artaman

Voici le log de diaghelp C:\WINDOWS\System32/drivers\fidbox2.idx -->4/04/2007 15:08:18 C:\WINDOWS\System32/drivers\fidbox2.dat -->4/04/2007 15:08:18 C:\WINDOWS\System32/drivers\fidbox.idx -->4/04/2007 15:08:18 C:\WINDOWS\System32/drivers\fidbox.dat -->4/04/2007 15:08:18 C:\WINDOWS\System32/drivers\ativvpxx.vp -->22/11/2006 5:59:55 C:\WINDOWS\System32/drivers\ati2mtag.sys -->22/11/2006 5:25:08 C:\WINDOWS\System32/drivers\ati2erec.dll -->22/11/2006 4:55:46 C:\WINDOWS\System32\zllictbl.dat -->3/04/2007 10:43:13 C:\WINDOWS\System32\wpa.dbl -->2/04/2007 11:20:21 C:\WINDOWS\System32\bxufhhsa.ini -->29/03/2007 9:56:14 C:\WINDOWS\System32\PerfStringBackup.INI -->26/03/2007 9:26:52 C:\WINDOWS\System32\perfh00C.dat -->26/03/2007 9:26:52 C:\WINDOWS\System32\perfh009.dat -->26/03/2007 9:26:52 C:\WINDOWS\System32\perfc00C.dat -->26/03/2007 9:26:52 C:\WINDOWS\System32\perfc009.dat -->26/03/2007 9:26:52 C:\WINDOWS\System32\FNTCACHE.DAT -->2/03/2007 16:38:58 C:\WINDOWS\System32\jupdate-1.5.0_10-b03.log -->29/01/2007 19:12:31 C:\WINDOWS\System32\wmpscheme.xml -->8/01/2007 13:11:36 C:\WINDOWS\System32\$winnt$.inf -->8/01/2007 13:09:32 C:\WINDOWS\System32\CONFIG.NT -->8/01/2007 13:06:37 C:\WINDOWS\System32\nscompat.tlb -->8/01/2007 13:06:33 C:\WINDOWS\System32\amcompat.tlb -->8/01/2007 13:06:33 C:\WINDOWS\System32\WindowsLogon.manifest -->8/01/2007 13:05:28 C:\WINDOWS\System32\logonui.exe.manifest -->8/01/2007 13:05:28 C:\WINDOWS\System32\wuaucpl.cpl.manifest -->8/01/2007 13:05:21 C:\WINDOWS\System32\sapi.cpl.manifest -->8/01/2007 13:05:21 C:\WINDOWS\System32\nwc.cpl.manifest -->8/01/2007 13:05:21 C:\WINDOWS\System32\ncpa.cpl.manifest -->8/01/2007 13:05:21 C:\WINDOWS\System32\cdplayer.exe.manifest -->8/01/2007 13:05:21 C:\WINDOWS\System32\emptyregdb.dat -->8/01/2007 13:03:33 C:\WINDOWS\System32\h323log.txt -->8/01/2007 13:01:37 C:\WINDOWS\System32\ati2sgag.exe -->22/11/2006 11:52:00 C:\WINDOWS\setupapi.log -->4/04/2007 17:25:32 C:\WINDOWS\wiadebug.log -->4/04/2007 17:25:18 C:\WINDOWS\wiaservc.log -->4/04/2007 17:25:15 C:\WINDOWS.log -->4/04/2007 17:25:10 C:\WINDOWS\bootstat.dat -->4/04/2007 17:25:08 C:\WINDOWS\SchedLgU.Txt -->4/04/2007 15:08:16 C:\WINDOWS\setupact.log -->4/04/2007 12:00:12 C:\WINDOWS\Windows Update.log -->3/04/2007 23:34:38 C:\WINDOWS\QTFont.qfn -->3/04/2007 11:41:05 C:\WINDOWS\IE4 Error Log.txt -->29/03/2007 16:13:48 C:\WINDOWS\QTFont.for -->29/03/2007 11:30:31 C:\WINDOWS\NeroDigital.ini -->24/03/2007 10:11:08 C:\WINDOWS\ntbtlog.txt -->12/03/2007 13:24:21 C:\WINDOWS\ODBC.INI -->28/02/2007 13:29:31 C:\WINDOWS\DirectX.log -->24/02/2007 16:50:25 C:\WINDOWS\CmiRmRedundDir.exe |11/01/2007 16:57:44 C:\WINDOWS\CMIUninstall.exe |11/01/2007 16:57:46 C:\WINDOWS\IsUn040c.exe |11/01/2007 16:51:26 C:\WINDOWS\IsUninst.exe |17/02/2007 15:34:33 C:\WINDOWS\twunk_16.exe |04/10/2001 13:01:41 C:\WINDOWS\twunk_32.exe |04/10/2001 13:01:41 C:\WINDOWS\unin040c.exe |28/03/2007 14:48:58 C:\WINDOWS\uninst.exe |17/02/2007 15:37:20 C:\WINDOWS\UNNeroBackItUp.exe |12/09/2005 16:13:46 C:\WINDOWS\UNNeroMediaHome.exe |12/09/2005 16:13:46 C:\WINDOWS\UNNeroShowTime.exe |12/09/2005 16:13:46 C:\WINDOWS\UNNeroVision.exe |12/09/2005 16:13:46 C:\WINDOWS\UNRecode.exe |12/09/2005 16:13:46 C:\WINDOWS\ADE.DLL |17/02/2007 15:34:47 C:\WINDOWS\CMIRmDriver.dll |11/01/2007 16:57:44 C:\WINDOWS\SlantAdj.dll |17/02/2007 15:34:47 C:\WINDOWS\twain.dll |04/10/2001 13:01:40 C:\WINDOWS\twain_32.dll |04/10/2001 13:01:41 C:\WINDOWS\system32\append.exe |04/10/2001 12:32:20 C:\WINDOWS\system32\ati2evxx.exe |22/11/2006 05:18:37 C:\WINDOWS\system32\Ati2mdxx.exe |22/11/2006 05:19:55 C:\WINDOWS\system32\ati2sgag.exe |08/01/2007 14:47:50 C:\WINDOWS\system32\cmirmdrv.exe |11/01/2007 16:57:51 C:\WINDOWS\system32\debug.exe |04/10/2001 12:34:02 C:\WINDOWS\system32\delaySpawn.exe |08/01/2007 14:44:02 C:\WINDOWS\system32\directx.exe |19/07/2005 06:52:02 C:\WINDOWS\system32\dosx.exe |04/10/2001 12:34:19 C:\WINDOWS\system32\dslagent.exe |08/01/2007 14:44:02 C:\WINDOWS\system32\dvdplay.exe |23/08/2001 19:47:34 C:\WINDOWS\system32\edlin.exe |04/10/2001 12:38:43 C:\WINDOWS\system32\exe2bin.exe |04/10/2001 12:38:50 C:\WINDOWS\system32\fastopen.exe |04/10/2001 12:38:59 C:\WINDOWS\system32\FileOps.exe |08/01/2007 14:57:11 C:\WINDOWS\system32\gsicon.exe |08/01/2007 14:44:03 C:\WINDOWS\system32\java.exe |29/01/2007 19:12:33 C:\WINDOWS\system32\javaw.exe |29/01/2007 19:12:33 C:\WINDOWS\system32\javaws.exe |29/01/2007 19:12:33 C:\WINDOWS\system32\mem.exe |04/10/2001 12:41:27 C:\WINDOWS\system32\mscdexnt.exe |04/10/2001 12:42:17 C:\WINDOWS\system32\nlsfunc.exe |04/10/2001 12:44:48 C:\WINDOWS\system32\nw16.exe |04/10/2001 12:46:43 C:\WINDOWS\system32\redir.exe |04/10/2001 12:53:58 C:\WINDOWS\system32\SETBROWS.EXE |17/02/2007 15:37:27 C:\WINDOWS\system32\setver.exe |04/10/2001 12:55:57 C:\WINDOWS\system32\share.exe |04/10/2001 12:56:00 C:\WINDOWS\system32\usrmlnka.exe |23/08/2001 19:47:48 C:\WINDOWS\system32\usrprbda.exe |23/08/2001 19:47:48 C:\WINDOWS\system32\usrshuta.exe |23/08/2001 19:47:48 C:\WINDOWS\system32\vwipxspx.exe |04/10/2001 13:02:26 C:\WINDOWS\system32\a3d.dll |11/01/2007 16:57:49 C:\WINDOWS\system32\AdobePDF.dll |15/05/2003 02:32:58 C:\WINDOWS\system32\amstream.dll |08/01/2007 16:21:30 C:\WINDOWS\system32\ati2cqag.dll |22/11/2006 04:51:50 C:\WINDOWS\system32\ati2dvag.dll |22/11/2006 05:25:23 C:\WINDOWS\system32\ati2edxx.dll |22/11/2006 05:19:50 C:\WINDOWS\system32\ati2evxx.dll |22/11/2006 05:19:41 C:\WINDOWS\system32\ati3duag.dll |22/11/2006 05:12:27 C:\WINDOWS\system32\ATIDDC.DLL |22/11/2006 05:17:58 C:\WINDOWS\system32\ATIDEMGR.dll |22/11/2006 04:21:19 C:\WINDOWS\system32\atiiiexx.dll |22/11/2006 04:49:45 C:\WINDOWS\system32\atikvmag.dll |22/11/2006 04:57:31 C:\WINDOWS\system32\atioglx1.dll |22/11/2006 04:50:55 C:\WINDOWS\system32\atioglxx.dll |22/11/2006 05:11:19 C:\WINDOWS\system32\atipdlxx.dll |22/11/2006 05:20:11 C:\WINDOWS\system32\atitvo32.dll |22/11/2006 04:56:25 C:\WINDOWS\system32\ativcoxx.dll |09/11/2001 18:01:04 C:\WINDOWS\system32\ativvaxx.dll |22/11/2006 05:08:16 C:\WINDOWS\system32\atmfd.dll |04/10/2001 12:32:37 C:\WINDOWS\system32\atmlib.dll |04/10/2001 12:32:37 C:\WINDOWS\system32\Audio3D.dll |11/01/2007 16:57:49 C:\WINDOWS\system32\cmirmdrv.dll |11/01/2007 16:57:51 C:\WINDOWS\system32\cmuda.dll |11/01/2007 16:57:51 C:\WINDOWS\system32\CoInst.dll |08/01/2007 14:44:02 C:\WINDOWS\system32\compatUI.dll |04/10/2001 12:33:24 C:\WINDOWS\system32\dgrpsetu.dll |08/01/2007 12:55:07 C:\WINDOWS\system32\dgsetup.dll |08/01/2007 12:55:07 C:\WINDOWS\system32\EPCOMDD.DLL |17/02/2007 15:34:22 C:\WINDOWS\system32\Epfb5cpl.dll |17/02/2007 15:34:23 C:\WINDOWS\system32\EPSN.DLL |17/02/2007 15:37:27 C:\WINDOWS\system32\EqnClass.Dll |08/01/2007 12:55:07 C:\WINDOWS\system32\esccm.dll |17/02/2007 15:34:23 C:\WINDOWS\system32\esccmn.dll |17/02/2007 15:34:23 C:\WINDOWS\system32\escimg.dll |17/02/2007 15:34:23 C:\WINDOWS\system32\escimgn.dll |17/02/2007 15:34:23 C:\WINDOWS\system32\escwiab.dll |17/02/2007 15:34:23 C:\WINDOWS\system32\escwian.dll |17/02/2007 15:34:23 C:\WINDOWS\system32\ESDTR.dll |17/02/2007 15:34:22 C:\WINDOWS\system32\ESICM.dll |17/02/2007 15:34:23 C:\WINDOWS\system32\Esintpl.dll |17/02/2007 15:34:22 C:\WINDOWS\system32\GEARAspi.dll |19/09/2006 16:43:58 C:\WINDOWS\system32\gspnDll.dll |08/01/2007 14:43:49 C:\WINDOWS\system32\hpzcoi05.dll |18/03/2002 13:52:42 C:\WINDOWS\system32\hpzcon05.dll |18/03/2002 13:52:42 C:\WINDOWS\system32\hpzlnt05.dll |12/01/2007 16:44:32 C:\WINDOWS\system32\hticons.dll |08/01/2007 13:02:50 C:\WINDOWS\system32\hypertrm.dll |08/01/2007 13:02:50 C:\WINDOWS\system32\iccvid.dll |04/10/2001 12:40:06 C:\WINDOWS\system32\imagX7.dll |26/07/2004 17:16:10 C:\WINDOWS\system32\imagXpr7.dll |26/07/2004 17:16:10 C:\WINDOWS\system32\imagXR7.dll |26/07/2004 17:16:10 C:\WINDOWS\system32\imagXRA7.dll |26/07/2004 17:16:10 C:\WINDOWS\system32\INETWH16.DLL |17/02/2007 15:37:27 C:\WINDOWS\system32\INETWH32.dll |17/02/2007 15:37:27 C:\WINDOWS\system32\instDll.dll |08/01/2007 14:43:49 C:\WINDOWS\system32\ir32_32.dll |04/10/2001 12:40:44 C:\WINDOWS\system32\ir41_qc.dll |04/10/2001 12:40:45 C:\WINDOWS\system32\ir41_qcx.dll |04/10/2001 12:40:45 C:\WINDOWS\system32\ir50_32.dll |04/10/2001 12:40:46 C:\WINDOWS\system32\ir50_qc.dll |04/10/2001 12:40:46 C:\WINDOWS\system32\ir50_qcx.dll |04/10/2001 12:40:46 C:\WINDOWS\system32\isrdbg32.dll |08/01/2007 13:04:19 C:\WINDOWS\system32\jgaw400.dll |04/10/2001 12:40:50 C:\WINDOWS\system32\jgdw400.dll |04/10/2001 12:40:50 C:\WINDOWS\system32\jgmd400.dll |04/10/2001 12:40:50 C:\WINDOWS\system32\jgpl400.dll |04/10/2001 12:40:50 C:\WINDOWS\system32\jgsd400.dll |04/10/2001 12:40:51 C:\WINDOWS\system32\jgsh400.dll |04/10/2001 12:40:51 C:\WINDOWS\system32\mciqtz32.dll |08/01/2007 16:21:30 C:\WINDOWS\system32\mdwmdmsp.dll |23/08/2001 19:47:06 C:\WINDOWS\system32\msdmo.dll |08/01/2007 16:21:30 C:\WINDOWS\system32\msencode.dll |04/10/2001 12:42:25 C:\WINDOWS\system32\NeroCo.dll |16/02/2005 15:18:04 C:\WINDOWS\system32\Oemdspif.dll |22/11/2006 05:20:01 C:\WINDOWS\system32\paqsp.dll |23/08/2001 19:47:16 C:\WINDOWS\system32\PIXDFLTN.DLL |17/02/2007 15:37:27 C:\WINDOWS\system32\PIXLOCN.DLL |17/02/2007 15:37:27 C:\WINDOWS\system32\PIXPCZ.DLL |17/02/2007 15:37:27 C:\WINDOWS\system32\PIXPERMN.DLL |17/02/2007 15:37:27 C:\WINDOWS\system32\PIXPNR.DLL |17/02/2007 15:37:27 C:\WINDOWS\system32\psisdecd.dll |08/01/2007 16:21:32 C:\WINDOWS\system32\qedwipes.dll |08/01/2007 16:21:30 C:\WINDOWS\system32\scriptpw.dll |04/10/2001 12:55:27 C:\WINDOWS\system32\slbcsp.dll |04/10/2001 12:56:59 C:\WINDOWS\system32\slbiop.dll |04/10/2001 12:57:00 C:\WINDOWS\system32\slbrccsp.dll |04/10/2001 12:57:00 C:\WINDOWS\system32\spnike.dll |23/08/2001 19:47:18 C:\WINDOWS\system32\sprio600.dll |23/08/2001 19:47:18 C:\WINDOWS\system32\sprio800.dll |23/08/2001 19:47:18 C:\WINDOWS\system32\spxcoins.dll |08/01/2007 12:55:07 C:\WINDOWS\system32\tsd32.dll |04/10/2001 13:01:30 C:\WINDOWS\system32\TwnLib4.dll |09/07/2004 09:43:56 C:\WINDOWS\system32\udaprop.dll |11/01/2007 16:57:52 C:\WINDOWS\system32\usrcntra.dll |23/08/2001 19:47:20 C:\WINDOWS\system32\usrcoina.dll |23/08/2001 19:47:20 C:\WINDOWS\system32\usrdpa.dll |23/08/2001 19:47:20 C:\WINDOWS\system32\usrdtea.dll |23/08/2001 19:47:20 C:\WINDOWS\system32\usrfaxa.dll |23/08/2001 19:47:20 C:\WINDOWS\system32\usrlbva.dll |23/08/2001 19:47:20 C:\WINDOWS\system32\usrrtosa.dll |23/08/2001 19:47:20 C:\WINDOWS\system32\usrsdpia.dll |23/08/2001 19:47:20 C:\WINDOWS\system32\usrsvpia.dll |23/08/2001 19:47:20 C:\WINDOWS\system32\usrv42a.dll |23/08/2001 19:47:20 C:\WINDOWS\system32\usrv80a.dll |23/08/2001 19:47:20 C:\WINDOWS\system32\usrvoica.dll |23/08/2001 19:47:20 C:\WINDOWS\system32\usrvpa.dll |23/08/2001 19:47:20 C:\WINDOWS\system32\win87em.dll |04/10/2001 13:03:03 C:\WINDOWS\system32\xvidcore.dll |20/12/2004 12:03:26 C:\WINDOWS\system32\xvidvfw.dll |20/12/2004 12:08:28 Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 0C26-AB06 Répertoire de C:\WINDOWS\system 15/10/2003 10:26 1.454.080 SmWizard.exe 1 fichier(s) 1.454.080 octets 0 Rép(s) 24.184.270.848 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 0C26-AB06 Répertoire de C:\WINDOWS\system32 04/10/2001 12:33 4.096 csrss.exe 1 fichier(s) 4.096 octets 0 Rép(s) 24.184.270.848 octets libres Contenu de Downloaded Program Files Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 0C26-AB06 Répertoire de C:\WINDOWS\Downloaded Program Files 12/01/2007 21:40 <REP> . 12/01/2007 21:40 <REP> .. 08/01/2007 13:05 65 desktop.ini 05/03/2005 17:59 1.706.800 gdiplus.dll 05/03/2005 17:59 283.296 IDrop.ocx 05/03/2005 17:59 114.848 IDropENU.dll 05/03/2005 17:59 114.688 vizable.ocx 11/08/2004 03:22 3.036 wmv9dmo.inf 30/06/2003 23:41 1.689 WMV9VCM.inf 7 fichier(s) 2.224.422 octets Total des fichiers listés : 7 fichier(s) 2.224.422 octets 2 Rép(s) 24.184.266.752 octets libres Recherche de rootkit! (Merci S!Ri) Recherche d'infections connues catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Liste des programmes installes Ad-Aware SE Personal Adobe Creative Suite Adobe SVG Viewer 3.0 Allegorithmic MaPZone2.Free Apple Software Update Applet_App Applet_Copy Applet_Email Applet_Epp Applet_File Applet_OCR Applet_Photoshop Applet_Web AquaMark3 Archiveur WinRAR ATI - Software Uninstall Utility ATI Display Driver Autodesk 3ds Max 8 Autodesk 3ds Max 8 Additional Maps and Materials Autodesk 3ds Max 8 Architectural Materials Autodesk 3ds Max 8 Reference Files Autodesk DWF Viewer Azureus Azureus 3.0 Backburner Battlefield 2 : Forces Spéciales Battlefield 2 C-Media 3D Audio Copy Utility DDS Converter 2.1 DX Studio Player Eicon Networks ADSL Modem eMule EPSON Photo Print EPSON Smart Panel EPSON TWAIN 5 Extensis Suitcase GOM Player HD Tach version 3 HijackThis 1.99.1 hp deskjet 5550 series (Supprimer uniquement) hp print screen utility iTunes J2SE Runtime Environment 5.0 Update 10 MailNavigator v.1.11 Microsoft Office Professional Edition 2003 Mozilla Firefox (2.0.0.3) Nero 7 Demo OpenOffice.org 2.1 PartyPoker Poker Academy Pro 2 QuickTime ScanToWeb TestLAB 2006 Evaluation TextBridge Pro 8.0 Tri-CATALOG Pro VideoLAN VLC media player 0.8.6a WarRock WebFldrs XP Windows Installer 3.1 (KB893803) XviD MPEG-4 Video Codec ZoneAlarm Zoom Player (remove only) Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 0C26-AB06 Répertoire de C:\Program Files 04/04/2007 15:08 <REP> . 04/04/2007 15:08 <REP> .. 26/02/2007 17:59 <REP> 7-Zip 08/01/2007 15:00 <REP> Adobe 01/03/2007 12:25 <REP> Allegorithmic 08/01/2007 21:41 <REP> Apple Software Update 08/01/2007 14:30 <REP> ATI Technologies 08/01/2007 16:25 <REP> Autodesk 05/02/2007 10:47 <REP> Azureus 11/01/2007 16:57 <REP> C-Media 3D Audio 08/01/2007 13:03 <REP> ComPlus Applications 11/01/2007 12:28 <REP> DDS Converter 2 08/01/2007 14:44 <REP> Eicon 28/03/2007 18:16 <REP> eMule 17/02/2007 15:36 <REP> EPSON 11/01/2007 11:22 <REP> Extensis 28/02/2007 13:28 <REP> Fichiers communs 07/02/2007 23:35 <REP> GRETECH 12/01/2007 16:44 <REP> Hewlett-Packard 12/01/2007 16:44 <REP> hp deskjet 5550 series 08/01/2007 13:05 <REP> Internet Explorer 08/01/2007 21:41 <REP> iPod 08/01/2007 21:41 <REP> iTunes 29/01/2007 19:12 <REP> Java 28/03/2007 21:07 <REP> Lavasoft 13/03/2007 20:33 <REP> MailNavigator 08/01/2007 13:11 <REP> Messenger 08/01/2007 13:07 <REP> microsoft frontpage 28/02/2007 13:28 <REP> Microsoft Office 08/01/2007 13:04 <REP> Movie Maker 04/04/2007 17:25 <REP> Mozilla Firefox 09/01/2007 12:35 <REP> Mozilla Thunderbird 08/01/2007 13:03 <REP> MSN 08/01/2007 13:02 <REP> MSN Gaming Zone 17/02/2007 19:20 <REP> Nero 08/01/2007 13:04 <REP> NetMeeting 08/02/2007 13:18 <REP> OpenOffice.org 2.1 08/01/2007 13:04 <REP> Outlook Express 04/04/2007 14:54 <REP> PartyGaming 16/02/2007 16:04 <REP> PokerAcademyPro2 09/02/2007 12:45 <REP> Polices postscript 20/02/2007 14:11 <REP> Primordial Life 3.2 08/01/2007 21:41 <REP> QuickTime 08/01/2007 13:03 <REP> Services en ligne 17/02/2007 15:37 <REP> TextBridge Pro 8.0 28/03/2007 18:25 <REP> Tri-Edre 11/01/2007 16:46 <REP> VideoLAN 21/02/2007 19:40 <REP> Windows Media Player 08/01/2007 13:02 <REP> Windows NT 07/02/2007 15:14 <REP> WinRAR 06/02/2007 10:59 <REP> Worldweaver 08/01/2007 13:07 <REP> xerox 24/03/2007 10:11 <REP> Zoom Player 0 fichier(s) 0 octets 53 Rép(s) 24.180.015.104 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 0C26-AB06 Répertoire de C:\Program Files\fichiers communs 28/02/2007 13:28 <REP> . 28/02/2007 13:28 <REP> .. 08/01/2007 14:59 <REP> Adobe 08/01/2007 15:00 <REP> Adobe Systems Shared 17/02/2007 19:22 <REP> Ahead 08/01/2007 16:25 <REP> Autodesk Shared 28/02/2007 13:28 <REP> DESIGNER 10/02/2007 15:46 <REP> InstallShield 29/01/2007 19:11 <REP> Java 28/02/2007 13:29 <REP> Microsoft Shared 08/01/2007 13:04 <REP> MSSoap 08/01/2007 12:55 <REP> ODBC 08/01/2007 13:04 <REP> Services 08/01/2007 12:55 <REP> SpeechEngines 08/01/2007 13:04 <REP> System 17/02/2007 15:37 <REP> Xerox Shared 0 fichier(s) 0 octets 16 Rép(s) 24.180.015.104 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 0C26-AB06 Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders 28/02/2007 13:28 <REP> . 28/02/2007 13:28 <REP> .. 28/02/2007 13:28 <REP> 1033 28/02/2007 13:28 <REP> 1036 11/07/2003 11:15 1.292.872 MSONSEXT.DLL 15/07/2003 07:52 35.896 MSOSV.DLL 03/06/1999 15:09 122.937 MSOWS409.DLL 07/03/2001 10:00 127.033 MSOWS40c.DLL 11/07/2003 03:25 80.448 PKMWS.DLL 5 fichier(s) 1.659.186 octets 4 Rép(s) 24.180.015.104 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 0C26-AB06 Répertoire de C:\ 11/11/2001 00:00 68.096 diff.exe 27/08/2006 14:10 103.424 grep.exe 2 fichier(s) 171.520 octets 0 Rép(s) 24.180.015.104 octets libres c:\Documents and Settings\Administrateur\Application Data\Azureus\data\Poker Academy Pro 2.5 [English & French] + crack\PokerAcademyPro2-setup.exe c:\Documents and Settings\Administrateur\Bureau\clamwin-0.90.1-setup.exe c:\Documents and Settings\Administrateur\Bureau\eMule0.47c-Installer.exe c:\Documents and Settings\Administrateur\Bureau\MNavi111.exe c:\Documents and Settings\Administrateur\Bureau\mview.exe c:\Documents and Settings\Administrateur\Bureau\VundoFix.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\generator.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\i4jdel0.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\NeroDemo9599\nero_y.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\NeroDemo9599\SetupX.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\NeroDemo9599\ycomp_setup_nero.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\NeroDemo9599\Redist\50comupd.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\NeroDemo9599\Redist\instmsia.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\NeroDemo9599\Redist\instmsiw.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\NeroDemo9599\Redist\ShFolder.Exe c:\Documents and Settings\Administrateur\Local Settings\Temp\NeroDemo9599\Setup\NeroDelTmp.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\NeroDemo9599\Setup\UninstallNero.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\nstmp\uninstall.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\{7E731430-8D7E-4E01-A163-D44DFEE62191}\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}\dxsetup.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\{CE930CD5-B2A3-47EE-ADE2-AD39F1842D44}\{50D4CB89-AF34-4978-96DC-C3034062E901}\dxsetup.exe c:\Documents and Settings\Administrateur\Local Settings\Temp\~dxwebdownloads\DXStudioPlayerSetup.exe c:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.0.2.16\iTunesSetupAdmin.exe Liste des drivers... < Microsoft ® Windows ® version 5.1 (num'ro 2600). < 4 4 2007 17:43:45.500 < Pilote charg' \WINDOWS\system32\ntoskrnl.exe < Pilote charg' \WINDOWS\system32\hal.dll < Pilote charg' \WINDOWS\system32\KDCOM.DLL < Pilote charg' \WINDOWS\system32\BOOTVID.dll < Pilote charg' ACPI.sys < Pilote charg' \WINDOWS\System32\DRIVERS\WMILIB.SYS < Pilote charg' pci.sys < Pilote charg' isapnp.sys < Pilote charg' pciide.sys < Pilote charg' \WINDOWS\System32\DRIVERS\PCIIDEX.SYS < Pilote charg' MountMgr.sys < Pilote charg' ftdisk.sys < Pilote charg' dmload.sys < Pilote charg' dmio.sys < Pilote charg' PartMgr.sys < Pilote charg' VolSnap.sys < Pilote charg' atapi.sys < Pilote charg' disk.sys < Pilote charg' \WINDOWS\System32\DRIVERS\CLASSPNP.SYS < Pilote charg' sr.sys < Pilote charg' KSecDD.sys < Pilote charg' Ntfs.sys < Pilote charg' NDIS.sys < Pilote charg' Mup.sys < Pilote charg' \SystemRoot\System32\DRIVERS\processr.sys < Pilote charg' \SystemRoot\System32\DRIVERS\ati2mtag.sys < Pilote charg' \SystemRoot\System32\DRIVERS\i8042prt.sys < Pilote charg' \SystemRoot\System32\DRIVERS\kbdclass.sys < Pilote charg' \SystemRoot\System32\DRIVERS\cdrom.sys < Pilote charg' \SystemRoot\System32\DRIVERS\redbook.sys < Pilote charg' \SystemRoot\System32\Drivers\GEARAspiWDM.sys < Pilote charg' \SystemRoot\System32\Drivers\Imapi.SYS < Pilote charg' \SystemRoot\system32\drivers\cmuda.sys < Pilote charg' \SystemRoot\System32\DRIVERS\usbohci.sys < Pilote charg' \SystemRoot\System32\DRIVERS\sisnic.sys < Pilote charg' \SystemRoot\System32\DRIVERS\fdc.sys < Pilote charg' \SystemRoot\System32\DRIVERS\serial.sys < Pilote charg' \SystemRoot\System32\DRIVERS\serenum.sys < Pilote charg' \SystemRoot\System32\DRIVERS\irsir.sys < Pilote charg' \SystemRoot\System32\DRIVERS\irenum.sys < Pilote charg' \SystemRoot\System32\DRIVERS\parport.sys < Pilote charg' \SystemRoot\System32\DRIVERS\gameenum.sys < Pilote charg' \SystemRoot\system32\drivers\msmpu401.sys < Pilote charg' \SystemRoot\System32\DRIVERS\audstub.sys < Pilote charg' \SystemRoot\System32\DRIVERS\rasirda.sys < Pilote charg' \SystemRoot\System32\DRIVERS\rasl2tp.sys < Pilote charg' \SystemRoot\System32\DRIVERS\ndistapi.sys < Pilote charg' \SystemRoot\System32\DRIVERS\ndiswan.sys < Pilote charg' \SystemRoot\System32\DRIVERS\raspppoe.sys < Pilote charg' \SystemRoot\System32\DRIVERS\raspptp.sys < Pilote charg' \SystemRoot\System32\DRIVERS\msgpc.sys < Pilote charg' \SystemRoot\System32\DRIVERS\psched.sys < Pilote charg' \SystemRoot\System32\DRIVERS\ptilink.sys < Pilote charg' \SystemRoot\System32\DRIVERS\raspti.sys < Pilote charg' \SystemRoot\System32\DRIVERS\rdpdr.sys < Pilote charg' \SystemRoot\System32\DRIVERS\termdd.sys < Pilote charg' \SystemRoot\System32\DRIVERS\mouclass.sys < Pilote charg' \SystemRoot\System32\DRIVERS\swenum.sys < Pilote charg' \SystemRoot\System32\DRIVERS\update.sys < Pilote charg' \SystemRoot\System32\Drivers\NDProxy.SYS < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\NDProxy.SYS < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\NDProxy.SYS < Pilote charg' \SystemRoot\System32\DRIVERS\usbhub.sys < Pilote charg' \SystemRoot\System32\DRIVERS\gwausb.sys < Pilote charg' \SystemRoot\System32\DRIVERS\usbprint.sys < Pilote charg' \SystemRoot\System32\DRIVERS\hidusb.sys < Pilote charg' \SystemRoot\System32\DRIVERS\USBSTOR.SYS < Pilote charg' \SystemRoot\System32\DRIVERS\mouhid.sys < Pilote charg' \SystemRoot\System32\DRIVERS\flpydisk.sys < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\lbrtfdc.SYS < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\Sfloppy.SYS < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\i2omgmt.SYS < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\Changer.SYS < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\Cdaudio.SYS < Pilote charg' \SystemRoot\System32\Drivers\Fs_Rec.SYS < Pilote charg' \SystemRoot\System32\Drivers\Null.SYS < Pilote charg' \SystemRoot\System32\Drivers\Beep.SYS < Pilote charg' \SystemRoot\System32\drivers\vga.sys < Pilote charg' \SystemRoot\System32\Drivers\mnmdd.SYS < Pilote charg' \SystemRoot\System32\DRIVERS\RDPCDD.sys < Pilote charg' \SystemRoot\System32\Drivers\Msfs.SYS < Pilote charg' \SystemRoot\System32\Drivers\Npfs.SYS < Pilote charg' \SystemRoot\System32\DRIVERS\rasacd.sys < Pilote charg' \SystemRoot\System32\DRIVERS\ipsec.sys < Pilote charg' \SystemRoot\System32\DRIVERS\tcpip.sys < Pilote charg' \SystemRoot\System32\DRIVERS\netbt.sys < Pilote charg' \SystemRoot\System32\DRIVERS\netbios.sys < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\PCIDump.SYS < Pilote charg' \SystemRoot\System32\DRIVERS\rdbss.sys < Pilote charg' \SystemRoot\System32\DRIVERS\mrxsmb.sys < Pilote charg' \SystemRoot\System32\DRIVERS\wanarp.sys < Pilote charg' \SystemRoot\System32\Drivers\Fips.SYS < Pilote charg' \SystemRoot\System32\Drivers\Fastfat.SYS < Pilote charg' \SystemRoot\System32\Drivers\Udfs.SYS < Pilote charg' \SystemRoot\System32\DRIVERS\atinavt2.sys < Le pilote n'a pas 't' charg' \SystemRoot\System32\DRIVERS\gafwload.sys < Pilote charg' \SystemRoot\System32\drivers\afd.sys < Pilote charg' \SystemRoot\System32\DRIVERS\irda.sys < Pilote charg' \SystemRoot\System32\DRIVERS\ndisuio.sys < Le pilote n'a pas 't' charg' \SystemRoot\System32\drivers\afd.sys < Le pilote n'a pas 't' charg' \SystemRoot\System32\DRIVERS\rdbss.sys < Le pilote n'a pas 't' charg' \SystemRoot\System32\DRIVERS\mrxsmb.sys < Pilote charg' \SystemRoot\System32\DRIVERS\mrxdav.sys < Pilote charg' \SystemRoot\System32\Drivers\ParVdm.SYS < Pilote charg' \SystemRoot\System32\DRIVERS\srv.sys < Pilote charg' \SystemRoot\system32\drivers\sysaudio.sys < Pilote charg' \SystemRoot\system32\drivers\splitter.sys < Pilote charg' \SystemRoot\system32\drivers\aec.sys < Pilote charg' \SystemRoot\system32\drivers\swmidi.sys < Pilote charg' \SystemRoot\system32\drivers\DMusic.sys < Pilote charg' \SystemRoot\system32\drivers\kmixer.sys < Pilote charg' \SystemRoot\system32\drivers\drmkaud.sys < Pilote charg' \SystemRoot\system32\drivers\wdmaud.sys

Je n'arrivai pas a ajouter les 2 fichiers dans VUNDO, mais je pense que c'était un problème d'ordre dans lequel je faisais le copier-coller dans les champs. Après qq essais cela a fonctionné ! Voici les log VUNDO et hijackthis VundoFix V6.3.19 Checking Java version... Java version is 1.5.0.10 Scan started at 11:48:08 4/04/2007 Listing files found while scanning.... C:\WINDOWS\system32\awtqr.dll C:\WINDOWS\System32\gjkkj.bak1 C:\WINDOWS\System32\gjkkj.ini C:\WINDOWS\System32\jkkjg.dll C:\WINDOWS\system32\kjjlm.bak1 C:\WINDOWS\system32\kjjlm.ini C:\WINDOWS\System32\mljjk.dll C:\WINDOWS\System32\muixplnm.dll C:\WINDOWS\system32\rqtwa.ini Beginning removal... Attempting to delete C:\WINDOWS\system32\awtqr.dll C:\WINDOWS\system32\awtqr.dll Has been deleted! Attempting to delete C:\WINDOWS\System32\gjkkj.bak1 C:\WINDOWS\System32\gjkkj.bak1 Has been deleted! Attempting to delete C:\WINDOWS\System32\gjkkj.ini C:\WINDOWS\System32\gjkkj.ini Has been deleted! Attempting to delete C:\WINDOWS\System32\jkkjg.dll C:\WINDOWS\System32\jkkjg.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\kjjlm.bak1 C:\WINDOWS\system32\kjjlm.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\kjjlm.ini C:\WINDOWS\system32\kjjlm.ini Has been deleted! Attempting to delete C:\WINDOWS\System32\mljjk.dll C:\WINDOWS\System32\mljjk.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\rqtwa.ini C:\WINDOWS\system32\rqtwa.ini Has been deleted! Performing Repairs to the registry. Done! VundoFix V6.3.19 Checking Java version... Java version is 1.5.0.10 Scan started at 13:54:02 4/04/2007 Listing files found while scanning.... No infected files were found. Beginning removal... Beginning removal... VundoFix V6.3.19 Checking Java version... Java version is 1.5.0.10 Scan started at 17:20:19 4/04/2007 Listing files found while scanning.... Beginning removal... Beginning removal... Attempting to delete C:\WINDOWS\SYSTEM32\opnnkhi.dll C:\WINDOWS\SYSTEM32\opnnkhi.dll Has been deleted! Performing Repairs to the registry. Done! Logfile of HijackThis v1.99.1 Scan saved at 17:29:55, on 4/04/2007 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\GSICON.EXE C:\WINDOWS\System32\dslagent.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\System32\RunDll32.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\Extensis\Suitcase\Suitcase.exe C:\Program Files\OpenOffice.org 2.1\program\soffice.exe C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\WINDOWS\inf\explorer.exe C:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: (no name) - {C10525B4-17EC-4D8A-BE71-08F6AD617339} - C:\WINDOWS\system32\opnnkhi.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [instantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [soundService] rundll32.exe "C:\WINDOWS\System32\ashhfuxb.dll",setvm O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Suitcase Startup.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{CAD1BFAB-A4E3-46D1-BB7E-5D0806525319}: NameServer = 195.238.2.21 195.238.2.22 O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe O23 - Service: DirectX Service (Qimer) - Unknown owner - C:\WINDOWS\System32\directx.exe

euh entretemps, j'ai essayer de cocher ces 2 dll dans hijackthis, mais après redémarrage, elle ne disparaisse pas ! J'ai désinstallé Zone alarm (version démo avec antivirus) qui me bloquait avec l'alerte Virtumonde qui revient tout le temps J'ai désinstallé Clamwin également (antivirus gratuit) Donc je suis toujours infecté ! J'ai fais ta manoeuvre avec VUNDO mais il ne détecte pas les dll ! Voici mon log Hijackthis : Logfile of HijackThis v1.99.1 Scan saved at 16:29:51, on 4/04/2007 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\GSICON.EXE C:\WINDOWS\System32\dslagent.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\System32\RunDll32.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\Extensis\Suitcase\Suitcase.exe C:\Program Files\OpenOffice.org 2.1\program\soffice.exe C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\inf\explorer.exe C:\WINDOWS\System32\dwwin.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: (no name) - {C10525B4-17EC-4D8A-BE71-08F6AD617339} - C:\WINDOWS\system32\opnnkhi.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [instantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [soundService] rundll32.exe "C:\WINDOWS\System32\ashhfuxb.dll",setvm O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Suitcase Startup.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{CAD1BFAB-A4E3-46D1-BB7E-5D0806525319}: NameServer = 195.238.2.21 195.238.2.22 O20 - Winlogon Notify: opnnkhi - C:\WINDOWS\SYSTEM32\opnnkhi.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe O23 - Service: DirectX Service (Qimer) - Unknown owner - C:\WINDOWS\System32\directx.exe Peux-tu m'aider ? merci pour ta réponse !

Bonjour, Je suis infecté par Win32 VirtuMonde, j'ai trouvé un cas similaire sur le forum et exécuté VUNDOFIX qui a trouvé des fichiers a effacer : je poste le log vundofix VundoFix V6.3.19 Checking Java version... Java version is 1.5.0.10 Scan started at 11:48:08 4/04/2007 Listing files found while scanning.... C:\WINDOWS\system32\awtqr.dll C:\WINDOWS\System32\gjkkj.bak1 C:\WINDOWS\System32\gjkkj.ini C:\WINDOWS\System32\jkkjg.dll C:\WINDOWS\system32\kjjlm.bak1 C:\WINDOWS\system32\kjjlm.ini C:\WINDOWS\System32\mljjk.dll C:\WINDOWS\System32\muixplnm.dll C:\WINDOWS\system32\rqtwa.ini Beginning removal... Attempting to delete C:\WINDOWS\system32\awtqr.dll C:\WINDOWS\system32\awtqr.dll Has been deleted! Attempting to delete C:\WINDOWS\System32\gjkkj.bak1 C:\WINDOWS\System32\gjkkj.bak1 Has been deleted! Attempting to delete C:\WINDOWS\System32\gjkkj.ini C:\WINDOWS\System32\gjkkj.ini Has been deleted! Attempting to delete C:\WINDOWS\System32\jkkjg.dll C:\WINDOWS\System32\jkkjg.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\kjjlm.bak1 C:\WINDOWS\system32\kjjlm.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\kjjlm.ini C:\WINDOWS\system32\kjjlm.ini Has been deleted! Attempting to delete C:\WINDOWS\System32\mljjk.dll C:\WINDOWS\System32\mljjk.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\rqtwa.ini C:\WINDOWS\system32\rqtwa.ini Has been deleted! Performing Repairs to the registry. Done! Pouvez vous me conseiller sur ce post hijack this ? Que dois je cocher ? Logfile of HijackThis v1.99.1 Scan saved at 12:03:53, on 4/04/2007 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\GSICON.EXE C:\WINDOWS\System32\dslagent.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\System32\RunDll32.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE C:\Program Files\ClamWin\bin\ClamTray.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\Extensis\Suitcase\Suitcase.exe C:\Program Files\OpenOffice.org 2.1\program\soffice.exe C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\inf\explorer.exe C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE C:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: (no name) - {C10525B4-17EC-4D8A-BE71-08F6AD617339} - C:\WINDOWS\System32\opnnkhi.dll O2 - BHO: (no name) - {F5AAD9D7-EFD4-4D6B-A56A-2E99AEC1C1F9} - C:\WINDOWS\System32\jkkjg.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [instantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [soundService] rundll32.exe "C:\WINDOWS\System32\ashhfuxb.dll",setvm O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Suitcase Startup.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{CAD1BFAB-A4E3-46D1-BB7E-5D0806525319}: NameServer = 195.238.2.21 195.238.2.22 O20 - Winlogon Notify: opnnkhi - C:\WINDOWS\SYSTEM32\opnnkhi.dll O20 - Winlogon Notify: winigd32 - winigd32.dll (file missing) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe O23 - Service: DirectX Service (Qimer) - Unknown owner - C:\WINDOWS\System32\directx.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe Merci d'avance de me donner un petit coup de main !