ithyne

Bonjour, Le pc est toujours un peu lent, mais puisqu'il semble propre, ca n'a peut etre rien à voir avec une éventuelle infection (?). J'ai quelques problemes avec internet (indépendants du pc), et je ne pourrai plus me connecter avant longtemps. Je profite donc d'etre là pour vous remercier =) Bonne continuation.

Bonjour, Msnfix a bien enlevé des choses, je vous joins le rapport : Pardon mais vous n'avez pas indiqué les lignes à cocher sur hijackthis ^^ J'avais antivir, j'avais suivi la procedure de prenettoyage et l'avais lancé (il n'y avait rien à signaler) puis je l'ai desinstallé avant de lancer le premier hijack. Je l'ai remis, Voici le rapport : Voici le rapport AVG (vaut il mieux que j'utilise AVG ou Zone Alarm Security ?) :

Bonjour, Voici le nouveau rapport : (j'ai désinstallé les updates de java antérieures, mais ne sachant pas si je devais aussi désinstaller "Java SE Runtime Environment 6", je l'ai laissé) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:23:48, on 04/04/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 4981 bytes

Bonjour, Mon pc (xp sp2) est bien lent, de plus en plus, mais je n'ai pas la possibilité de le formater. Zone Alarm signale des exe étranges ayant pour nom : hbrwyer, icngvj, ipmfeevdgd, jgbktzab, jmwndf, prburewz, qerugqia, qgstnk ou encore ugzkuwbec, mais le scan d'antivir ne les relève pas. Je ne sais pas si cela a quelque chose à voir, alors je suis la procédure et vous présente mon rapport ^^ : Logfile of HijackThis v1.99.1 Scan saved at 02:06:31, on 04/04/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: rdihost - {EDF95E7E-923F-4D63-8643-036ED45B5EAD} - rdihost.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe En espérant avoir tout fait comme il faut. Merci =)

Le PC malade (qui n'etait pas le mien) m'a été repris. Merci beaucoup beaucoup pour ta compétence et ta patience Bon courage =)

Coucou Il y a un probleme (encore :s) Lorsque le cd de windows demarre, j'ai bien le chargement des pilotes de l’installation. Mais après, je n'ai pas la fenetre qui me propose d'installer ou de réparer windows, je tombe sur une fenetre qui me demande de selectionner la partition, ce que je fais. Puis j'ai le choix entre installer windows sur le dossier existant ou sur un dossier différent. J'ai peur de faire des betises irréparables, alors je prefere demander conseil

Non, il n'y a pas de message d'erreur ou des trucs du genre, simplement la barre des taches se fige, puis l'ecran. J'ai bien un cd Windows xp, mais je ne sais pas s'il appartient à cet ordinateur. Est ce que ç'a une importance ? Quoi qu'il en soit, je te remercie pour tout =)

C'est de pire en pire :/ Maintenant l'ordinateur plante dès le démarrage. En fait en premier la barre des taches fait comme si elle se "desactivait" : elle est toujours là mais on ne peut plus y acceder, les bouton de lancement rapide ne reagissent plus quand la souris passe dessus. Et juste après, les fenetres ouvertes ne reagissent plus non plus, on ne peut plus rien faire, ni les fermer, ni ouvrir le gestionnaire des taches, ni redemarrer correctement. Sauf que maintenant le probleme survient dès l'ouverture de la session. Je ne peux donc rien faire des manipulations que tu m'indiques. Bizarrement, en mode sans echec, ca a l'air de fonctionner. Mais j'ignore si le pc finit par planter au bout d'un certain temps. C'etait le probleme initial de la machine, et je pensais que ça venait d'un virus ou truc du genre...

J'ai reussi à connecter l'ordi malade ^^ Je ne trouve pas ecda1_r.dll dans windows, j'ai meme essayé de le localiser avec l'outil de recherche windows, mais ca n'a rien donné. En attendant je vais installer Zone Alarm =) Par contre je viens de remarquer que la barre des taches bloque de nouveau, et ca fait ramer le tout. Je suppose que le PC se reveille après un petit moment, mais je ne sais pas encore. Est ce que ca veut dire qu'il y a un probleme matériel ? Ou est ce que ca vaut le coup d'essayer de formater ?...

Heu oui mais justement pour le moment l'ordi malade n'a pas internet pour le moment, alors pour le scan chez Virus Total...

Charles Ingals ne dort jamais.. J'ai tout fait comme prescrit, voici le log : AntiVir PersonalEdition Classic Report file date: mercredi 11 juillet 2007 10:21 Scanning for 740715 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Username: Dominique Computer name: ASTAMM-DOMI Version information: BUILD.DAT : 248 14437 Bytes 31/05/2007 16:59:00 AVSCAN.EXE : 7.0.4.15 282664 Bytes 20/04/2007 11:37:14 AVSCAN.DLL : 7.0.4.4 33832 Bytes 27/03/2007 11:31:54 LUKE.DLL : 7.0.4.11 143400 Bytes 27/03/2007 11:26:04 LUKERES.DLL : 7.0.4.0 10280 Bytes 19/03/2007 11:18:59 ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 31/05/2006 13:08:58 ANTIVIR1.VDF : 6.37.1.151 4303360 Bytes 23/02/2007 13:09:01 ANTIVIR2.VDF : 6.38.0.214 729600 Bytes 12/04/2007 13:09:02 ANTIVIR3.VDF : 6.38.0.225 50688 Bytes 16/04/2007 13:09:02 AVEWIN32.DLL : 7.4.0.12 2404864 Bytes 13/04/2007 13:04:24 AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:26 AVPREF.DLL : 7.0.2.1 24616 Bytes 27/03/2007 11:31:50 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24 AVPACK32.DLL : 7.3.0.8 360488 Bytes 27/03/2007 07:48:28 AVREG.DLL : 7.0.1.2 31784 Bytes 15/03/2007 08:05:08 AVEVTLOG.DLL : 7.0.0.18 86056 Bytes 27/03/2007 11:16:05 AVARKT.DLL : 1.0.0.17 278568 Bytes 02/05/2007 10:32:26 NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:42 RCIMAGE.DLL : 7.0.1.15 2228264 Bytes 13/03/2007 09:46:18 RCTEXT.DLL : 7.0.45.0 86056 Bytes 19/03/2007 11:42:42 Configuration settings for the scan: Jobname..........................: Manual Selection Configuration file...............: C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic\PROFILES\folder.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: C:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: All files Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, Macro heuristic..................: on File heuristic...................: medium Start of the scan: mercredi 11 juillet 2007 10:21 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 11 processes with 11 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( '9' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! End of the scan: mercredi 11 juillet 2007 12:46 Used time: 2:24:27 min The scan has been done completely. 11723 Scanning directories 247202 Files were scanned 0 viruses and/or unwanted programs were found 0 classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 1 Files cannot be scanned 247202 Files not concerned 6799 Archives were scanned 8 Warnings 0 Notes 0 Hidden objects were found En effet, ce pc est connecté à internet en temps normal. J'avais l'intention de lui mettre AVG en guise d'antivirus; est ce qu'il vaut antivir ?

L'ordinateur malade (gueri ?) n'est malheureusement pas connecté à internet. Est ce qu'un programme de substitution peut effectuer le scan ? Voila toutefois le HajiskThis : Logfile of HijackThis v1.99.1 Scan saved at 00:24:48, on 11/07/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16441) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\Program Files\HjackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/def...://fr.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.5672\swg.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\fr\msntb.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\fr\msntb.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [irkjmebghx] c:\windows\system32\irkjmebghx.exe irkjmebghx O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 2.0\resources\fr-FR\local\search.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.8.0.25/mahj...hjong-fr_FR.cab O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-6.8.0.32/sque...chies-fr_FR.cab O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - http://aolcc.aol.fr/computercheckup/qdiagcc.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.fr.aol.com/molbin/share...84/mcinsctl.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1100179122359 O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://jeuxvideo.wanadoo.fr/components/Metaboli.ocx O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1169918633312 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.fr.aol.com/molbin/share...,21/mcgdmgr.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - Unknown owner - C:\Program Files\Securitoo\av_fw\fswsclds.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe 'A propos de Messenger Skinner et des autres vicieux, je note et fais passer ^^)

Le rapport de Navilog : Clean Navipromo version 2.0.5 commencé le 10/07/2007 à 23:52:12,26 Fix lancé depuis C:\Program Files\navilog1 Mise a jour le 01.07.2007 a 12h00 by IL-MAFIOSO Mode suppression automatique avec prise en charge résultats Blacklight *** fsbl1.txt non trouvé *** (Assurez-vous que Blacklight n'avait rien trouvé lors de la recherche) *** Suppression dossiers dans C:\WINDOWS *** *** Suppression dossiers dans C:\Program Files *** *** Suppression dossiers dans C:\Documents and Settings\All Users\Application Data *** *** Suppression dossiers dans C:\Documents and Settings\Dominique\Application Data *** ...\Application Data\MessengerSkinner ...suppression... ...\Application Data\MessengerSkinner supprimé ! *** Suppression fichiers *** C:\WINDOWS\pack.epk supprimé ! C:\WINDOWS\system32\nvs2.inf supprimé ! *** Suppression fichiers temporaires *** Nettoyage contenu C:\WINDOWS\Temp effectué ! Nettoyage contenu C:\Documents and Settings\Dominique\Local Settings\Temp effectué ! *** Sauvegarde du registre vers dossier Backupnavi*** sauvegarde du registre réalise avec succes ! *** Nettoyage registre *** Nettoyage registre Ok *** Traitement Recherche complémentaire *** (Recherche fichiers spécifiques) 1)Recherche fichiers connus: 2)Recherche et Suppression Heuristique : * C:\WINDOWS\System32\irkjmebghx.dat trouvé ! Copie C:\WINDOWS\system32\irkjmebghx.dat réalise avec succes ! C:\WINDOWS\system32\irkjmebghx.dat supprimé ! ** *** **** C:\WINDOWS\System32\irkjmebghx_navps.dat trouvé ! Copie C:\WINDOWS\system32\irkjmebghx_navps.dat réalise avec succes ! C:\WINDOWS\system32\irkjmebghx_navps.dat supprimé ! ***** C:\WINDOWS\System32\irkjmebghx_nav.dat trouvé ! Copie C:\WINDOWS\system32\irkjmebghx_nav.dat réalise avec succes ! C:\WINDOWS\system32\irkjmebghx_nav.dat supprimé ! C:\WINDOWS\System32\irkjmebghx_navup.dat trouvé ! Copie C:\WINDOWS\system32\irkjmebghx_navup.dat réalise avec succes ! C:\WINDOWS\system32\irkjmebghx_navup.dat supprimé ! ****** ******* ******** 3)Contrôle présence clés Rootkit dans le registre : Aucune autre clés présente dans le registre ! 4)Certificats : Certificat Egroup supprimé ! *** Nettoyage termine le 10/07/2007 à 23:54:28,56 *** Le rapport de DiagHelp (euh dans le doute, j'ai fais les choix 1 et 2 ) : 1 DiagHelp version v1.1.2 - http://www.malekal.com excute le 10/07/2007 à 23:55:43,28 Liste des derniers fichies modifies/crees dans windir\system32 C:\WINDOWS\System32/drivers\ntfs.sys -->09/02/2007 13:10:35 C:\WINDOWS\System32/drivers\pcouffin.sys -->28/11/2006 18:26:11 C:\WINDOWS\System32/drivers\atwpkt264.sys -->16/11/2006 18:44:22 C:\WINDOWS\System32/drivers\atwpkt2.sys -->16/11/2006 18:44:08 C:\WINDOWS\System32/drivers\wpdusb.sys -->18/10/2006 21:00:00 C:\WINDOWS\System32/drivers\WudfRd.sys -->28/09/2006 20:00:34 C:\WINDOWS\System32/drivers\WudfPf.sys -->28/09/2006 19:55:50 C:\WINDOWS\System32\wpa.dbl -->10/07/2007 23:53:59 C:\WINDOWS\System32\ecda1_r.dll -->05/07/2007 09:37:49 C:\WINDOWS\System32\ecaedeab9_r.ocx -->05/07/2007 09:37:49 C:\WINDOWS\System32\Status.MPF -->05/07/2007 05:11:47 C:\WINDOWS\System32\MRT.exe -->27/04/2007 22:45:12 C:\WINDOWS\System32\msi.dll -->18/04/2007 18:14:18 C:\WINDOWS\System32\FNTCACHE.DAT -->05/04/2007 03:15:35 C:\WINDOWS\System32\ieapfltr.dll -->03/04/2007 16:29:23 C:\WINDOWS\System32\ieapfltr.dat -->03/04/2007 06:36:20 C:\WINDOWS\System32\perfh00C.dat -->27/03/2007 09:13:06 C:\WINDOWS\System32\perfh009.dat -->27/03/2007 09:13:05 C:\WINDOWS\System32\perfc00C.dat -->27/03/2007 09:13:05 C:\WINDOWS\System32\perfc009.dat -->27/03/2007 09:13:05 C:\WINDOWS\System32\PerfStringBackup.INI -->27/03/2007 09:13:03 C:\WINDOWS\System32\winsrv.dll -->17/03/2007 15:44:47 C:\WINDOWS\System32\LegitCheckControl.dll -->15/03/2007 18:19:28 C:\WINDOWS\System32\WgaTray.exe -->15/03/2007 18:17:20 C:\WINDOWS\System32\WgaLogon.dll -->15/03/2007 18:16:48 C:\WINDOWS\System32\xpsp3res.dll -->09/03/2007 13:51:20 C:\WINDOWS\System32\user32.dll -->08/03/2007 17:37:50 C:\WINDOWS\System32\mf3216.dll -->08/03/2007 17:37:50 C:\WINDOWS\System32\gdi32.dll -->08/03/2007 17:37:50 C:\WINDOWS\System32\win32k.sys -->08/03/2007 17:33:58 C:\WINDOWS\System32\ntoskrnl.exe -->28/02/2007 18:02:36 C:\WINDOWS\System32\ntkrnlpa.exe -->28/02/2007 18:02:36 C:\WINDOWS.log -->10/07/2007 23:53:54 C:\WINDOWS\WindowsUpdate.log -->10/07/2007 23:53:53 C:\WINDOWS\wiaservc.log -->10/07/2007 23:53:53 C:\WINDOWS\wiadebug.log -->10/07/2007 23:53:53 C:\WINDOWS\bootstat.dat -->10/07/2007 23:53:44 C:\WINDOWS\SchedLgU.Txt -->10/07/2007 23:52:40 C:\WINDOWS\win.ini -->10/07/2007 23:00:25 C:\WINDOWS\SYSTEM.INI -->10/07/2007 23:00:25 C:\WINDOWS\IE4 Error Log.txt -->10/07/2007 22:58:33 C:\WINDOWS\ntbtlog.txt -->10/07/2007 12:16:43 C:\WINDOWS\setupact.log -->10/07/2007 00:34:49 C:\WINDOWS\setupapi.log -->10/07/2007 00:24:35 C:\WINDOWS\ST6UNST.000 -->05/07/2007 08:46:39 C:\WINDOWS\LUINSTALL.LOG -->05/07/2007 08:09:41 C:\WINDOWS\KB885295.log -->10/06/2007 09:14:23 Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est B82F-A082 Répertoire de C:\WINDOWS\system32 19/08/2004 17:09 6 144 csrss.exe 1 fichier(s) 6 144 octets 0 Rép(s) 76 134 682 624 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est B82F-A082 Répertoire de C:\WINDOWS\system32 02/04/2003 15:40 1 323 008 dmcpl.exe 1 fichier(s) 1 323 008 octets 0 Rép(s) 76 134 682 624 octets libres Contenu de Downloaded Program Files Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est B82F-A082 Répertoire de C:\WINDOWS\Downloaded Program Files 10/07/2007 00:30 <REP> . 10/07/2007 00:30 <REP> .. 11/11/2004 13:01 65 desktop.ini 25/07/2002 18:13 24 576 dwusplay.dll 25/07/2002 18:13 196 608 dwusplay.exe 25/06/2006 13:50 1 793 erma.inf 14/07/2005 17:28 365 f3initialsetup1.0.0.15-3.inf 10/04/2000 17:12 1 765 fhg.inf 23/11/2006 00:22 372 736 GAME_UNO1.dll 22/11/2006 21:50 316 GAME_UNO1.INF 25/07/2002 18:05 172 032 isusweb.dll 09/10/2006 02:16 5 281 Mah Jong Garden by pogo.osd 18/06/2003 18:01 691 McGDMgr.inf 19/05/2004 12:01 678 mcinsctl.inf 29/05/2003 16:00 160 864 messengerstatsclient.dll 18/08/2005 09:28 219 384 Metaboli.ocx 20/01/2000 16:25 1 162 Microsoft XML Parser for Java.osd 14/07/2005 12:41 322 240 MsnInstC.dll 14/07/2005 14:11 249 MsnInstC.inf 26/05/2005 05:19 293 muweb.inf 22/08/2003 22:10 226 opuc.inf 18/08/2004 13:57 1 088 qdiagcc.inf 16/10/2006 02:28 5 412 Squelchies by pogo.osd 09/11/2006 15:36 5 019 swflash.inf 03/08/2004 15:51 293 wuweb.inf 23 fichier(s) 1 493 136 octets Total des fichiers listés : 23 fichier(s) 1 493 136 octets 2 Rép(s) 76 134 682 624 octets libres Recherche de rootkit! (Merci S!Ri) Recherche d'infections connues Export des clefs sensibles.. Liste des fichiers en exception sur le pare-feu XP SP2 "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "C:\\Program Files\\Securitoo\\av_fw\\backweb\\1044199\\Program\\backWeb-1044199.exe"="C:\\Program Files\\Securitoo\\av_fw\\backweb\\1044199\\Program\\backWeb-1044199.exe:*:Enabled:backWeb-1044199" "C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"="C:\\Program Files\\IncrediMail\\bin\\IMApp.exe:*:Enabled:IncrediMail" "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail" "C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"="C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail" "C:\\Documents and Settings\\Dominique\\Local Settings\\Temporary Internet Files\\Content.IE5\\K5OHEJGL\\incredimail_install[3].exe"="C:\\Documents and Settings\\Dominique\\Local Settings\\Temporary Internet Files\\Content.IE5\\K5OHEJGL\\incredimail_install[3].exe:*:Enabled:IncrediMail Installer" "C:\\Program Files\\Zone.com Deluxe Games\\Hexic Deluxe\\HexicDeluxe.exe"="C:\\Program Files\\Zone.com Deluxe Games\\Hexic Deluxe\\HexicDeluxe.exe:*:Disabled:Hexic Deluxe" "C:\\Program Files\\PopCap Games\\Pixelus Deluxe\\Pixelus.exe"="C:\\Program Files\\PopCap Games\\Pixelus Deluxe\\Pixelus.exe:*:Disabled:Pixelus Game" "C:\\Documents and Settings\\Dominique\\Local Settings\\Temporary Internet Files\\Content.IE5\\4NJBYCTX\\incredimail_install[1].exe"="C:\\Documents and Settings\\Dominique\\Local Settings\\Temporary Internet Files\\Content.IE5\\4NJBYCTX\\incredimail_install[1].exe:*:Enabled:IncrediMail Installer" "C:\\Documents and Settings\\Dominique\\Local Settings\\Temp\\ST_NG_SetupWizard\\stInstall.exe"="C:\\Documents and Settings\\Dominique\\Local Settings\\Temp\\ST_NG_SetupWizard\\stInstall.exe:*:Enabled:SpeedTouch Setup Wizard" "C:\\Documents and Settings\\Dominique\\Local Settings\\Temporary Internet Files\\Content.IE5\\SDM70HMZ\\incredimail_install[1].exe"="C:\\Documents and Settings\\Dominique\\Local Settings\\Temporary Internet Files\\Content.IE5\\SDM70HMZ\\incredimail_install[1].exe:*:Enabled:IncrediMail Installer" "C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer" "C:\\Program Files\\Lemoncast\\lemoncast.exe"="C:\\Program Files\\Lemoncast\\lemoncast.exe:*:Enabled:OneClick" "C:\\Program Files\\IncrediMail\\bin\\ImLc.exe"="C:\\Program Files\\IncrediMail\\bin\\ImLc.exe:*:Enabled:IncrediMail" "C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe:*:Enabled:AOL" "C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\PopCap Games\\Zuma Deluxe\\Zuma.exe"="C:\\Program Files\\PopCap Games\\Zuma Deluxe\\Zuma.exe:*:Disabled:Zuma" "C:\\Program Files\\Fichiers communs\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Fichiers communs\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader" "C:\\Program Files\\Fichiers communs\\AOL\\1145603298\\ee\\aolsoftware.exe"="C:\\Program Files\\Fichiers communs\\AOL\\1145603298\\ee\\aolsoftware.exe:*:Enabled:AOL Services" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\Magentic\\bin\\MgImp.exe"="C:\\Program Files\\Magentic\\bin\\MgImp.exe:*:Enabled:Magentic" "C:\\Program Files\\Magentic\\bin\\Magentic.exe"="C:\\Program Files\\Magentic\\bin\\Magentic.exe:*:Enabled:Magentic" "C:\\Program Files\\Magentic\\bin\\MgApp.exe"="C:\\Program Files\\Magentic\\bin\\MgApp.exe:*:Enabled:Magentic" "C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL" "C:\\Program Files\\AOL 9.0d\\waol.exe"="C:\\Program Files\\AOL 9.0d\\waol.exe:*:Enabled:AOL" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Program Files\\AOL 9.0b\\waol.exe"="C:\\Program Files\\AOL 9.0b\\waol.exe:*:Enabled:AOL" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe:*:Enabled:AOL" "C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL" "C:\\Program Files\\AOL 9.0d\\waol.exe"="C:\\Program Files\\AOL 9.0d\\waol.exe:*:Enabled:AOL" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Program Files\\AOL 9.0b\\waol.exe"="C:\\Program Files\\AOL 9.0b\\waol.exe:*:Enabled:AOL" Export de la clef SharedTaskScheduler [sharedTaskScheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant" Rechercher adresses sensibles dans le fichier HOSTS... catchme 0.3.914 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-10 23:55:55 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden services: 0 hidden files: 0 KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Process list by traversal of KiWaitListHead 4 - System 192 - wuauclt.exe 496 - csrss.exe 520 - winlogon.exe 564 - services.exe 576 - lsass.exe 724 - svchost.exe 780 - svchost.exe 824 - svchost.exe 852 - wscntfy.exe 920 - svchost.exe 1024 - cmd.exe 1076 - spoolsv.exe 1176 - AOLacsd.exe 1192 - CDAC11BA.EXE 1240 - GoogleUpdaterSe 1276 - MDM.EXE 1316 - nvsvc32.exe 1616 - svchost.exe 1808 - explorer.exe 2040 - alg.exe Total number of processes = 21 NOTE: Under WinXP, this will not show all processes. KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Driver/Module list by traversal of PsLoadedModuleList 804D7000 - \WINDOWS\system32\ntoskrnl.exe 806EC000 - \WINDOWS\system32\hal.dll F8A35000 - \WINDOWS\system32\KDCOM.DLL F8945000 - \WINDOWS\system32\BOOTVID.dll F84E5000 - ACPI.sys F8A37000 - \WINDOWS\System32\DRIVERS\WMILIB.SYS F84D4000 - pci.sys F8535000 - isapnp.sys F8545000 - ohci1394.sys F8555000 - \WINDOWS\System32\DRIVERS\1394BUS.SYS F8A39000 - viaide.sys F87B5000 - \WINDOWS\System32\DRIVERS\PCIIDEX.SYS F8565000 - MountMgr.sys F84B5000 - ftdisk.sys F87BD000 - PartMgr.sys F8575000 - VolSnap.sys F849D000 - atapi.sys F8585000 - disk.sys F8595000 - \WINDOWS\System32\DRIVERS\CLASSPNP.SYS F847D000 - fltmgr.sys F846B000 - sr.sys F85A5000 - PxHelp20.sys F8949000 - PzWDM.sys F8454000 - KSecDD.sys F83C7000 - Ntfs.sys F839A000 - NDIS.sys F87C5000 - viaagp1.sys F837F000 - Mup.sys F85F5000 - \SystemRoot\System32\DRIVERS\intelppm.sys F7A58000 - \SystemRoot\System32\DRIVERS\nv4_mini.sys F7A44000 - \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS F88E5000 - \SystemRoot\System32\DRIVERS\RTL8139.SYS F8605000 - \SystemRoot\System32\DRIVERS\nic1394.sys F88ED000 - \SystemRoot\System32\DRIVERS\usbuhci.sys F7A21000 - \SystemRoot\System32\DRIVERS\USBPORT.SYS F88F5000 - \SystemRoot\System32\DRIVERS\usbehci.sys F8615000 - \SystemRoot\System32\DRIVERS\cdrom.sys F8625000 - \SystemRoot\System32\DRIVERS\redbook.sys F79FE000 - \SystemRoot\System32\DRIVERS\ks.sys F794B000 - \SystemRoot\system32\drivers\ALCXWDM.SYS F7927000 - \SystemRoot\system32\drivers\portcls.sys F8635000 - \SystemRoot\system32\drivers\drmk.sys F88FD000 - \SystemRoot\System32\DRIVERS\fdc.sys F7916000 - \SystemRoot\System32\DRIVERS\serial.sys F8283000 - \SystemRoot\System32\DRIVERS\serenum.sys F7902000 - \SystemRoot\System32\DRIVERS\parport.sys F8645000 - \SystemRoot\System32\DRIVERS\i8042prt.sys F8905000 - \SystemRoot\System32\DRIVERS\mouclass.sys F890D000 - \SystemRoot\System32\DRIVERS\kbdclass.sys F8C3E000 - \SystemRoot\system32\drivers\msmpu401.sys F827F000 - \SystemRoot\System32\DRIVERS\gameenum.sys F8C3F000 - \SystemRoot\System32\DRIVERS\audstub.sys F8655000 - \SystemRoot\System32\DRIVERS\rasl2tp.sys F827B000 - \SystemRoot\System32\DRIVERS\ndistapi.sys F78AD000 - \SystemRoot\System32\DRIVERS\ndiswan.sys F8665000 - \SystemRoot\System32\DRIVERS\raspppoe.sys F8675000 - \SystemRoot\System32\DRIVERS\raspptp.sys F8915000 - \SystemRoot\System32\DRIVERS\TDI.SYS F789C000 - \SystemRoot\System32\DRIVERS\psched.sys F8685000 - \SystemRoot\System32\DRIVERS\msgpc.sys F891D000 - \SystemRoot\System32\DRIVERS\ptilink.sys F8925000 - \SystemRoot\System32\DRIVERS\raspti.sys F892D000 - \SystemRoot\system32\DRIVERS\wanatw4.sys F8695000 - \SystemRoot\System32\DRIVERS\termdd.sys F8A75000 - \SystemRoot\System32\DRIVERS\swenum.sys F7868000 - \SystemRoot\System32\DRIVERS\update.sys F8267000 - \SystemRoot\System32\DRIVERS\mssmbios.sys F86A5000 - \SystemRoot\System32\Drivers\NDProxy.SYS F89CD000 - \SystemRoot\System32\Drivers\vulfntr.sys F86B5000 - \SystemRoot\System32\DRIVERS\usbhub.sys F8A7D000 - \SystemRoot\System32\DRIVERS\USBD.SYS F8935000 - \SystemRoot\System32\DRIVERS\flpydisk.sys F8A8B000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS F8BAD000 - \SystemRoot\System32\Drivers\Null.SYS F8A8D000 - \SystemRoot\System32\Drivers\Beep.SYS F8BAC000 - \SystemRoot\System32\Drivers\VIAPFD.SYS F87ED000 - \SystemRoot\System32\drivers\vga.sys F8A8F000 - \SystemRoot\System32\Drivers\mnmdd.SYS F8A91000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys F87F5000 - \SystemRoot\System32\Drivers\Msfs.SYS F87FD000 - \SystemRoot\System32\Drivers\Npfs.SYS F89E9000 - \SystemRoot\System32\DRIVERS\rasacd.sys EE6DD000 - \SystemRoot\System32\DRIVERS\ipsec.sys EE685000 - \SystemRoot\System32\DRIVERS\tcpip.sys EE65D000 - \SystemRoot\System32\DRIVERS\netbt.sys F89F1000 - \SystemRoot\System32\Drivers\nmconpid.SYS EE63B000 - \SystemRoot\System32\drivers\afd.sys F86D5000 - \SystemRoot\System32\DRIVERS\netbios.sys EE610000 - \SystemRoot\System32\DRIVERS\rdbss.sys EE579000 - \SystemRoot\System32\DRIVERS\mrxsmb.sys F8705000 - \SystemRoot\System32\Drivers\Fips.SYS EE558000 - \SystemRoot\System32\DRIVERS\ipnat.sys F8715000 - \SystemRoot\System32\DRIVERS\wanarp.sys F8725000 - \SystemRoot\System32\DRIVERS\arp1394.sys F8745000 - \SystemRoot\System32\Drivers\Cdfs.SYS EE540000 - \SystemRoot\System32\Drivers\dump_atapi.sys F8A95000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS BF800000 - \SystemRoot\System32\win32k.sys EE754000 - \SystemRoot\System32\drivers\Dxapi.sys F880D000 - \SystemRoot\System32\watchdog.sys BF9C3000 - \SystemRoot\System32\drivers\dxg.sys F8BE4000 - \SystemRoot\System32\drivers\dxgthk.sys BF9D5000 - \SystemRoot\System32\nv4_disp.dll EE377000 - \SystemRoot\System32\DRIVERS\ndisuio.sys EE10A000 - \SystemRoot\System32\DRIVERS\mrxdav.sys F8ABF000 - \SystemRoot\System32\Drivers\ParVdm.SYS EE223000 - \??\C:\WINDOWS\system32\drivers\CdaC15BA.SYS EDFA0000 - \SystemRoot\System32\DRIVERS\srv.sys EDE9B000 - \SystemRoot\system32\drivers\wdmaud.sys EE0AA000 - \SystemRoot\system32\drivers\sysaudio.sys ED951000 - \SystemRoot\System32\Drivers\HTTP.sys F8845000 - \SystemRoot\system32\DRIVERS\USBSTOR.SYS ED88E000 - \SystemRoot\System32\Drivers\Fastfat.SYS F8BB8000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys Total number of drivers = 114 Liste des programmes installes Adobe Flash Player 9 ActiveX Adobe Reader 7.0.9 - Français Adobe Shockwave Player AOL - Assistant de désinstallation AOL Auto-diagnostic AOL Coach Version 1.0(Build:20040229.1 fr) AOL Toolbar 2.0 AOL Uninstaller Atomica Deluxe 2.5 AutoUpdate Barre d'outils MSN Canon Camera WIA Driver Canon PowerShot A200 Pilote WIA CCleaner (remove only) Cubis 2 Deluxe Cubis Deluxe DivX DivX Player Ecran de veille AOL Photos EPSON Attach To Email EPSON Attach To Email EPSON Copy Utility 3 EPSON Easy Photo Print EPSON File Manager EPSON Image Clip Palette EPSON Logiciel imprimante EPSON Scan EPSON Scan Assistant EPSON Web-To-Page ESDX3800 Guide d'utilisation Extension HighMAT pour l'Assistant Graver un CD de Microsoft Windows XP Garfield 25th Anniversary Screen Saver Google Earth Google Toolbar for Internet Explorer Google Toolbar for Internet Explorer GSpot Codec Information Appliance HijackThis 1.99.1 Hotfix for Windows XP (KB915865) IncrediMail Xe J2SE Runtime Environment 5.0 Update 3 jv16 PowerTools 2007 L&H TTS3000 Français Learn2 Player (Uninstall Only) Lecteur Windows Media 11 Macrogaming SweetIM 2.0 Magic Ball Maxi Mah Jong 3D Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 French Language Pack Microsoft AutoRoute v11.0 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office Professional Edition 2003 Microsoft User-Mode Driver Framework Feature Pack 1.0 Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969) Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768) Mise à jour pour Windows XP (KB898461) Mise à jour pour Windows XP (KB931836) Navilog1 Version 2.0.5 NetSolitaire NVIDIA Windows 2000/XP Display Drivers OpiStat Outil de mise à jour Google Paint Shop Pro 6.02 CD Patience 2.4 Picasa 2 PIF DESIGNER QuickTime RealPlayer SafeCast Shared Components SAGEM F@st 800-840 Satsuki Decoder Pack Security Update for CAPICOM (KB931906) Security Update for CAPICOM (KB931906) Shockwave SLD Codec Pack SolSuite Spybot - Search & Destroy 1.4 SweetIM For Internet Explorer 3.0b TX RecordNow DX TX RecordNow DX Update Manager Viewpoint Media Player Visionneuse Journal Windows Microsoft WebFldrs XP Winamp (remove only) Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool Windows Internet Explorer 7 Windows Live Messenger Windows Live Sign-in Assistant Windows Media Format 11 runtime WinRAR archiver Yahoo! Toolbar Yahoo! Toolbar avec bloqueur de fenêtres pop-up Zip Password Recovery Zuma Deluxe! 1.0 Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est B82F-A082 Répertoire de C:\Program Files 10/07/2007 23:23 <REP> . 10/07/2007 23:23 <REP> .. 21/07/2005 16:24 <REP> 2004 Mahjongg Lite 4r 08/09/2006 11:20 <REP> Absolutist.com 21/12/2006 18:30 <REP> Adobe 02/06/2006 10:13 <REP> Alawar 07/01/2007 20:55 <REP> AOL 08/05/2007 14:03 <REP> AOL 9.0 12/10/2006 17:22 <REP> AOL 9.0a 10/06/2007 08:58 <REP> AOL 9.0b 08/05/2007 14:23 <REP> AOL 9.0c 10/05/2007 17:06 <REP> AOL 9.0d 13/10/2006 16:57 <REP> AOL Compagnon 14/07/2006 16:24 <REP> AOL Toolbar 10/07/2007 21:36 <REP> BFG 29/04/2006 15:32 <REP> CCleaner 20/04/2006 18:04 <REP> Common files 14/08/2005 12:07 <REP> DivX 03/06/2007 11:27 <REP> eMule 10/01/2006 10:48 <REP> EPSON 27/10/2006 17:42 15 672 ffdsasetts.reg 27/10/2006 17:42 40 430 ffdssetts.reg 27/10/2006 17:42 30 164 ffdsvsetts.reg 05/07/2007 08:06 <REP> Fichiers communs 24/05/2006 09:14 <REP> FreshGames 05/07/2007 08:03 <REP> Google 11/11/2004 15:17 <REP> GSpot 10/07/2007 12:22 <REP> HjackThis 16/02/2007 18:54 <REP> IncrediMail 12/05/2007 03:10 <REP> Internet Explorer 10/11/2005 11:01 <REP> Inventel 31/01/2007 20:22 <REP> Java 05/07/2007 09:37 <REP> jv16 PowerTools 2007 23/02/2007 19:00 <REP> Macrogaming 02/01/2007 12:51 <REP> Magic Ball 2 New Worlds 28/04/2005 16:06 <REP> Mahjong Quest 15/02/2005 01:42 <REP> Messenger 12/07/2005 19:01 <REP> Micro Application 11/11/2004 14:35 <REP> Microsoft AutoRoute 12/05/2007 03:11 <REP> Microsoft CAPICOM 2.1.0.2 11/11/2004 13:02 <REP> microsoft frontpage 11/11/2004 14:34 <REP> Microsoft Office 11/11/2004 14:13 <REP> Microsoft Visual Studio 11/11/2004 14:27 <REP> Microsoft Works 11/11/2004 14:14 <REP> Microsoft.NET 11/11/2004 13:26 <REP> Movie Maker 27/10/2006 17:42 596 mpc1.reg 27/10/2006 17:42 680 mpc2.reg 27/10/2006 17:42 3 006 mpc3.reg 27/10/2006 17:42 3 948 mpc4.reg 27/10/2006 17:42 16 954 mpc5.reg 27/10/2006 17:42 18 156 mpc6.reg 27/10/2006 17:42 5 352 mpc7.reg 11/11/2004 12:58 <REP> MSN 20/03/2005 20:38 <REP> MSN Apps 11/11/2004 12:58 <REP> MSN Gaming Zone 13/05/2007 10:09 <REP> MSN Messenger 10/07/2007 23:54 <REP> Navilog1 10/07/2007 22:22 <REP> NetMeeting 08/02/2005 12:51 <REP> NetSolitaire 31/12/2006 15:47 102 400 Nouveau Application Microsoft Office Access.mdb 19/03/2007 16:36 <REP> Oberon Media 11/11/2004 14:31 <REP> OfficeUpdate11 17/11/2005 09:58 <REP> OpiStat 12/07/2006 11:33 <REP> orange 15/12/2006 11:26 <REP> Outlook Express 10/07/2007 23:16 <REP> Paint Shop Pro 6 25/04/2006 17:15 <REP> Patience 17/03/2007 09:56 <REP> Picasa2 26/03/2007 09:21 <REP> PopCap Games 21/12/2004 19:33 <REP> QuickTime 27/03/2006 17:37 <REP> Real 31/05/2006 08:47 <REP> ReflexiveArcade 08/07/2007 17:02 <REP> SAGEM 01/07/2006 10:58 <REP> Satsuki Decoder Pack 01/07/2006 10:58 4 482 satsukidecodersettings.ini 05/07/2007 08:47 <REP> shangai 26/09/2005 23:27 <REP> SLD Codec Pack 25/05/2006 18:49 <REP> SolSuite 10/07/2007 01:00 <REP> Spybot - Search & Destroy 31/03/2006 12:56 <REP> TechCity Solutions 04/02/2007 13:47 <REP> TX RecordNow DX 29/10/2006 14:47 <REP> VERITAS Software 11/11/2004 15:42 <REP> VIA Technologies, Inc 01/06/2006 09:10 <REP> Visual Zip Password Recovery 10/07/2007 21:49 <REP> VSO 23/06/2006 13:56 <REP> Winamp 11/11/2004 15:27 <REP> Windows Journal Viewer 15/01/2007 19:34 <REP> Windows Media Connect 2 15/01/2007 19:34 <REP> Windows Media Player 11/11/2004 13:24 <REP> Windows NT 17/04/2005 03:09 <REP> WinRAR 11/11/2004 13:02 <REP> xerox 13/07/2006 11:09 <REP> Yahoo! 13/04/2007 16:02 <REP> Zylom Games 12 fichier(s) 241 840 octets 83 Rép(s) 76 134 633 472 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est B82F-A082 Répertoire de C:\Program Files\fichiers communs 05/07/2007 08:06 <REP> . 05/07/2007 08:06 <REP> .. 27/03/2005 19:25 <REP> Adobe 10/06/2007 09:14 <REP> AOL 27/03/2006 17:39 <REP> aolback 10/06/2007 08:56 <REP> aolshare 20/05/2006 14:49 <REP> BOONTY Shared 11/11/2004 14:13 <REP> DESIGNER 18/08/2005 10:18 <REP> DirectX 24/09/2005 10:54 <REP> Droppix 15/11/2005 10:54 278 528 FDEUnInstaller.exe 10/01/2006 10:54 <REP> InstallShield 31/01/2007 20:20 <REP> Java 16/02/2005 15:42 <REP> Macrovision Shared 18/01/2007 19:10 <REP> Microsoft Shared 11/11/2004 13:00 <REP> MSSoap 27/03/2006 17:38 <REP> Nullsoft 11/11/2004 12:46 <REP> ODBC 11/01/2007 16:27 <REP> Real 21/04/2006 09:09 <REP> Scanner 11/11/2004 13:00 <REP> Services 08/01/2007 16:47 <REP> Softwin 11/11/2004 12:46 <REP> SpeechEngines 08/07/2007 17:59 <REP> Symantec Shared 15/12/2006 11:26 <REP> System 11/01/2007 16:27 <REP> xing shared 1 fichier(s) 278 528 octets 25 Rép(s) 76 134 633 472 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est B82F-A082 Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders 11/11/2004 14:13 <REP> . 11/11/2004 14:13 <REP> .. 11/11/2004 14:13 <REP> 1033 11/11/2004 14:13 <REP> 1036 11/07/2003 11:15 1 292 872 MSONSEXT.DLL 15/07/2003 07:52 35 896 MSOSV.DLL 03/06/1999 15:09 122 937 MSOWS409.DLL 07/03/2001 10:00 127 033 MSOWS40c.DLL 11/07/2003 03:25 80 448 PKMWS.DLL 5 fichier(s) 1 659 186 octets 4 Rép(s) 76 134 633 472 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est B82F-A082 Répertoire de C:\Program Files\common files 20/04/2006 18:04 <REP> . 20/04/2006 18:04 <REP> .. 17/11/2006 15:10 <REP> Companion Wizard 23/11/2004 18:59 <REP> Microsoft Shared 0 fichier(s) 0 octets 4 Rép(s) 76 134 633 472 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est B82F-A082 Répertoire de C:\ 12/05/2007 18:22 68 096 diff.exe 12/05/2007 18:22 103 424 grep.exe 2 fichier(s) 171 520 octets 0 Rép(s) 76 134 633 472 octets libres c:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0b\AMP\ampx.exe c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\PPClean.exe c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\alsetup.exe c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\aspinst.exe c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\muninst.exe c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\ocpinst.exe c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\postproc.exe c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\setup.exe c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\tbsetup.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\afixinst.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\afixlang.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\afixlang_fr.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\alsetup.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\CCUInst.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\cculang.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\cculang_fr.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\iphinst.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\muinst.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\ocpinst.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\postproc.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\setup.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\sminstlp.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\sminstlp_fr.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\stmninst.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ietoolbar_fr_1.0.17.5\setup.exe c:\Documents and Settings\All Users\Application Data\AOL Downloads\ietoolbar_fr_1.0.17.5\toolbar.exe c:\Documents and Settings\All Users\Application Data\Google Updater\cache\GoogleDesktopSetup.exe c:\Documents and Settings\All Users\Application Data\Google Updater\cache\installers_ci_tb_fr_4.0.1020.6156_setup_2006.12.04_11.11.09.exe c:\Documents and Settings\All Users\Application Data\Google Updater\cache\promo=132933.exe c:\Documents and Settings\All Users\Menu Démarrer\Programmes\Télécharger des logiciels.exe c:\Documents and Settings\Dominique\.limewire\.NetworkShare\LimeWireWin4.12.6-fixed.exe c:\Documents and Settings\Dominique\.limewire\.NetworkShare\LimeWireWinInstaller.exe c:\Documents and Settings\Dominique\Application Data\ezpinst.exe c:\Documents and Settings\Dominique\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_fr_FR.exe c:\Documents and Settings\Dominique\Application Data\Microsoft\Installer\{F6D63A65-BD23-46F3-B9A3-87F442423481}\ARPPRODUCTICON.exe c:\Documents and Settings\Dominique\Bureau\Navilog1.exe c:\Documents and Settings\Dominique\Bureau\DiagHelp\catchme.exe c:\Documents and Settings\Dominique\Bureau\DiagHelp\diff.exe c:\Documents and Settings\Dominique\Bureau\DiagHelp\dumphive.exe c:\Documents and Settings\Dominique\Bureau\DiagHelp\FilesInfoCmd.exe c:\Documents and Settings\Dominique\Bureau\DiagHelp\find2.exe c:\Documents and Settings\Dominique\Bureau\DiagHelp\Fport.exe c:\Documents and Settings\Dominique\Bureau\DiagHelp\grep.exe c:\Documents and Settings\Dominique\Bureau\DiagHelp\KProcCheck.exe c:\Documents and Settings\Dominique\Bureau\DiagHelp\LFiles.exe c:\Documents and Settings\Dominique\Bureau\DiagHelp\LISTDLLS.exe c:\Documents and Settings\Dominique\Bureau\DiagHelp\pslist.exe c:\Documents and Settings\Dominique\Bureau\DiagHelp\streams.exe c:\Documents and Settings\Dominique\Bureau\DiagHelp\swreg.exe c:\Documents and Settings\Dominique\Mes documents\copytodvd4_setup.exe c:\Documents and Settings\Dominique\Mes documents\Satsuki.Decoder.Pack.3.1.0.3.exe c:\Documents and Settings\Dominique\Mes documents\sld.codec.pack.2.2.exe c:\Documents and Settings\Dominique\Mes documents\wrar342.exe c:\Documents and Settings\Dominique\Mes documents\Adobe Illustrator CS 11.0.0 Fr\setup.exe c:\Documents and Settings\Dominique\Mes documents\sarah\power shot\CNDNDlg.exe c:\Documents and Settings\Dominique\Mes documents\sarah\power shot\k3405frx.exe c:\Documents and Settings\Dominique\Mes documents\Scrabble(FR-DE-SP-EN)-Game.Board.Game.testé.www.divxovore.com\Scrabble\RegSetup.exe c:\Documents and Settings\Dominique\Mes documents\Scrabble(FR-DE-SP-EN)-Game.Board.Game.testé.www.divxovore.com\Scrabble\Scrabble.exe c:\Documents and Settings\Dominique\Mes documents\Scrabble(FR-DE-SP-EN)-Game.Board.Game.testé.www.divxovore.com\Scrabble\unpack.exe c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\aspchk.dll c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\gui.dll c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\instph.dll c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\instSup.dll c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\ocpchk.dll c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\ProgUpd.dll c:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\tbinst.dll c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\CCNdInst.dll c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\gui.dll c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\instph.dll c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\instSup.dll c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\ocfcheck.dll c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\ocpchk.dll c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\ProgUpd.dll c:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\tbinst.dll c:\Documents and Settings\All Users\Application Data\AOL Downloads\ietoolbar_fr_1.0.17.5\aoltbchk.dll c:\Documents and Settings\All Users\Application Data\AOL Downloads\ietoolbar_fr_1.0.17.5\gui.dll c:\Documents and Settings\All Users\Application Data\AOL Downloads\ietoolbar_fr_1.0.17.5\instph.dll c:\Documents and Settings\All Users\Application Data\AOL Downloads\ietoolbar_fr_1.0.17.5\ProgUpd.dll c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylomgamesplayer.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Babel\babel.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Babel\fmod.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Babel\fr-FR\babel.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Babel\fr-FR\fmod.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chainz2\fr-FR\chainz2.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chainz2\fr-FR\core.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chainz2\fr-FR\file.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chainz2\fr-FR\fmod.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chainz2\fr-FR\gfx2d.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chainz2\fr-FR\gfx2d_dd7.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chainz2\fr-FR\imglib.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chainz2\fr-FR\jpeg.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chainz2\fr-FR\logger.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chainz2\fr-FR\msvcr71.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chainz2\fr-FR\snd3d.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chainz2\fr-FR\snd3d_fmod.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chainz2\fr-FR\ui2.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\chuzzle\fr-FR\Chuzzle.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\GenericGameExtension\GenericGameExtension.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\mahjongescapeaj\fr-FR\bass.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\mahjongescapeaj\fr-FR\mahjongescapeaj.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\mahjongescapeaj\fr-FR\Resource.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\MahjongFortuna2\fr-FR\fmod.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\MahjongFortuna2\fr-FR\mahjongfortuna2.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\MumboJumboExtension\MumboJumboExtension.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\MyZylomExtension\MyZylomExtension.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\PlaytimeExtension\PlaytimeExtension.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\PopcapExtension\PopcapExtension.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Ribiba\fr-FR\ribiba.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\ShangriLa\fr-FR\fmod.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\ShangriLa\fr-FR\shangrila.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\textexpress2\fr-FR\fmod.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\textexpress2\fr-FR\textexpress2.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\TrivialPursuit\fr-FR\fmod.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\TrivialPursuit\fr-FR\msvcr71d.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\TrivialPursuit\fr-FR\trivialpursuit.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\ZylomDeluxeInstaller\ZylomDeluxeInstaller.dll c:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\ZylomExtension\ZylomExtension.dll c:\Documents and Settings\Dominique\Application Data\Identities\{00009BV5-V6E6-N99D-O8SF-9VRP3OLUMVK3}\xmlparse.dll c:\Documents and Settings\Dominique\Application Data\Identities\{000HQ7FF-AD7A-3FG1-FP6A-215DM52C4VUV}\xmlparse.dll c:\Documents and Settings\Dominique\Application Data\Identities\{000HQ7FF-AD7A-3FG3-4A90-24BL1LF8IVV6}\xmlparse.dll c:\Documents and Settings\Dominique\Application Data\Identities\{002AVPFP-JHLQ-ABE1-51HL-20PR0G666VVQ}\xmlparse.dll c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll ****** Fin du rapport DiagHelp 2 FPort v2.0 - TCP/IP Process to Port Mapper Copyright 2000 by Foundstone, Inc. http://www.foundstone.com Pid Process Port Proto Path 2040 -> 1025 TCP 780 -> 135 TCP 4 System -> 445 TCP 780 -> 445 UDP 2040 -> 4500 UDP 0 System -> 123 UDP 0 System -> 1900 UDP 4 System -> 500 UDP PsList 1.26 - Process Information Lister Copyright © 1999-2004 Mark Russinovich Sysinternals - www.sysinternals.com Process information for ASTAMM-DOMI: Name Pid Pri Thd Hnd VM WS Priv Idle 0 0 1 0 0 16 0 System 4 8 50 164 1904 220 0 smss 440 11 3 21 3828 372 164 csrss 496 13 10 384 23576 3472 1636 winlogon 520 13 19 423 52900 3208 6548 services 564 9 15 265 22064 3424 1696 svchost 724 8 19 213 62132 4964 3120 svchost 780 8 11 247 35452 4052 1728 svchost 824 8 76 1330 95468 19780 12556 wscntfy 852 8 1 27 26888 1980 516 svchost 864 8 4 52 27804 2800 1072 svchost 920 8 13 194 37796 4288 1628 spoolsv 1076 8 13 140 45368 4888 3276 AOLacsd 1176 8 6 95 39540 4108 1696 CDAC11BA 1192 8 4 28 13572 1128 312 GoogleUpdaterService 1240 8 6 85 35124 2956 1888 MDM 1276 8 5 86 34620 2744 868 nvsvc32 1316 8 3 51 20272 2056 552 svchost 1616 8 7 126 36708 4128 2404 wanmpsvc 1640 8 7 69 29488 416 756 alg 2040 8 6 98 33064 3460 1132 lsass 576 9 19 326 41272 1336 3608 explorer 1808 8 18 531 97840 25296 18676 cmd 160 8 1 20 14016 1648 1504 pslist 1752 13 2 83 17908 1784 768 ListDLLs v2.25 - DLL lister for Win9x/NT Copyright © 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ explorer.exe pid: 1808 Command line: C:\WINDOWS\explorer.exe Base Size Version Path 0x7c800000 0x104000 5.01.2600.2945 C:\WINDOWS\system32\kernel32.dll 0x77ef0000 0x47000 5.01.2600.3099 C:\WINDOWS\system32\GDI32.dll 0x7e390000 0x90000 5.01.2600.3099 C:\WINDOWS\system32\USER32.dll 0x77f40000 0x76000 6.00.2900.2995 C:\WINDOWS\system32\SHLWAPI.dll 0x7c9d0000 0x823000 6.00.2900.3051 C:\WINDOWS\system32\SHELL32.dll 0x774a0000 0x13d000 5.01.2600.2726 C:\WINDOWS\system32\ole32.dll 0x75f10000 0xfd000 6.00.2900.2995 C:\WINDOWS\system32\BROWSEUI.dll 0x77720000 0x170000 6.00.2900.2987 C:\WINDOWS\system32\SHDOCVW.dll 0x6fee0000 0x54000 5.01.2600.2976 C:\WINDOWS\system32\NETAPI32.dll 0x44080000 0xcf000 7.00.6000.16441 C:\WINDOWS\system32\WININET.dll 0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll 0x43e00000 0x45000 7.00.6000.16441 C:\WINDOWS\system32\iertutil.dll 0x77390000 0x103000 6.00.2900.2982 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll 0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll 0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll 0x76920000 0x8000 5.01.2600.2751 C:\WINDOWS\system32\LINKINFO.dll 0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL 0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll 0x44360000 0x5ca000 7.00.6000.16441 C:\WINDOWS\system32\ieframe.dll 0x44160000 0x124000 7.00.6000.16441 C:\WINDOWS\system32\urlmon.dll 0x72c60000 0x8000 5.01.2600.0000 C:\WINDOWS\system32\msacm32.drv 0x442b0000 0x3c000 7.00.6000.16441 C:\WINDOWS\system32\webcheck.dll 0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\WPDShServiceObj.dll 0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceTypes.dll 0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll 0x76d10000 0x19000 5.01.2600.2912 C:\WINDOWS\system32\iphlpapi.dll 0x10000000 0xd000 7.00.0009.0050 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll 0x7c340000 0x56000 7.10.3052.0004 C:\WINDOWS\system32\MSVCR71.dll 0x02190000 0x5b000 1.01.0000.0000 C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll 0x77210000 0xb1000 5.01.2600.3019 C:\WINDOWS\system32\SXS.DLL 0x02670000 0x1c000 7.00.0000.0000 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll 0x01bd0000 0x2b000 C:\Program Files\WinRAR\rarext.dll 0x02ab0000 0x13000 2.00.0000.0000 C:\PROGRA~1\INCRED~1\bin\ImShExt.dll 0x02bd0000 0x92000 4.00.0001.0049 C:\PROGRA~1\VSO\COPYTO~1\CTCDSH~1.DLL 0x0ffd0000 0x28000 5.01.2600.2161 C:\WINDOWS\system32\rsaenh.dll 0x60980000 0x7000 3.01.4000.1823 C:\WINDOWS\system32\MSISIP.DLL 0x74e10000 0x10000 5.06.0000.8820 C:\WINDOWS\system32\wshext.dll 0x73d20000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL 0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL 0x59000000 0xe000 5.06.0000.6626 C:\WINDOWS\system32\wshFR.DLL 0x36d30000 0x1a000 11.00.6357.0000 C:\PROGRA~1\MICROS~2\OFFICE11\MCPS.DLL ListDLLs v2.25 - DLL lister for Win9x/NT Copyright © 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com No matching processes were found. ListDLLs v2.25 - DLL lister for Win9x/NT Copyright © 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ winlogon.exe pid: 520 Command line: winlogon.exe Base Size Version Path 0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe 0x7c800000 0x104000 5.01.2600.2945 C:\WINDOWS\system32\kernel32.dll 0x77680000 0x11000 5.01.2600.2622 C:\WINDOWS\system32\AUTHZ.dll 0x7e390000 0x90000 5.01.2600.3099 C:\WINDOWS\system32\USER32.dll 0x77ef0000 0x47000 5.01.2600.3099 C:\WINDOWS\system32\GDI32.dll 0x6fee0000 0x54000 5.01.2600.2976 C:\WINDOWS\system32\NETAPI32.dll 0x7c9d0000 0x823000 6.00.2900.3051 C:\WINDOWS\system32\SHELL32.dll 0x77f40000 0x76000 6.00.2900.2995 C:\WINDOWS\system32\SHLWAPI.dll 0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll 0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll 0x77390000 0x103000 6.00.2900.2982 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll 0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll 0x776a0000 0x24000 6.00.2900.3051 C:\WINDOWS\system32\SHSVCS.dll 0x774a0000 0x13d000 5.01.2600.2726 C:\WINDOWS\system32\ole32.dll 0x77210000 0xb1000 5.01.2600.3019 C:\WINDOWS\system32\sxs.dll 0x0ffd0000 0x28000 5.01.2600.2161 C:\WINDOWS\system32\rsaenh.dll 0x011d0000 0x3b000 1.07.0018.0005 C:\WINDOWS\system32\WgaLogon.dll 0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL 0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll 0x76d10000 0x19000 5.01.2600.2912 C:\WINDOWS\system32\iphlpapi.dll 0x72c60000 0x8000 5.01.2600.0000 C:\WINDOWS\system32\msacm32.drv 0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL ListDLLs v2.25 - DLL lister for Win9x/NT Copyright © 1997-2004 Mark Russinovich Sysinternals - www.sysinternals.com ------------------------------------------------------------------------------ services.exe pid: 564 Command line: C:\WINDOWS\system32\services.exe Base Size Version Path 0x7c800000 0x104000 5.01.2600.2945 C:\WINDOWS\system32\kernel32.dll 0x7e390000 0x90000 5.01.2600.3099 C:\WINDOWS\system32\USER32.dll 0x77ef0000 0x47000 5.01.2600.3099 C:\WINDOWS\system32\GDI32.dll 0x77680000 0x11000 5.01.2600.2622 C:\WINDOWS\system32\AUTHZ.dll 0x7dbc0000 0x21000 5.01.2600.2744 C:\WINDOWS\system32\umpnpmgr.dll 0x6fee0000 0x54000 5.01.2600.2976 C:\WINDOWS\system32\NETAPI32.dll 0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll 0x47260000 0xf000 5.01.2600.3008 C:\WINDOWS\AppPatch\AcAdProc.dll Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est B82F-A082 Répertoire de C:\Program Files 10/07/2007 23:23 <REP> . 10/07/2007 23:23 <REP> .. 21/07/2005 16:24 <REP> 2004 Mahjongg Lite 4r 08/09/2006 11:20 <REP> Absolutist.com 21/12/2006 18:30 <REP> Adobe 02/06/2006 10:13 <REP> Alawar 07/01/2007 20:55 <REP> AOL 08/05/2007 14:03 <REP> AOL 9.0 12/10/2006 17:22 <REP> AOL 9.0a 10/06/2007 08:58 <REP> AOL 9.0b 08/05/2007 14:23 <REP> AOL 9.0c 10/05/2007 17:06 <REP> AOL 9.0d 13/10/2006 16:57 <REP> AOL Compagnon 14/07/2006 16:24 <REP> AOL Toolbar 10/07/2007 21:36 <REP> BFG 29/04/2006 15:32 <REP> CCleaner 20/04/2006 18:04 <REP> Common files 14/08/2005 12:07 <REP> DivX 03/06/2007 11:27 <REP> eMule 10/01/2006 10:48 <REP> EPSON 27/10/2006 17:42 15 672 ffdsasetts.reg 27/10/2006 17:42 40 430 ffdssetts.reg 27/10/2006 17:42 30 164 ffdsvsetts.reg 05/07/2007 08:06 <REP> Fichiers communs 24/05/2006 09:14 <REP> FreshGames 05/07/2007 08:03 <REP> Google 11/11/2004 15:17 <REP> GSpot 10/07/2007 12:22 <REP> HjackThis 16/02/2007 18:54 <REP> IncrediMail 12/05/2007 03:10 <REP> Internet Explorer 10/11/2005 11:01 <REP> Inventel 31/01/2007 20:22 <REP> Java 05/07/2007 09:37 <REP> jv16 PowerTools 2007 23/02/2007 19:00 <REP> Macrogaming 02/01/2007 12:51 <REP> Magic Ball 2 New Worlds 28/04/2005 16:06 <REP> Mahjong Quest 15/02/2005 01:42 <REP> Messenger 12/07/2005 19:01 <REP> Micro Application 11/11/2004 14:35 <REP> Microsoft AutoRoute 12/05/2007 03:11 <REP> Microsoft CAPICOM 2.1.0.2 11/11/2004 13:02 <REP> microsoft frontpage 11/11/2004 14:34 <REP> Microsoft Office 11/11/2004 14:13 <REP> Microsoft Visual Studio 11/11/2004 14:27 <REP> Microsoft Works 11/11/2004 14:14 <REP> Microsoft.NET 11/11/2004 13:26 <REP> Movie Maker 27/10/2006 17:42 596 mpc1.reg 27/10/2006 17:42 680 mpc2.reg 27/10/2006 17:42 3 006 mpc3.reg 27/10/2006 17:42 3 948 mpc4.reg 27/10/2006 17:42 16 954 mpc5.reg 27/10/2006 17:42 18 156 mpc6.reg 27/10/2006 17:42 5 352 mpc7.reg 11/11/2004 12:58 <REP> MSN 20/03/2005 20:38 <REP> MSN Apps 11/11/2004 12:58 <REP> MSN Gaming Zone 13/05/2007 10:09 <REP> MSN Messenger 10/07/2007 23:54 <REP> Navilog1 10/07/2007 22:22 <REP> NetMeeting 08/02/2005 12:51 <REP> NetSolitaire 31/12/2006 15:47 102 400 Nouveau Application Microsoft Office Access.mdb 19/03/2007 16:36 <REP> Oberon Media 11/11/2004 14:31 <REP> OfficeUpdate11 17/11/2005 09:58 <REP> OpiStat 12/07/2006 11:33 <REP> orange 15/12/2006 11:26 <REP> Outlook Express 10/07/2007 23:16 <REP> Paint Shop Pro 6 25/04/2006 17:15 <REP> Patience 17/03/2007 09:56 <REP> Picasa2 26/03/2007 09:21 <REP> PopCap Games 21/12/2004 19:33 <REP> QuickTime 27/03/2006 17:37 <REP> Real 31/05/2006 08:47 <REP> ReflexiveArcade 08/07/2007 17:02 <REP> SAGEM 01/07/2006 10:58 <REP> Satsuki Decoder Pack 01/07/2006 10:58 4 482 satsukidecodersettings.ini 05/07/2007 08:47 <REP> shangai 26/09/2005 23:27 <REP> SLD Codec Pack 25/05/2006 18:49 <REP> SolSuite 10/07/2007 01:00 <REP> Spybot - Search & Destroy 31/03/2006 12:56 <REP> TechCity Solutions 04/02/2007 13:47 <REP> TX RecordNow DX 29/10/2006 14:47 <REP> VERITAS Software 11/11/2004 15:42 <REP> VIA Technologies, Inc 01/06/2006 09:10 <REP> Visual Zip Password Recovery 10/07/2007 21:49 <REP> VSO 23/06/2006 13:56 <REP> Winamp 11/11/2004 15:27 <REP> Windows Journal Viewer 15/01/2007 19:34 <REP> Windows Media Connect 2 15/01/2007 19:34 <REP> Windows Media Player 11/11/2004 13:24 <REP> Windows NT 17/04/2005 03:09 <REP> WinRAR 11/11/2004 13:02 <REP> xerox 13/07/2006 11:09 <REP> Yahoo! 13/04/2007 16:02 <REP> Zylom Games 12 fichier(s) 241 840 octets 83 Rép(s) 76 134 998 016 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est B82F-A082 Répertoire de C:\ 12/05/2007 18:22 68 096 diff.exe 12/05/2007 18:22 103 424 grep.exe Répertoire de C:\ 12/05/2007 18:22 68 096 diff.exe 12/05/2007 18:22 103 424 grep.exe 4 fichier(s) 343 040 octets 0 Rép(s) 76 134 998 016 octets libres C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0b\AMP\ampx.exe C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\PPClean.exe C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\alsetup.exe C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\aspinst.exe C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\muninst.exe C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\ocpinst.exe C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\postproc.exe C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\setup.exe C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\antiSpyware\dat\updates\aspapp\tbsetup.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\afixinst.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\afixlang.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\afixlang_fr.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\alsetup.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\CCUInst.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\cculang.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\cculang_fr.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\iphinst.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\muinst.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\ocpinst.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\postproc.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\setup.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\sminstlp.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\sminstlp_fr.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ccu_suite_fr_1.1.17.1\stmninst.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ietoolbar_fr_1.0.17.5\setup.exe C:\Documents and Settings\All Users\Application Data\AOL Downloads\ietoolbar_fr_1.0.17.5\toolbar.exe C:\Documents and Settings\All Users\Application Data\Google Updater\cache\GoogleDesktopSetup.exe C:\Documents and Settings\All Users\Application Data\Google Updater\cache\installers_ci_tb_fr_4.0.1020.6156_setup_2006.12.04_11.11.09.exe C:\Documents and Settings\All Users\Application Data\Google Updater\cache\promo=132933.exe C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Télécharger des logiciels.exe C:\Documents and Settings\Dominique\.limewire\.NetworkShare\LimeWireWin4.12.6-fixed.exe C:\Documents and Settings\Dominique\.limewire\.NetworkShare\LimeWireWinInstaller.exe C:\Documents and Settings\Dominique\Application Data\ezpinst.exe C:\Documents and Settings\Dominique\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_fr_FR.exe C:\Documents and Settings\Dominique\Application Data\Microsoft\Installer\{F6D63A65-BD23-46F3-B9A3-87F442423481}\ARPPRODUCTICON.exe C:\Documents and Settings\Dominique\Bureau\Navilog1.exe C:\Documents and Settings\Dominique\Bureau\DiagHelp\catchme.exe C:\Documents and Settings\Dominique\Bureau\DiagHelp\diff.exe C:\Documents and Settings\Dominique\Bureau\DiagHelp\dumphive.exe C:\Documents and Settings\Dominique\Bureau\DiagHelp\FilesInfoCmd.exe C:\Documents and Settings\Dominique\Bureau\DiagHelp\find2.exe C:\Documents and Settings\Dominique\Bureau\DiagHelp\Fport.exe C:\Documents and Settings\Dominique\Bureau\DiagHelp\grep.exe C:\Documents and Settings\Dominique\Bureau\DiagHelp\KProcCheck.exe C:\Documents and Settings\Dominique\Bureau\DiagHelp\LFiles.exe C:\Documents and Settings\Dominique\Bureau\DiagHelp\LISTDLLS.exe C:\Documents and Settings\Dominique\Bureau\DiagHelp\pslist.exe C:\Documents and Settings\Dominique\Bureau\DiagHelp\streams.exe C:\Documents and Settings\Dominique\Bureau\DiagHelp\swreg.exe C:\Documents and Settings\Dominique\Mes documents\copytodvd4_setup.exe C:\Documents and Settings\Dominique\Mes documents\Satsuki.Decoder.Pack.3.1.0.3.exe C:\Documents and Settings\Dominique\Mes documents\sld.codec.pack.2.2.exe C:\Documents and Settings\Dominique\Mes documents\wrar342.exe C:\Documents and Settings\Dominique\Mes documents\Adobe Illustrator CS 11.0.0 Fr\setup.exe C:\Documents and Settings\Dominique\Mes documents\sarah\power shot\CNDNDlg.exe C:\Documents and Settings\Dominique\Mes documents\sarah\power shot\k3405frx.exe C:\Documents and Settings\Dominique\Mes documents\Scrabble(FR-DE-SP-EN)-Game.Board.Game.testé.www.divxovore.com\Scrabble\RegSetup.exe C:\Documents and Settings\Dominique\Mes documents\Scrabble(FR-DE-SP-EN)-Game.Board.Game.testé.www.divxovore.com\Scrabble\Scrabble.exe C:\Documents and Settings\Dominique\Mes documents\Scrabble(FR-DE-SP-EN)-Game.Board.Game.testé.www.divxovore.com\Scrabble\unpack.exe

Bonsoir Voici le rapport : Search Navipromo version 2.0.5 commencé le 10/07/2007 à 23:24:51,68 !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!! !!! Poster ce rapport sur le forum pour le faire analyser !!! !!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!! Fix lancé depuis C:\Program Files\navilog1 Mise a jour le 01.07.2007 a 12h00 by IL-MAFIOSO Executé en mode normal *** Recherche Programmes installes *** *** Recherche dossiers dans C:\WINDOWS *** *** Recherche dossiers dans C:\Program Files *** *** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data *** *** Recherche dossiers dans C:\Documents and Settings\Dominique\Application Data *** ...\Application Data\MessengerSkinner trouvé ! *** Recherche avec BlackLight Engine/F-secure *** BlackLight Engine est un produit de F-secure, pour + d'infos : http://www.f-secure.com/blacklight/blacklight_help.html F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR ====================================== Copyright 2005-2006 F-Secure Corporation. All rights reserved. This is a beta version. It will expire on 1st of October, 2007. Version information: 2.2.1064. [+] Started on 07/10/07 at 23:24:53. [+] Initializing ... [+] Starting scan, press Ctrl-C to abort. [+] Scanning for hidden items ......................................................... [+] Scan complete. [+] Summary: 0 hidden item(s) found, 0 scheduled for renaming. [+] Exited on 07/10/07 at 23:31:13 (return code = 0). *** Recherche fichiers *** C:\WINDOWS\pack.epk trouvé ! C:\WINDOWS\system32\nvs2.inf trouvé ! *** Recherche cles registre *** Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs] Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/egaccess4_1063.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/egaccess4_1064.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/egaccess4_1066.dll Recherche Clé Magic Control HKEY_CURRENT_USER\Software\Lanconfig trouvé ! HKEY_USERS\S-1-5-21-1202660629-73586283-725345543-1004\Software\Lanconfig trouvé ! *** Module de Recherche complémentaire *** (Recherche fichiers spécifiques) 1)Recherche fichiers connus: 2)Recherche Heuristique : * C:\WINDOWS\system32\irkjmebghx.dat trouvé ! ** C:\WINDOWS\system32\irkjmebghx.dat trouvé ! *** **** C:\WINDOWS\system32\irkjmebghx_navps.dat trouvé ! ***** C:\WINDOWS\system32\irkjmebghx_nav.dat trouvé ! C:\WINDOWS\system32\irkjmebghx_navup.dat trouvé ! ****** ******* ******** 3)Recherche Certificats : Certificat Egroup trouvé ! *** Analyse Terminé le 10/07/2007 à 23:31:36,09 *** (C'est pour ça que je n'arrivais pas à savoir ce qu'est irkjmebghx... ) Merci =)

Bonjour Oui, je connais ce site qui m'a permis de cibler plusieurs lignes deja suspectes. Quant à SweetIm (au cas où un jour tu tombes dessus, ce qui est peu probable si tu ne le telecharges pas de toi même, mais sait on jamais ^^) c'est un programme bénin. Merci =)