\system32\drivers\sscdbus.sys 2008-10-25 19:22 . 2007-07-03 15:57 11,944 --a------ c:\windows\system32\drivers\sscdmdfl.sys 2008-10-25 19:22 . 2007-07-03 16:00 9,256 --a------ c:\windows\system32\drivers\sscdwhnt.sys 2008-10-25 19:22 . 2007-07-03 16:00 9,256 --a------ c:\windows\system32\drivers\sscdwh.sys 2008-10-25 19:22 . 2007-07-03 15:56 9,256 --a------ c:\windows\system32\drivers\sscdcmnt.sys 2008-10-25 19:22 . 2007-07-03 15:56 9,256 --a------ c:\windows\system32\drivers\sscdcm.sys 2008-10-25 19:21 . 2008-10-25 19:22 d-------- c:\windows\system32\Samsung_USB_Drivers 2008-10-25 19:21 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico 2008-10-25 19:20 . 2008-10-31 14:09 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys 2008-10-25 11:53 . 2008-11-23 10:08 205,597 --a------ c:\windows\system32\oodbs.lor 2008-10-25 10:35 . 2008-10-25 10:35 d-------- c:\program files\OO Software 2008-10-23 15:04 . 2008-10-25 11:30 d-------- c:\windows\system32\oodag 2008-10-23 15:02 . 2008-10-23 15:02 0 --a------ c:\windows\OODCNT.INI 2008-10-23 11:21 . 2008-10-23 11:21 d-------- c:\program files\MSBuild 2008-10-23 11:21 . 2008-10-23 11:21 d-------- c:\program files\Microsoft Works 2008-10-23 11:18 . 2008-10-23 11:18 d-------- c:\program files\Microsoft.NET 2008-10-23 11:14 . 2008-10-23 11:14 d-------- c:\program files\Microsoft Visual Studio 8 2008-10-23 11:12 . 2008-10-23 11:20 d--h----- c:\windows\ShellNew 2008-10-23 11:08 . 2008-11-13 21:23 d-------- c:\documents and settings\All Users\Application Data\Microsoft Help 2008-10-23 11:07 . 2008-10-23 11:07 dr-h----- C:\MSOCache 2008-10-23 11:02 . 2008-10-23 11:04 d-------- c:\documents and settings\All Users\Application Data\WinZip 2008-10-23 10:53 . 2008-10-23 10:53 d-------- c:\program files\Free iPod Video Converter 2008-10-23 10:53 . 2004-05-25 16:06 417,792 --a------ c:\windows\system32\ac3filter.ax . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-19 16:42 --------- d-----w c:\program files\Atheros 2008-11-19 16:31 --------- d-----w c:\program files\IDETOOL 2008-11-19 15:42 --------- d-----w c:\program files\DirectX 2008-11-19 15:22 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-18 20:35 --------- d-----w c:\program files\ma-config.com 2008-11-18 20:35 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com 2008-11-18 19:46 20,152 ----a-w c:\windows\system32\drivers\INFCACHE.1 2008-11-16 13:03 --------- d-----w c:\program files\Java 2008-11-10 15:30 --------- d-----w c:\program files\Fichiers communs\Nero 2008-11-10 13:26 --------- d-----w c:\program files\Ahead 2008-10-30 08:51 51,072 ----a-w c:\windows\system32\drivers\fsdfw.sys 2008-10-30 08:51 30,016 ----a-w c:\windows\system32\drivers\fsndis5.sys 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 09:00 --------- d-----w c:\program files\Microsoft Silverlight 2008-10-22 14:34 --------- d-----w c:\documents and settings\All Users\Application Data\DVD Shrink 2008-10-22 14:16 --------- d-----w c:\documents and settings\Propriétaire\Application Data\dvdcss 2008-10-21 15:16 --------- d-----w c:\program files\DVD Shrink 2008-10-21 13:42 --------- d-----w c:\documents and settings\Propriétaire\Application Data\vlc 2008-10-21 13:31 --------- d-----w c:\documents and settings\Propriétaire\Application Data\Apple Computer 2008-10-21 13:30 --------- d-----w c:\program files\VideoLAN 2008-10-21 12:31 --------- d-----w c:\program files\Office 2007 Pro Edition _ Lyes dz 2008-10-20 16:00 --------- d-----w c:\documents and settings\Propriétaire\Application Data\Image Zone Express 2008-10-20 08:28 --------- d-----w c:\program files\BitComet 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-12 16:48 --------- d-----w c:\program files\Fichiers communs\InstallShield 2008-10-12 16:32 --------- d-----w c:\program files\Windows Installer Clean Up 2008-10-12 16:31 --------- d-----w c:\program files\MSECACHE 2008-10-12 16:30 359,656 ----a-w c:\program files\msicuu2.exe 2008-10-12 15:38 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2 2008-10-10 18:33 --------- d-----w c:\program files\Fichiers communs\Labtec 2008-10-10 18:31 --------- d-----w c:\program files\Fichiers communs\LogiShrd 2008-10-10 18:30 --------- d-----w c:\program files\Labtec 2008-10-09 14:40 --------- d-----w c:\documents and settings\Propriétaire\Application Data\HP 2008-10-08 17:42 1,495,112 ----a-w c:\program files\install_flash_player.exe 2008-10-07 17:52 --------- d-----w c:\program files\Windows Desktop Search 2008-10-07 17:31 --------- d-----w c:\program files\MSXML 4.0 2008-10-07 17:22 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus! 2008-10-07 17:20 --------- d-----w c:\program files\Windows Media Connect 2 2008-10-07 15:03 --------- d-----w c:\program files\NEW DRIVERS 2008-10-07 14:42 --------- d-----w c:\program files\S3 2008-10-07 14:30 --------- d-----w c:\program files\Messenger Plus! Live 2008-10-07 14:24 --------- d-----w c:\program files\Windows Live 2008-10-07 14:19 --------- dcsh--w c:\program files\Fichiers communs\WindowsLiveInstaller 2008-10-07 14:17 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller 2008-10-07 14:15 --------- d-----w c:\program files\iTunes 2008-10-07 14:15 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-07 14:14 --------- d-----w c:\program files\QuickTime 2008-10-07 14:14 --------- d-----w c:\program files\iPod 2008-10-07 14:14 --------- d-----w c:\program files\Bonjour 2008-10-07 14:14 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer 2008-10-07 14:12 --------- d-----w c:\program files\Fichiers communs\Apple 2008-10-07 14:11 --------- d-----w c:\program files\Apple Software Update 2008-10-07 14:09 --------- d-----w c:\documents and settings\All Users\Application Data\Apple 2008-10-07 14:07 --------- d-----w c:\program files\VIA 2008-10-07 12:58 67,167,528 ----a-w c:\program files\iTunes801Setup.exe 2008-10-06 19:27 --------- d-----w c:\program files\Orange 2008-10-06 19:24 25,752,376 ----a-w c:\program files\wmp11-windowsxp-x86-enu.exe 2008-10-06 19:22 --------- d-----w c:\program files\Fichiers communs\France Telecom 2008-10-06 19:21 --------- d-----w c:\documents and settings\Propriétaire\Application Data\F-Secure 2008-10-06 19:19 --------- d-----w c:\program files\SAGEM 2008-10-06 19:19 --------- d-----w c:\documents and settings\Propriétaire\Application Data\InstallShield 2008-10-06 19:18 --------- d-----w c:\program files\Securitoo 2008-10-06 17:35 4,865,872 ----a-w c:\program files\MsgPlusLive-470.exe 2008-10-06 17:29 --------- d-----w c:\documents and settings\All Users\Application Data\F-Secure 2008-10-06 17:27 2,402,832 ----a-w c:\program files\WLinstaller.exe 2008-10-06 17:27 14,648,672 ----a-w c:\program files\winzip120.exe 2008-10-06 17:27 --------- d-----w c:\documents and settings\All Users\Application Data\fssg 2008-10-06 17:25 69,235,448 ----a-w c:\program files\orange_avfw_513.exe 2008-10-06 16:43 1,234,120 ----a-w c:\program files\wrar380.exe 2008-10-06 16:41 --------- d-----w c:\program files\CCleaner 2008-10-06 16:38 1,885,208 ----a-w c:\program files\flashplayer10_install_activex_091508.exe 2008-10-06 16:36 2,934,168 ----a-w c:\program files\ccsetup212.exe 2008-10-06 16:36 1,014,272 ----a-w c:\program files\wlsetup-web.exe 2008-10-06 16:34 5,318,816 ----a-w c:\program files\bitcomet_setup.exe 2008-10-06 16:31 --------- d-----w c:\program files\Google 2008-10-06 16:30 166,560 ----a-w c:\program files\GoogleToolbarInstaller_download_signed.exe 2008-10-06 15:47 --------- d-----w c:\program files\DRIVERS 2008-10-06 15:46 9,388 ----a-w c:\windows\system32\drivers\iaStor.PNF 2008-10-06 15:46 7,280 ----a-w c:\windows\system32\drivers\viamraid.PNF 2008-10-06 15:46 63,240 ----a-w c:\windows\system32\drivers\Si3112r.PNF 2008-10-06 15:46 6,984 ----a-w c:\windows\system32\drivers\SiSRaid.PNF 2008-10-06 15:46 12,432 ----a-w c:\windows\system32\drivers\adpu320.PNF 2008-10-06 15:46 12,204 ----a-w c:\windows\system32\drivers vraid.PNF 2008-10-06 15:46 10,828 ----a-w c:\windows\system32\drivers\iaAHCI.PNF 2008-10-06 15:39 --------- d-----w c:\program files\HP 2008-10-06 15:39 --------- d-----w c:\program files\Fichiers communs\HP 2008-10-06 15:39 --------- d-----w c:\documents and settings\All Users\Application Data\HP 2008-10-06 15:36 --------- d-----w c:\program files\Hewlett-Packard 2008-10-06 15:35 --------- d-----w c:\program files\Fichiers communs\Hewlett-Packard 2008-10-06 15:17 --------- d-----w c:\program files\microsoft frontpage 2008-10-06 15:15 --------- d-----w c:\program files\Fichiers communs\Java 2008-10-06 15:10 --------- d-----w c:\program files\Services en ligne 2008-10-05 16:31 498 ----a-w c:\program files\DisparitionCD.inf 2008-10-01 11:01 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys . ((((((((((((((((((((((((((((( snapshot@2008-11-21_20.23.01.07 ))))))))))))))))))))))))))))))))))))))))) . - 2004-10-14 18:35:00 8,192 ----a-w c:\windows\$hf_mig$\KB885836\spmsg.dll + 2004-10-14 10:35:08 8,192 ----a-w c:\windows\$hf_mig$\KB885836\spmsg.dll - 2004-10-14 18:36:11 172,032 ----a-w c:\windows\$hf_mig$\KB885836\spuninst.exe + 2004-10-14 10:36:22 172,032 ----a-w c:\windows\$hf_mig$\KB885836\spuninst.exe - 2004-10-14 18:36:10 21,504 ----a-w c:\windows\$hf_mig$\KB885836\update\spcustom.dll + 2004-10-14 10:36:20 21,504 ----a-w c:\windows\$hf_mig$\KB885836\update\spcustom.dll - 2004-10-14 18:35:00 666,624 ----a-w c:\windows\$hf_mig$\KB885836\update\update.exe + 2004-10-14 10:35:12 666,624 ----a-w c:\windows\$hf_mig$\KB885836\update\update.exe + 2006-11-27 15:18:34 539,136 ----a-w c:\windows\$hf_mig$\KB918118\SP2QFE\msftedit.dll + 2006-11-27 15:18:34 433,664 ----a-w c:\windows\$hf_mig$\KB918118\SP2QFE iched20.dll + 2005-10-12 23:15:25 15,072 ----a-w c:\windows\$hf_mig$\KB918118\spmsg.dll + 2005-10-12 23:15:26 216,800 ----a-w c:\windows\$hf_mig$\KB918118\spuninst.exe + 2005-10-12 23:15:25 22,752 ----a-w c:\windows\$hf_mig$\KB918118\update\spcustom.dll + 2005-10-12 23:15:28 727,776 ----a-w c:\windows\$hf_mig$\KB918118\update\update.exe + 2005-10-12 23:15:45 394,976 ----a-w c:\windows\$hf_mig$\KB918118\update\updspapi.dll + 2006-10-12 13:55:58 42,496 ----a-w c:\windows\$hf_mig$\KB920213\SP2QFE\agentdp2.dll + 2006-10-12 13:55:58 57,344 ----a-w c:\windows\$hf_mig$\KB920213\SP2QFE\agentdpv.dll + 2006-10-12 11:54:07 256,512 ----a-w c:\windows\$hf_mig$\KB920213\SP2QFE\agentsvr.exe + 2006-10-16 11:19:09 265,216 ----a-w c:\windows\$hf_mig$\KB920213\SP2QFE\spru040c.dll + 2005-10-12 23:18:45 15,072 ----a-w c:\windows\$hf_mig$\KB920213\spmsg.dll + 2005-10-12 23:18:45 216,800 ----a-w c:\windows\$hf_mig$\KB920213\spuninst.exe + 2005-10-12 23:18:45 22,752 ----a-w c:\windows\$hf_mig$\KB920213\update\spcustom.dll + 2005-10-12 23:18:46 727,776 ----a-w c:\windows\$hf_mig$\KB920213\update\update.exe + 2005-10-12 23:18:49 394,976 ----a-w c:\windows\$hf_mig$\KB920213\update\updspapi.dll + 2006-06-14 08:50:19 172,416 ----a-w c:\windows\$hf_mig$\KB920872\SP2QFE\kmixer.sys + 2006-06-14 08:50:19 6,272 ----a-w c:\windows\$hf_mig$\KB920872\SP2QFE\splitter.sys + 2006-06-14 09:17:04 82,944 ----a-w c:\windows\$hf_mig$\KB920872\SP2QFE\wdmaud.sys + 2005-10-12 23:15:25 15,072 ----a-w c:\windows\$hf_mig$\KB920872\spmsg.dll + 2005-10-12 23:15:26 216,800 ----a-w c:\windows\$hf_mig$\KB920872\spuninst.exe + 2005-10-12 23:15:25 22,752 ----a-w c:\windows\$hf_mig$\KB920872\update\spcustom.dll + 2005-10-12 23:15:28 727,776 ----a-w c:\windows\$hf_mig$\KB920872\update\update.exe + 2005-10-12 23:15:45 394,976 ----a-w c:\windows\$hf_mig$\KB920872\update\updspapi.dll + 2006-10-13 12:43:07 64,000 ----a-w c:\windows\$hf_mig$\KB923980\SP2QFE wapi32.dll + 2006-10-13 12:43:07 145,920 ----a-w c:\windows\$hf_mig$\KB923980\SP2QFE wprovau.dll + 2006-10-13 10:39:12 163,456 ----a-w c:\windows\$hf_mig$\KB923980\SP2QFE wrdr.sys + 2006-10-13 12:43:07 65,536 ----a-w c:\windows\$hf_mig$\KB923980\SP2QFE wwks.dll + 2005-10-12 23:18:45 15,072 ----a-w c:\windows\$hf_mig$\KB923980\spmsg.dll + 2005-10-12 23:18:45 216,800 ----a-w c:\windows\$hf_mig$\KB923980\spuninst.exe + 2005-10-12 23:18:45 22,752 ----a-w c:\windows\$hf_mig$\KB923980\update\spcustom.dll + 2005-10-12 23:18:46 727,776 ----a-w c:\windows\$hf_mig$\KB923980\update\update.exe + 2005-10-12 23:18:49 394,976 ----a-w c:\windows\$hf_mig$\KB923980\update\updspapi.dll + 2006-08-17 12:43:04 733,184 ----a-w c:\windows\$hf_mig$\KB924270\SP2QFE\lsasrv.dll + 2006-08-17 12:43:04 337,408 ----a-w c:\windows\$hf_mig$\KB924270\SP2QFE etapi32.dll + 2006-08-17 12:43:04 132,096 ----a-w c:\windows\$hf_mig$\KB924270\SP2QFE\wkssvc.dll + 2005-10-12 23:15:25 15,072 ----a-w c:\windows\$hf_mig$\KB924270\spmsg.dll + 2005-10-12 23:15:26 216,800 ----a-w c:\windows\$hf_mig$\KB924270\spuninst.exe + 2005-10-12 23:15:25 22,752 ----a-w c:\windows\$hf_mig$\KB924270\update\spcustom.dll + 2005-10-12 23:15:28 727,776 ----a-w c:\windows\$hf_mig$\KB924270\update\update.exe + 2005-10-12 23:15:45 394,976 ----a-w c:\windows\$hf_mig$\KB924270\update\updspapi.dll + 2007-03-08 15:50:30 282,112 ----a-w c:\windows\$hf_mig$\KB925902\SP2QFE\gdi32.dll + 2007-03-08 15:50:30 40,960 ----a-w c:\windows\$hf_mig$\KB925902\SP2QFE\mf3216.dll + 2007-03-08 15:50:30 579,072 ----a-w c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll + 2007-03-08 15:45:59 1,844,096 ----a-w c:\windows\$hf_mig$\KB925902\SP2QFE\win32k.sys + 2006-01-19 19:29:25 15,072 ----a-w c:\windows\$hf_mig$\KB925902\spmsg.dll + 2006-01-19 19:29:25 216,800 ----a-w c:\windows\$hf_mig$\KB925902\spuninst.exe + 2006-01-19 19:29:25 22,752 ----a-w c:\windows\$hf_mig$\KB925902\update\spcustom.dll + 2006-01-19 19:29:26 727,776 ----a-w c:\windows\$hf_mig$\KB925902\update\update.exe + 2006-01-19 19:29:26 394,976 ----a-w c:\windows\$hf_mig$\KB925902\update\updspapi.dll + 2006-10-20 01:40:33 716,800 ----a-w c:\windows\$hf_mig$\KB926255\SP2QFE\sxs.dll + 2005-10-12 23:15:25 15,072 ----a-w c:\windows\$hf_mig$\KB926255\spmsg.dll + 2005-10-12 23:15:26 216,800 ----a-w c:\windows\$hf_mig$\KB926255\spuninst.exe + 2005-10-12 23:15:25 22,752 ----a-w c:\windows\$hf_mig$\KB926255\update\spcustom.dll + 2005-10-12 23:15:28 727,776 ----a-w c:\windows\$hf_mig$\KB926255\update\update.exe + 2005-10-12 23:15:45 394,976 ----a-w c:\windows\$hf_mig$\KB926255\update\updspapi.dll + 2006-10-16 17:14:12 124,928 ----a-w c:\windows\$hf_mig$\KB926436\SP2QFE\oledlg.dll + 2005-10-12 23:18:45 15,072 ----a-w c:\windows\$hf_mig$\KB926436\spmsg.dll + 2005-10-12 23:18:45 216,800 ----a-w c:\windows\$hf_mig$\KB926436\spuninst.exe + 2005-10-12 23:18:45 22,752 ----a-w c:\windows\$hf_mig$\KB926436\update\spcustom.dll + 2005-10-12 23:18:46 727,776 ----a-w c:\windows\$hf_mig$\KB926436\update\update.exe + 2005-10-12 23:18:49 394,976 ----a-w c:\windows\$hf_mig$\KB926436\update\updspapi.dll + 2006-12-26 13:20:21 536,576 ----a-w c:\windows\$hf_mig$\KB927779\SP2QFE\msado15.dll + 2006-12-26 13:20:21 180,224 ----a-w c:\windows\$hf_mig$\KB927779\SP2QFE\msadomd.dll + 2006-12-26 13:20:21 200,704 ----a-w c:\windows\$hf_mig$\KB927779\SP2QFE\msadox.dll + 2006-12-26 13:20:21 102,400 ----a-w c:\windows\$hf_mig$\KB927779\SP2QFE\msjro.dll + 2006-01-19 19:29:25 15,072 ----a-w c:\windows\$hf_mig$\KB927779\spmsg.dll + 2006-01-19 19:29:25 216,800 ----a-w c:\windows\$hf_mig$\KB927779\spuninst.exe + 2006-01-19 19:29:25 22,752 ----a-w c:\windows\$hf_mig$\KB927779\update\spcustom.dll + 2006-01-19 19:29:26 727,776 ----a-w c:\windows\$hf_mig$\KB927779\update\update.exe + 2006-01-19 19:29:26 394,976 ----a-w c:\windows\$hf_mig$\KB927779\update\updspapi.dll + 2006-12-19 18:48:57 334,336 ----a-w c:\windows\$hf_mig$\KB927802\SP2QFE\wiaservc.dll + 2005-10-12 23:15:25 15,072 ----a-w c:\windows\$hf_mig$\KB927802\spmsg.dll + 2005-10-12 23:15:26 216,800 ----a-w c:\windows\$hf_mig$\KB927802\spuninst.exe + 2005-10-12 23:15:25 22,752 ----a-w c:\windows\$hf_mig$\KB927802\update\spcustom.dll + 2005-10-12 23:15:28 727,776 ----a-w c:\windows\$hf_mig$\KB927802\update\update.exe + 2005-10-12 23:15:45 394,976 ----a-w c:\windows\$hf_mig$\KB927802\update\updspapi.dll + 2006-12-19 21:48:29 8,515,072 ----a-w c:\windows\$hf_mig$\KB928255\SP2QFE\shell32.dll + 2006-12-19 21:48:29 135,680 ----a-w c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll + 2006-12-19 16:29:57 265,216 ----a-w c:\windows\$hf_mig$\KB928255\SP2QFE\spru040c.dll + 2006-01-19 19:29:25 15,072 ----a-w c:\windows\$hf_mig$\KB928255\spmsg.dll + 2006-01-19 19:29:25 216,800 ----a-w c:\windows\$hf_mig$\KB928255\spuninst.exe + 2006-01-19 19:29:25 22,752 ----a-w c:\windows\$hf_mig$\KB928255\update\spcustom.dll + 2006-01-19 19:29:26 727,776 ----a-w c:\windows\$hf_mig$\KB928255\update\update.exe + 2006-01-19 19:29:26 394,976 ----a-w c:\windows\$hf_mig$\KB928255\update\updspapi.dll + 2005-10-12 23:15:25 15,072 ----a-w c:\windows\$hf_mig$\KB928843\spmsg.dll + 2005-10-12 23:15:26 216,800 ----a-w c:\windows\$hf_mig$\KB928843\spuninst.exe + 2005-10-12 23:15:25 22,752 ----a-w c:\windows\$hf_mig$\KB928843\update\spcustom.dll + 2005-10-12 23:15:28 727,776 ----a-w c:\windows\$hf_mig$\KB928843\update\update.exe + 2005-10-12 23:15:45 394,976 ----a-w c:\windows\$hf_mig$\KB928843\update\updspapi.dll + 2007-05-16 15:28:27 86,528 ----a-w c:\windows\$hf_mig$\KB929123\SP2QFE\directdb.dll + 2007-05-16 15:28:28 683,520 ----a-w c:\windows\$hf_mig$\KB929123\SP2QFE\inetcomm.dll + 2007-05-16 15:28:31 1,314,816 ----a-w c:\windows\$hf_mig$\KB929123\SP2QFE\msoe.dll + 2007-05-16 15:28:32 510,976 ----a-w c:\windows\$hf_mig$\KB929123\SP2QFE\wab32.dll + 2007-05-16 15:28:33 85,504 ----a-w c:\windows\$hf_mig$\KB929123\SP2QFE\wabimp.dll + 2006-01-19 19:29:25 15,072 ----a-w c:\windows\$hf_mig$\KB929123\spmsg.dll + 2006-01-19 19:29:25 216,800 ----a-w c:\windows\$hf_mig$\KB929123\spuninst.exe + 2006-01-19 19:29:25 22,752 ----a-w c:\windows\$hf_mig$\KB929123\update\spcustom.dll + 2006-01-19 19:29:26 727,776 ----a-w c:\windows\$hf_mig$\KB929123\update\update.exe + 2006-01-19 19:29:26 394,976 ----a-w c:\windows\$hf_mig$\KB929123\update\updspapi.dll + 2007-03-17 13:47:04 293,376 ----a-w c:\windows\$hf_mig$\KB930178\SP2QFE\winsrv.dll + 2005-10-12 23:15:25 15,072 ----a-w c:\windows\$hf_mig$\KB930178\spmsg.dll + 2005-10-12 23:15:26 216,800 ----a-w c:\windows\$hf_mig$\KB930178\spuninst.exe + 2005-10-12 23:15:25 22,752 ----a-w c:\windows\$hf_mig$\KB930178\update\spcustom.dll + 2005-10-12 23:15:28 727,776 ----a-w c:\windows\$hf_mig$\KB930178\update\update.exe + 2005-10-12 23:15:45 394,976 ----a-w c:\windows\$hf_mig$\KB930178\update\updspapi.dll + 2007-02-09 11:23:36 574,976 ----a-w c:\windows\$hf_mig$\KB930916\SP2QFE tfs.sys + 2005-10-12 23:15:25 15,072 ----a-w c:\windows\$hf_mig$\KB930916\spmsg.dll + 2005-10-12 23:15:26 216,800 ----a-w c:\windows\$hf_mig$\KB930916\spuninst.exe + 2005-10-12 23:15:25 22,752 ----a-w c:\windows\$hf_mig$\KB930916\update\spcustom.dll + 2005-10-12 23:15:28 727,776 ----a-w c:\windows\$hf_mig$\KB930916\update\update.exe + 2005-10-12 23:15:45 394,976 ----a-w c:\windows\$hf_mig$\KB930916\update\updspapi.dll + 2007-02-05 20:20:56 185,344 ----a-w c:\windows\$hf_mig$\KB931261\SP2QFE\upnphost.dll + 2006-01-19 19:29:25 15,072 ----a-w c:\windows\$hf_mig$\KB931261\spmsg.dll + 2006-01-19 19:29:25 216,800 ----a-w c:\windows\$hf_mig$\KB931261\spuninst.exe + 2006-01-19 19:29:25 22,752 ----a-w c:\windows\$hf_mig$\KB931261\update\spcustom.dll + 2006-01-19 19:29:26 727,776 ----a-w c:\windows\$hf_mig$\KB931261\update\update.exe + 2006-01-19 19:29:26 394,976 ----a-w c:\windows\$hf_mig$\KB931261\update\updspapi.dll + 2007-03-09 14:00:38 57,344 ----a-w c:\windows\$hf_mig$\KB932168\SP2QFE\agentdpv.dll + 2007-03-09 11:51:20 265,216 ----a-w c:\windows\$hf_mig$\KB932168\SP2QFE\spru040c.dll + 2006-01-19 19:29:25 15,072 ----a-w c:\windows\$hf_mig$\KB932168\spmsg.dll + 2006-01-19 19:29:25 216,800 ----a-w c:\windows\$hf_mig$\KB932168\spuninst.exe + 2006-01-19 19:29:25 22,752 ----a-w c:\windows\$hf_mig$\KB932168\update\spcustom.dll + 2006-01-19 19:29:26 727,776 ----a-w c:\windows\$hf_mig$\KB932168\update\update.exe + 2006-01-19 19:29:26 394,976 ----a-w c:\windows\$hf_mig$\KB932168\update\updspapi.dll + 2008-02-26 11:49:32 297,984 ----a-w c:\windows\$hf_mig$\KB932823-v3\SP2QFE\msctf.dll + 2007-03-06 01:34:33 15,072 ----a-w c:\windows\$hf_mig$\KB932823-v3\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w c:\windows\$hf_mig$\KB932823-v3\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w c:\windows\$hf_mig$\KB932823-v3\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w c:\windows\$hf_mig$\KB932823-v3\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w c:\windows\$hf_mig$\KB932823-v3\update\updspapi.dll + 2007-04-16 16:11:08 1,051,136 ----a-w c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll + 2005-10-12 23:15:25 15,072 ----a-w c:\windows\$hf_mig$\KB935839\spmsg.dll + 2005-10-12 23:15:26 216,800 ----a-w c:\windows\$hf_mig$\KB935839\spuninst.exe + 2005-10-12 23:15:25 22,752 ----a-w c:\windows\$hf_mig$\KB935839\update\spcustom.dll + 2005-10-12 23:15:28 727,776 ----a-w c:\windows\$hf_mig$\KB935839\update\update.exe + 2005-10-12 23:15:45 394,976 ----a-w c:\windows\$hf_mig$\KB935839\update\updspapi.dll + 2007-04-25 20:32:29 144,896 ----a-w c:\windows\$hf_mig$\KB935840\SP2QFE\schannel.dll + 2006-01-19 19:29:25 15,072 ----a-w c:\windows\$hf_mig$\KB935840\spmsg.dll + 2006-01-19 19:29:25 216,800 ----a-w c:\windows\$hf_mig$\KB935840\spuninst.exe + 2006-01-19 19:29:25 22,752 ----a-w c:\windows\$hf_mig$\KB935840\update\spcustom.dll + 2006-01-19 19:29:26 727,776 ----a-w c:\windows\$hf_mig$\KB935840\update\update.exe + 2006-01-19 19:29:26 394,976 ----a-w c:\windows\$hf_mig$\KB935840\update\updspapi.dll + 2007-04-23 10:14:23 364,160 ----a-w c:\windows\$hf_mig$\KB936357\SP2QFE\update.sys + 2006-01-19 19:29:25 15,072 ----a-w c:\windows\$hf_mig$\KB936357\spmsg.dll + 2006-01-19 19:29:25 216,800 ----a-w c:\windows\$hf_mig$\KB936357\spuninst.exe + 2006-01-19 19:29:25 22,752 ----a-w c:\windows\$hf_mig$\KB936357\update\spcustom.dll + 2006-01-19 19:29:26 727,776 ----a-w c:\windows\$hf_mig$\KB936357\update\update.exe + 2006-01-19 19:29:26 394,976 ----a-w c:\windows\$hf_mig$\KB936357\update\updspapi.dll + 2007-07-12 23:28:38 765,952 ----a-w c:\windows\$hf_mig$\KB938127-IE7\SP2QFE\vgx.dll + 2007-03-06 01:34:33 15,072 ----a-w c:\windows\$hf_mig$\KB938127-IE7\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w c:\windows\$hf_mig$\KB938127-IE7\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w c:\windows\$hf_mig$\KB938127-IE7\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w c:\windows\$hf_mig$\KB938127-IE7\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w c:\windows\$hf_mig$\KB938127-IE7\update\updspapi.dll + 2007-06-13 13:10:53 1,037,312 ----a-w c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe + 2005-10-12 23:15:25 15,072 ----a-w c:\windows\$hf_mig$\KB938828\spmsg.dll + 2005-10-12 23:15:26 216,800 ----a-w c:\windows\$hf_mig$\KB938828\spuninst.exe + 2005-10-12 23:15:25 22,752 ----a-w c:\windows\$hf_mig$\KB938828\update\spcustom.dll + 2005-10-12 23:15:28 727,776 ----a-w c:\windows\$hf_mig$\KB938828\update\update.exe + 2005-10-12 23:15:45 394,976 ----a-w c:\windows\$hf_mig$\KB938828\update\updspapi.dll + 2007-12-04 18:30:15 551,936 ----a-w c:\windows\$hf_mig$\KB943055\SP2QFE\oleaut32.dll + 2007-03-06 01:34:33 15,072 ----a-w c:\windows\$hf_mig$\KB943055\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w c:\windows\$hf_mig$\KB943055\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w c:\windows\$hf_mig$\KB943055\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w c:\windows\$hf_mig$\KB943055\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w c:\windows\$hf_mig$\KB943055\update\updspapi.dll + 2007-11-07 09:50:06 733,696 ----a-w c:\windows\$hf_mig$\KB943485\SP2QFE\lsasrv.dll + 2007-03-06 01:34:33 15,072 ----a-w c:\windows\$hf_mig$\KB943485\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w c:\windows\$hf_mig$\KB943485\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w c:\windows\$hf_mig$\KB943485\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w c:\windows\$hf_mig$\KB943485\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w c:\windows\$hf_mig$\KB943485\update\updspapi.dll + 2007-11-13 08:47:45 20,480 ----a-w c:\windows\$hf_mig$\KB944653\SP2QFE\secdrv.sys + 2007-03-06 01:34:33 15,072 ----a-w c:\windows\$hf_mig$\KB944653\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w c:\windows\$hf_mig$\KB944653\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w c:\windows\$hf_mig$\KB944653\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w c:\windows\$hf_mig$\KB944653\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w c:\windows\$hf_mig$\KB944653\update\updspapi.dll + 2008-02-20 05:20:23 147,968 ----a-w c:\windows\$hf_mig$\KB945553\SP2QFE\dnsapi.dll + 2008-02-20 18:50:24 45,568 ----a-w c:\windows\$hf_mig$\KB945553\SP2QFE\dnsrslvr.dll + 2007-03-06 01:34:33 15,072 ----a-w c:\windows\$hf_mig$\KB945553\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w c:\windows\$hf_mig$\KB945553\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w c:\windows\$hf_mig$\KB945553\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w c:\windows\$hf_mig$\KB945553\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w c:\windows\$hf_mig$\KB945553\update\updspapi.dll + 2007-12-18 09:38:59 179,712 ----a-w c:\windows\$hf_mig$\KB946026\SP2QFE\mrxdav.sys + 2007-03-06 01:34:33 15,072 ----a-w c:\windows\$hf_mig$\KB946026\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w c:\windows\$hf_mig$\KB946026\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w c:\windows\$hf_mig$\KB946026\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w c:\windows\$hf_mig$\KB946026\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w c:\windows\$hf_mig$\KB946026\update\updspapi.dll + 2008-02-20 06:52:42 282,624 ----a-w c:\windows\$hf_mig$\KB948590\SP2QFE\gdi32.dll + 2007-03-06 01:34:33 15,072 ----a-w c:\windows\$hf_mig$\KB948590\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w c:\windows\$hf_mig$\KB948590\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w c:\windows\$hf_mig$\KB948590\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w c:\windows\$hf_mig$\KB948590\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w c:\windows\$hf_mig$\KB948590\update\updspapi.dll + 2008-01-23 04:56:21 554,008 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\dao360.dll + 2007-12-10 12:41:11 518,944 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msexch40.dll + 2007-12-10 12:41:11 326,432 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msexcl40.dll + 2007-12-10 12:41:11 1,516,568 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msjet40.dll + 2007-12-10 12:41:11 355,112 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msjetol1.dll + 2008-03-25 06:56:31 194,144 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msjint40.dll + 2007-12-10 12:41:12 60,192 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msjter40.dll + 2007-12-10 12:41:12 248,608 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msjtes40.dll + 2007-12-10 12:41:12 219,936 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msltus40.dll + 2007-12-10 12:41:12 355,104 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\mspbde40.dll + 2007-12-10 12:41:13 432,928 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msrd2x40.dll + 2007-12-10 12:41:13 322,336 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msrd3x40.dll + 2007-12-10 12:41:13 559,904 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msrepl40.dll + 2007-12-10 12:41:13 264,992 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\mstext40.dll + 2007-12-10 12:41:13 838,432 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\mswdat10.dll + 2007-11-01 05:15:27 621,344 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\mswstr10.dll + 2007-12-10 12:41:14 355,104 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msxbde40.dll + 2007-03-06 01:34:33 15,072 ----a-w c:\windows\$hf_mig$\KB950749\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w c:\windows\$hf_mig$\KB950749\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w c:\windows\$hf_mig$\KB950749\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w c:\windows\$hf_mig$\KB950749\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w c:\windows\$hf_mig$\KB950749\update\updspapi.dll + 2008-05-08 12:14:51 203,008 ----a-w c:\windows\$hf_mig$\KB950762\SP2QFE mcast.sys + 2008-05-08 14:02:52 203,136 ----a-w c:\windows\$hf_mig$\KB950762\SP3GDR mcast.sys + 2008-07-07 20:18:27 253,952 ----a-w c:\windows\$hf_mig$\KB950974\SP2QFE\es.dll + 2008-07-07 20:28:20 253,952 ----a-w c:\windows\$hf_mig$\KB950974\SP3GDR\es.dll + 2008-04-11 18:40:33 683,520 ----a-w c:\windows\$hf_mig$\KB951066\SP2QFE\inetcomm.dll + 2008-04-11 19:05:22 691,712 ----a-w c:\windows\$hf_mig$\KB951066\SP3GDR\inetcomm.dll + 2008-07-14 11:03:00 62,976 ----a-w c:\windows\$hf_mig$\KB951072-v2\SP2QFE zchange.exe + 2008-07-11 12:42:28 62,976 ----a-w c:\windows\$hf_mig$\KB951072-v2\SP3GDR zchange.exe + 2008-06-14 18:03:13 272,768 ----a-w c:\windows\$hf_mig$\KB951376-v2\SP2QFE\bthport.sys + 2008-06-14 17:33:37 272,768 ----a-w c:\windows\$hf_mig$\KB951376-v2\SP3GDR\bthport.sys + 2008-05-07 04:55:47 1,294,336 ----a-w c:\windows\$hf_mig$\KB951698\SP2QFE\quartz.dll + 2008-05-07 05:11:24 1,294,336 ----a-w c:\windows\$hf_mig$\KB951698\SP3GDR\quartz.dll + 2006-08-16 12:13:24 100,352 ----a-w c:\windows\$hf_mig$\KB951748\SP2QFE\6to4svc.dll + 2008-06-20 10:44:08 138,368 ----a-w c:\windows\$hf_mig$\KB951748\SP2QFE\afd.sys + 2008-06-20 17:37:01 147,968 ----a-w c:\windows\$hf_mig$\KB951748\SP2QFE\dnsapi.dll + 2008-06-20 17:37:01 247,808 ----a-w c:\windows\$hf_mig$\KB951748\SP2QFE\mswsock.dll + 2008-06-20 10:44:42 360,960 ----a-w c:\windows\$hf_mig$\KB951748\SP2QFE cpip.sys + 2008-06-20 09:32:39 225,920 ----a-w c:\windows\$hf_mig$\KB951748\SP2QFE cpip6.sys + 2008-06-20 11:40:08 138,496 ----a-w c:\windows\$hf_mig$\KB951748\SP3GDR\afd.sys + 2008-06-20 17:47:22 147,968 ----a-w c:\windows\$hf_mig$\KB951748\SP3GDR\dnsapi.dll + 2008-06-20 17:47:22 247,808 ----a-w c:\windows\$hf_mig$\KB951748\SP3GDR\mswsock.dll + 2008-06-20 11:51:12 361,600 ----a-w c:\windows\$hf_mig$\KB951748\SP3GDR cpip.sys + 2008-06-20 11:08:27 225,856 ----a-w c:\windows\$hf_mig$\KB951748\SP3GDR cpip6.sys + 2008-05-01 15:04:51 331,776 ----a-w c:\windows\$hf_mig$\KB952287\SP2QFE\msadce.dll + 2008-05-01 14:36:26 331,776 ----a-w c:\windows\$hf_mig$\KB952287\SP3GDR\msadce.dll + 2008-06-24 16:30:27 74,240 ----a-w c:\windows\$hf_mig$\KB952954\SP2QFE\mscms.dll + 2008-06-24 16:44:02 74,240 ----a-w c:\windows\$hf_mig$\KB952954\SP3GDR\mscms.dll + 2008-08-28 07:54:20 74,752 ----a-w c:\windows\$hf_mig$\KB953155\SP2QFE\msw3prt.dll + 2008-08-28 07:54:20 105,472 ----a-w c:\windows\$hf_mig$\KB953155\SP2QFE\win32spl.dll + 2008-08-28 07:47:55 74,752 ----a-w c:\windows\$hf_mig$\KB953155\SP3GDR\msw3prt.dll + 2008-08-28 07:47:55 105,472 ----a-w c:\windows\$hf_mig$\KB953155\SP3GDR\win32spl.dll + 2008-08-28 07:39:02 74,752 ----a-w c:\windows\$hf_mig$\KB953155\SP3QFE\msw3prt.dll + 2008-08-28 07:39:02 105,472 ----a-w c:\windows\$hf_mig$\KB953155\SP3QFE\win32spl.dll + 2007-11-30 11:19:06 18,296 ----a-w c:\windows\$hf_mig$\KB953155\spmsg.dll + 2007-11-30 11:19:06 234,872 ----a-w c:\windows\$hf_mig$\KB953155\spuninst.exe + 2007-11-30 11:19:06 26,488 ----a-w c:\windows\$hf_mig$\KB953155\update\spcustom.dll + 2007-11-30 12:39:29 767,352 ----a-w c:\windows\$hf_mig$\KB953155\update\update.exe + 2007-11-30 12:39:31 406,392 ----a-w c:\windows\$hf_mig$\KB953155\update\updspapi.dll + 2008-09-15 15:14:42 1,847,040 ----a-w c:\windows\$hf_mig$\KB954211\SP2QFE\win32k.sys + 2008-09-15 15:26:07 1,846,528 ----a-w c:\windows\$hf_mig$\KB954211\SP3GDR\win32k.sys + 2008-09-04 16:34:21 1,106,944 ----a-w c:\windows\$hf_mig$\KB955069\SP2QFE\msxml3.dll + 2008-09-04 17:16:10 1,106,944 ----a-w c:\windows\$hf_mig$\KB955069\SP3GDR\msxml3.dll + 2008-08-14 09:48:52 138,368 ----a-w c:\windows\$hf_mig$\KB956803\SP2QFE\afd.sys + 2008-08-14 10:04:36 138,496 ----a-w c:\windows\$hf_mig$\KB956803\SP3GDR\afd.sys + 2008-08-14 13:23:44 2,147,328 ----a-w c:\windows\$hf_mig$\KB956841\SP3GDR tkrnlmp.exe + 2008-08-14 13:23:49 2,068,096 ----a-w c:\windows\$hf_mig$\KB956841\SP3GDR tkrnlpa.exe + 2008-08-14 13:23:44 2,025,984 ----a-w c:\windows\$hf_mig$\KB956841\SP3GDR tkrpamp.exe + 2008-08-14 13:23:49 2,191,232 ----a-w c:\windows\$hf_mig$\KB956841\SP3GDR toskrnl.exe + 2008-08-28 10:35:33 333,056 ----a-w c:\windows\$hf_mig$\KB957095\SP2QFE\srv.sys + 2008-09-08 10:41:42 333,824 ----a-w c:\windows\$hf_mig$\KB957095\SP3GDR\srv.sys + 2008-10-24 11:25:29 455,936 ----a-w c:\windows\$hf_mig$\KB957097\SP2QFE\mrxsmb.sys + 2008-10-24 11:21:09 455,296 ----a-w c:\windows\$hf_mig$\KB957097\SP3GDR\mrxsmb.sys + 2008-10-15 16:55:13 339,456 ----a-w c:\windows\$hf_mig$\KB958644\SP2QFE etapi32.dll + 2008-10-15 16:35:43 337,408 ----a-w c:\windows\$hf_mig$\KB958644\SP3GDR etapi32.dll - 2008-10-07 17:07:50 315,392 ----a-w c:\windows\assembly\GAC_MSIL\AspNetMMCExt.resources\2.0.0.0_fr_b03f5f7f11d50a3a\aspnetmmcext.resources.dll + 2008-11-22 22:49:03 315,392 ----a-w c:\windows\assembly\GAC_MSIL\AspNetMMCExt.resources\2.0.0.0_fr_b03f5f7f11d50a3a\aspnetmmcext.resources.dll - 2008-10-07 17:07:57 53,248 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Engine.resources.dll + 2008-11-22 22:49:18 53,248 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Engine.resources.dll - 2008-10-07 17:07:57 139,264 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Tasks.resources.dll + 2008-11-22 22:49:19 139,264 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Tasks.resources.dll - 2008-10-07 17:07:57 10,240 ----a-w c:\windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Utilities.Resources.dll + 2008-11-22 22:49:20 10,752 ----a-w c:\windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Utilities.Resources.dll - 2008-10-07 17:07:50 45,056 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.JScript.Resources.dll + 2008-11-22 22:49:05 45,056 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.JScript.Resources.dll - 2008-10-07 17:08:03 9,216 ----a-w c:\windows\assembly\GAC_MSIL\microsoft.visualbasic.compatibility.data.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.resources.dll + 2008-11-22 22:49:32 9,216 ----a-w c:\windows\assembly\GAC_MSIL\microsoft.visualbasic.compatibility.data.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.resources.dll - 2008-10-07 17:08:02 9,728 ----a-w c:\windows\assembly\GAC_MSIL\microsoft.visualbasic.compatibility.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.resources.dll + 2008-11-22 22:49:32 9,728 ----a-w c:\windows\assembly\GAC_MSIL\microsoft.visualbasic.compatibility.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.resources.dll - 2008-10-07 17:08:02 61,440 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.resources.dll + 2008-11-22 22:49:30 61,440 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.VisualBasic.resources.dll - 2008-10-07 17:07:57 311,296 ----a-w c:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_fr_b77a5c561934e089\mscorlib.Resources.dll + 2008-11-22 22:49:20 311,296 ----a-w c:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_fr_b77a5c561934e089\mscorlib.Resources.dll - 2008-10-07 17:08:01 10,752 ----a-w c:\windows\assembly\GAC_MSIL\sysglobl.resources\2.0.0.0_fr_b03f5f7f11d50a3a\sysglobl.resources.dll + 2008-11-22 22:49:28 10,752 ----a-w c:\windows\assembly\GAC_MSIL\sysglobl.resources\2.0.0.0_fr_b03f5f7f11d50a3a\sysglobl.resources.dll - 2008-10-07 17:07:58 28,672 ----a-w c:\windows\assembly\GAC_MSIL\System.Configuration.Install.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Configuration.Install.Resources.dll + 2008-11-22 22:49:21 28,672 ----a-w c:\windows\assembly\GAC_MSIL\System.Configuration.Install.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Configuration.Install.Resources.dll - 2008-10-07 17:08:01 49,152 ----a-w c:\windows\assembly\GAC_MSIL\system.configuration.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Configuration.resources.dll + 2008-11-22 22:49:29 49,152 ----a-w c:\windows\assembly\GAC_MSIL\system.configuration.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Configuration.resources.dll - 2008-10-07 17:07:58 110,592 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.OracleClient.resources\2.0.0.0_fr_b77a5c561934e089\System.Data.OracleClient.resources.dll + 2008-11-22 22:49:22 110,592 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.OracleClient.resources\2.0.0.0_fr_b77a5c561934e089\System.Data.OracleClient.resources.dll - 2008-10-07 17:07:55 335,872 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.resources\2.0.0.0_fr_b77a5c561934e089\System.Data.Resources.dll + 2008-11-22 22:49:14 344,064 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.resources\2.0.0.0_fr_b77a5c561934e089\System.Data.Resources.dll - 2008-10-07 17:07:58 36,864 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.SqlXml.resources\2.0.0.0_fr_b77a5c561934e089\system.data.sqlxml.resources.dll + 2008-11-22 22:49:23 36,864 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.SqlXml.resources\2.0.0.0_fr_b77a5c561934e089\system.data.sqlxml.resources.dll - 2008-10-07 17:07:50 385,024 ----a-w c:\windows\assembly\GAC_MSIL\System.Deployment.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Deployment.resources.dll + 2008-11-22 22:49:04 389,120 ----a-w c:\windows\assembly\GAC_MSIL\System.Deployment.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Deployment.resources.dll - 2008-10-07 17:07:55 544,768 ----a-w c:\windows\assembly\GAC_MSIL\System.Design.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Design.Resources.dll + 2008-11-22 22:49:14 544,768 ----a-w c:\windows\assembly\GAC_MSIL\System.Design.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Design.Resources.dll - 2008-10-07 17:07:52 28,672 ----a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.DirectoryServices.Protocols.resources.dll + 2008-11-22 22:49:08 28,672 ----a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.DirectoryServices.Protocols.resources.dll - 2008-10-07 17:07:52 40,960 ----a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.DirectoryServices.Resources.dll + 2008-11-22 22:49:07 40,960 ----a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.DirectoryServices.Resources.dll - 2008-10-07 17:07:59 6,144 ----a-w c:\windows\assembly\GAC_MSIL\System.Drawing.Design.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Drawing.Design.Resources.dll + 2008-11-22 22:49:24 6,144 ----a-w c:\windows\assembly\GAC_MSIL\System.Drawing.Design.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Drawing.Design.Resources.dll - 2008-10-07 17:07:56 15,360 ----a-w c:\windows\assembly\GAC_MSIL\System.Drawing.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Drawing.Resources.dll + 2008-11-22 22:49:15 15,360 ----a-w c:\windows\assembly\GAC_MSIL\System.Drawing.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Drawing.Resources.dll - 2008-10-07 17:07:51 32,768 ----a-w c:\windows\assembly\GAC_MSIL\System.EnterpriseServices.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.EnterpriseServices.Resources.dll + 2008-11-22 22:49:06 32,768 ----a-w c:\windows\assembly\GAC_MSIL\System.EnterpriseServices.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.EnterpriseServices.Resources.dll - 2008-10-07 17:07:59 13,312 ----a-w c:\windows\assembly\GAC_MSIL\System.Management.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Management.Resources.dll + 2008-11-22 22:49:25 13,312 ----a-w c:\windows\assembly\GAC_MSIL\System.Management.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Management.Resources.dll - 2008-10-07 17:07:56 61,440 ----a-w c:\windows\assembly\GAC_MSIL\System.Messaging.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Messaging.Resources.dll + 2008-11-22 22:49:16 61,440 ----a-w c:\windows\assembly\GAC_MSIL\System.Messaging.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Messaging.Resources.dll - 2008-10-07 17:07:56 212,992 ----a-w c:\windows\assembly\GAC_MSIL\System.resources\2.0.0.0_fr_b77a5c561934e089\system.Resources.dll + 2008-11-22 22:49:17 212,992 ----a-w c:\windows\assembly\GAC_MSIL\System.resources\2.0.0.0_fr_b77a5c561934e089\system.Resources.dll - 2008-10-07 17:08:00 32,768 ----a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_fr_b77a5c561934e089\System.Runtime.Remoting.Resources.dll + 2008-11-22 22:49:26 32,768 ----a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_fr_b77a5c561934e089\System.Runtime.Remoting.Resources.dll - 2008-10-07 17:08:00 11,776 ----a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.Resources.dll + 2008-11-22 22:49:27 11,776 ----a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.Resources.dll - 2008-10-07 17:07:51 28,672 ----a-w c:\windows\assembly\GAC_MSIL\System.Security.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Security.Resources.dll + 2008-11-22 22:49:06 28,672 ----a-w c:\windows\assembly\GAC_MSIL\System.Security.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Security.Resources.dll - 2008-10-07 17:07:52 40,960 ----a-w c:\windows\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.ServiceProcess.Resources.dll + 2008-11-22 22:49:09 40,960 ----a-w c:\windows\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.ServiceProcess.Resources.dll - 2008-10-07 17:08:01 16,896 ----a-w c:\windows\assembly\GAC_MSIL\System.Transactions.resources\2.0.0.0_fr_b77a5c561934e089\System.Transactions.resources.dll + 2008-11-22 22:49:28 16,896 ----a-w c:\windows\assembly\GAC_MSIL\System.Transactions.resources\2.0.0.0_fr_b77a5c561934e089\System.Transactions.resources.dll - 2008-10-07 17:08:01 81,920 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.Mobile.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Web.Mobile.resources.dll + 2008-11-22 22:49:30 81,920 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.Mobile.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Web.Mobile.resources.dll - 2008-10-07 17:07:53 610,304 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Web.Resources.dll + 2008-11-22 22:49:10 618,496 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Web.Resources.dll - 2008-10-07 17:07:53 81,920 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.Services.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Web.Services.Resources.dll + 2008-11-22 22:49:11 81,920 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.Services.resources\2.0.0.0_fr_b03f5f7f11d50a3a\System.Web.Services.Resources.dll - 2008-10-07 17:07:54 430,080 ----a-w c:\windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_fr_b77a5c561934e089\System.Windows.Forms.Resources.dll + 2008-11-22 22:49:12 430,080 ----a-w c:\windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_fr_b77a5c561934e089\System.Windows.Forms.Resources.dll - 2008-10-07 17:07:54 167,936 ----a-w c:\windows\assembly\GAC_MSIL\System.XML.resources\2.0.0.0_fr_b77a5c561934e089\System.xml.Resources.dll + 2008-11-22 22:49:13 167,936 ----a-w c:\windows\assembly\GAC_MSIL\System.XML.resources\2.0.0.0_fr_b77a5c561934e089\System.xml.Resources.dll + 2006-02-15 00:22:26 142,464 ------w c:\windows\Driver Cache\i386\aec.sys + 2008-06-14 17:59:52 272,768 ------w c:\windows\Driver Cache\i386\bthport.sys + 2006-03-17 00:33:10 262,784 ------w c:\windows\Driver Cache\i386\http.sys + 2006-06-14 08:47:45 172,416 ------w c:\windows\Driver Cache\i386\kmixer.sys - 2005-01-19 04:26:52 451,584 ------w c:\windows\Driver Cache\i386\mrxsmb.sys + 2008-10-24 11:10:42 453,632 ------w c:\windows\Driver Cache\i386\mrxsmb.sys - 2005-09-29 18:28:35 2,138,112 ------w c:\windows\Driver Cache\i386 tkrnlmp.exe + 2008-08-14 13:39:07 2,144,768 ------w c:\windows\Driver Cache\i386 tkrnlmp.exe - 2005-09-29 18:28:42 2,059,520 ------w c:\windows\Driver Cache\i386 tkrnlpa.exe + 2008-08-14 13:39:12 2,065,024 ------w c:\windows\Driver Cache\i386 tkrnlpa.exe - 2005-09-29 18:28:57 2,017,792 ------w c:\windows\Driver Cache\i386 tkrpamp.exe + 2008-08-14 13:39:03 2,022,912 ------w c:\windows\Driver Cache\i386 tkrpamp.exe - 2005-09-29 18:29:05 2,182,272 ------w c:\windows\Driver Cache\i386 toskrnl.exe + 2008-08-14 13:39:11 2,188,032 ------w c:\windows\Driver Cache\i386 toskrnl.exe + 2006-06-14 08:47:46 6,400 ------w c:\windows\Driver Cache\i386\splitter.sys + 2006-06-14 09:00:45 82,944 ------w c:\windows\Driver Cache\i386\wdmaud.sys - 2004-08-05 12:00:00 1,036,288 ----a-w c:\windows\explorer.exe + 2007-06-13 13:22:28 1,037,312 ----a-w c:\windows\explorer.exe + 2007-03-06 01:34:38 216,800 -c----w c:\windows\ie7updates\KB938127-IE7\spuninst\spuninst.exe + 2007-03-06 01:35:48 394,976 -c----w c:\windows\ie7updates\KB938127-IE7\spuninst\updspapi.dll + 2007-08-13 17:54:10 765,952 -c----w c:\windows\ie7updates\KB938127-IE7\vgx.dll + 2007-03-06 01:34:31 22,752 -c----w c:\windows\ie7updates\KB938127-v2-IE7\spcustom.dll + 2007-03-06 01:34:33 15,072 -c----w c:\windows\ie7updates\KB938127-v2-IE7\spmsg.dll + 2007-03-06 01:34:38 216,800 -c----w c:\windows\ie7updates\KB938127-v2-IE7\spuninst.exe + 2007-03-06 01:34:56 727,776 -c----w c:\windows\ie7updates\KB938127-v2-IE7\update.exe + 2007-03-06 01:35:47 394,976 -c----w c:\windows\ie7updates\KB938127-v2-IE7\updspapi.dll - 2007-08-13 16:54:10 765,952 -c--a-w c:\windows\ie7updates\KB938127-v2-IE7\vgx.dll + 2007-07-12 23:30:52 765,952 -c----w c:\windows\ie7updates\KB938127-v2-IE7\vgx.dll - 2008-06-23 16:28:17 124,928 -c--a-w c:\windows\ie7updates\KB956390-IE7\advpack.dll + 2007-08-13 17:39:00 123,904 -c----w c:\windows\ie7updates\KB956390-IE7\advpack.dll - 2008-06-23 16:28:17 347,136 -c--a-w c:\windows\ie7updates\KB956390-IE7\dxtmsft.dll + 2007-08-13 17:35:46 346,624 -c----w c:\windows\ie7updates\KB956390-IE7\dxtmsft.dll - 2008-06-23 16:28:17 214,528 -c--a-w c:\windows\ie7updates\KB956390-IE7\dxtrans.dll + 2007-08-13 17:35:38 214,528 -c----w c:\windows\ie7updates\KB956390-IE7\dxtrans.dll - 2008-06-23 16:28:17 133,120 -c--a-w c:\windows\ie7updates\KB956390-IE7\extmgr.dll + 2007-08-13 17:54:10 131,584 -c----w c:\windows\ie7updates\KB956390-IE7\extmgr.dll - 2008-06-23 09:21:30 70,656 -c--a-w c:\windows\ie7updates\KB956390-IE7\ie4uinit.exe + 2007-08-13 17:39:06 54,784 -c----w c:\windows\ie7updates\KB956390-IE7\ie4uinit.exe - 2008-06-23 16:28:18 153,088 -c--a-w c:\windows\ie7updates\KB956390-IE7\ieakeng.dll + 2007-08-13 17:39:26 152,064 -c----w c:\windows\ie7updates\KB956390-IE7\ieakeng.dll - 2008-06-23 16:28:18 230,400 -c--a-w c:\windows\ie7updates\KB956390-IE7\ieaksie.dll + 2007-08-13 17:39:54 229,376 -c----w c:\windows\ie7updates\KB956390-IE7\ieaksie.dll - 2008-06-21 05:23:54 161,792 -c--a-w c:\windows\ie7updates\KB956390-IE7\ieakui.dll + 2007-08-13 16:56:54 161,792 -c----w c:\windows\ie7updates\KB956390-IE7\ieakui.dll - 2008-06-23 16:28:18 384,512 -c--a-w c:\windows\ie7updates\KB956390-IE7\iedkcs32.dll + 2007-08-13 17:39:50 382,976 -c----w c:\windows\ie7updates\KB956390-IE7\iedkcs32.dll - 2008-06-23 16:28:19 44,544 -c--a-w c:\windows\ie7updates\KB956390-IE7\iernonce.dll + 2007-08-13 17:39:10 43,008 -c----w c:\windows\ie7updates\KB956390-IE7\iernonce.dll - 2008-06-23 09:20:26 13,824 -c--a-w c:\windows\ie7updates\KB956390-IE7\ieudinit.exe + 2007-08-13 17:39:10 13,312 -c----w c:\windows\ie7updates\KB956390-IE7\ieudinit.exe - 2008-06-23 09:21:49 625,664 -c--a-w c:\windows\ie7updates\KB956390-IE7\iexplore.exe + 2007-08-13 17:43:56 622,080 -c----w c:\windows\ie7updates\KB956390-IE7\iexplore.exe - 2008-06-23 16:28:20 27,648 -c--a-w c:\windows\ie7updates\KB956390-IE7\jsproxy.dll + 2007-08-13 17:54:10 27,136 -c----w c:\windows\ie7updates\KB956390-IE7\jsproxy.dll - 2008-06-24 08:28:24 3,592,192 -c--a-w c:\windows\ie7updates\KB956390-IE7\mshtml.dll + 2007-08-13 17:54:12 3,578,368 -c----w c:\windows\ie7updates\KB956390-IE7\mshtml.dll - 2008-06-23 16:28:22 477,696 -c--a-w c:\windows\ie7updates\KB956390-IE7\mshtmled.dll + 2007-08-13 17:54:10 475,648 -c----w c:\windows\ie7updates\KB956390-IE7\mshtmled.dll - 2008-06-23 16:28:22 193,024 -c--a-w c:\windows\ie7updates\KB956390-IE7\msrating.dll + 2007-08-13 17:44:26 192,000 -c----w c:\windows\ie7updates\KB956390-IE7\msrating.dll - 2008-06-23 16:28:22 671,232 -c--a-w c:\windows\ie7updates\KB956390-IE7\mstime.dll + 2007-08-13 17:54:10 670,720 -c----w c:\windows\ie7updates\KB956390-IE7\mstime.dll - 2008-06-23 16:28:22 102,912 -c--a-w c:\windows\ie7updates\KB956390-IE7\occache.dll + 2007-08-13 17:44:06 101,376 -c----w c:\windows\ie7updates\KB956390-IE7\occache.dll - 2008-06-23 16:28:22 44,544 -c--a-w c:\windows\ie7updates\KB956390-IE7\pngfilt.dll + 2007-08-13 17:36:12 44,544 -c----w c:\windows\ie7updates\KB956390-IE7\pngfilt.dll + 2007-03-06 01:34:31 22,752 -c----w c:\windows\ie7updates\KB956390-IE7\spcustom.dll + 2007-03-06 01:34:33 15,072 -c----w c:\windows\ie7updates\KB956390-IE7\spmsg.dll + 2007-03-06 01:34:38 216,800 -c----w c:\windows\ie7updates\KB956390-IE7\spuninst.exe + 2007-03-06 01:34:56 727,776 -c----w c:\windows\ie7updates\KB956390-IE7\update.exe + 2007-03-06 01:35:48 394,976 -c----w c:\windows\ie7updates\KB95

cynthia92 · Answer

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1415
Windows 5.1.2600 Service Pack 2

23/11/2008 10:45:51
mbam-log-2008-11-23 (10-45-51).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 95100
Temps écoulé: 22 minute(s), 15 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 14

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSktkl.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSlajf.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSoxum.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSurxb.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\TDSSrvdc.sys.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1028A0E6-0F7E-4546-B8A3-3241BD0A3B0E}\RP6\A0004001.0ys (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1028A0E6-0F7E-4546-B8A3-3241BD0A3B0E}\RP6\A0004002.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1028A0E6-0F7E-4546-B8A3-3241BD0A3B0E}\RP6\A0004003.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1028A0E6-0F7E-4546-B8A3-3241BD0A3B0E}\RP6\A0004004.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1028A0E6-0F7E-4546-B8A3-3241BD0A3B0E}\RP6\A0004005.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1028A0E6-0F7E-4546-B8A3-3241BD0A3B0E}\RP6\A0004023.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSoiqt.log (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSottt.log (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSqrde.log (Trojan.TDSS) -> Quarantined and deleted successfully.

cynthia92 · Answer

Que faire maintenant stp?

Utilisateur anonyme · Answer

Hi,

Refait un hijackthis.

Alut.

cynthia92 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:03:17, on 23/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDETOOL\IDETOOL.EXE
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Service de configuration OLITEC (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slmdmsr.exe

Utilisateur anonyme · Answer

Hi, Relance hijack et clique sur "Do a system scan only" Ensuite recherche ces lignes et coches les cases O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet ools\BitCometBHO_1.2.8.7.dll/206 (file missing) Ensuite clique sur "Fix checked" Refait un hijackthis. =*=*=*=*=*=*=*=*=*=*=*=*=*=*=APRES=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=* > Fais un scan en ligne avec Kaspersky : Kaspersky N.B. : Le scan ne marche que sous Internet Explorer. - Commence par connecter tout ton matériel de stockage à ton PC (clés USB, DD amovible...). Allume les si necessaire. - Sous Démonstration en ligne, on t'explique la marche à suivre, et pour lancer le scan il faut sélectionner < Exécuter l'analyse en ligne >. - On va te demander de télécharger un contrôle active x, accepte . - Dans le menu < Choisissez la cible de l'analyse >, sélectionne < Poste de travail >. Le scan va commencer. - Poste le rapport qui sera généré stp. (clique sur puis sauvegarde-le sur ton bureau en choisissant "fichier texte (*.txt)" pour l'extension). S'il y a un problème, assure toi que les contrôles active x sont bien configurés dans les options internet comme décrit sur ce lien : clic ici Rappel : le scan est à faire sous Internet Explorer Tuto ici si problème NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte toi sur le site de Kaspersky pour retenter le scan en ligne. Pour le rapport Kaspersky il faut que tu choisisses "Afficher le rapport" puis que tu l'enregistres sur ton bureau sous forme de fichier texte (type de fichier "tous les fichiers").

cynthia92 · Answer

Excuse moi mais il y a eu un petit problème.

Après avoir mis Kaspersky online scanner à jour, il n' y avait pas de bouton pour démarrer l'analyse...

donc j'ai recommencé l'opération et surprise, mon pc est super lent et je n'arrive pas a aller sur les sites d'analyses en ligne...

Tout ça a commencé quand mon antivirus a repéré un programme à risque et la mit en quarantaine.

Que faire stp?

Utilisateur anonyme · Answer

Hi,

Bon,désactive ton antivirus le temps du scan.

Alut.

cynthia92 · Answer

Excuse moi mais je ne trouve pas le bouton sur lequel il faut cliquer pour commencer l'analyse et le tuto ne se charge pas donc...???

Utilisateur anonyme · Answer

Hi,

Il faut le faire sous internet explorer.

Alut.

cynthia92 · Answer

C'est ce que je fais et rien pourtant.

Utilisateur anonyme · Answer

Hi,

Bon refait un  hijackthis.

Alut.

cynthia92 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57:26, on 24/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDETOOL\IDETOOL.EXE
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSLAUNCH.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe
C:\Program Files\Java\jre6\bin\java.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail?kw=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.orange.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Service de configuration Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slmdmsr.exe

Utilisateur anonyme · Answer

Hi,

Relance hijack et clique sur "Do a system scan only"
Ensuite recherche ces lignes et coches les cases

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail?kw=

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

Ensuite clique sur "Fix checked"


Désinstalle le scan que je t'avait demander.

Ensuite pour en finir:

Télécharge toolscleaner sur ton Bureau : 

toolscleaner

* Double-clique sur ToolsCleaner2.exe et laisse le travailler 

* Clique sur Recherche et laisse le scan se terminer. 

* Clique sur Suppression pour finaliser. 

* Tu peux, si tu le souhaites, te servir des Options facultatives. 

* Clique sur Quitter, pour que le rapport puisse se créer. 

* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse

Désactive et réactive la Restauration du système :
 
1 Dans la barre des tâches de Windows, clique sur Démarrer.
 
2 Clique avec le bouton droit de la souris sur Poste de travail puis clique sur Propriétés.
 
3 Dans l'onglet Restauration du système, coche "Désactiver la Restauration du système"

4 Clique sur Appliquer.
  
5 Ensuite décoche "Désactiver la restauration du systeme"

6 clique sur appliquer puis ok

7 vas créer un point de restauration dans accessoires----outils systeme----restauration du systeme.

cynthia92 · Answer

Ne t'inquiètes pas, le scan a réussi et il est a 93% et à 01h38 min.

Quand c'est fait, je te baalance tout!

@+

cynthia92 · Answer

C:\Documents and Settings\Propriétaire\Mes documents\RAP KAS.html

cynthia92 · Answer

ça y est, que faire maintenant?

Utilisateur anonyme · Answer

Hi,

C'est fait quoi?

Alut.

cynthia92 · Answer

KASPERSKY ONLINE SCANNER 7 REPORT  
Monday, November 24, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, November 23, 2008 02:00:45
Records in database: 1404358
 
 
Scan settings 
Scan using the following database extended 
Scan archives yes 
Scan mail databases yes 
 
Scan area My Computer 
C:\
D:\
F:\  
 
Scan statistics 
Files scanned 57980 
Threat name 5 
Infected objects 6 
Suspicious objects 0 
Duration of the scan 01:55:50 

File name Threat name Threats count 
C:\Documents and Settings\Propriétaire\Bureau\SDFix\SDFix\backups\catchme.zip Infected: Backdoor.Win32.TDSS.blh 1  
 
C:\Documents and Settings\Propriétaire\Bureau\SDFix\SDFix\backups\catchme.zip Infected: Backdoor.Win32.TDSS.asz 1  
 
C:\Documents and Settings\Propriétaire\Bureau\SDFix\SDFix\backups\catchme.zip Infected: Backdoor.Win32.TDSS.atb 1  
 
C:\Documents and Settings\Propriétaire\Mes documents\Nouveau dossier\FindyKill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.k 1  
 
C:\Documents and Settings\Propriétaire\Mes documents\Nouveau dossier\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1  
 
C:\Program Files\FindyKill\Tools\Kill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.k 1

cynthia92 · Answer

???

Utilisateur anonyme · Answer

Hi,

Télécharge OTMoveIt3 (de Old_Timer) sur le bureau :

http://oldtimer.geekstogo.com/OTMoveIt3.exe

Double-clique sur OTMoveIt3.exe sur le bureau

- Assure toi que la case Unregister Dll's and Ocx's soit bien cochée

- Copie le texte qui se trouve en citation sans les====et colle le dans le cadre de gauche de OTMoveIt nommé Paste List of Files/Folders to be moved
===================================================================
:processes
explorer.exe

:services

:reg

:files 

C:\Documents and Settings\Propriétaire\Bureau\SDFix\SDFix\backups\catchme.zip­ Infected: Backdoor.Win32.TDSS.blh 1

C:\Documents and Settings\Propriétaire\Bureau\SDFix\SDFix\backups\catchme.zip­ Infected: Backdoor.Win32.TDSS.asz 1

C:\Documents and Settings\Propriétaire\Bureau\SDFix\SDFix\backups\catchme.zip­ Infected: Backdoor.Win32.TDSS.atb 1

C:\Documents and Settings\Propriétaire\Mes documents\Nouveau dossier\FindyKill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.k 1

C:\Documents and Settings\Propriétaire\Mes documents\Nouveau dossier\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1

C:\Program Files\FindyKill\Tools\Kill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.k 1


:commands
[purity]
[emptytemp]
[start explorer]
[reboot]
======================================================================
- Clique sur MoveIt! pour lancer la suppression.
- Ferme OTMoveIt3

Ton PC va redémarrer pour finir la suppression

cynthia92 · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File/Folder C:\Documents and Settings\Propriétaire\Bureau\SDFix\SDFix\backups\catchme.zip­­ Infected: Backdoor.Win32.TDSS.blh 1 not found.
File/Folder C:\Documents and Settings\Propriétaire\Bureau\SDFix\SDFix\backups\catchme.zip­­ Infected: Backdoor.Win32.TDSS.asz 1 not found.
File/Folder C:\Documents and Settings\Propriétaire\Bureau\SDFix\SDFix\backups\catchme.zip­­ Infected: Backdoor.Win32.TDSS.atb 1 not found.
File/Folder C:\Documents and Settings\Propriétaire\Mes documents\Nouveau dossier\FindyKill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.k 1 not found.
File/Folder C:\Documents and Settings\Propriétaire\Mes documents\Nouveau dossier\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1 not found.
File/Folder C:\Program Files\FindyKill\Tools\Kill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.k 1 not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\hsperfdata_Propriétaire\648 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\Perflib_Perfdata_878.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\~DFE200.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp
vcbin.def.CA456A2F.TMP scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_7cc.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11242008_194113

Files moved on Reboot...
File C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\hsperfdata_Propriétaire\648 not found!
File C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\Perflib_Perfdata_878.dat not found!
C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\~DFE200.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\WINDOWS	emp
vcbin.def.CA456A2F.TMP scheduled to be moved on reboot.
File C:\WINDOWS	emp\Perflib_Perfdata_7cc.dat not found!

cynthia92 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:53:18, on 24/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\WINDOWS
otepad.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDETOOL\IDETOOL.EXE
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail?kw=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.orange.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Service de configuration Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slmdmsr.exe

cynthia92 · Answer

Que faire maintenant stp?

Utilisateur anonyme · Answer

Hi, 	

Relance hijack et clique sur "Do a system scan only"
Ensuite recherche ces lignes et coches les cases

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail?kw=

Ensuite clique sur "Fix checked"

Refait un hijackthis de controle.

cynthia92 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:53:18, on 24/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\WINDOWS
otepad.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDETOOL\IDETOOL.EXE
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail?kw=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.orange.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Service de configuration Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slmdmsr.exe

cynthia92 · Answer

Et maintenantt...

cynthia92 · Answer

Il est bizarement lent et ne charge pas certaines pages internet...

Utilisateur anonyme · Answer

Hi,

ben utilise "toolscleaner que je t'ai donner précedement,et tu lance l'analyse et tu supprime tout les fix que l'on a utiliser.

Et c'est bon pour toi.

Alut.

cynthia92 · Answer

Ca y est, que faire maintenant parce qu'il est lent et ne charge pas certains sites, choses qu'il ne faisait pas il y a 2 jours...

Utilisateur anonyme · Answer

Hi,

passe sa:

Combofix. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...

Fais exactement ce qui suit :



Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide : 

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation (si jamais tu en as et que je ne les ai pas vu sur le rapport hijackthis....)

---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

Tuto ici : TUTO
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :

Double-clique sur C-Fix.exe (= combofix.exe ) .

Appuie sur une touche pour démarrer le scan .

Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp

cynthia92 · Answer

ça y est, et maintenant???

cynthia92 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:51:45, on 24/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDETOOL\IDETOOL.EXE
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Service de configuration Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slmdmsr.exe

Utilisateur anonyme · Answer

Hi,

tu la fait combofix?

Alut.

cynthia92 · Answer

ComboFix 08-11-22.02 - Propriétaire 2008-11-24 20:35:38.4 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.192 [GMT 1:00] Lancé depuis: c:\documents and settings\Propriétaire\Bureau\ComboFix.exe * Un nouveau point de restauration a été créé [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\InfoSat.txt . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-24 au 2008-11-24 )))))))))))))))))))))))))))))))))))) . 2008-11-24 19:41 . 2008-11-24 19:41 d-------- C:\_OTMoveIt 2008-11-24 10:14 . 2008-11-24 10:14 d-------- c:\windows\system32\Kaspersky Lab 2008-11-23 19:04 . 2008-11-23 21:20 1,393 --a------ c:\windows\imsins.BAK 2008-11-23 16:05 . 2008-04-14 03:04 93,184 -----c--- c:\windows\system32\dllcache\msxml6r.dll 2008-11-23 16:05 . 2004-08-03 22:41 11,868 --------- c:\windows\system32\drivers\mdmxsdk.sys 2008-11-23 11:10 . 2008-11-23 11:15 d-------- C:\KB 2008-11-22 23:59 . 2008-11-23 00:08 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-22 23:59 . 2008-11-22 23:59 d-------- c:\documents and settings\Propriétaire\Application Data\Malwarebytes 2008-11-22 23:59 . 2008-11-22 23:59 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-11-22 23:59 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-22 23:59 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-11-22 23:49 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2008-11-22 22:33 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuapi.dll.mui 2008-11-21 21:26 . 2008-10-03 18:12 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2008-11-21 21:26 . 2007-04-17 10:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2008-11-21 21:26 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys 2008-11-21 21:26 . 2007-03-08 06:10 1,048,576 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2008-11-21 21:26 . 2008-08-26 09:11 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2008-11-21 21:26 . 2008-08-26 09:11 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2008-11-21 21:26 . 2008-08-26 09:11 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2008-11-21 21:26 . 2008-08-26 09:11 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2008-11-21 21:26 . 2008-08-26 09:11 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2008-11-21 21:25 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-11-21 21:25 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-11-21 21:25 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-11-21 21:25 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-11-21 21:14 . 2008-06-14 18:33 272,768 -----c--- c:\windows\system32\dllcache\bthport.sys 2008-11-21 21:13 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys 2008-11-21 21:09 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys 2008-11-21 21:08 . 2008-04-11 20:05 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll 2008-11-21 21:02 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-11-21 21:01 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-21 19:52 . 2008-11-23 14:30 664 --a------ c:\windows\system32\d3d9caps.dat 2008-11-21 18:24 . 2008-11-21 18:24 d-------- C:\VundoFix Backups 2008-11-21 18:08 . 2008-11-21 18:08 d-------- C:\rsit 2008-11-20 22:45 . 2008-11-24 20:09 d-------- c:\windows\ERUNT 2008-11-20 21:18 . 2008-11-20 21:30 d-------- c:\program files\Navilog1 2008-11-20 19:17 . 2008-11-23 14:06 d-------- c:\program files\FindyKill 2008-11-20 17:01 . 2008-11-20 17:24 d-------- C:\ToolBar SD 2008-11-20 16:40 . 2008-11-24 20:15 4,004 --a------ c:\windows\system32\PerfStringBackup.TMP 2008-11-19 16:22 . 2008-11-19 16:22 d-------- C:\OEMSettings 2008-11-19 16:09 . 2008-11-19 16:09 17,801 --a------ c:\windows\system32\drivers\AegisP.sys 2008-11-19 16:08 . 2008-11-19 16:21 d-------- c:\program files\NETGEAR 2008-11-19 15:56 . 2008-11-19 15:56 d-------- c:\windows\Downloaded Installations 2008-11-19 14:32 . 2008-11-19 14:32 268 --ah----- C:\sqmdata00.sqm 2008-11-19 14:32 . 2008-11-19 14:32 244 --ah----- C:\sqmnoopt00.sqm 2008-11-18 21:53 . 2008-11-18 21:53 d-------- c:\program files\Realtek AC97 2008-11-18 21:21 . 2008-11-19 17:00 d-------- C:\Driver Download 2008-11-18 21:08 . 2004-08-05 13:00 28,288 --a--c--- c:\windows\system32\dllcache\xjis.nls 2008-11-18 21:06 . 2004-08-05 13:00 1,875,968 --a--c--- c:\windows\system32\dllcache\msir3jp.lex 2008-11-18 21:05 . 2008-04-14 03:31 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll 2008-11-18 21:04 . 2004-08-05 13:00 1,677,824 --a--c--- c:\windows\system32\dllcache\chsbrkr.dll 2008-11-18 21:03 . 2003-04-14 20:29 217,088 --a--c--- c:\windows\system32\dllcache\fpmmcsat.dll 2008-11-18 21:03 . 2003-04-14 20:29 16,384 --a--c--- c:\windows\system32\dllcache\tcptsat.dll 2008-11-18 20:57 . 2008-11-18 20:57 749 -rah----- c:\windows\WindowsShell.Manifest 2008-11-18 20:57 . 2008-11-18 20:57 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest 2008-11-18 20:57 . 2008-11-18 20:57 749 -rah----- c:\windows\system32\sapi.cpl.manifest 2008-11-18 20:57 . 2008-11-18 20:57 749 -rah----- c:\windows\system32\ncpa.cpl.manifest 2008-11-18 20:57 . 2008-11-18 20:57 488 -rah----- c:\windows\system32\logonui.exe.manifest 2008-11-18 20:56 . 2004-08-05 13:00 16,384 --a--c--- c:\windows\system32\dllcache\isignup.exe 2008-11-18 20:42 . 2008-11-18 20:42 d---s---- c:\windows\system32\config\systemprofile\Historique 2008-11-18 18:11 . 2008-11-18 18:11 d-------- c:\documents and settings\All Users\Application Data\AntiVir PersonalEdition Classic 2008-11-18 18:06 . 2008-11-18 18:06 d-------- c:\program files\Avira 2008-11-18 18:04 . 2008-11-18 18:04 932 --a------ c:\windows\setupapi.old 2008-11-18 16:39 . 2007-09-02 20:56 1,686,016 --a------ c:\windows\system32\clinetsuitex6.ocx 2008-11-18 16:39 . 2004-03-09 16:45 662,288 --a------ c:\windows\system32\MSCOMCT2.OCX 2008-11-18 16:39 . 2004-06-14 14:56 427,864 --a------ c:\windows\system32\XceedZip.dll 2008-11-16 14:08 . 2008-11-16 14:04 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-16 13:18 . 2008-11-16 13:42 16,307,608 --a------ c:\program files\jre-6u10-windows-i586-p-s.exe 2008-11-16 13:18 . 2008-11-16 13:18 1,886,800 --a------ c:\program files\install_flash_player_10_active_x.exe 2008-11-12 12:57 . 2008-11-16 14:04 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-11 17:16 . 2008-11-11 17:16 d-------- c:\program files\WinZip.Pro.v12.0.8252{H33T}{JOHNCANADUDE} 2008-11-11 17:15 . 2008-11-11 17:16 d-------- c:\program files\WinRAR 3.71 Final French 2008-11-10 16:44 . 2008-11-10 16:44 d-------- c:\program files\NeroInstall.bak 2008-11-10 16:34 . 2008-11-10 16:34 d-------- c:\documents and settings\Propriétaire\Application Data\Nero 2008-11-10 16:23 . 2008-11-10 16:23 d-------- c:\program files\Nero 2008-11-10 16:23 . 2008-11-10 16:23 d-------- c:\documents and settings\All Users\Application Data\Nero 2008-11-09 11:17 . 2008-11-09 11:20 2,955,128 --a------ c:\program files\ccsetup213.exe 2008-11-07 19:35 . 2008-11-07 19:35 25,129,080 --a------ c:\program files\antivir_workstation_winu_en_h.exe 2008-11-07 17:50 . 2008-11-07 17:52 6,113,439 --a------ c:\program files\pci_filerecovery.exe 2008-11-07 17:42 . 2008-11-07 17:43 2,331,336 --a------ c:\program files\recuva_recuva_1.20.361_francais_31279.exe 2008-11-07 17:40 . 2008-11-07 17:43 7,261,864 --a------ c:\program files\RecoverMyFiles-Setup.exe 2008-11-05 18:18 . 2008-11-05 18:40 16,735,888 --a------ c:\program files\wg311t_5_0_setup.exe 2008-11-05 17:10 . 2008-11-18 19:24 d-------- c:\windows\Drivers 2008-11-05 17:10 . 2002-12-24 13:52 54,016 --a------ c:\windows\system32\drivers\ousb2hub.sys 2008-11-05 17:10 . 2002-12-24 13:52 39,040 --a------ c:\windows\system32\drivers\ousbehci.sys 2008-11-04 23:28 . 2008-11-04 23:44 15,689,944 --a------ c:\documents and settings\wpn311_2_0_setup.exe 2008-11-04 23:27 . 2008-11-04 23:44 16,735,888 --a------ c:\documents and settings\wg311t_5_0_setup.exe 2008-11-04 23:24 . 2008-11-04 23:26 1,435,845 --a------ c:\documents and settings\VIA_Hyperion 4in1_v456v.zip 2008-11-04 23:23 . 2008-11-04 23:34 13,301,758 --a------ c:\documents and settings\via_hyperionpro_v521a.zip 2008-11-04 23:21 . 2008-11-04 23:26 461,960 --a------ c:\documents and settings\MANUAL_CMP-USB2PCC10.zip 2008-11-04 23:20 . 2008-11-04 23:33 15,243,539 --a------ c:\documents and settings\VIA_USB2_V270p1-L-M.zip 2008-10-31 13:38 . 2008-10-31 13:38 d-------- c:\program files\Samsung 2008-10-28 14:01 . 2008-05-14 17:12 d-------- C:\META-INF 2008-10-28 13:35 . 2008-10-06 18:01 d--h----- c:\documents and settings\Administrateur\Voisinage réseau 2008-10-28 13:35 . 2008-10-06 18:01 d--h----- c:\documents and settings\Administrateur\Voisinage d'impression 2008-10-28 13:35 . 2008-10-06 16:07 d--h----- c:\documents and settings\Administrateur\Modèles 2008-10-28 13:35 . 2008-10-06 18:01 d-------- c:\documents and settings\Administrateur\Mes documents 2008-10-28 13:35 . 2008-10-06 18:01 dr------- c:\documents and settings\Administrateur\Menu Démarrer 2008-10-28 13:35 . 2008-10-06 18:01 d-------- c:\documents and settings\Administrateur\Favoris 2008-10-28 13:35 . 2008-10-06 16:17 d-------- c:\documents and settings\Administrateur\Bureau 2008-10-28 13:35 . 2008-10-28 13:35 d-------- c:\documents and settings\Administrateur 2008-10-28 12:19 . 2003-03-11 00:12 59,632 -ra------ c:\windows\system32\drivers\qcusbser.sys 2008-10-28 11:41 . 2003-03-11 00:12 59,632 -ra------ c:\windows\system32\drivers\qcusbmdm.sys 2008-10-25 19:34 . 2008-10-31 14:12 d-------- c:\documents and settings\Propriétaire\Application Data\Samsung 2008-10-25 19:30 . 2008-10-25 19:30 d-------- c:\program files\Fichiers communs\Adobe 2008-10-25 19:22 . 2006-05-03 21:53 174,592 --a------ c:\windows\system32\framedyn.dll 2008-10-25 19:22 . 2007-07-03 15:58 106,792 --a------ c:\windows\system32\drivers\sscdmdm.sys 2008-10-25 19:22 . 2007-07-03 15:54 80,552 --a------ c:\windows\system32\drivers\sscdbus.sys 2008-10-25 19:22 . 2007-07-03 15:57 11,944 --a------ c:\windows\system32\drivers\sscdmdfl.sys 2008-10-25 19:22 . 2007-07-03 16:00 9,256 --a------ c:\windows\system32\drivers\sscdwhnt.sys 2008-10-25 19:22 . 2007-07-03 16:00 9,256 --a------ c:\windows\system32\drivers\sscdwh.sys 2008-10-25 19:22 . 2007-07-03 15:56 9,256 --a------ c:\windows\system32\drivers\sscdcmnt.sys 2008-10-25 19:22 . 2007-07-03 15:56 9,256 --a------ c:\windows\system32\drivers\sscdcm.sys 2008-10-25 19:21 . 2008-10-25 19:22 d-------- c:\windows\system32\Samsung_USB_Drivers 2008-10-25 19:21 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico 2008-10-25 19:20 . 2008-10-31 14:09 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys 2008-10-25 11:53 . 2008-11-24 20:13 229,860 --a------ c:\windows\system32\oodbs.lor 2008-10-25 10:35 . 2008-10-25 10:35 d-------- c:\program files\OO Software . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-23 17:36 --------- d-----w c:\program files\MSECACHE 2008-11-23 13:43 --------- d-----w c:\program files\Atheros 2008-11-23 13:08 --------- d-----w c:\program files\VideoLAN 2008-11-19 16:31 --------- d-----w c:\program files\IDETOOL 2008-11-19 15:42 --------- d-----w c:\program files\DirectX 2008-11-19 15:22 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-18 20:35 --------- d-----w c:\program files\ma-config.com 2008-11-18 20:35 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com 2008-11-18 19:46 20,152 ----a-w c:\windows\system32\drivers\INFCACHE.1 2008-11-16 13:03 --------- d-----w c:\program files\Java 2008-11-13 20:23 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2008-11-10 15:30 --------- d-----w c:\program files\Fichiers communs\Nero 2008-11-10 13:26 --------- d-----w c:\program files\Ahead 2008-10-30 08:51 51,072 ----a-w c:\windows\system32\drivers\fsdfw.sys 2008-10-30 08:51 30,016 ----a-w c:\windows\system32\drivers\fsndis5.sys 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 10:21 --------- d-----w c:\program files\MSBuild 2008-10-23 10:21 --------- d-----w c:\program files\Microsoft Works 2008-10-23 10:18 --------- d-----w c:\program files\Microsoft.NET 2008-10-23 10:14 --------- d-----w c:\program files\Microsoft Visual Studio 8 2008-10-23 10:04 --------- d-----w c:\documents and settings\All Users\Application Data\WinZip 2008-10-23 09:00 --------- d-----w c:\program files\Microsoft Silverlight 2008-10-22 14:34 --------- d-----w c:\documents and settings\All Users\Application Data\DVD Shrink 2008-10-22 14:16 --------- d-----w c:\documents and settings\Propriétaire\Application Data\dvdcss 2008-10-21 15:16 --------- d-----w c:\program files\DVD Shrink 2008-10-21 13:42 --------- d-----w c:\documents and settings\Propriétaire\Application Data\vlc 2008-10-21 13:31 --------- d-----w c:\documents and settings\Propriétaire\Application Data\Apple Computer 2008-10-21 12:31 --------- d-----w c:\program files\Office 2007 Pro Edition _ Lyes dz 2008-10-20 16:00 --------- d-----w c:\documents and settings\Propriétaire\Application Data\Image Zone Express 2008-10-20 08:28 --------- d-----w c:\program files\BitComet 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-12 16:48 --------- d-----w c:\program files\Fichiers communs\InstallShield 2008-10-12 16:32 --------- d-----w c:\program files\Windows Installer Clean Up 2008-10-12 16:30 359,656 ----a-w c:\program files\msicuu2.exe 2008-10-12 15:38 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2 2008-10-10 18:33 --------- d-----w c:\program files\Fichiers communs\Labtec 2008-10-10 18:31 --------- d-----w c:\program files\Fichiers communs\LogiShrd 2008-10-10 18:30 --------- d-----w c:\program files\Labtec 2008-10-09 14:40 --------- d-----w c:\documents and settings\Propriétaire\Application Data\HP 2008-10-08 17:42 1,495,112 ----a-w c:\program files\install_flash_player.exe 2008-10-07 17:52 --------- d-----w c:\program files\Windows Desktop Search 2008-10-07 17:31 --------- d-----w c:\program files\MSXML 4.0 2008-10-07 17:22 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus! 2008-10-07 17:20 --------- d-----w c:\program files\Windows Media Connect 2 2008-10-07 15:03 --------- d-----w c:\program files\NEW DRIVERS 2008-10-07 14:42 --------- d-----w c:\program files\S3 2008-10-07 14:30 --------- d-----w c:\program files\Messenger Plus! Live 2008-10-07 14:24 --------- d-----w c:\program files\Windows Live 2008-10-07 14:19 --------- dcsh--w c:\program files\Fichiers communs\WindowsLiveInstaller 2008-10-07 14:17 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller 2008-10-07 14:15 --------- d-----w c:\program files\iTunes 2008-10-07 14:15 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-07 14:14 --------- d-----w c:\program files\QuickTime 2008-10-07 14:14 --------- d-----w c:\program files\iPod 2008-10-07 14:14 --------- d-----w c:\program files\Bonjour 2008-10-07 14:14 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer 2008-10-07 14:12 --------- d-----w c:\program files\Fichiers communs\Apple 2008-10-07 14:11 --------- d-----w c:\program files\Apple Software Update 2008-10-07 14:09 --------- d-----w c:\documents and settings\All Users\Application Data\Apple 2008-10-07 14:07 --------- d-----w c:\program files\VIA 2008-10-07 12:58 67,167,528 ----a-w c:\program files\iTunes801Setup.exe 2008-10-06 19:27 --------- d-----w c:\program files\Orange 2008-10-06 19:24 25,752,376 ----a-w c:\program files\wmp11-windowsxp-x86-enu.exe 2008-10-06 19:22 --------- d-----w c:\program files\Fichiers communs\France Telecom 2008-10-06 19:21 --------- d-----w c:\documents and settings\Propriétaire\Application Data\F-Secure 2008-10-06 19:19 --------- d-----w c:\program files\SAGEM 2008-10-06 19:19 --------- d-----w c:\documents and settings\Propriétaire\Application Data\InstallShield 2008-10-06 19:18 --------- d-----w c:\program files\Securitoo 2008-10-06 17:35 4,865,872 ----a-w c:\program files\MsgPlusLive-470.exe 2008-10-06 17:29 --------- d-----w c:\documents and settings\All Users\Application Data\F-Secure 2008-10-06 17:27 2,402,832 ----a-w c:\program files\WLinstaller.exe 2008-10-06 17:27 14,648,672 ----a-w c:\program files\winzip120.exe 2008-10-06 17:27 --------- d-----w c:\documents and settings\All Users\Application Data\fssg 2008-10-06 17:25 69,235,448 ----a-w c:\program files\orange_avfw_513.exe 2008-10-06 16:43 1,234,120 ----a-w c:\program files\wrar380.exe 2008-10-06 16:41 --------- d-----w c:\program files\CCleaner 2008-10-06 16:38 1,885,208 ----a-w c:\program files\flashplayer10_install_activex_091508.exe 2008-10-06 16:36 2,934,168 ----a-w c:\program files\ccsetup212.exe 2008-10-06 16:36 1,014,272 ----a-w c:\program files\wlsetup-web.exe 2008-10-06 16:34 5,318,816 ----a-w c:\program files\bitcomet_setup.exe 2008-10-06 16:31 --------- d-----w c:\program files\Google 2008-10-06 16:30 166,560 ----a-w c:\program files\GoogleToolbarInstaller_download_signed.exe 2008-10-06 15:47 --------- d-----w c:\program files\DRIVERS 2008-10-06 15:46 9,388 ----a-w c:\windows\system32\drivers\iaStor.PNF 2008-10-06 15:46 7,280 ----a-w c:\windows\system32\drivers\viamraid.PNF 2008-10-06 15:46 63,240 ----a-w c:\windows\system32\drivers\Si3112r.PNF 2008-10-06 15:46 6,984 ----a-w c:\windows\system32\drivers\SiSRaid.PNF 2008-10-06 15:46 12,432 ----a-w c:\windows\system32\drivers\adpu320.PNF 2008-10-06 15:46 12,204 ----a-w c:\windows\system32\drivers\nvraid.PNF 2008-10-06 15:46 10,828 ----a-w c:\windows\system32\drivers\iaAHCI.PNF 2008-10-06 15:39 --------- d-----w c:\program files\HP 2008-10-06 15:39 --------- d-----w c:\program files\Fichiers communs\HP 2008-10-06 15:39 --------- d-----w c:\documents and settings\All Users\Application Data\HP 2008-10-06 15:36 --------- d-----w c:\program files\Hewlett-Packard . ((((((((((((((((((((((((((((( snapshot_2008-11-23_10.13.56,39 ))))))))))))))))))))))))))))))))))))))))) . - 2004-08-05 12:00:00 200,064 -c----w c:\windows\$NtUninstallKB950762$\rmcast.sys - 2005-07-26 04:39:58 243,200 -c----w c:\windows\$NtUninstallKB950974$\es.dll - 2004-08-05 12:00:00 678,400 -c----w c:\windows\$NtUninstallKB951066$\inetcomm.dll - 2004-08-05 12:00:00 274,944 -c----w c:\windows\$NtUninstallKB951376-v2$\bthport.sys - 2005-08-30 03:55:44 1,293,312 -c----w c:\windows\$NtUninstallKB951698$\quartz.dll - 2008-02-20 05:35:05 148,992 -c----w c:\windows\$NtUninstallKB951748$\dnsapi.dll - 2004-08-05 12:00:00 247,808 -c----w c:\windows\$NtUninstallKB951748$\mswsock.dll - 2006-01-13 02:28:14 359,808 -c----w c:\windows\$NtUninstallKB951748$\tcpip.sys - 2004-08-05 12:00:00 223,616 -c----w c:\windows\$NtUninstallKB951748$\tcpip6.sys - 2004-08-05 12:00:00 331,776 -c----w c:\windows\$NtUninstallKB952287$\msadce.dll - 2005-06-29 01:49:42 74,240 -c----w c:\windows\$NtUninstallKB952954$\mscms.dll - 2004-08-05 12:00:00 72,704 -c----w c:\windows\$NtUninstallKB953155$\msw3prt.dll - 2004-08-05 12:00:00 102,400 -c----w c:\windows\$NtUninstallKB953155$\win32spl.dll - 2005-10-06 03:08:50 1,839,616 -c----w c:\windows\$NtUninstallKB954211$\win32k.sys - 2004-08-05 12:00:00 1,236,480 -c----w c:\windows\$NtUninstallKB955069$\msxml3.dll - 2004-08-05 12:00:00 138,496 -c----w c:\windows\$NtUninstallKB956803$\afd.sys - 2005-09-29 18:28:42 2,059,520 -c----w c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe - 2005-09-29 18:29:05 2,182,272 -c----w c:\windows\$NtUninstallKB956841$\ntoskrnl.exe - 2005-05-10 00:17:52 332,544 -c----w c:\windows\$NtUninstallKB957095$\srv.sys - 2006-05-05 09:41:45 453,120 -c----w c:\windows\$NtUninstallKB957097$\mrxsmb.sys - 2004-08-05 12:00:00 332,288 -c----w c:\windows\$NtUninstallKB958644$\netapi32.dll - 2004-08-05 12:00:00 1,852,416 ----a-w c:\windows\AppPatch\AcGenral.dll + 2008-04-14 02:33:18 1,852,928 ----a-w c:\windows\AppPatch\acgenral.dll - 2004-08-05 12:00:00 450,048 ----a-w c:\windows\AppPatch\AcLayers.dll + 2008-04-14 02:33:18 451,072 ----a-w c:\windows\AppPatch\aclayers.dll - 2004-08-05 12:00:00 137,728 ----a-w c:\windows\AppPatch\AcLua.dll + 2008-04-14 02:33:18 141,312 ----a-w c:\windows\AppPatch\aclua.dll - 2004-08-05 12:00:00 244,736 ----a-w c:\windows\AppPatch\AcSpecfc.dll + 2008-04-14 02:33:18 245,248 ----a-w c:\windows\AppPatch\acspecfc.dll - 2004-08-05 12:00:00 116,224 ----a-w c:\windows\AppPatch\AcXtrnal.dll + 2008-04-14 02:33:18 116,224 ----a-w c:\windows\AppPatch\acxtrnal.dll - 2008-06-14 17:59:52 272,768 ------w c:\windows\Driver Cache\i386\bthport.sys + 2008-06-14 17:33:37 272,768 ------w c:\windows\Driver Cache\i386\bthport.sys - 2008-10-24 11:10:42 453,632 ------w c:\windows\Driver Cache\i386\mrxsmb.sys + 2008-10-24 11:21:09 455,296 ------w c:\windows\Driver Cache\i386\mrxsmb.sys - 2008-08-14 13:39:07 2,144,768 ------w c:\windows\Driver Cache\i386\ntkrnlmp.exe + 2008-08-14 13:23:44 2,147,328 ------w c:\windows\Driver Cache\i386\ntkrnlmp.exe - 2008-08-14 13:39:12 2,065,024 ------w c:\windows\Driver Cache\i386\ntkrnlpa.exe + 2008-08-14 13:23:49 2,068,096 ------w c:\windows\Driver Cache\i386\ntkrnlpa.exe - 2008-08-14 13:39:03 2,022,912 ------w c:\windows\Driver Cache\i386\ntkrpamp.exe + 2008-08-14 13:23:44 2,025,984 ------w c:\windows\Driver Cache\i386\ntkrpamp.exe - 2008-08-14 13:39:11 2,188,032 ------w c:\windows\Driver Cache\i386\ntoskrnl.exe + 2008-08-14 13:23:49 2,191,232 ------w c:\windows\Driver Cache\i386\ntoskrnl.exe + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIXT\ERDNT.EXE + 2008-11-20 21:45:37 3,977,216 ----a-w c:\windows\ERUNT\SDFIXT\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-11-20 21:45:37 192,512 ----a-w c:\windows\ERUNT\SDFIXT\Users\[u]0[/u]0000002\UsrClass.dat - 2007-06-13 13:22:28 1,037,312 ----a-w c:\windows\explorer.exe + 2008-04-14 02:34:03 1,037,824 ----a-w c:\windows\explorer.exe - 2004-08-05 12:00:00 34,816 ----a-w c:\windows\Help\sniffpol.dll + 2008-04-14 02:33:41 34,816 ----a-w c:\windows\Help\sniffpol.dll - 2004-08-05 12:00:00 33,280 ----a-w c:\windows\Help\sstub.dll + 2008-04-14 02:33:46 33,280 ----a-w c:\windows\Help\sstub.dll - 2004-08-05 12:00:00 279,040 ----a-w c:\windows\Help\tshoot.dll + 2008-04-14 02:33:46 279,040 ----a-w c:\windows\Help\tshoot.dll - 2005-05-26 23:22:02 10,752 ----a-w c:\windows\hh.exe + 2008-04-14 02:34:06 10,752 ----a-w c:\windows\hh.exe - 2004-08-05 12:00:00 220,160 ----a-w c:\windows\ime\mscandui.dll + 2008-04-14 02:33:30 220,160 ----a-w c:\windows\ime\mscandui.dll - 2004-08-05 12:00:00 130,048 ----a-w c:\windows\ime\SOFTKBD.DLL + 2008-04-14 02:33:41 130,048 ----a-w c:\windows\ime\softkbd.dll - 2004-08-05 12:00:00 62,976 ----a-w c:\windows\ime\SPGRMR.dll + 2008-04-13 16:43:18 62,976 ----a-w c:\windows\ime\spgrmr.dll - 2004-08-05 12:00:00 272,384 ----a-w c:\windows\ime\SPTIP.dll + 2008-04-14 02:33:46 272,384 ----a-w c:\windows\ime\sptip.dll - 2006-11-03 08:58:34 317,440 ----a-w c:\windows\inf\unregmp2.exe + 2007-06-29 10:59:14 318,976 ----a-w c:\windows\inf\unregmp2.exe - 2004-08-05 12:00:00 24,064 ----a-w c:\windows\msagent\agentanm.dll + 2008-04-14 02:33:18 24,064 ----a-w c:\windows\msagent\agentanm.dll - 2004-08-05 12:00:00 214,016 ----a-w c:\windows\msagent\agentctl.dll + 2008-04-14 02:33:18 214,016 ----a-w c:\windows\msagent\agentctl.dll - 2006-10-12 14:04:13 42,496 ----a-w c:\windows\msagent\agentdp2.dll + 2008-04-14 02:33:18 42,496 ----a-w c:\windows\msagent\agentdp2.dll - 2007-03-09 13:48:06 57,344 ----a-w c:\windows\msagent\agentdpv.dll + 2008-04-14 02:33:18 57,344 ----a-w c:\windows\msagent\agentdpv.dll - 2004-08-05 12:00:00 49,152 ----a-w c:\windows\msagent\agentmpx.dll + 2008-04-14 02:33:18 49,152 ----a-w c:\windows\msagent\agentmpx.dll - 2004-08-05 12:00:00 24,064 ----a-w c:\windows\msagent\agentpsh.dll + 2008-04-14 02:33:18 24,064 ----a-w c:\windows\msagent\agentpsh.dll - 2004-08-05 12:00:00 44,032 ----a-w c:\windows\msagent\agentsr.dll + 2008-04-14 02:33:18 44,032 ----a-w c:\windows\msagent\agentsr.dll - 2006-10-12 11:09:53 256,512 ----a-w c:\windows\msagent\agentsvr.exe + 2008-04-14 02:33:53 256,512 ----a-w c:\windows\msagent\agentsvr.exe - 2004-08-05 12:00:00 24,064 ----a-w c:\windows\msagent\agtintl.dll + 2008-04-14 02:33:19 24,064 ----a-w c:\windows\msagent\agtintl.dll - 2004-08-05 12:00:00 19,456 ----a-w c:\windows\msagent\intl\agt0405.dll + 2007-04-02 18:25:59 19,456 ----a-w c:\windows\msagent\intl\agt0405.dll - 2004-08-05 12:00:00 19,456 ----a-w c:\windows\msagent\intl\agt0406.dll + 2007-04-02 18:25:59 19,456 ----a-w c:\windows\msagent\intl\agt0406.dll - 2004-08-05 12:00:00 21,504 ----a-w c:\windows\msagent\intl\agt0407.dll + 2007-04-02 18:26:00 21,504 ----a-w c:\windows\msagent\intl\agt0407.dll - 2004-08-05 12:00:00 22,016 ----a-w c:\windows\msagent\intl\agt0408.dll + 2007-04-02 18:26:00 22,016 ----a-w c:\windows\msagent\intl\agt0408.dll - 2004-08-05 12:00:00 19,456 ----a-w c:\windows\msagent\intl\agt0409.dll + 2008-04-13 17:32:28 19,968 ----a-w c:\windows\msagent\intl\agt0409.dll - 2004-08-05 12:00:00 19,456 ----a-w c:\windows\msagent\intl\agt040b.dll + 2007-04-02 18:26:00 19,456 ----a-w c:\windows\msagent\intl\agt040b.dll - 2004-08-05 12:00:00 21,504 ----a-w c:\windows\msagent\intl\agt040c.dll + 2007-04-02 18:26:00 21,504 ----a-w c:\windows\msagent\intl\agt040c.dll - 2004-08-05 12:00:00 19,968 ----a-w c:\windows\msagent\intl\agt040e.dll + 2007-04-02 18:26:00 19,968 ----a-w c:\windows\msagent\intl\agt040e.dll - 2004-08-05 12:00:00 20,992 ----a-w c:\windows\msagent\intl\agt0410.dll + 2007-04-02 18:26:00 20,992 ----a-w c:\windows\msagent\intl\agt0410.dll - 2004-08-05 12:00:00 20,992 ----a-w c:\windows\msagent\intl\agt0413.dll + 2007-04-02 18:26:01 20,992 ----a-w c:\windows\msagent\intl\agt0413.dll - 2004-08-05 12:00:00 19,456 ----a-w c:\windows\msagent\intl\agt0414.dll + 2007-04-02 18:26:01 19,456 ----a-w c:\windows\msagent\intl\agt0414.dll - 2004-08-05 12:00:00 19,456 ----a-w c:\windows\msagent\intl\agt0415.dll + 2007-04-02 18:26:01 19,456 ----a-w c:\windows\msagent\intl\agt0415.dll - 2004-08-05 12:00:00 20,480 ----a-w c:\windows\msagent\intl\agt0416.dll + 2007-04-02 18:26:01 20,480 ----a-w c:\windows\msagent\intl\agt0416.dll - 2004-08-05 12:00:00 19,456 ----a-w c:\windows\msagent\intl\agt0419.dll + 2007-04-02 18:26:01 19,456 ----a-w c:\windows\msagent\intl\agt0419.dll - 2004-08-05 12:00:00 19,456 ----a-w c:\windows\msagent\intl\agt041d.dll + 2007-04-02 18:26:01 19,456 ----a-w c:\windows\msagent\intl\agt041d.dll - 2004-08-05 12:00:00 19,456 ----a-w c:\windows\msagent\intl\agt041f.dll + 2007-04-02 18:26:01 19,456 ----a-w c:\windows\msagent\intl\agt041f.dll - 2004-08-05 12:00:00 20,992 ----a-w c:\windows\msagent\intl\agt0816.dll + 2007-04-02 18:26:02 20,992 ----a-w c:\windows\msagent\intl\agt0816.dll - 2004-08-05 12:00:00 20,480 ----a-w c:\windows\msagent\intl\agt0c0a.dll + 2007-04-02 18:26:02 20,480 ----a-w c:\windows\msagent\intl\agt0c0a.dll - 2004-08-05 12:00:00 39,936 ----a-w c:\windows\msagent\mslwvtts.dll + 2008-04-14 02:33:32 39,936 ----a-w c:\windows\msagent\mslwvtts.dll - 2004-08-05 12:00:00 70,656 ----a-w c:\windows\notepad.exe + 2008-04-14 02:34:15 70,656 ----a-w c:\windows\notepad.exe - 2004-08-05 12:00:00 768,512 ----a-w c:\windows\pchealth\helpctr\binaries\HelpCtr.exe + 2008-04-14 02:34:06 769,024 ----a-w c:\windows\pchealth\helpctr\binaries\helpctr.exe - 2004-08-05 12:00:00 743,936 ----a-w c:\windows\pchealth\helpctr\binaries\HelpSvc.exe + 2008-04-14 02:34:06 744,448 ----a-w c:\windows\pchealth\helpctr\binaries\helpsvc.exe - 2004-08-05 12:00:00 18,944 ----a-w c:\windows\pchealth\helpctr\binaries\HscUpd.exe + 2008-04-14 02:34:06 18,432 ----a-w c:\windows\pchealth\helpctr\binaries\hscupd.exe - 2004-08-05 12:00:00 160,768 ----a-w c:\windows\pchealth\helpctr\binaries\msconfig.exe + 2008-04-14 02:34:12 172,544 ----a-w c:\windows\pchealth\helpctr\binaries\msconfig.exe - 2004-08-05 12:00:00 381,952 ----a-w c:\windows\pchealth\helpctr\binaries\msinfo.dll + 2008-04-14 02:33:32 382,464 ----a-w c:\windows\pchealth\helpctr\binaries\msinfo.dll - 2004-08-05 12:00:00 102,400 ----a-w c:\windows\pchealth\helpctr\binaries\pchshell.dll + 2008-04-14 02:33:38 102,912 ----a-w c:\windows\pchealth\helpctr\binaries\pchshell.dll - 2004-08-05 12:00:00 38,912 ----a-w c:\windows\pchealth\helpctr\binaries\pchsvc.dll + 2008-04-14 02:33:38 38,400 ----a-w c:\windows\pchealth\helpctr\binaries\pchsvc.dll - 2004-08-05 12:00:00 151,040 ----a-w c:\windows\pchealth\UploadLB\Binaries\UploadM.exe + 2008-04-14 02:34:26 151,040 ----a-w c:\windows\pchealth\UploadLB\Binaries\uploadm.exe - 2004-08-05 12:00:00 151,552 ----a-w c:\windows\PeerNet\sqldb20.dll + 2008-04-14 02:33:46 151,552 ----a-w c:\windows\PeerNet\sqldb20.dll - 2004-08-05 12:00:00 462,848 ----a-w c:\windows\PeerNet\sqlqp20.dll + 2008-04-14 02:33:46 462,848 ----a-w c:\windows\PeerNet\sqlqp20.dll - 2004-08-05 12:00:00 110,592 ----a-w c:\windows\PeerNet\sqlse20.dll + 2008-04-14 02:33:46 110,592 ----a-w c:\windows\PeerNet\sqlse20.dll - 2004-08-05 12:00:00 153,088 ----a-w c:\windows\regedit.exe + 2008-04-14 02:34:19 153,088 ----a-w c:\windows\regedit.exe + 2008-04-13 18:46:18 53,376 ------w c:\windows\ServicePackFiles\i386\1394bus.sys + 2008-04-13 18:40:50 12,288 ------w c:\windows\ServicePackFiles\i386\4mmdat.sys + 2008-04-13 18:46:20 48,128 ------w c:\windows\ServicePackFiles\i386\61883.sys + 2008-04-14 02:33:18 100,352 ------w c:\windows\ServicePackFiles\i386\6to4svc.dll + 2008-04-14 02:33:18 136,192 ------w c:\windows\ServicePackFiles\i386\aaclient.dll + 2004-08-03 21:32:22 231,552 ------w c:\windows\ServicePackFiles\i386\ac97ali.sys + 2004-08-03 21:32:32 84,480 ------w c:\windows\ServicePackFiles\i386\ac97via.sys + 2008-04-14 02:33:18 39,424 ------w c:\windows\ServicePackFiles\i386\acadproc.dll + 2008-04-14 02:33:53 190,464 ------w c:\windows\ServicePackFiles\i386\accwiz.exe + 2008-04-14 02:33:18 1,852,928 ------w c:\windows\ServicePackFiles\i386\acgenral.dll + 2008-04-14 02:33:18 451,072 ------w c:\windows\ServicePackFiles\i386\aclayers.dll + 2008-04-14 02:33:18 141,312 ------w c:\windows\ServicePackFiles\i386\aclua.dll + 2008-04-14 02:33:18 120,320 ------w c:\windows\ServicePackFiles\i386\aclui.dll + 2008-04-14 01:52:42 188,672 ------w c:\windows\ServicePackFiles\i386\acpi.sys + 2008-04-14 02:33:18 245,248 ------w c:\windows\ServicePackFiles\i386\acspecfc.dll + 2008-04-14 02:33:18 193,536 ------w c:\windows\ServicePackFiles\i386\activeds.dll + 2008-04-14 02:33:53 4,096 ------w c:\windows\ServicePackFiles\i386\actmovie.exe + 2008-04-14 02:33:18 98,304 ------w c:\windows\ServicePackFiles\i386\actxprxy.dll + 2008-04-14 02:33:18 116,224 ------w c:\windows\ServicePackFiles\i386\acxtrnal.dll + 2008-04-14 02:33:18 20,540 ------w c:\windows\ServicePackFiles\i386\admin.dll + 2008-04-14 02:33:53 16,439 ------w c:\windows\ServicePackFiles\i386\admin.exe + 2004-08-03 21:32:24 10,880 ------w c:\windows\ServicePackFiles\i386\admjoy.sys + 2008-04-14 02:33:18 61,440 ------w c:\windows\ServicePackFiles\i386\admparse.dll + 2008-04-14 02:33:18 175,616 ------w c:\windows\ServicePackFiles\i386\adsldp.dll + 2008-04-14 02:33:18 143,360 ------w c:\windows\ServicePackFiles\i386\adsldpc.dll + 2008-04-14 02:33:18 68,096 ------w c:\windows\ServicePackFiles\i386\adsmsext.dll + 2008-04-14 02:33:18 263,680 ------w c:\windows\ServicePackFiles\i386\adsnt.dll + 2008-04-14 02:33:18 4,255 ------w c:\windows\ServicePackFiles\i386\adv01nt5.dll + 2008-04-14 02:33:18 3,967 ------w c:\windows\ServicePackFiles\i386\adv02nt5.dll + 2008-04-14 02:33:18 3,615 ------w c:\windows\ServicePackFiles\i386\adv05nt5.dll + 2008-04-14 02:33:18 3,647 ------w c:\windows\ServicePackFiles\i386\adv07nt5.dll + 2008-04-14 02:33:18 3,135 ------w c:\windows\ServicePackFiles\i386\adv08nt5.dll + 2008-04-14 02:33:18 3,711 ------w c:\windows\ServicePackFiles\i386\adv09nt5.dll + 2008-04-14 02:33:18 3,775 ------w c:\windows\ServicePackFiles\i386\adv11nt5.dll + 2008-04-14 02:33:18 685,568 ------w c:\windows\ServicePackFiles\i386\advapi32.dll + 2008-04-14 02:33:18 101,888 ------w c:\windows\ServicePackFiles\i386\advpack.dll + 2008-04-13 16:39:23 142,592 ------w c:\windows\ServicePackFiles\i386\aec.sys + 2008-04-13 19:19:23 138,112 ------w c:\windows\ServicePackFiles\i386\afd.sys + 2008-04-14 02:33:18 24,064 ------w c:\windows\ServicePackFiles\i386\agentanm.dll + 2008-04-14 02:33:18 214,016 ------w c:\windows\ServicePackFiles\i386\agentctl.dll + 2008-04-14 02:33:18 42,496 ------w c:\windows\ServicePackFiles\i386\agentdp2.dll + 2008-04-14 02:33:18 57,344 ------w c:\windows\ServicePackFiles\i386\agentdpv.dll + 2008-04-14 02:33:18 49,152 ------w c:\windows\ServicePackFiles\i386\agentmpx.dll + 2008-04-14 02:33:18 24,064 ------w c:\windows\ServicePackFiles\i386\agentpsh.dll + 2008-04-14 02:33:18 44,032 ------w c:\windows\ServicePackFiles\i386\agentsr.dll + 2008-04-14 02:33:53 256,512 ------w c:\windows\ServicePackFiles\i386\agentsvr.exe + 2008-04-13 18:36:38 42,368 ------w c:\windows\ServicePackFiles\i386\agp440.sys + 2008-04-13 18:36:39 44,928 ------w c:\windows\ServicePackFiles\i386\agpcpq.sys + 2007-04-02 18:25:59 19,456 ------w c:\windows\ServicePackFiles\i386\agt0401.dll + 2007-04-02 18:25:59 19,456 ------w c:\windows\ServicePackFiles\i386\agt0404.dll + 2007-04-02 18:25:59 19,456 ------w c:\windows\ServicePackFiles\i386\agt0405.dll + 2007-04-02 18:25:59 19,456 ------w c:\windows\ServicePackFiles\i386\agt0406.dll + 2007-04-02 18:26:00 21,504 ------w c:\windows\ServicePackFiles\i386\agt0407.dll + 2007-04-02 18:26:00 22,016 ------w c:\windows\ServicePackFiles\i386\agt0408.dll + 2008-04-13 17:32:28 19,968 ------w c:\windows\ServicePackFiles\i386\agt0409.dll + 2007-04-02 18:26:00 19,456 ------w c:\windows\ServicePackFiles\i386\agt040b.dll + 2007-04-02 18:26:00 21,504 ------w c:\windows\ServicePackFiles\i386\agt040c.dll + 2007-04-02 18:26:00 19,456 ------w c:\windows\ServicePackFiles\i386\agt040d.dll + 2007-04-02 18:26:00 19,968 ------w c:\windows\ServicePackFiles\i386\agt040e.dll + 2007-04-02 18:26:00 20,992 ------w c:\windows\ServicePackFiles\i386\agt0410.dll + 2007-04-02 18:26:00 19,456 ------w c:\windows\ServicePackFiles\i386\agt0411.dll + 2007-04-02 18:26:00 19,456 ------w c:\windows\ServicePackFiles\i386\agt0412.dll + 2007-04-02 18:26:01 20,992 ------w c:\windows\ServicePackFiles\i386\agt0413.dll + 2007-04-02 18:26:01 19,456 ------w c:\windows\ServicePackFiles\i386\agt0414.dll + 2007-04-02 18:26:01 19,456 ------w c:\windows\ServicePackFiles\i386\agt0415.dll + 2007-04-02 18:26:01 20,480 ------w c:\windows\ServicePackFiles\i386\agt0416.dll + 2007-04-02 18:26:01 19,456 ------w c:\windows\ServicePackFiles\i386\agt0419.dll + 2007-04-02 18:26:01 19,456 ------w c:\windows\ServicePackFiles\i386\agt041d.dll + 2007-04-02 18:26:01 19,456 ------w c:\windows\ServicePackFiles\i386\agt041f.dll + 2007-04-02 18:26:02 19,456 ------w c:\windows\ServicePackFiles\i386\agt0804.dll + 2007-04-02 18:26:02 20,992 ------w c:\windows\ServicePackFiles\i386\agt0816.dll + 2007-04-02 18:26:02 20,480 ------w c:\windows\ServicePackFiles\i386\agt0c0a.dll + 2008-04-14 02:33:19 24,064 ------w c:\windows\ServicePackFiles\i386\agtintl.dll + 2008-04-14 02:33:53 98,304 ------w c:\windows\ServicePackFiles\i386\ahui.exe + 2008-04-14 02:33:53 44,544 ------w c:\windows\ServicePackFiles\i386\alg.exe + 2008-04-13 18:36:38 42,752 ------w c:\windows\ServicePackFiles\i386\alim1541.sys + 2008-04-14 02:33:19 17,408 ------w c:\windows\ServicePackFiles\i386\alrsvc.dll + 2008-04-13 18:36:39 43,008 ------w c:\windows\ServicePackFiles\i386\amdagp.sys + 2008-04-14 01:54:28 41,472 ------w c:\windows\ServicePackFiles\i386\amdk6.sys + 2008-04-14 01:54:29 41,856 ------w c:\windows\ServicePackFiles\i386\amdk7.sys + 2008-04-14 02:33:19 70,656 ------w c:\windows\ServicePackFiles\i386\amstream.dll + 2004-08-03 21:31:20 36,224 ------w c:\windows\ServicePackFiles\i386\an983.sys + 2008-04-14 02:33:19 125,952 ------w c:\windows\ServicePackFiles\i386\apphelp.dll + 2008-04-14 02:33:19 334,336 ------w c:\windows\ServicePackFiles\i386\aqueue.dll + 2008-04-13 18:51:25 60,800 ------w c:\windows\ServicePackFiles\i386\arp1394.sys + 2008-04-14 02:33:19 65,024 ------w c:\windows\ServicePackFiles\i386\asycfilt.dll + 2008-04-13 18:57:27 14,336 ------w c:\windows\ServicePackFiles\i386\asyncmac.sys + 2008-04-14 02:33:53 25,088 ------w c:\windows\ServicePackFiles\i386\at.exe + 2008-04-13 18:40:30 96,512 ------w c:\windows\ServicePackFiles\i386\atapi.sys + 2004-08-03 20:29:30 56,623 ------w c:\windows\ServicePackFiles\i386\ati1btxx.sys + 2004-08-03 20:29:30 11,615 ------w c:\windows\ServicePackFiles\i386\ati1mdxx.sys + 2004-08-03 20:29:30 12,047 ------w c:\windows\ServicePackFiles\i386\ati1pdxx.sys + 2004-08-03 20:29:32 30,671 ------w c:\windows\ServicePackFiles\i386\ati1raxx.sys + 2004-08-03 20:29:32 63,663 ------w c:\windows\ServicePackFiles\i386\ati1rvxx.sys + 2004-08-03 20:29:32 26,367 ------w c:\windows\ServicePackFiles\i386\ati1snxx.sys + 2004-08-03 20:29:32 21,343 ------w c:\windows\ServicePackFiles\i386\ati1ttxx.sys + 2004-08-03 20:29:32 36,463 ------w c:\windows\ServicePackFiles\i386\ati1tuxx.sys + 2004-08-03 20:29:32 29,455 ------w c:\windows\ServicePackFiles\i386\ati1xbxx.sys + 2004-08-03 20:29:32 34,735 ------w c:\windows\ServicePackFiles\i386\ati1xsxx.sys + 2008-04-14 02:33:19 229,376 ------w c:\windows\ServicePackFiles\i386\ati2cqag.dll + 2008-04-14 02:33:19 377,984 ------w c:\windows\ServicePackFiles\i386\ati2dvaa.dll + 2008-04-14 02:33:19 201,728 ------w c:\windows\ServicePackFiles\i386\ati2dvag.dll + 2004-08-03 22:38:42 327,168 ------w c:\windows\ServicePackFiles\i386\ati2mtaa.sys + 2004-08-03 22:38:44 701,440 ------w c:\windows\ServicePackFiles\i386\ati2mtag.sys + 2008-04-14 02:33:19 870,784 ------w c:\windows\ServicePackFiles\i386\ati3d1ag.dll + 2008-04-14 02:33:19 1,057,760 ------w c:\windows\ServicePackFiles\i386\ati3d2ag.dll + 2008-04-14 02:33:19 1,888,992 ------w c:\windows\ServicePackFiles\i386\ati3duag.dll + 2004-08-03 20:29:28 57,856 ------w c:\windows\ServicePackFiles\i386\atinbtxx.sys + 2004-08-03 20:29:30 13,824 ------w c:\windows\ServicePackFiles\i386\atinmdxx.sys + 2004-08-03 20:29:30 14,336 ------w c:\windows\ServicePackFiles\i386\atinpdxx.sys + 2004-08-03 20:29:30 52,224 ------w c:\windows\ServicePackFiles\i386\atinraxx.sys + 2004-08-03 20:29:32 104,960 ------w c:\windows\ServicePackFiles\i386\atinrvxx.sys + 2004-08-03 20:29:32 28,672 ------w c:\windows\ServicePackFiles\i386\atinsnxx.sys + 2004-08-03 20:29:32 13,824 ------w c:\windows\ServicePackFiles\i386\atinttxx.sys + 2004-08-03 20:29:32 73,216 ------w c:\windows\ServicePackFiles\i386\atintuxx.sys + 2004-08-03 20:29:32 31,744 ------w c:\windows\ServicePackFiles\i386\atinxbxx.sys + 2004-08-03 20:29:32 63,488 ------w c:\windows\ServicePackFiles\i386\atinxsxx.sys + 2008-04-14 02:33:19 32,768 ------w c:\windows\ServicePackFiles\i386\ativtmxx.dll + 2008-04-14 02:33:19 516,768 ------w c:\windows\ServicePackFiles\i386\ativvaxx.dll + 2008-04-14 02:33:19 58,880 ------w c:\windows\ServicePackFiles\i386\atl.dll + 2008-04-14 02:33:53 11,264 ------w c:\windows\ServicePackFiles\i386\atmadm.exe + 2008-04-13 18:51:25 59,904 ------w c:\windows\ServicePackFiles\i386\atmarpc.sys + 2008-04-14 02:31:00 285,696 ------w c:\windows\ServicePackFiles\i386\atmfd.dll + 2008-04-13 18:51:30 55,808 ------w c:\windows\ServicePackFiles\i386\atmlane.sys + 2008-04-14 02:33:19 30,208 ------w c:\windows\ServicePackFiles\i386\atmlib.dll + 2008-04-14 02:33:53 12,288 ------w c:\windows\ServicePackFiles\i386\attrib.exe + 2008-04-14 02:33:19 21,183 ------w c:\windows\ServicePackFiles\i386\atv01nt5.dll + 2008-04-14 02:33:19 11,359 ------w c:\windows\ServicePackFiles\i386\atv02nt5.dll + 2008-04-14 02:33:19 25,471 ------w c:\windows\ServicePackFiles\i386\atv04nt5.dll + 2008-04-14 02:33:19 14,143 ------w c:\windows\ServicePackFiles\i386\atv06nt5.dll + 2008-04-14 02:33:19 17,279 ------w c:\windows\ServicePackFiles\i386\atv10nt5.dll + 2008-04-14 02:33:19 42,496 ------w c:\windows\ServicePackFiles\i386\audiosrv.dll + 2008-04-14 02:33:53 14,336 ------w c:\windows\ServicePackFiles\i386\auditusr.exe + 2008-04-14 02:33:19 20,540 ------w c:\windows\ServicePackFiles\i386\author.dll + 2008-04-14 02:33:53 16,439 ------w c:\windows\ServicePackFiles\i386\author.exe + 2008-04-14 02:33:19 62,464 ------w c:\windows\ServicePackFiles\i386\authz.dll + 2008-04-14 02:33:53 625,152 ------w c:\windows\ServicePackFiles\i386\autochk.exe + 2008-04-14 02:33:53 638,976 ------w c:\windows\ServicePackFiles\i386\autoconv.exe + 2008-04-14 02:33:54 616,960 ------w c:\windows\ServicePackFiles\i386\autofmt.exe + 2008-04-14 02:33:54 11,264 ------w c:\windows\ServicePackFiles\i386\autolfn.exe + 2008-04-13 18:46:20 38,912 ------w c:\windows\ServicePackFiles\i386\avc.sys + 2008-04-13 18:46:07 13,696 ------w c:\windows\ServicePackFiles\i386\avcstrm.sys + 2008-04-14 02:33:19 85,504 ------w c:\windows\ServicePackFiles\i386\avifil32.dll + 2008-04-14 02:33:19 233,472 ------w c:\windows\ServicePackFiles\i386\azroles.dll + 2008-04-14 02:33:19 52,736 ------w c:\windows\ServicePackFiles\i386\basesrv.dll + 2008-04-14 02:33:19 29,184 ------w c:\windows\ServicePackFiles\i386\batmeter.dll + 2008-04-14 02:33:19 8,704 ------w c:\windows\ServicePackFiles\i386\batt.dll + 2008-04-13 18:36:32 14,208 ------w c:\windows\ServicePackFiles\i386\battc.sys + 2008-04-13 18:46:21 11,776 ------w c:\windows\ServicePackFiles\i386\bdasup.sys + 2008-04-14 02:33:19 17,408 ------w c:\windows\ServicePackFiles\i386\bidispl.dll + 2008-04-14 02:33:19 8,192 ------w c:\windows\ServicePackFiles\i386\bitsprx2.dll + 2008-04-14 02:33:19 7,168 ------w c:\windows\ServicePackFiles\i386\bitsprx3.dll + 2008-04-14 02:33:19 7,168 ------w c:\windows\ServicePackFiles\i386\bitsprx4.dll + 2008-04-14 02:33:55 71,680 ------w c:\windows\ServicePackFiles\i386\blastcln.exe + 2008-04-13 18:53:23 71,552 ------w c:\windows\ServicePackFiles\i386\bridge.sys + 2008-04-14 01:57:48 70,144 ------w c:\windows\ServicePackFiles\i386\browselc.dll + 2008-04-14 02:33:20 77,824 ------w c:\windows\ServicePackFiles\i386\browser.dll + 2008-04-14 02:33:20 1,025,024 ------w c:\windows\ServicePackFiles\i386\browseui.dll + 2008-04-14 02:33:20 78,336 ------w c:\windows\ServicePackFiles\i386\browsewm.dll + 2008-04-14 02:33:20 20,992 ------w c:\windows\ServicePackFiles\i386\bthci.dll + 2008-04-13 18:46:33 17,024 ------w c:\windows\ServicePackFiles\i386\bthenum.sys + 2008-04-13 18:46:33 37,888 ------w c:\windows\ServicePackFiles\i386\bthmodem.sys + 2008-04-13 18:51:34 101,120 ------w c:\windows\ServicePackFiles\i386\bthpan.sys + 2008-04-14 01:58:00 273,664 ------w c:\windows\ServicePackFiles\i386\bthport.sys + 2008-04-13 18:46:31 36,480 ------w c:\windows\ServicePackFiles\i386\bthprint.sys + 2008-04-14 02:33:20 30,208 ------w c:\windows\ServicePackFiles\i386\bthserv.dll + 2008-04-13 18:46:29 18,944 ------w c:\windows\ServicePackFiles\i386\bthusb.sys + 2008-04-14 02:33:20 50,688 ------w c:\windows\ServicePackFiles\i386\btpanui.dll + 2008-04-14 02:33:20 218,112 ------w c:\windows\ServicePackFiles\i386\c_g18030.dll + 2008-04-14 02:33:20 60,416 ------w c:\windows\ServicePackFiles\i386\cabinet.dll + 2008-04-14 02:33:20 85,504 ------w c:\windows\ServicePackFiles\i386\cabview.dll + 2008-04-14 02:33:55 20,992 ------w c:\windows\ServicePackFiles\i386\cacls.exe + 2008-04-14 02:33:20 385,024 ------w c:\windows\ServicePackFiles\i386\callcont.dll + 2008-04-14 02:33:20 121,856 ------w c:\windows\ServicePackFiles\i386\camext30.dll + 2008-04-14 02:33:20 50,688 ------w c:\windows\ServicePackFiles\i386\camocx.dll + 2008-04-14 02:33:20 153,600 ------w c:\windows\ServicePackFiles\i386\capesnpn.dll + 2008-04-14 02:33:20 226,304 ------w c:\windows\ServicePackFiles\i386\catsrv.dll + 2008-04-14 02:33:20 85,504 ------w c:\windows\ServicePackFiles\i386\catsrvps.dll + 2008-04-14 02:33:20 625,664 ------w c:\windows\ServicePackFiles\i386\catsrvut.dll + 2008-04-13 18:46:23 17,024 ------w c:\windows\ServicePackFiles\i386\ccdecode.sys + 2008-04-13 19:14:21 63,744 ------w c:\windows\ServicePackFiles\i386\cdfs.sys + 2008-04-14 02:33:20 152,064 ------w c:\windows\ServicePackFiles\i386\cdfview.dll + 2008-04-14 02:33:20 66,560 ------w c:\windows\ServicePackFiles\i386\cdm.dll + 2008-04-14 02:33:20 2,091,520 ------w c:\windows\ServicePackFiles\i386\cdosys.dll + 2008-04-13 18:40:46 62,976 ------w c:\windows\ServicePackFiles\i386\cdrom.sys + 2008-04-14 02:33:20 200,192 ------w c:\windows\ServicePackFiles\i386\certcli.dll + 2008-04-14 02:33:20 467,968 ------w c:\windows\ServicePackFiles\i386\certmgr.dll + 2008-04-14 02:33:20 39,424 ------w c:\windows\ServicePackFiles\i386\cfgbkend.dll + 2008-04-14 02:31:03 16,896 ------w c:\windows\ServicePackFiles\i386\cfgmgr32.dll + 2008-04-14 02:33:56 188,480 ------w c:\windows\ServicePackFiles\i386\cfgwiz.exe + 2008-04-14 02:33:20 15,423 ------w c:\windows\ServicePackFiles\i386\ch7xxnt5.dll + 2008-04-13 18:40:58 8,192 ------w c:\windows\ServicePackFiles\i386\changer.sys + 2008-04-14 02:33:20 148,480 ------w c:\windows\ServicePackFiles\i386\cic.dll + 2008-04-14 02:33:20 1,359,360 ------w c:\windows\ServicePackFiles\i386\cimwin32.dll + 2008-04-14 02:33:20 69,120 ------w c:\windows\ServicePackFiles\i386\ciodm.dll + 2008-04-14 02:33:57 5,632 ------w c:\windows\ServicePackFiles\i386\cisvc.exe + 2008-04-13 19:16:22 49,536 ------w c:\windows\ServicePackFiles\i386\classpnp.sys + 2008-04-14 02:33:21 110,592 ------w c:\windows\ServicePackFiles\i386\clbcatex.dll + 2008-04-14 02:33:21 498,688 ------w c:\windows\ServicePackFiles\i386\clbcatq.dll + 2008-04-14 02:33:57 65,536 ------w c:\windows\ServicePackFiles\i386\cleanmgr.exe + 2008-04-14 02:33:21 77,824 ------w c:\windows\ServicePackFiles\i386\cliconfg.dll + 2008-04-14 02:33:57 20,480 ------w c:\windows\ServicePackFiles\i386\cliconfg.exe + 2008-04-14 02:33:57 104,448 ------w c:\windows\ServicePackFiles\i386\clipbrd.exe + 2008-04-14 02:33:57 33,280 ------w c:\windows\ServicePackFiles\i386\clipsrv.exe + 2008-04-14 02:33:21 58,368 ------w c:\windows\ServicePackFiles\i386\clusapi.dll + 2008-04-13 18:36:37 13,952 ------w c:\windows\ServicePackFiles\i386\cmbatt.sys + 2008-04-14 02:33:21 15,872 ------w c:\windows\ServicePackFiles\i386\cmcfg32.dll + 2008-04-14 02:33:57 401,408 ------w c:\windows\ServicePackFiles\i386\cmd.exe + 2008-04-14 02:33:21 353,280 ------w c:\windows\ServicePackFiles\i386\cmdial32.dll + 2008-04-14 02:33:57 25,600 ------w c:\windows\ServicePackFiles\i386\cmdl32.exe + 2008-04-14 02:33:57 39,936 ------w c:\windows\ServicePackFiles\i386\cmmon32.exe + 2008-04-14 02:33:21 191,488 ------w c:\windows\ServicePackFiles\i386\cmprops.dll + 2008-04-14 02:33:21 13,312 ------w c:\windows\ServicePackFiles\i386\cmsetacl.dll + 2008-04-14 02:33:57 65,536 ------w c:\windows\ServicePackFiles\i386\cmstp.exe + 2008-04-14 02:33:21 40,960 ------w c:\windows\ServicePackFiles\i386\cmutil.dll + 2008-04-14 02:33:21 50,688 ------w c:\windows\ServicePackFiles\i386\cnbjmon.dll + 2008-04-14 02:33:21 83,968 ------w c:\windows\ServicePackFiles\i386\cnbjmon2.dll + 2008-04-13 16:44:16 17,920 ------w c:\windows\ServicePackFiles\i386\cobramsg.dll + 2008-04-14 02:33:21 60,416 ------w c:\windows\ServicePackFiles\i386\colbact.dll + 2008-04-14 02:33:21 28,160 ------w c:\windows\ServicePackFiles\i386\comaddin.dll + 2008-04-14 02:33:21 195,072 ------w c:\windows\ServicePackFiles\i386\comadmin.dll + 2008-04-14 02:33:21 617,472 ------w c:\windows\ServicePackFiles\i386\comctl32.dll + 2008-04-14 02:33:21 281,600 ------w c:\windows\ServicePackFiles\i386\comdlg32.dll + 2008-04-14 02:33:21 253,440 ------w c:\windows\ServicePackFiles\i386\compatui.dll + 2008-04-13 18:36:37 10,240 ------w c:\windows\ServicePackFiles\i386\compbatt.sys + 2008-04-14 02:33:21 230,912 ------w c:\windows\ServicePackFiles\i386\compstui.dll + 2008-04-14 02:33:21 97,792 ------w c:\windows\ServicePackFiles\i386\comrepl.dll + 2008-04-14 02:33:57 9,728 ------w c:\windows\ServicePackFiles\i386\comrepl.exe + 2008-04-14 02:33:57 6,144 ------w c:\windows\ServicePackFiles\i386\comrereg.exe + 2008-04-14 02:33:21 851,968 ------w c:\windows\ServicePackFiles\i386\comres.dll + 2008-04-14 02:33:21 274,944 ------w c:\windows\ServicePackFiles\i386\comsetup.dll + 2008-04-14 02:33:21 167,424 ------w c:\windows\ServicePackFiles\i386\comsnap.dll + 2008-04-14 02:33:21 1,267,200 ------w c:\windows\ServicePackFiles\i386\comsvcs.dll + 2008-04-14 02:33:21 539,648 ------w c:\windows\ServicePackFiles\i386\comuid.dll + 2008-04-14 02:33:58 1,044,480 ------w c:\windows\ServicePackFiles\i386\conf.exe + 2008-04-14 02:33:21 45,056 ------w c:\windows\ServicePackFiles\i386\confmrsl.dll + 2008-04-14 02:33:21 358,400 ------w c:\windows\ServicePackFiles\i386\confmsp.dll + 2008-04-14 02:33:59 27,648 ------w c:\windows\ServicePackFiles\i386\conime.exe + 2008-04-14 02:33:21 35,328 ------w c:\windows\ServicePackFiles\i386\corpol.dll + 2008-04-14 02:33:21 12,800 ------w c:\windows\ServicePackFiles\i386\credssp.dll + 2008-04-14 02:33:21 165,888 ------w c:\windows\ServicePackFiles\i386\credui.dll + 2008-04-14 02:02:47 40,960 ------w c:\windows\ServicePackFiles\i386\crusoe.sys + 2008-04-14 02:33:21 606,208 ------w c:\windows\ServicePackFiles\i386\crypt32.dll + 2008-04-14 02:33:21 75,776 ------w c:\windows\ServicePackFiles\i386\cryptdlg.dll + 2008-04-14 02:33:21 33,280 ------w c:\windows\ServicePackFiles\i386\cryptdll.dll + 2008-04-14 02:33:21 54,784 ------w c:\windows\ServicePackFiles\i386\cryptext.dll + 2008-04-14 02:33:21 64,512 ------w c:\windows\ServicePackFiles\i386\cryptnet.dll + 2008-04-14 02:33:21 62,464 ------w c:\windows\ServicePackFiles\i386\cryptsvc.dll + 2008-04-14 02:33:21 530,432 ------w c:\windows\ServicePackFiles\i386\cryptui.dll + 2008-04-14 02:33:21 102,912 ------w c:\windows\ServicePackFiles\i386\cscdll.dll + 2008-04-14 02:33:59 139,264 ------w c:\windows\ServicePackFiles\i386\cscript.exe + 2008-04-14 02:33:21 337,920 ------w c:\windows\ServicePackFiles\i386\cscui.dll + 2008-04-14 02:33:22 32,256 ------w c:\windows\ServicePackFiles\i386\csrsrv.dll + 2008-04-14 02:33:59 6,144 ------w c:\windows\ServicePackFiles\i386\csrss.exe + 2008-04-14 02:33:59 15,360 ------w c:\windows\ServicePackFiles\i386\ctfmon.exe + 2008-04-14 02:33:22 252,416 ------w c:\windows\ServicePackFiles\i386\ctmasetp.dll + 2008-04-14 02:33:22 33,792 ------w c:\windows\ServicePackFiles\i386\custsat.dll + 2004-08-03 21:32:26 48,640 ------w c:\windows\ServicePackFiles\i386\cwrwdm.sys + 2008-04-14 02:33:22 1,179,648 ------w c:\windows\ServicePackFiles\i386\d3d8.dll + 2008-04-14 02:33:22 8,192 ------w c:\windows\ServicePackFiles\i386\d3d8thk.dll + 2008-04-14 02:33:22 1,689,088 ------w c:\windows\ServicePackFiles\i386\d3d9.dll + 2008-04-14 02:33:22 824,320 ------w c:\windows\ServicePackFiles\i386\d3dim700.dll + 2008-04-14 02:33:22 1,056,768 ------w c:\windows\ServicePackFiles\i386\danim.dll + 2008-01-19 11:04:48 554,008 ------w c:\windows\ServicePackFiles\i386\dao360.dll + 2008-04-14 02:33:22 55,296 ------w c:\windows\ServicePackFiles\i386\dataclen.dll + 2008-04-14 02:33:22 165,376 ------w c:\windows\ServicePackFiles\i386\datime.dll + 2008-04-14 02:33:22 25,600 ------w c:\windows\ServicePackFiles\i386\davclnt.dll + 2008-04-14 02:33:22 640,000 ------w c:\windows\ServicePackFiles\i386\dbghelp.dll + 2008-04-14 02:33:22 24,576 ------w c:\windows\ServicePackFiles\i386\dbmsrpcn.dll + 2008-04-14 02:33:22 110,592 ------w c:\windows\ServicePackFiles\i386\dbnetlib.dll + 2008-04-14 02:33:22 28,672 ------w c:\windows\ServicePackFiles\i386\dbnmpntw.dll + 2008-04-14 02:50:20 1,804 ------w c:\windows\ServicePackFiles\i386\dcache.bin + 2008-04-14 02:33:22 40,960 ------w c:\windows\ServicePackFiles\i386\dcap32.dll + 2008-04-14 02:33:22 8,704 ------w c:\windows\ServicePackFiles\i386\dciman32.dll + 2008-04-14 02:33:59 6,144 ------w c:\windows\ServicePackFiles\i386\dcomcnfg.exe + 2008-04-14 02:33:59 31,744 ------w c:\windows\ServicePackFiles\i386\ddeshare.exe + 2008-04-14 02:33:22 279,552 ------w c:\windows\ServicePackFiles\i386\ddraw.dll + 2008-04-14 02:33:22 27,136 ------w c:\windows\ServicePackFiles\i386\ddrawex.dll + 2008-04-14 02:33:59 25,088 ------w c:\windows\ServicePackFiles\i386\defrag.exe + 2008-04-14 02:33:22 59,904 ------w c:\windows\ServicePackFiles\i386\devenum.dll + 2008-04-14 02:33:22 290,816 ------w c:\windows\ServicePackFiles\i386\devmgr.dll + 2008-04-14 02:33:59 82,944 ------w c:\windows\ServicePackFiles\i386\dfrgfat.exe + 2008-04-14 02:33:59 105,472 ------w c:\windows\ServicePackFiles\i386\dfrgntfs.exe + 2008-04-14 02:33:22 39,936 ------w c:\windows\ServicePackFiles\i386\dfrgsnap.dll + 2008-04-14 02:33:22 124,416 ------w c:\windows\ServicePackFiles\i386\dfrgui.dll + 2008-04-14 02:33:22 28,672 ------w c:\windows\ServicePackFiles\i386\dfsshlex.dll + 2008-04-14 02:33:22 115,200 ------w c:\windows\ServicePackFiles\i386\dgnet.dll + 2008-04-14 02:33:22 127,488 ------w c:\windows\ServicePackFiles\i386\dhcpcsvc.dll + 2008-04-14 02:33:22 411,136 ------w c:\windows\ServicePackFiles\i386\dhcpmon.dll + 2008-04-14 02:33:22 49,152 ------w c:\windows\ServicePackFiles\i386\dhcpqec.dll + 2008-04-14 02:33:59 548,352 ------w c:\windows\ServicePackFiles\i386\dialer.exe + 2008-04-14 02:34:00 87,040 ------w c:\windows\ServicePackFiles\i386\diantz.exe + 2007-03-28 13:08:57 887,784 ------w c:\windows\ServicePackFiles\i386\digcore.exe + 2008-04-14 02:33:22 68,608 ------w c:\windows\ServicePackFiles\i386\digest.dll + 2008-04-14 02:33:22 19,456 ------w c:\windows\ServicePackFiles\i386\dimsntfy.dll + 2008-04-14 02:33:22 39,936 ------w c:\windows\ServicePackFiles\i386\dimsroam.dll + 2008-04-14 02:33:22 165,376 ------w c:\windows\ServicePackFiles\i386\dinput.dll + 2008-04-14 02:33:22 187,904 ------w c:\windows\ServicePackFiles\i386\dinput8.dll + 2008-04-14 02:33:22 86,528 ------w c:\windows\ServicePackFiles\i386\directdb.dll + 2008-04-13 18:40:47 36,352 ------w c:\windows\ServicePackFiles\i386\disk.sys + 2008-04-14 02:33:22 1,504,768 ------w c:\windows\ServicePackFiles\i386\diskcopy.dll + 2008-04-13 18:40:44 14,208 ------w c:\windows\ServicePackFiles\i386\diskdump.sys + 2008-04-14 02:34:00 167,936 ------w c:\windows\ServicePackFiles\i386\diskpart.exe + 2008-04-14 02:33:22 32,768 ------w c:\windows\ServicePackFiles\i386\dispex.dll + 2008-04-14 02:34:00 5,120 ------w c:\windows\ServicePackFiles\i386\dllhost.exe + 2008-04-13 18:40:51 8,320 ------w c:\windows\ServicePackFiles\i386\dlttape.sys + 2008-04-14 02:34:00 225,280 ------w c:\windows\ServicePackFiles\i386\dmadmin.exe + 2008-04-14 02:33:22 28,672 ------w c:\windows\ServicePackFiles\i386\dmband.dll + 2008-04-14 02:05:07 800,256 ------w c:\windows\ServicePackFiles\i386\dmboot.sys + 2008-04-14 02:33:22 61,440 ------w c:\windows\ServicePackFiles\i386\dmcompos.dll + 2008-04-14 02:33:22 285,184 ------w c:\windows\ServicePackFiles\i386\dmdlgs.dll + 2008-04-14 02:33:22 200,704 ------w c:\windows\ServicePackFiles\i386\dmdskmgr.dll + 2008-04-14 02:33:22 181,248 ------w c:\windows\ServicePackFiles\i386\dmime.dll + 2008-04-14 02:05:12 154,496 ------w c:\windows\ServicePackFiles\i386\dmio.sys + 2008-04-14 02:33:22 35,840 ------w c:\windows\ServicePackFiles\i386\dmloader.dll + 2008-04-14 02:34:00 15,872 ------w c:\windows\ServicePackFiles\i386\dmremote.exe + 2008-04-14 02:33:22 82,432 ------w c:\windows\ServicePackFiles\i386\dmscript.dll + 2008-04-14 02:33:22 24,576 ------w c:\windows\ServicePackFiles\i386\dmserver.dll + 2008-04-14 02:33:22 105,984 ------w c:\windows\ServicePackFiles\i386\dmstyle.dll + 2008-04-14 02:33:22 103,424 ------w c:\windows\ServicePackFiles\i386\dmsynth.dll + 2008-04-14 02:33:22 104,448 ------w c:\windows\ServicePackFiles\i386\dmusic.dll + 2008-04-13 18:45:01 52,864 ------w c:\windows\ServicePackFiles\i386\dmusic.sys + 2008-04-14 02:33:22 58,880 ------w c:\windows\ServicePackFiles\i386\dmutil.dll + 2008-04-14 02:33:22 147,968 ------w c:\windows\ServicePackFiles\i386\dnsapi.dll + 2008-04-14 02:33:22 45,568 ------w c:\windows\ServicePackFiles\i386\dnsrslvr.dll + 2008-04-14 02:33:22 48,640 ------w c:\windows\ServicePackFiles\i386\docprop2.dll + 2004-08-05 12:00:00 54,080 ------w c:\windows\ServicePackFiles\i386\dosx.exe + 2008-04-14 02:33:22 26,112 ------w c:\windows\ServicePackFiles\i386\dot3api.dll + 2008-04-14 02:33:22 60,928 ------w c:\windows\ServicePackFiles\i386\dot3cfg.dll + 2008-04-14 02:33:22 39,936 ------w c:\windows\ServicePackFiles\i386\dot3clnt.dll + 2008-04-14 02:33:22 9,216 ------w c:\windows\ServicePackFiles\i386\dot3dlg.dll + 2008-04-14 02:33:22 56,832 ------w c:\windows\ServicePackFiles\i386\dot3msm.dll + 2008-04-14 02:33:22 133,120 ------w c:\windows\ServicePackFiles\i386\dot3svc.dll + 2008-04-14 02:33:22 651,264 ------w c:\windows\ServicePackFiles\i386\dot3ui.dll + 2008-04-13 18:39:46 206,976 ------w c:\windows\ServicePackFiles\i386\dot4.sys + 2008-04-14 01:54:17 103,936 ------w c:\windows\ServicePackFiles\i386\dpcdll.dll + 2008-04-14 02:34:01 29,696 ------w c:\windows\ServicePackFiles\i386\dplaysvr.exe + 2008-04-14 02:33:22 229,888 ------w c:\windows\ServicePackFiles\i386\dplayx.dll + 2008-04-14 02:33:23 24,064 ------w c:\windows\ServicePackFiles\i386\dpmodemx.dll + 2008-04-14 02:31:14 3,072 ------w c:\windows\ServicePackFiles\i386\dpnaddr.dll + 2008-04-14 02:33:23 375,296 ------w c:\windows\ServicePackFiles\i386\dpnet.dll + 2008-04-14 02:33:23 35,328 ------w c:\windows\ServicePackFiles\i386\dpnhpast.dll + 2008-04-14 02:33:23 60,928 ------w c:\windows\ServicePackFiles\i386\dpnhupnp.dll + 2008-04-14 02:31:14 3,072 ------w c:\windows\ServicePackFiles\i386\dpnlobby.dll + 2008-04-14 02:34:01 18,432 ------w c:\windows\ServicePackFiles\i386\dpnsvr.exe + 2008-04-14 02:33:23 21,504 ------w c:\windows\ServicePackFiles\i386\dpvacm.dll + 2008-04-14 02:33:23 213,504 ------w c:\windows\ServicePackFiles\i386\dpvoice.dll + 2008-04-14 02:34:01 83,456 ------w c:\windows\ServicePackFiles\i386\dpvsetup.exe + 2008-04-14 02:33:23 116,736 ------w c:\windows\ServicePackFiles\i386\dpvvox.dll + 2008-04-14 02:33:23 57,344 ------w c:\windows\ServicePackFiles\i386\dpwsockx.dll + 2008-04-13 18:45:14 60,160 ------w c:\windows\ServicePackFiles\i386\drmk.sys + 2008-04-13 18:45:13 2,944 ------w c:\windows\ServicePackFiles\i386\drmkaud.sys + 2008-04-14 02:33:23 14,336 ------w c:\windows\ServicePackFiles\i386\drprov.dll + 2004-08-05 12:00:00 4,656 ------w c:\windows\ServicePackFiles\i386\ds16gt.dll + 2008-04-14 02:33:23 16,384 ------w c:\windows\ServicePackFiles\i386\ds32gt.dll + 2008-04-14 02:33:23 181,248 ------w c:\windows\ServicePackFiles\i386\dsdmo.dll + 2008-04-14 02:33:23 72,192 ------w c:\windows\ServicePackFiles\i386\dsdmoprp.dll + 2008-04-14 02:33:23 93,696 ------w c:\windows\ServicePackFiles\i386\dskquota.dll + 2008-04-14 02:33:23 161,280 ------w c:\windows\ServicePackFiles\i386\dskquoui.dll + 2008-04-14 02:33:23 367,616 ------w c:\windows\ServicePackFiles\i386\dsound.dll + 2008-04-14 02:33:23 1,293,824 ------w c:\windows\Ser

cynthia92 · Answer

Que faire maintenant stp?

Utilisateur anonyme · Answer

Hi,

Il est pas complet ton rapport?

Ensuite comment va ton pc?

Alut.

cynthia92 · Answer

" APPPARAMENT " il est normal , mais je pense que c'est parce que j'ai désactivé mon antivirus.

Quand j'ai fait une analyse avec TrendMicro il m'a détecté 1 trojan.... Mais comme j'avais un problème Java  

"environnement" que j'ai toujours il n'a rien pu supprimer...

Que faire stp?

cynthia92 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:21:10, on 25/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\acs.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDETOOL\IDETOOL.EXE
C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Orange\AntivirusFirewall\Common\FSLAUNCH.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: NETGEAR WG311T Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311T\wlancfg5.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Service de configuration Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slmdmsr.exe

Utilisateur anonyme · Answer

Hi,

Pour moi c'est bon tu n'as plus rien d'infectieux.

Alut.

cynthia92 · Answer

D'accord merci, je réinstalle Java ; refais un scan et réctive mon antivirus et je te recontacte.

En tout cas merci pour ta patience et de m'avoir aidé durant tout ce temps!

Virus!!!!

121 réponses

Discussions similaires

Newsletters