L'ordinateur redémare en boucle !Résolu/Fermé

Question

Salut !

En ayant toujours eu de bon conseils en écrivant ici, je me doit de vous poser celle ci.

hier soir, j'ai voulu installer le SP3 de windows update. au lancement, un message d'erreur me dit que je ne peut l'installer... bref, j'ai fait des mises a jours de mes programes par la suite et ce matin il y avait mon fond d'écran qui a changer pour un messages comme quoi il y avait des spyware détecter. j'ai éteindu mon ordinateur et depuis ce temps, il ne démarre pas en mode normal, juste en sans échec si non il se ferme et redémarre en boucle sans arrêt.


Alors, je peut fournir un raport HJT question d'y voir un peu plus clair.
Bien sur, c'est un HJT en mode sans échec.

Merci de vos précieux conseils.
GaB

Destrio5 · Answer

Salut,

C'est un PC de marque HP ?

Gabster · Answer

Logfile of HijackThis v1.99.1
Scan saved at 22:40:04, on 2008-09-14
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 210.74.254.35:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - Default URLSearchHook is missing
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [lphcagdj0e791] C:\WINDOWS\system32\lphcagdj0e791.exe
O4 - HKLM\..\Run: [inrhcegdj0e791] C:\Documents and Settings\Gabriel\Local Settings\Temp\.tt84.tmp.exe /CR=5F8C0875B49BA02BB503A8EC828A17BC776E5DF2296E2A34FF680C0CE11E89C8A75CD31F40E3D56E96AA6691EE4273EEF35FE4AEACF70CB5C3F6B893E7397C0A5889EC4A3BB6442E8AF74065B3FAB21B44
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [NeroHomeFirstStart] C:\Program Files\Fichiers communs\Ahead\Lib\NMFirstStart.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin
pjpi160_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin
pjpi160_03.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/2.0.1.14/cfweb_activex.camfrogweb.com-advanced-2.0.1.14_instmodule.exe
O16 - DPF: {2396F475-3C4C-4028-AD17-FAF37352EE82} (Activex Control) - http://www.poolgameonline.com/loadgame_et.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {33331111-1111-1111-1111-611111193423} - 
O16 - DPF: {33331111-1111-1111-1111-611111193429} - 
O16 - DPF: {33331111-1111-1111-1111-615111193427} - 
O16 - DPF: {33331111-1131-1111-1111-611111193428} - 
O16 - DPF: {43331111-1111-1111-1111-611111195622} - 
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gabster2000.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/26aab6d08b25bb502504/netzip/RdxIE601.cab
O16 - DPF: {597F9140-0DC6-4657-A162-76EC0E7AEE81} (ActiveBroadcast Control) - http://www.meetstream.com/activex/28010/activebroadcast.cab
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://gabster2000.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {BFD90062-6B5E-4F8F-87B1-5F022C14E32F} (ActiveReceiver Control) - http://www.meetstream.com/activex/28014/activereceiver.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Gabster · Answer

non, c'est un ordi monter avec différente pieces. tour AOPEN Amd athlon.

Destrio5 · Answer

---> Fais un scan rapide avec MBAM, supprime tout ce qu'il trouve et poste le rapport :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

Gabster · Answer

c'est en route et dewja 6 de trouver...

;-/

Gabster · Answer

Voici le raport  !

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1134
Windows 5.1.2600 Service Pack 2

2008-09-14 23:29:17
mbam-log-2008-09-14 (23-29-17).txt

Type de recherche: Examen rapide
Eléments examinés: 46136
Temps écoulé: 3 minute(s), 43 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 12

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{33331111-1111-1111-1111-611111193423} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{33331111-1111-1111-1111-611111193429} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{33331111-1111-1111-1111-615111193427} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{33331111-1131-1111-1111-611111193428} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{43331111-1111-1111-1111-611111195622} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{64311111-1111-1121-1111-111191113457} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	dssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE	dss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\systemcheck2 (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcagdj0e791 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\inrhcegdj0e791 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\VideoEgg\user.dat (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	dssadw.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssl.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssserf.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssmain.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssinit.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dsslog.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	dssservers.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers	dssserv.sys (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\blphcagdj0e791.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lphcagdj0e791.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\phcagdj0e791.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.



Merci !

Destrio5 · Answer

T'es infecté par un rootkit.

* Télécharge SDFix (par Andy Manchesta) et sauvegarde-le sur ton bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

* Double-clique sur SDFix.exe et choisis Install pour l'extraire dans son dossier sur le bureau.
* Redémarre le PC en mode sans échec :
https://www.malekal.com/demarrer-windows-mode-sans-echec/
* Choisis ton compte.

Déroule la liste des instructions ci-dessous :
* Ouvre le dossier SDFix qui vient d'être créé sur le bureau et double-clique sur RunThis.bat pour lancer le script.
* Appuie sur Y pour commencer le nettoyage.
* Quand il te le demandera, appuie sur une touche pour redémarrer le PC.
* Ton système sera plus long à redémarrer car l'outil va continuer à s'exécuter et supprimer des fichiers.
* Après le chargement du bureau, l'outil aura terminé et affichera Finished.
* Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton bureau.
* Le rapport SDFix s'ouvrira et il sera enregistré dans le dossier SDFix sous le nom Report.txt.
* Enfin, copie/colle le rapport du fichier Report.txt.

Gabster · Answer

Bon quelques problemes... 

au redémarrage de l'ordi, il n'y a pas émis de rapport et ne m'as pas indiqué qu'il avais terminer... alors j'ai répété l'opération et il cherche toujours...

alors...

Merci !

Destrio5 · Answer

Le mode normal ne se lance toujours pas ?

Gabster · Answer

il avais bien détecter le rootkit au premier scan et l'or du redémarrages, il n'a rien affiché.

Gabster · Answer

oui! il redémmare en mode normal... 

mais il n'a pas afficher de raport!


:-/

Destrio5 · Answer

Ok

Destrio5 · Answer

* Le rapport SDFix s'ouvrira et il sera enregistré dans le dossier SDFix sous le nom Report.txt.

Gabster · Answer

je suis de retour en mode sans échec... et le scan est beaucoup plus long que le premier...

c'est qu'au premier scan, il avais détecter quelquechose dans la mémoire !

Pardonnez moi pour mon novisme... !

Gabster · Answer

[b]SDFix: Version 1.225 [/b]
Run by Gabriel on 2008-09-15 at 00:03

Microsoft Windows XP [version 5.1.2600]
Running From: C:\Documents and Settings\Gabriel\Bureau\SDFix

[b]Checking Services [/b]:

Rootkit Found :
C:\WINDOWS\system32\drivers	dssserv.sys - Rootkit.Win32.Agent.cku

[b]Name [/b]: 
tdssserv

[b]Path [/b]:
\systemroot\system32\drivers\TDSSserv.sys 

tdssserv - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\WINDOWS\SYSTEM32\PAYTIME.EXE - Deleted
C:\WINDOWS\SOFT.EXE - Deleted
C:\Documents and Settings\Gabriel\Local Settings\Temp\.tt84.tmp.exe - Deleted
C:\Documents and Settings\Gabriel\Local Settings\Temp\aax1C8.tmp.exe - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt101.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt103.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt105.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt107.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt109.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt10B.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt10D.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt10F.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt111.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt113.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt115.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt117.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt119.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt11B.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt11D.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt11F.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt121.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt123.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt125.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt127.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt129.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt12B.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt12D.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt12F.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt131.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt133.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt135.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt137.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt139.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt13B.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt13D.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt13F.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt141.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt143.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt145.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt147.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt149.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt14B.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt14D.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt14F.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt151.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt153.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt155.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt157.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt159.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt15B.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt15D.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt15F.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt161.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt163.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt165.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt167.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt169.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt16B.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt16D.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt16F.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt171.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt173.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt175.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt177.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt179.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt17B.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt17D.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt17F.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt181.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt183.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt185.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt187.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt189.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt18B.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt18D.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt18F.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt191.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt193.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt195.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt197.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt199.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt19B.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt19D.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt19F.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt1A1.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt1A3.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt1A5.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt1A7.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt1A9.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt1AB.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt1AD.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt1AF.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt1F9.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt1FB.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt1FD.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt1FF.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt202.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt204.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt81.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt84.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt8A.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt8C.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt8E.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt91.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt93.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt95.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt97.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt99.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt9B.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt9D.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt9F.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttA1.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttA3.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttA5.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttA7.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttA9.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttAB.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttAD.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttAF.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttB1.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttB3.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttB5.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttB7.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttB9.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttBB.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttBD.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttBF.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttC1.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttC3.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttC5.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttC7.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttC9.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttCB.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttCD.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttCF.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttD1.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttD3.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttD5.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttD7.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttD9.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttDB.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttDD.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttDF.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttE1.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttE3.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttE5.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttE7.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttE9.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttEB.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttED.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttEF.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttF1.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttF3.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttF5.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttF7.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttF9.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttFB.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttFD.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.ttFF.tmp - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt84.tmp.exe - Deleted
C:\DOCUME~1\Gabriel\LOCALS~1\Temp\.tt81.tmp.vbs - Deleted
C:\WINDOWS\system32\a.exe - Deleted
C:\WINDOWS\system32\TFTP2136 - Deleted
C:\WINDOWS\system32\TFTP2616 - Deleted
C:\WINDOWS\system32\TFTP3184 - Deleted
C:\WINDOWS\system32\TFTP3672 - Deleted
C:\WINDOWS\system32\i - Deleted
C:\WINDOWS\system32\drivers	dssserv.sys  - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-15 00:12:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Azureus\Azureus.exe"="C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus"
"C:\mIRC\mirc.exe"="C:\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"="C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe:*:Disabled:Nero ShowTime"
"D:\wamp\bin\apache\apache2.2.6\bin\httpd.exe"="D:\wamp\bin\apache\apache2.2.6\bin\httpd.exe:*:Enabled:Apache HTTP Server"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\WINDOWS\system32\a.exe"="C:\WINDOWS\system32\a.exe:*:Disabled:a"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\DOCUME~1\Gabriel\Bureau\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Fri 16 May 2008           207 ..SHR --- "C:\WINDOWS
sfsrx.dll"
Wed  2 Nov 2005     2,472,960 A..H. --- "C:\WINDOWS\x74ca5e40.tmp"
Thu 16 Dec 2004         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 28 May 2003        65,088 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\3COM 3c556 Packet\3C556.COM"
Wed 28 May 2003        12,732 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\3COM 3c509 Packet\3C5X9PD.COM"
Wed 28 May 2003        26,424 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\3COM 3c59x Packet\3C59XPD.COM"
Wed 28 May 2003        28,062 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1207F Packet\EN5251PD.COM"
Wed 28 May 2003        10,710 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1207C Packet\PCIPD.COM"
Wed 28 May 2003        10,083 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1207D Packet\ACCPKT.COM"
Wed 28 May 2003        10,257 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1207TX Packet\PCIPD.COM"
Wed 28 May 2003        29,499 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1203 Packet\PCIPD.COM"
Wed 28 May 2003        12,660 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1204 Packet\VLNWPD.COM"
Wed 28 May 2003        11,031 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1207 Packet\PCIPD.COM"
Wed 28 May 2003        17,952 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1200 Packet\EC32PD.COM"
Wed 28 May 2003         9,424 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1208 Packet\1208PD.COM"
Wed 28 May 2003         7,825 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1650 Packet\NWPD.COM"
Wed 28 May 2003        13,673 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1640 Packet\NWPD.COM"
Wed 28 May 2003        14,438 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1658 Packet\NWPD.COM"
Wed 28 May 2003         7,825 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN166X Packet\NWPD.COM"
Wed 28 May 2003         7,825 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1651 Packet\NWPD.COM"
Wed 28 May 2003         7,825 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1652 Packet\NWPD.COM"
Wed 28 May 2003         7,243 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1653 Packet\NE2PD.COM"
Wed 28 May 2003        24,767 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN2216 Packet\PCMPD.COM"
Wed 28 May 2003         7,463 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1625 Packet\NEPD.COM"
Wed 28 May 2003         7,825 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1656 Packet\NWPD.COM"
Wed 28 May 2003        10,286 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN2228 Packet\PCMPD.COM"
Wed 28 May 2003        25,460 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN2218 Packet\PCMPD.COM"
Wed 28 May 2003        28,866 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN2320 Packet\EN5251PD.COM"
Wed 28 May 2003        14,438 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\ACCTON EN1657 Packet\NWPD.COM"
Wed 28 May 2003         8,544 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\CATC USB Ethernet\Elndis.sys"
Wed 28 May 2003        33,149 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\CATC USB Ethernet\Usbd.sys"
Wed 28 May 2003        51,150 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPI1394.SYS"
Wed 28 May 2003        35,340 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPI2DOS.SYS"
Wed 28 May 2003        14,378 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPI4DOS.SYS"
Wed 28 May 2003        37,984 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPI8DOS.SYS"
Wed 28 May 2003        44,828 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPI8U2.SYS"
Wed 28 May 2003        29,628 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPICD.SYS"
Wed 28 May 2003        52,106 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPIEHCI.SYS"
Wed 28 May 2003        49,250 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPIOHCI.SYS"
Wed 28 May 2003        50,600 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\ASPIUHCI.SYS"
Wed 28 May 2003       161,792 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\BOOTSRV.SYS"
Wed 28 May 2003       174,080 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\bootsrv16.sys"
Wed 28 May 2003        21,971 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\BTCDROM.SYS"
Wed 28 May 2003        30,955 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\BTDOSM.SYS"
Wed 28 May 2003       202,517 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\CMDS.EXE"
Wed 28 May 2003       374,038 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\CMDS16.EXE"
Wed 28 May 2003        22,158 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\COUNTRY.SYS"
Wed 28 May 2003         1,608 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\DEVICE.COM"
Wed 28 May 2003        15,345 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\DISPLAY.SYS"
Wed 28 May 2003         7,840 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\DLSHELP.SYS"
Wed 28 May 2003        56,821 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\E.EXE"
Wed 28 May 2003        64,425 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\FLASHPT.SYS"
Wed 28 May 2003        32,396 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\GUEST.EXE"
Wed 28 May 2003        14,160 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\HIMEM.SYS"
Wed 28 May 2003        10,898 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\KEYB.COM"
Wed 28 May 2003        53,556 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\KEYBOARD.SYS"
Wed 28 May 2003        15,777 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\MODE.COM"
Wed 28 May 2003        37,681 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\MOUSE.COM"
Wed 28 May 2003       354,304 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\msbootsrv16.sys"
Wed 28 May 2003        21,180 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\MSCDEX.EXE"
Wed 28 May 2003       354,263 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\Net.exe"
Wed 28 May 2003         8,513 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\NETBIND.COM"
Wed 28 May 2003        41,302 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\OAKCDROM.SYS"
Wed 28 May 2003       129,240 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\OHCI.EXE"
Wed 28 May 2003        28,439 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\Paralink.com"
Wed 28 May 2003        13,770 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\PROTMAN.EXE"
Wed 28 May 2003       130,980 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\UHCI.EXE"
Wed 28 May 2003        11,854 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\DEC EtherWorks ISA (DE305) Packet\DE305.COM"
Wed 28 May 2003        52,715 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\DEC EtherWORKS DE450 Packet\DE450.COM"
Wed 28 May 2003        62,391 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\DEC EtherWORKS DE500 Packet\DE500.COM"
Wed 28 May 2003        11,491 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\DLink DMF560-TX Packet\Lmpd.com"
Wed 28 May 2003        17,791 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\DLink DT620 Packet\Dt620pd.com"
Wed 28 May 2003        17,043 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\DLink DE400 Packet\De400pd.com"
Wed 28 May 2003        11,786 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\IBM Crystal LAN Packet\Epktisa.com"
Wed 28 May 2003        18,300 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Kingston EtheRx KNE110TX Packet\Ktc110p.com"
Wed 28 May 2003        48,224 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Laneed LD 10-100AL Packet\L100al.com"
Wed 28 May 2003        13,360 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Laneed LD-CDF Packet\Ldcdt.com"
Wed 28 May 2003         9,190 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Laneed LD-PCI2TL Packet\Ldpcil.com"
Wed 28 May 2003        12,567 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Melco LPC2-T\Lpchkat2.com"
Wed 28 May 2003        44,640 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Planex FW-100TX Fast Ethernet Packet\FETPKT.COM"
Wed 28 May 2003        56,896 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Planex FW-100TX Fast Ethernet Packet\Rtspkt.com"
Wed 28 May 2003        44,640 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Planex FNW9x00T - ENW8300T Packet\fetpkt.com"
Wed 28 May 2003         9,692 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\PXE Packet Driver\Undipd.com"
Wed 28 May 2003         9,537 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\SN 2000p Packet\PNPPD.COM"
Wed 28 May 2003        32,484 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\WaveLAN Packet\Wvlan42.com"
Wed 28 May 2003        52,225 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Ethernet 10-100 + Modem\Cbendis.exe"
Wed 28 May 2003        48,491 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom RE10BT\Ce3ndis.exe"
Wed 28 May 2003        50,405 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom RE10 - RE100 Packet\Ce3pd.com"
Wed 28 May 2003        33,860 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom PE3-10Bx\Pe3ndis.exe"
Wed 28 May 2003        50,175 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Re-100Btx + Ce3B-100Btx\Ce3ndis.exe"
Wed 28 May 2003        50,795 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom CBE10-100BTX\Cbendis.exe"
Wed 28 May 2003        48,223 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom CBE10-100BTX Packet\Cbepd.com"
Wed 28 May 2003        48,641 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Ethernet II PS\Xpsndis.exe"
Wed 28 May 2003        49,015 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\Xircom Ethernet II PS Packet\Xpspd.com"
Wed 28 May 2003        53,786 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\pcdos\command.com"
Wed 28 May 2003        44,240 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\pcdos\IBMBIO.COM"
Wed 28 May 2003        42,550 A..H. --- "C:\Documents and Settings\All Users\Application Data\Symantec\Ghost\Template\common\pcdos\IBMDOS.COM"

[b]Finished![/b]

Destrio5 · Answer

Poste un nouveau rapport HijackThis.

Gabster · Answer

Logfile of HijackThis v1.99.1
Scan saved at 00:26:00, on 2008-09-15
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.elgoog.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 210.74.254.35:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunServices: [Up Service] up32.pif
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/2.0.1.14/cfweb_activex.camfrogweb.com-advanced-2.0.1.14_instmodule.exe
O16 - DPF: {2396F475-3C4C-4028-AD17-FAF37352EE82} (Activex Control) - http://www.poolgameonline.com/loadgame_et.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gabster2000.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/26aab6d08b25bb502504/netzip/RdxIE601.cab
O16 - DPF: {597F9140-0DC6-4657-A162-76EC0E7AEE81} (ActiveBroadcast Control) - http://www.meetstream.com/activex/28010/activebroadcast.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://gabster2000.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {BFD90062-6B5E-4F8F-87B1-5F022C14E32F} (ActiveReceiver Control) - http://www.meetstream.com/activex/28014/activereceiver.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe



Merci!

Destrio5 · Answer

Je voulais que tu désinstalles Norton mais tu as Norton Ghost.

Gabster · Answer

À premiere vue, tout me semble normal sur l'ordi...

Poblem Fixed

C'est ca qui arrive quand on fait affaire avec des pros..

MERCI !!! Destrio5

Destrio5 · Answer

---> Mets à jour Java :
https://www.java.com/fr/download/manual.jsp

---> Relance HijackThis et choisis Do a system scan only

---> Coche les cases qui sont devant les lignes suivantes :

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot     

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe     

O4 - HKCU\..\RunServices: [Up Service] up32.pif 

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe     

O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/     

O16 - DPF: {2396F475-3C4C-4028-AD17-FAF37352EE82} (Activex Control) - http://www.poolgameonline.com/loadgame_et.cab 

O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.com/activex/zylomgamesplayer.cab 

O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\ 

---> Clique en bas sur Fix checked. Mets oui si HijackThis te demande quelque chose.

---> Poste un nouveau rapport HijackThis

L'ordinateur redémare en boucle !

20 réponses

Discussions similaires

Newsletters