sygnud

Voilou [ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ] --> Recherche: C:\Combofix.txt: trouvé ! C:\TB.txt: trouvé ! C:\Qoobox: trouvé ! C:\Toolbar SD: trouvé ! C:\Rsit: trouvé ! C:\Program Files\Trend Micro\HijackThis.exe: trouvé ! C:\Program Files\Trend Micro\hijackthis.log: trouvé ! C:\Program Files\Trend Micro\HijackThis: trouvé ! C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé ! C:\Qoobox\Quarantine\catchme.log: trouvé ! C:\Users\croquis\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis: trouvé ! C:\Users\croquis\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé ! C:\Users\croquis\Downloads\hijackthis.log: trouvé ! C:\Windows\mbr.exe: trouvé ! --------------------------------- --> Suppression: C:\Program Files\Trend Micro\HijackThis.exe: supprimé ! C:\Combofix.txt: supprimé ! C:\TB.txt: supprimé ! C:\Program Files\Trend Micro\hijackthis.log: supprimé ! C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé ! C:\Qoobox\Quarantine\catchme.log: supprimé ! C:\Users\croquis\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé ! C:\Users\croquis\Downloads\hijackthis.log: supprimé ! C:\Windows\mbr.exe: supprimé ! C:\Qoobox: supprimé ! C:\Toolbar SD: supprimé ! C:\Rsit: supprimé ! C:\Program Files\Trend Micro\HijackThis: supprimé ! C:\Users\croquis\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis: supprimé ! Fichiers temporaires nettoyés !

Ok merci

Merci pour le lien En faite j'ai déjà fait cette manip. mais le service est bien activé ....Hum mystère Sinon je suis maintenant vierge de toutes infections Je voulais quand même te remercier de m'avoir grandement aidé et d'avoir perdu du temps avec moi.

Par contre, je viens de me rendre compte que mon imprimante que je mets en réseau ne fonctionne plus J’ai un petit message « Serveur RPC n’est pas disponible » Heu m'enfin.....

Je n'ai pas trouvé de rapport même en cherchant partout. Je n'ai plus de redirection sous FF et IE Houppi !! Voici les logs GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-02-01 11:00:34 Windows 6.0.6002 Service Pack 2 Running: ueiid6yp.exe; Driver: C:\Users\croquis\AppData\Local\Temp\ffldrpod.sys ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 8407D1E8 Device \Driver\volmgr \Device\VolMgrControl 83C571E8 Device \Driver\usbuhci \Device\USBPDO-0 84DA3790 Device \Driver\usbuhci \Device\USBPDO-1 84DA3790 Device \Driver\usbuhci \Device\USBPDO-2 84DA3790 Device \Driver\PCI_NTPNP5019 \Device\00000046 sptd.sys Device \Driver\usbuhci \Device\USBPDO-3 84DA3790 Device \Driver\usbehci \Device\USBPDO-4 84FF0790 Device \Driver\volmgr \Device\HarddiskVolume1 83C571E8 Device \Driver\cdrom \Device\CdRom0 84BAD790 Device \Driver\cdrom \Device\CdRom1 84BAD790 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 8407C1E8 Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4 8407C1E8 Device \Driver\atapi \Device\Ide\IdePort0 8407C1E8 Device \Driver\atapi \Device\Ide\IdePort1 8407C1E8 Device \Driver\atapi \Device\Ide\IdePort2 8407C1E8 Device \Driver\iScsiPrt \Device\RaidPort0 84DAA1E8 Device \Driver\usbuhci \Device\USBFDO-0 84DA3790 Device \Driver\usbuhci \Device\USBFDO-1 84DA3790 Device \Driver\usbuhci \Device\USBFDO-2 84DA3790 Device \Driver\usbuhci \Device\USBFDO-3 84DA3790 Device \Driver\usbehci \Device\USBFDO-4 84FF0790 Device \Driver\ahv8l3bf \Device\Scsi\ahv8l3bf1Port4Path0Target0Lun0 84E22790 Device \Driver\ahv8l3bf \Device\Scsi\ahv8l3bf1 84E22790 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -340674176 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 -1792538445 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x7B 0x9E 0x4E 0x45 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x1E 0xED 0xF1 0x4D ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0x66 0xD5 0x32 0x8A ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x7B 0x9E 0x4E 0x45 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x1E 0xED 0xF1 0x4D ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0x66 0xD5 0x32 0x8A ... ---- EOF - GMER 1.0.15 ----

Je viens de faire tourner ton appli et il m’a trouvé 2 rootkit dans le boot à première vue. Il a demandé à relancer le PC mais par contre impossible de trouver un rapport et il ouvre un notepad mais rien dedans. J’ai relancé et il ne trouve plus de rootkit

Voila le rapport ComboFix 10-01-26.06 - croquis 27/01/2010 19:33:51.3.2 - x86 Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6002.2.1252.33.1036.18.2045.1341 [GMT 1:00] Lancé depuis: c:\users\croquis\Desktop\sygnud.exe Commutateurs utilisés :: c:\users\croquis\Desktop\CFScript.txt SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22} SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((( Fichiers créés du 2009-12-28 au 2010-01-28 )))))))))))))))))))))))))))))))))))) . 2010-01-27 18:47 . 2010-01-28 08:48 -------- d-----w- c:\users\croquis\AppData\Local\temp 2010-01-27 18:47 . 2010-01-27 18:47 -------- d-----w- c:\users\Public\AppData\Local\temp 2010-01-27 18:47 . 2010-01-27 18:47 -------- d-----w- c:\users\stephane\AppData\Local\temp 2010-01-27 18:47 . 2010-01-27 18:47 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-01-22 18:35 . 2010-01-22 18:35 -------- d-----w- c:\users\stephane\AppData\Local\Mozilla 2010-01-22 18:35 . 2010-01-22 18:35 -------- d-----w- c:\users\stephane\AppData\Local\MigWiz 2010-01-22 18:33 . 2010-01-22 19:25 -------- d-----w- c:\users\stephane\Tracing 2010-01-22 18:33 . 2010-01-22 18:33 -------- d-----w- c:\users\stephane\AppData\Local\Panda Security 2010-01-22 17:40 . 2010-01-22 17:40 -------- d-----w- c:\users\croquis\AppData\Roaming\PeerNetworking 2010-01-20 17:06 . 2010-01-20 17:06 2037 ----a-w- c:\users\croquis\AppData\Roaming\Microsoft\Setup.exe 2010-01-20 16:55 . 2010-01-25 15:14 -------- d-----w- C:\SmartDraw 2010 2010-01-20 15:06 . 2010-01-20 15:06 -------- d-----w- C:\Library 2010-01-20 14:40 . 2010-01-20 16:06 -------- d-----w- c:\users\croquis\vue_2 2010-01-20 14:35 . 2010-01-20 14:35 -------- d-----w- c:\program files\VUE 2010-01-14 08:42 . 2010-01-14 11:11 -------- d-----w- C:\ToolBar SD 2010-01-13 13:41 . 2010-01-13 13:43 -------- d-----w- C:\rsit 2010-01-13 09:07 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32\t2embed.dll 2010-01-13 09:07 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll 2010-01-06 14:29 . 2010-01-06 14:29 -------- d--h--w- c:\windows\PIF 2010-01-06 13:27 . 2010-01-06 13:27 -------- d-----w- c:\program files\CCleaner 2010-01-06 13:06 . 2010-01-06 13:06 250 ----a-w- c:\windows\system32\PavCPL.dat 2010-01-06 13:06 . 2003-10-22 17:23 446464 ----a-w- c:\windows\system32\HHActiveX.dll 2010-01-06 13:05 . 2009-03-30 17:23 193792 ----a-w- c:\windows\system32\TpUtil.dll 2010-01-06 13:05 . 2009-03-30 17:22 87296 ----a-w- c:\windows\system32\PavLspHook.dll 2010-01-06 13:05 . 2009-03-30 17:22 55552 ----a-w- c:\windows\system32\pavipc.dll 2010-01-06 13:05 . 2007-02-08 09:53 107568 ----a-w- c:\windows\system32\SYSTOOLS.DLL 2010-01-06 13:05 . 2009-03-30 17:22 518400 ----a-w- c:\windows\system32\PavSHook.dll 2010-01-06 13:05 . 2009-08-06 11:29 49160 ----a-w- c:\windows\system32\drivers\amm8660.sys 2010-01-06 13:05 . 2008-03-18 15:58 58672 ----a-w- c:\windows\system32\avldr.dll 2010-01-06 12:57 . 2008-03-04 14:59 41144 ----a-w- c:\windows\system32\drivers\ShlDrv51.sys 2010-01-06 12:57 . 2009-06-30 16:17 163336 ----a-w- c:\windows\system32\drivers\PavProc.sys 2010-01-06 12:57 . 2010-01-06 12:57 -------- d-----w- c:\program files\Common Files\Panda Security 2010-01-06 11:49 . 2010-01-27 12:16 5115824 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2010-01-05 12:52 . 2010-01-05 12:52 -------- d-----w- c:\users\croquis\AppData\Local\Ashampoo 2010-01-05 11:34 . 2010-01-05 11:34 -------- d-----w- c:\program files\Ashampoo 2010-01-05 10:38 . 2010-01-05 10:38 -------- d-----w- c:\program files\Java(365) 2010-01-05 10:13 . 2010-01-05 10:51 -------- d-----w- c:\users\croquis\AppData\Local\NOS 2010-01-04 18:23 . 2010-01-04 18:23 -------- d-----w- c:\programdata\Panda Software 2009-12-31 16:33 . 2010-01-13 13:43 -------- d-----w- c:\program files\Trend Micro 2009-12-31 13:41 . 2009-12-31 13:41 -------- d-----w- c:\users\croquis\AppData\Local\Panda Security 2009-12-31 13:39 . 2009-12-31 13:39 -------- d-----w- c:\windows\system32\PAV 2009-12-31 13:39 . 2009-12-31 13:39 -------- d-----w- c:\users\croquis\AppData\Roaming\Panda Security 2009-12-31 13:39 . 2009-12-31 13:39 -------- d-----w- c:\programdata\Panda Security 2009-12-31 12:45 . 2009-12-31 12:49 -------- d-----w- c:\users\croquis\AppData\Roaming\QuickScan 2009-12-30 10:22 . 2009-12-30 10:23 -------- d-----w- c:\users\croquis\AppData\Local\CUSTPDF Writer 2009-12-30 10:19 . 2009-12-30 10:19 -------- d-----w- c:\program files\gs 2009-12-30 10:19 . 2009-12-30 10:21 -------- d-----w- c:\program files\SmartDraw PDF Filter 2009-12-30 10:14 . 2009-12-30 10:18 -------- d-----w- c:\program files\SmartDraw 2010(556) 2009-12-29 19:16 . 2009-12-29 19:16 -------- d-----w- c:\program files\Enigma Software Group . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-01-28 08:47 . 2009-04-21 08:46 -------- d-----w- c:\users\croquis\AppData\Roaming\DNA 2010-01-28 08:47 . 2009-04-21 08:46 -------- d-----w- c:\program files\DNA 2010-01-27 18:55 . 2006-11-02 15:45 672084 ----a-w- c:\windows\system32\perfh00C.dat 2010-01-27 18:55 . 2006-11-02 15:45 124228 ----a-w- c:\windows\system32\perfc00C.dat 2010-01-27 12:17 . 2009-10-30 09:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-01-22 19:52 . 2007-05-04 13:46 1356 ----a-w- c:\users\croquis\AppData\Local\d3d9caps.dat 2010-01-22 19:47 . 2007-07-31 09:00 -------- d-----w- c:\programdata\FLEXnet 2010-01-22 15:48 . 2007-05-15 13:20 65 ----a-w- c:\windows\system32\BD7420.DAT 2010-01-22 11:19 . 2007-05-11 13:59 -------- d-----w- c:\program files\Mozilla Thunderbird 2010-01-21 13:33 . 2009-09-30 14:23 -------- d-----w- c:\program files\Common Files\Adobe AIR 2010-01-21 13:33 . 2009-09-30 14:23 38784 ----a-w- c:\users\croquis\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2010-01-21 13:33 . 2009-09-30 14:23 38784 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2010-01-20 19:44 . 2009-03-25 11:36 -------- d-----w- c:\program files\Microsoft Silverlight 2010-01-20 17:07 . 2009-04-21 08:47 -------- d-----w- c:\users\croquis\AppData\Roaming\BitTorrent 2010-01-20 16:59 . 2009-12-17 09:33 -------- d-----w- c:\users\croquis\AppData\Roaming\SmartDraw 2010-01-14 10:12 . 2009-10-05 07:19 181120 ------w- c:\windows\system32\MpSigStub.exe 2010-01-13 19:34 . 2007-05-07 13:54 -------- d-----w- c:\programdata\Microsoft Help 2010-01-13 19:33 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2010-01-07 15:07 . 2009-10-30 09:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-07 15:07 . 2009-10-30 09:38 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-01-06 23:04 . 2009-06-08 13:19 19944 ----a-w- c:\windows\system32\drivers\atapi.sys 2010-01-06 17:13 . 2007-05-15 11:10 -------- d-----w- c:\program files\MSECache 2010-01-06 14:20 . 2008-11-20 09:38 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2010-01-06 13:10 . 2008-11-20 09:38 -------- d-----w- c:\program files\Spybot - Search & Destroy 2010-01-06 13:06 . 2008-09-03 10:51 -------- d-----w- c:\program files\Panda Security 2010-01-06 12:56 . 2007-05-11 13:19 -------- d-----w- c:\program files\Alwil Software 2010-01-06 11:45 . 2009-10-14 09:26 -------- d-----w- c:\program files\Java 2010-01-06 11:24 . 2007-05-07 13:58 -------- d-----w- c:\program files\Microsoft Works 2010-01-06 11:24 . 2007-08-10 14:19 -------- d-----w- c:\program files\Google 2010-01-06 11:24 . 2009-04-21 08:46 -------- d-----w- c:\program files\BitTorrent 2010-01-05 10:32 . 2007-06-11 11:19 -------- d-----w- c:\program files\Common Files\Adobe 2010-01-05 10:12 . 2009-09-14 07:36 -------- d-----w- c:\programdata\NOS 2010-01-02 06:38 . 2010-01-22 09:03 916480 ----a-w- c:\windows\system32\wininet.dll 2010-01-02 06:32 . 2010-01-22 09:03 109056 ----a-w- c:\windows\system32\iesysprep.dll 2010-01-02 06:32 . 2010-01-22 09:03 71680 ----a-w- c:\windows\system32\iesetup.dll 2010-01-02 04:57 . 2010-01-22 09:03 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2009-12-31 13:39 . 2007-05-04 14:46 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-11-27 09:22 . 2009-09-25 07:25 3695616 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AutoLaunch.exe 2009-11-19 10:48 . 2009-12-01 11:02 872960 ----a-w- c:\users\croquis\AppData\Roaming\Mozilla\Firefox\Profiles\lxx8rmto.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll 2009-11-19 10:48 . 2009-12-01 11:02 43008 ----a-w- c:\users\croquis\AppData\Roaming\Mozilla\Firefox\Profiles\lxx8rmto.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll 2009-11-19 10:48 . 2009-12-01 11:02 340480 ----a-w- c:\users\croquis\AppData\Roaming\Mozilla\Firefox\Profiles\lxx8rmto.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll 2009-11-19 10:48 . 2009-12-01 11:02 346624 ----a-w- c:\users\croquis\AppData\Roaming\Mozilla\Firefox\Profiles\lxx8rmto.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll 2009-11-18 08:43 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856] "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 219520] "swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe" [2007-08-10 165304] "Gestionnaire Antidote.exe"="c:\program files\Druide\Antidote\Gestionnaire Antidote.exe" [2007-04-16 534200] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-10-30 323392] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-12-18 622592] "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-07-19 65536] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 624248] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13580832] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 92704] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "APVXDWIN"="c:\program files\Panda Security\Panda Antivirus Pro 2010\APVXDWIN.EXE" [2009-09-25 906496] "SCANINICIO"="c:\program files\Panda Security\Panda Antivirus Pro 2010\Inicio.exe" [2009-08-12 56064] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Gestionnaire Antidote.exe"="c:\program files\Druide\Antidote\Gestionnaire Antidote.exe" [2007-04-16 534200] c:\users\croquis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Microsoft Office Groove.lnk - c:\program files\Microsoft Office\Office12\GROOVE.EXE [2009-2-14 337264] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-7-30 110592] InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2007-5-4 114688] Nokia Ovi Suite.lnk - c:\program files\Nokia\Ovi\Suite\RunLauncher.exe [2008-11-11 946176] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr] 2008-03-18 15:58 58672 ----a-w- c:\windows\System32\avldr.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "VistaSp2"=hex(b):71,38,e8,b8,d8,e8,c9,01 R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [10/07/2009 09:22 64160] R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [03/09/2008 11:52 28552] R1 ShldDrv;Panda File Shield Driver;c:\windows\System32\drivers\ShlDrv51.sys [06/01/2010 13:57 41144] R2 AmFSM;AmFSM;c:\windows\System32\drivers\amm8660.sys [06/01/2010 14:05 49160] R2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost -k Panda --> c:\windows\system32\svchost -k Panda [?] R2 PavProc;Panda Process Protection Driver;c:\windows\System32\drivers\PavProc.sys [06/01/2010 13:57 163336] R2 PskSvcRetail;Panda PSK service;c:\program files\Panda Security\Panda Antivirus Pro 2010\psksvc.exe [06/01/2010 14:06 28928] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [20/11/2008 10:38 1153368] S2 anggutih;PnP ISA/EISA Bus Monitor;c:\windows\System32\svchost.exe -k netsvcs [19/07/2008 17:52 21504] S3 FontCache;Service de cache de police Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [19/07/2008 17:52 21504] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 20:06 1028432] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\System32\drivers\nmwcdnsu.sys [01/02/2008 14:17 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\System32\drivers\nmwcdnsuc.sys [01/02/2008 14:17 8320] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache panda REG_MULTI_SZ Gwmsrv HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs anggutih . Contenu du dossier 'Tâches planifiées' 2010-01-25 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 07:25] 2009-06-30 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job - c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2010-01-06 14:31] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.com/ mWindow Title = uInternet Settings,ProxyOverride = *.local IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html FF - ProfilePath - c:\users\croquis\AppData\Roaming\Mozilla\Firefox\Profiles\lxx8rmto.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-01-28 09:47 Windows 6.0.6002 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x84ED1841]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0x881a0d24 \Driver\ACPI -> acpi.sys @ 0x807aad68 \Driver\atapi -> 0x8447a1e8 IoDeviceObjectType ->\Device\Harddisk0\DR0 ->Warning: possible MBR rootkit infection ! user & kernel MBR OK ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\nvvsvc.exe c:\program files\Panda Security\Panda Antivirus Pro 2010\TPSrv.exe c:\program files\PANDA SECURITY\PANDA ANTIVIRUS PRO 2010\WebProxy.exe c:\windows\system32\rundll32.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Panda Security\Panda Antivirus Pro 2010\PsCtrls.exe c:\program files\Panda Security\Panda Antivirus Pro 2010\PavFnSvr.exe c:\program files\Common Files\Panda Security\PavShld\pavprsrv.exe c:\program files\Panda Security\Panda Antivirus Pro 2010\pavsrvx86.exe c:\program files\Panda Security\Panda Antivirus Pro 2010\AVENGINE.EXE c:\program files\Panda Security\Panda Antivirus Pro 2010\PsImSvc.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\system32\vssvc.exe c:\windows\system32\conime.exe c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe c:\windows\System32\rundll32.exe c:\program files\Brother\ControlCenter3\brccMCtl.exe c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe . ************************************************************************** . Heure de fin: 2010-01-28 09:58:27 - La machine a redémarré ComboFix-quarantined-files.txt 2010-01-28 08:58 ComboFix2.txt 2010-01-22 21:33 Avant-CF: 99 771 133 952 octets libres Après-CF: 92 322 603 008 octets libres - - End Of File - - 8DD2803C3D6F6C0A5549C214A4E9C7DE

salut , Je vais faire ça se soir. Un script rien que pour moi la classe Merci pour tous tes efforts

Je viens de faire le test tout va bien

c'est le bon lien ?

Pas de problème Thanos , c'est déjà bien de m'aider GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-01-26 09:46:16 Windows 6.0.6002 Service Pack 2 Running: ueiid6yp.exe; Driver: C:\Users\croquis\AppData\Local\Temp\ffldrpod.sys ---- System - GMER 1.0.15 ---- SSDT \??\C:\Windows\system32\DRIVERS\PavProc.sys ZwTerminateProcess [0xA2A624E8] ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs ShlDrv51.sys (PandaShield driver/Panda Security, S.L.) AttachedDevice \FileSystem\Ntfs \Ntfs pavboot.sys (Panda Boot Driver/Panda Security, S.L.) AttachedDevice \FileSystem\Ntfs \Ntfs av5flt.sys Device -> \Driver\atapi \Device\Harddisk0\DR0 84C0B841 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x7B 0x9E 0x4E 0x45 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x1E 0xED 0xF1 0x4D ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0x66 0xD5 0x32 0x8A ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x7B 0x9E 0x4E 0x45 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x1E 0xED 0xF1 0x4D ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0x66 0xD5 0x32 0x8A ... ---- Files - GMER 1.0.15 ---- File C:\Windows\system32\drivers\atapi.sys suspicious modification ---- EOF - GMER 1.0.15 ----

p'ti up

Voilou 2010-01-22 11:31:49 . 2010-01-22 11:31:49 188 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-Ashampoo AntiSpyWare 2 Guard.reg.dat 2010-01-22 11:18:07 . 2010-01-22 11:18:07 1,398 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_srv2.reg.dat 2010-01-22 11:18:07 . 2010-01-22 11:18:07 990 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_SRV2.reg.dat 2010-01-22 11:17:02 . 2010-01-22 11:17:02 5,419 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2010-01-22 10:28:48 . 2010-01-22 11:07:32 124 ----a-w- C:\Qoobox\Quarantine\catchme.log 2010-01-20 16:49:17 . 2010-01-20 16:48:56 393,216 ----a-w- C:\Qoobox\Quarantine\C\Users\croquis\AppData\Roaming\Microsoft\svchost.exe.vir 2007-05-11 13:59:57 . 2009-11-24 13:31:40 34,416 ----a-w- C:\Qoobox\Quarantine\C\Program Files\Mozilla Thunderbird\plc4.dll.vir

Je pense que lors de la maintenance j’ai mon dernier message qui a disparu Je repost ComboFix 10-01-21.06 - croquis 22/01/2010 12:07:33.2.2 - x86 Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6002.2.1252.33.1036.18.2045.1411 [GMT 1:00] Lancé depuis: c:\users\croquis\Desktop\sygnud.exe SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22} SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-2365545147-1999384947-2466353664-500 c:\program files\Mozilla Thunderbird\plc4.dll c:\users\croquis\AppData\Roaming\Microsoft\svchost.exe . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SRV2 -------\Service_srv2 ((((((((((((((((((((((((((((( Fichiers créés du 2009-12-22 au 2010-01-22 )))))))))))))))))))))))))))))))))))) . 2010-01-22 11:20 . 2010-01-22 11:27 -------- d-----w- c:\users\croquis\AppData\Local\temp 2010-01-22 11:20 . 2010-01-22 11:20 -------- d-----w- c:\users\john\AppData\Local\temp 2010-01-22 11:20 . 2010-01-22 11:20 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-01-20 17:06 . 2010-01-20 17:06 2037 ----a-w- c:\users\croquis\AppData\Roaming\Microsoft\Setup.exe 2010-01-20 16:55 . 2010-01-20 16:59 -------- d-----w- C:\SmartDraw 2010 2010-01-20 15:06 . 2010-01-20 15:06 -------- d-----w- C:\Library 2010-01-20 14:40 . 2010-01-20 16:06 -------- d-----w- c:\users\croquis\vue_2 2010-01-20 14:35 . 2010-01-20 14:35 -------- d-----w- c:\program files\VUE 2010-01-14 08:42 . 2010-01-14 11:11 -------- d-----w- C:\ToolBar SD 2010-01-13 13:41 . 2010-01-13 13:43 -------- d-----w- C:\rsit 2010-01-13 09:07 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32\t2embed.dll 2010-01-13 09:07 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll 2010-01-06 14:29 . 2010-01-06 14:29 -------- d--h--w- c:\windows\PIF 2010-01-06 13:27 . 2010-01-06 13:27 -------- d-----w- c:\program files\CCleaner 2010-01-06 13:06 . 2010-01-06 13:06 250 ----a-w- c:\windows\system32\PavCPL.dat 2010-01-06 13:06 . 2003-10-22 17:23 446464 ----a-w- c:\windows\system32\HHActiveX.dll 2010-01-06 13:05 . 2009-03-30 17:23 193792 ----a-w- c:\windows\system32\TpUtil.dll 2010-01-06 13:05 . 2009-03-30 17:22 87296 ----a-w- c:\windows\system32\PavLspHook.dll 2010-01-06 13:05 . 2009-03-30 17:22 55552 ----a-w- c:\windows\system32\pavipc.dll 2010-01-06 13:05 . 2007-02-08 09:53 107568 ----a-w- c:\windows\system32\SYSTOOLS.DLL 2010-01-06 13:05 . 2009-03-30 17:22 518400 ----a-w- c:\windows\system32\PavSHook.dll 2010-01-06 13:05 . 2009-08-06 11:29 49160 ----a-w- c:\windows\system32\drivers\amm8660.sys 2010-01-06 13:05 . 2008-03-18 15:58 58672 ----a-w- c:\windows\system32\avldr.dll 2010-01-06 12:57 . 2008-03-04 14:59 41144 ----a-w- c:\windows\system32\drivers\ShlDrv51.sys 2010-01-06 12:57 . 2009-06-30 16:17 163336 ----a-w- c:\windows\system32\drivers\PavProc.sys 2010-01-06 12:57 . 2010-01-06 12:57 -------- d-----w- c:\program files\Common Files\Panda Security 2010-01-06 11:49 . 2010-01-06 11:49 5061520 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2010-01-05 12:52 . 2010-01-05 12:52 -------- d-----w- c:\users\croquis\AppData\Local\Ashampoo 2010-01-05 11:34 . 2010-01-05 11:34 -------- d-----w- c:\program files\Ashampoo 2010-01-05 10:38 . 2010-01-05 10:38 -------- d-----w- c:\program files\Java(365) 2010-01-05 10:13 . 2010-01-05 10:51 -------- d-----w- c:\users\croquis\AppData\Local\NOS 2010-01-04 18:23 . 2010-01-04 18:23 -------- d-----w- c:\programdata\Panda Software 2009-12-31 16:33 . 2010-01-13 13:43 -------- d-----w- c:\program files\Trend Micro 2009-12-31 13:41 . 2009-12-31 13:41 -------- d-----w- c:\users\croquis\AppData\Local\Panda Security 2009-12-31 13:39 . 2009-12-31 13:39 -------- d-----w- c:\windows\system32\PAV 2009-12-31 13:39 . 2009-12-31 13:39 -------- d-----w- c:\users\croquis\AppData\Roaming\Panda Security 2009-12-31 13:39 . 2009-12-31 13:39 -------- d-----w- c:\programdata\Panda Security 2009-12-31 12:45 . 2009-12-31 12:49 -------- d-----w- c:\users\croquis\AppData\Roaming\QuickScan 2009-12-30 10:22 . 2009-12-30 10:23 -------- d-----w- c:\users\croquis\AppData\Local\CUSTPDF Writer 2009-12-30 10:19 . 2009-12-30 10:19 -------- d-----w- c:\program files\gs 2009-12-30 10:19 . 2009-12-30 10:21 -------- d-----w- c:\program files\SmartDraw PDF Filter 2009-12-30 10:14 . 2009-12-30 10:18 -------- d-----w- c:\program files\SmartDraw 2010(556) 2009-12-29 19:16 . 2009-12-29 19:16 -------- d-----w- c:\program files\Enigma Software Group . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-01-22 11:19 . 2007-05-11 13:59 -------- d-----w- c:\program files\Mozilla Thunderbird 2010-01-22 10:58 . 2009-04-21 08:46 -------- d-----w- c:\users\croquis\AppData\Roaming\DNA 2010-01-21 13:33 . 2009-09-30 14:23 -------- d-----w- c:\program files\Common Files\Adobe AIR 2010-01-21 13:33 . 2009-09-30 14:23 38784 ----a-w- c:\users\croquis\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2010-01-21 13:33 . 2009-09-30 14:23 38784 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2010-01-21 08:12 . 2007-05-15 13:20 65 ----a-w- c:\windows\system32\BD7420.DAT 2010-01-20 19:44 . 2009-03-25 11:36 -------- d-----w- c:\program files\Microsoft Silverlight 2010-01-20 17:07 . 2009-04-21 08:47 -------- d-----w- c:\users\croquis\AppData\Roaming\BitTorrent 2010-01-20 16:59 . 2009-12-17 09:33 -------- d-----w- c:\users\croquis\AppData\Roaming\SmartDraw 2010-01-14 10:12 . 2009-10-05 07:19 181120 ------w- c:\windows\system32\MpSigStub.exe 2010-01-13 19:34 . 2007-05-07 13:54 -------- d-----w- c:\programdata\Microsoft Help 2010-01-13 19:33 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2010-01-06 23:04 . 2009-06-08 13:19 19944 ----a-w- c:\windows\system32\drivers\atapi.sys 2010-01-06 19:55 . 2007-07-31 09:00 -------- d-----w- c:\programdata\FLEXnet 2010-01-06 17:13 . 2007-05-15 11:10 -------- d-----w- c:\program files\MSECache 2010-01-06 14:20 . 2008-11-20 09:38 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2010-01-06 13:46 . 2009-04-21 08:46 -------- d-----w- c:\program files\DNA 2010-01-06 13:10 . 2008-11-20 09:38 -------- d-----w- c:\program files\Spybot - Search & Destroy 2010-01-06 13:06 . 2008-09-03 10:51 -------- d-----w- c:\program files\Panda Security 2010-01-06 12:56 . 2007-05-11 13:19 -------- d-----w- c:\program files\Alwil Software 2010-01-06 11:52 . 2009-10-30 09:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-01-06 11:45 . 2009-10-14 09:26 -------- d-----w- c:\program files\Java 2010-01-06 11:24 . 2007-05-07 13:58 -------- d-----w- c:\program files\Microsoft Works 2010-01-06 11:24 . 2007-08-10 14:19 -------- d-----w- c:\program files\Google 2010-01-06 11:24 . 2009-04-21 08:46 -------- d-----w- c:\program files\BitTorrent 2010-01-06 10:14 . 2007-05-04 13:46 1356 ----a-w- c:\users\croquis\AppData\Local\d3d9caps.dat 2010-01-05 10:32 . 2007-06-11 11:19 -------- d-----w- c:\program files\Common Files\Adobe 2010-01-05 10:12 . 2009-09-14 07:36 -------- d-----w- c:\programdata\NOS 2009-12-31 13:39 . 2007-05-04 14:46 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-12-30 13:55 . 2009-10-30 09:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-12-30 13:54 . 2009-10-30 09:38 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-11-27 09:22 . 2009-09-25 07:25 3695616 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AutoLaunch.exe 2009-11-21 06:40 . 2009-12-09 09:25 916480 ----a-w- c:\windows\system32\wininet.dll 2009-11-21 06:34 . 2009-12-09 09:25 71680 ----a-w- c:\windows\system32\iesetup.dll 2009-11-21 06:34 . 2009-12-09 09:25 109056 ----a-w- c:\windows\system32\iesysprep.dll 2009-11-21 04:59 . 2009-12-09 09:25 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2009-11-19 10:48 . 2009-12-01 11:02 872960 ----a-w- c:\users\croquis\AppData\Roaming\Mozilla\Firefox\Profiles\lxx8rmto.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll 2009-11-19 10:48 . 2009-12-01 11:02 43008 ----a-w- c:\users\croquis\AppData\Roaming\Mozilla\Firefox\Profiles\lxx8rmto.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll 2009-11-19 10:48 . 2009-12-01 11:02 340480 ----a-w- c:\users\croquis\AppData\Roaming\Mozilla\Firefox\Profiles\lxx8rmto.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll 2009-11-19 10:48 . 2009-12-01 11:02 346624 ----a-w- c:\users\croquis\AppData\Roaming\Mozilla\Firefox\Profiles\lxx8rmto.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll 2009-11-18 08:51 . 2006-11-02 15:45 672084 ----a-w- c:\windows\system32\perfh00C.dat 2009-11-18 08:51 . 2006-11-02 15:45 124228 ----a-w- c:\windows\system32\perfc00C.dat 2009-11-18 08:43 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat 2009-10-29 09:17 . 2009-11-25 19:00 2048 ----a-w- c:\windows\system32\tzres.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856] "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 219520] "swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe" [2007-08-10 165304] "Gestionnaire Antidote.exe"="c:\program files\Druide\Antidote\Gestionnaire Antidote.exe" [2007-04-16 534200] "BitTorrent DNA"="c:\users\croquis\Program Files\DNA\btdna.exe" [2009-10-07 323392] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-12-18 622592] "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-07-19 65536] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 624248] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13580832] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 92704] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "APVXDWIN"="c:\program files\Panda Security\Panda Antivirus Pro 2010\APVXDWIN.EXE" [2009-09-25 906496] "SCANINICIO"="c:\program files\Panda Security\Panda Antivirus Pro 2010\Inicio.exe" [2009-08-12 56064] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Gestionnaire Antidote.exe"="c:\program files\Druide\Antidote\Gestionnaire Antidote.exe" [2007-04-16 534200] c:\users\croquis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Microsoft Office Groove.lnk - c:\program files\Microsoft Office\Office12\GROOVE.EXE [2009-2-14 337264] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-7-30 110592] InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2007-5-4 114688] Nokia Ovi Suite.lnk - c:\program files\Nokia\Ovi\Suite\RunLauncher.exe [2008-11-11 946176] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr] 2008-03-18 15:58 58672 ----a-w- c:\windows\System32\avldr.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "VistaSp2"=hex(b):71,38,e8,b8,d8,e8,c9,01 R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [10/07/2009 09:22 64160] R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [03/09/2008 11:52 28552] R1 ShldDrv;Panda File Shield Driver;c:\windows\System32\drivers\ShlDrv51.sys [06/01/2010 13:57 41144] R2 AmFSM;AmFSM;c:\windows\System32\drivers\amm8660.sys [06/01/2010 14:05 49160] R2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost -k Panda --> c:\windows\system32\svchost -k Panda [?] R2 PavProc;Panda Process Protection Driver;c:\windows\System32\drivers\PavProc.sys [06/01/2010 13:57 163336] R2 PskSvcRetail;Panda PSK service;c:\program files\Panda Security\Panda Antivirus Pro 2010\psksvc.exe [06/01/2010 14:06 28928] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [20/11/2008 10:38 1153368] S2 anggutih;PnP ISA/EISA Bus Monitor;c:\windows\System32\svchost.exe -k netsvcs [19/07/2008 17:52 21504] S3 FontCache;Service de cache de police Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [19/07/2008 17:52 21504] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 20:06 1028432] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\System32\drivers\nmwcdnsu.sys [01/02/2008 14:17 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\System32\drivers\nmwcdnsuc.sys [01/02/2008 14:17 8320] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache panda REG_MULTI_SZ Gwmsrv HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs anggutih . Contenu du dossier 'Tâches planifiées' 2010-01-22 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 07:25] 2009-06-30 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job - c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2010-01-06 14:31] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.com/ mWindow Title = uInternet Settings,ProxyOverride = *.local IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html FF - ProfilePath - c:\users\croquis\AppData\Roaming\Mozilla\Firefox\Profiles\lxx8rmto.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll FF - plugin: c:\users\croquis\Program Files\DNA\plugins\npbtdna.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-Ashampoo AntiSpyWare 2 Guard - c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-01-22 12:26 Windows 6.0.6002 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x84EC9841]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0x881acd24 \Driver\ACPI -> acpi.sys @ 0x807b4d68 \Driver\atapi -> 0x8447b1e8 IoDeviceObjectType ->\Device\Harddisk0\DR0 ->Warning: possible MBR rootkit infection ! user & kernel MBR OK ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\nvvsvc.exe c:\program files\Panda Security\Panda Antivirus Pro 2010\TPSrv.exe c:\program files\PANDA SECURITY\PANDA ANTIVIRUS PRO 2010\WebProxy.exe c:\windows\system32\rundll32.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Panda Security\Panda Antivirus Pro 2010\PsCtrls.exe c:\program files\Panda Security\Panda Antivirus Pro 2010\PavFnSvr.exe c:\program files\Common Files\Panda Security\PavShld\pavprsrv.exe c:\program files\Panda Security\Panda Antivirus Pro 2010\pavsrvx86.exe c:\program files\Panda Security\Panda Antivirus Pro 2010\AVENGINE.EXE c:\program files\Panda Security\Panda Antivirus Pro 2010\PsImSvc.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\system32\conime.exe . ************************************************************************** . Heure de fin: 2010-01-22 12:36:09 - La machine a redémarré ComboFix-quarantined-files.txt 2010-01-22 11:35 Avant-CF: 89 556 234 240 octets libres Après-CF: 89 843 621 888 octets libres - - End Of File - - FD9BECE5BD1C3B1DA99011713E83EEF4 Sinon sous FF et IE j’ai toujours des redirections sauvages pour des pubs quand je clique sur des liens de temps en temps

Voilou le rapport Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.50 2010.01.20 - AhnLab-V3 5.0.0.2 2010.01.19 - AntiVir 7.9.1.142 2010.01.20 - Antiy-AVL 2.0.3.7 2010.01.20 - Authentium 5.2.0.5 2010.01.20 - Avast 4.8.1351.0 2010.01.20 - AVG 9.0.0.730 2010.01.19 - BitDefender 7.2 2010.01.20 - CAT-QuickHeal 10.00 2010.01.20 - ClamAV 0.94.1 2010.01.20 - Comodo 3647 2010.01.20 - DrWeb 5.0.1.12222 2010.01.20 - eSafe 7.0.17.0 2010.01.19 - eTrust-Vet 35.2.7247 2010.01.20 - F-Prot 4.5.1.85 2010.01.19 - F-Secure 9.0.15370.0 2010.01.20 - Fortinet 4.0.14.0 2010.01.20 - GData 19 2010.01.20 - Ikarus T3.1.1.80.0 2010.01.20 - Jiangmin 13.0.900 2010.01.20 - K7AntiVirus 7.10.951 2010.01.20 - Kaspersky 7.0.0.125 2010.01.20 - McAfee 5866 2010.01.19 - McAfee+Artemis 5866 2010.01.19 - McAfee-GW-Edition 6.8.5 2010.01.20 Heuristic.LooksLike.Trojan.Patched.H Microsoft 1.5302 2010.01.20 - NOD32 4789 2010.01.20 - Norman 6.04.03 2010.01.20 - nProtect 2009.1.8.0 2010.01.20 - Panda 10.0.2.2 2010.01.19 - PCTools 7.0.3.5 2010.01.19 - Rising 22.31.02.04 2010.01.20 - Sophos 4.49.0 2010.01.20 - Sunbelt 3.2.1858.2 2010.01.20 - Symantec 20091.2.0.41 2010.01.20 - TheHacker 6.5.0.7.157 2010.01.20 - TrendMicro 9.120.0.1004 2010.01.20 - VBA32 3.12.12.1 2010.01.20 - ViRobot 2010.1.20.2146 2010.01.20 - VirusBuster 5.0.21.0 2010.01.20 - Information additionnelle File size: 19944 bytes MD5 : 1f05b78ab91c9075565a9d8a4b880bc4 SHA1 : 218442cd7afecbc8d102c4e31d9ef3528642191b SHA256: 737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x5005 timedatestamp.....: 0x49E01EED (Sat Apr 11 06:39:09 2009) machinetype.......: 0x14C (Intel I386) ( 6 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x19B0 0x1A00 6.30 4ac8c9f82cf23d85316bd85d3d8e4efb .rdata 0x3000 0xAE 0x200 1.49 3d541e69f96e97a837841ad289adeac7 .data 0x4000 0xC 0x200 0.18 7c80b151582aa6280e754b477343e54e INIT 0x5000 0x364 0x400 4.51 f238fffd3a9917d72f4888f4276b3b06 .rsrc 0x6000 0x3F8 0x400 3.38 5c8a106a7c9416fb469c83dfab844abd .reloc 0x7000 0x8A 0x200 1.37 064d7db7c16955d4dc6d3f7afb703e06 ( 2 imports ) > ataport.sys: AtaPortNotification, AtaPortWritePortUchar, AtaPortWritePortUlong, AtaPortGetPhysicalAddress, AtaPortConvertPhysicalAddressToUlong, AtaPortGetScatterGatherList, AtaPortReadPortUchar, AtaPortStallExecution, AtaPortGetParentBusType, AtaPortRequestCallback, AtaPortWritePortBufferUshort, AtaPortGetUnCachedExtension, AtaPortCompleteRequest, AtaPortMoveMemory, AtaPortCompleteAllActiveRequests, AtaPortReleaseRequestSenseIrb, AtaPortBuildRequestSenseIrb, AtaPortReadPortUshort, AtaPortReadPortBufferUshort, AtaPortInitialize, AtaPortGetDeviceBase, AtaPortDeviceStateChange > ntoskrnl.exe: KeTickCount ( 0 exports ) TrID : File type identification Generic Win/DOS Executable (49.9%) DOS Executable Generic (49.8%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) ssdeep: 384:zzY0Vgd1RrKzBpWk4UwWFSn8G6FuT+quHpBjbOjBMwzt8:zz/Vgd1gzQUSuBxkMwzt8 PEiD : - RDS : NSRL Reference Data Set

Bonjour, Désolé, mais j’étais en panne d’internet, pour faire cour, on va dire qu’il y a internet et internet pfff. Sinon j’ai réussi à faire fonctionner le programme et 5mn après écran bleu. ***STOP :0X000000F4(0X00000003,0X865AAD90,0X865AAEDC,0X82064650) Voici les logs GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-01-21 09:56:14 Windows 6.0.6002 Service Pack 2 Running: pmerxto3.exe; Driver: C:\Users\croquis\AppData\Local\Temp\ffldrpod.sys ---- System - GMER 1.0.15 ---- SSDT \??\C:\Windows\system32\DRIVERS\PavProc.sys ZwTerminateProcess [0xA15424E8] ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs ShlDrv51.sys (PandaShield driver/Panda Security, S.L.) Device \FileSystem\Ntfs \Ntfs 8447B1E8 AttachedDevice \FileSystem\Ntfs \Ntfs av5flt.sys Device \Driver\volmgr \Device\VolMgrControl 844781E8 Device \Driver\netbt \Device\NetBT_Tcpip_{E021B06E-1A6C-44F0-80FF-C21632578119} 862F2790 Device \Driver\PCI_NTPNP7705 \Device\00000043 sptd.sys Device \Driver\usbuhci \Device\USBPDO-0 85ED71E8 Device \Driver\usbuhci \Device\USBPDO-1 85ED71E8 Device \Driver\usbuhci \Device\USBPDO-2 85ED71E8 Device \Driver\usbuhci \Device\USBPDO-3 85ED71E8 Device \Driver\usbehci \Device\USBPDO-4 8501C610 Device \Driver\volmgr \Device\HarddiskVolume1 844781E8 Device \Driver\cdrom \Device\CdRom0 85FE01E8 Device \Driver\cdrom \Device\CdRom1 85FE01E8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 8447A1E8 Device \Driver\atapi \Device\Ide\IdePort0 8447A1E8 Device \Driver\atapi \Device\Ide\IdePort1 8447A1E8 Device \Driver\atapi \Device\Ide\IdePort2 8447A1E8 Device \Driver\netbt \Device\NetBt_Wins_Export 862F2790 Device \Driver\iScsiPrt \Device\RaidPort0 860861E8 Device \Driver\usbuhci \Device\USBFDO-0 85ED71E8 Device \Driver\usbuhci \Device\USBFDO-1 85ED71E8 Device \Driver\usbuhci \Device\USBFDO-2 85ED71E8 Device \Driver\usbuhci \Device\USBFDO-3 85ED71E8 Device \Driver\usbehci \Device\USBFDO-4 8501C610 Device \Driver\a21857dc \Device\Scsi\a21857dc1 85ED41E8 Device \Driver\a21857dc \Device\Scsi\a21857dc1Port4Path0Target0Lun0 85ED41E8 Device -> \Driver\atapi \Device\Harddisk0\DR0 84EC6841 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -340674176 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 -1792538445 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x7B 0x9E 0x4E 0x45 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x1E 0xED 0xF1 0x4D ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0x66 0xD5 0x32 0x8A ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x7B 0x9E 0x4E 0x45 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x1E 0xED 0xF1 0x4D ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0x66 0xD5 0x32 0x8A ... ---- Files - GMER 1.0.15 ---- File C:\Windows\system32\drivers\atapi.sys suspicious modification ---- EOF - GMER 1.0.15 ----

Salut , Merci pour la suite des opérations. Pour répondre à ta question les logiciels Ashampoo AntiSpyWare et Panda ce sont tous les deux des versions d’essais, car après l’infection j’ai voulu changer ce que j’avais dans ma machine ( spybot et Avast) -----------\\ ToolBar S&D 1.2.9 XP/Vista Microsoft® Windows Vista™ Édition Familiale Basique ( v6.0.6002 ) Service Pack 2 X86-based PC ( Multiprocessor Free : Intel® Pentium® 4 CPU 3.20GHz ) BIOS : Default System BIOS USER : croquis ( Not Administrator ! ) BOOT : Normal boot C:\ (Local Disk) - NTFS - Total:153 Go (Free:84 Go) D:\ (CD or DVD) E:\ (CD or DVD) "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 ) Option : [2] ( 14/01/2010|10:01 ) [ UAC => 1 ] -----------\\ SUPPRESSION Supprime! - C:\Program Files\AskPBar\bar Supprime! - C:\Program Files\AskPBar -----------\\ Recherche de Fichiers / Dossiers ... -----------\\ [..\Internet Explorer\Main] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Local Page"="C:\\Windows\\system32\\blank.htm" "Search Page"="http://www.google.com"'>http://www.google.com"'>http://www.google.com" "Start Page"="http://www.google.com/" "Default_Page_URL"="http://www.google.com" "Url"="http://go.microsoft.com/fwlink/?LinkID=68928" "Url"="http://go.microsoft.com/fwlink/?LinkID=44406" "Url"="http://go.microsoft.com/fwlink/?LinkID=68929" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.msn.com/" "Default_Page_URL"="http://www.google.com" "Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"'>http://go.microsoft.com/fwlink/?LinkId=54896" "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896" "Local Page"="C:\\Windows\\System32\\blank.htm" --------------------\\ Recherche d'autres infections --------------------\\ Cracks & Keygens .. C:\Users\croquis\Desktop\WIFI C:\Users\croquis\Desktop\WIFI\drivers C:\Users\croquis\Desktop\WIFI\drivers2 C:\Users\croquis\Desktop\WIFI\WinAircrackPack C:\Users\croquis\Desktop\WIFI\drivers\bcm43xx.cat C:\Users\croquis\Desktop\WIFI\drivers\bcm43xxa.cat C:\Users\croquis\Desktop\WIFI\drivers\bcmwl5.inf C:\Users\croquis\Desktop\WIFI\drivers\bcmwl5.sys C:\Users\croquis\Desktop\WIFI\drivers\bcmwl5a.inf C:\Users\croquis\Desktop\WIFI\drivers\Readme.txt C:\Users\croquis\Desktop\WIFI\drivers2\ar5211.sys C:\Users\croquis\Desktop\WIFI\drivers2\net5211.inf C:\Users\croquis\Desktop\WIFI\drivers2\readme.htm C:\Users\croquis\Desktop\WIFI\WinAircrackPack\airdecap.exe C:\Users\croquis\Desktop\WIFI\WinAircrackPack\airodump.exe C:\Users\croquis\Desktop\WIFI\WinAircrackPack\cygwin1.dll C:\Users\croquis\Desktop\WIFI\WinAircrackPack\Lang C:\Users\croquis\Desktop\WIFI\WinAircrackPack\MSVCR70.DLL C:\Users\croquis\Desktop\WIFI\WinAircrackPack\PEEK.DLL C:\Users\croquis\Desktop\WIFI\WinAircrackPack\PEEK5.SYS C:\Users\croquis\Desktop\WIFI\WinAircrackPack\README.txt C:\Users\croquis\Desktop\WIFI\WinAircrackPack\Temp C:\Users\croquis\Desktop\WIFI\WinAircrackPack\Updater C:\Users\croquis\Desktop\WIFI\WinAircrackPack\Updater.exe C:\Users\croquis\Desktop\WIFI\WinAircrackPack\Updater.ini C:\Users\croquis\Desktop\WIFI\WinAircrackPack\WinAircrack.exe C:\Users\croquis\Desktop\WIFI\WinAircrackPack\WinAircrack.ini C:\Users\croquis\Desktop\WIFI\WinAircrackPack\Lang\english.ini C:\Users\croquis\Desktop\WIFI\WinAircrackPack\Lang\francais.ini C:\Users\croquis\Desktop\WIFI\WinAircrackPack\Lang\spanish.ini C:\Users\croquis\Desktop\WIFI\WinAircrackPack\Lang\system.ini.txt C:\Users\croquis\Desktop\WIFI\WinAircrackPack\Temp\check.upd C:\Users\croquis\Desktop\WIFI\WinAircrackPack\Temp\Download.tmp C:\Users\croquis\Desktop\WIFI\WinAircrackPack\Updater\Data.upd C:\Users\croquis\nokia_5800\Epocware Handy Expense v3.02.S60v5.SymbianOS9.4 incl Keygen-HSpda C:\Users\croquis\nokia_5800\Epocware Handy Expense v3.02.S60v5.SymbianOS9.4 incl Keygen-HSpda.rar C:\Users\croquis\nokia_5800\Epocware Handy Profiles.v1.06(1).S60v5.SymbianOS9.4.incl.Keygen-HSpda C:\Users\croquis\nokia_5800\Epocware Handy Profiles.v1.06(1).S60v5.SymbianOS9.4.incl.Keygen-HSpda.rar C:\Users\croquis\nokia_5800\Epocware Handy Taskman.v2.02.S60v5.SymbianOS9.4.incl.Keygen-HSpda C:\Users\croquis\nokia_5800\Epocware Handy Taskman.v2.02.S60v5.SymbianOS9.4.incl.Keygen-HSpda.rar C:\Users\croquis\nokia_5800\Smartphoneware.Best.Answering.Machine.v1.0.S60v5.SymbianOS9.4.incl.Keygen-HSpda.rar C:\Users\croquis\nokia_5800\Epocware Handy Expense v3.02.S60v5.SymbianOS9.4 incl Keygen-HSpda\HandyExpense_S60_Touch.sis C:\Users\croquis\nokia_5800\Epocware Handy Expense v3.02.S60v5.SymbianOS9.4 incl Keygen-HSpda\keygen.exe C:\Users\croquis\nokia_5800\Epocware Handy Profiles.v1.06(1).S60v5.SymbianOS9.4.incl.Keygen-HSpda\HandyProfiles_S60_Touch.sis C:\Users\croquis\nokia_5800\Epocware Handy Taskman.v2.02.S60v5.SymbianOS9.4.incl.Keygen-HSpda\HandyTaskman_S60_Touch.sis C:\Users\croquis\nokia_5800\OfficeSuite\keygen.exe [ UAC => 1 ] 1 - "C:\ToolBar SD\TB_1.txt" - 14/01/2010| 9:49 - Option : [1] 2 - "C:\ToolBar SD\TB_2.txt" - 14/01/2010| 9:57 - Option : [1] 3 - "C:\ToolBar SD\TB_3.txt" - 14/01/2010|10:04 - Option : [2]

J'ai lancé ton programme. voici les logs info.txt logfile of random's system information tool 1.06 2010-01-13 14:43:17 ======Uninstall list====== -->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER 2007 Microsoft Office system-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROHYBRIDR /dll OSETUP.DLL Ad-Aware-->"C:\ProgramData\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe" REMOVE=TRUE MODIFY=FALSE Ad-Aware-->C:\ProgramData\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe Adobe Acrobat 8.1.0 Professional-->msiexec /I {AC76BA86-1033-F400-7760-000000000003} Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7} Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723} Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95} Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61} Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394} Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23} Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C} Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C} Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D} Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD} Adobe Dreamweaver CS3-->C:\Program Files\Common Files\Adobe\Installers\ad19d2ae8332572b119cf35fd0a30d8\Setup.exe Adobe Dreamweaver CS3-->MsiExec.exe /I{4BDB76C6-902E-41D5-9064-68768E02886B} Adobe ExtendScript Toolkit 2-->C:\Program Files\Common Files\Adobe\Installers\3e054d2218e7aa282c2369d939e58ff\Setup.exe Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{77D2A9D3-5800-43E3-B274-87841BC87DB2} Adobe Extension Manager CS3-->MsiExec.exe /I{BE5F3842-8309-4754-92D5-83E02E6077A3} Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245} Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C} Adobe Photoshop 7.0-->C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll" Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003} Adobe Setup-->MsiExec.exe /I{2274624C-5B38-41AD-AD27-CEC0924EB628} Adobe Setup-->MsiExec.exe /I{8AE03988-8C8C-40EE-BDC7-76781BEF1B1D} Adobe Setup-->MsiExec.exe /I{D2E18162-47FB-4216-8AB3-F420C1AF75A4} Adobe Shockwave Player-->C:\Windows\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Macromed\SHOCKW~1\Install.log Adobe Stock Photos CS3-->C:\Program Files\Common Files\Adobe\Installers\cbb2ea61da9c780bd7e47a5230a9ed7\Setup.exe Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183} Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312} Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8} Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5} Antidote RX v3-->MsiExec.exe /X{A474EA56-5DBD-4181-8230-806A4762EA7F} Apple Software Update-->MsiExec.exe /I{74EC78BC-B379-4E29-9006-8F161DCAABA6} Ashampoo AntiSpyWare 2.10-->"C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\unins000.exe" Ask Toolbar-->rundll32 C:\PROGRA~1\AskPBar\bar\1.bin\AskPBar.dll,O Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2} Auslogics Registry Defrag-->"C:\Program Files\Auslogics\Auslogics Registry Defrag\unins000.exe" Brother MFL-Pro Suite-->"C:\Program Files\InstallShield Installation Information\{D83BD5E2-5AF4-49F6-B5C1-484A9760E73D}\Setup.exe" -runfromtemp -l0x040c Brunin03.dll -removeonly CCleaner-->"C:\Program Files\CCleaner\uninst.exe" DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN FileZilla (remove only)-->"C:\Program Files\FileZilla\uninstall.exe" Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll" HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT="" Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT="" Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31} InterVideo WinDVD 4-->"C:\Program Files\InstallShield Installation Information\{98E8A2EF-4EAE-43B8-A172-74842B764777}\setup.exe" REMOVEALL IZArc 3.7-->"C:\Program Files\IZArc\unins000.exe" Java 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216016FF} Magicbit 3GP Video Converter-->C:\Program Files\Magicbit\3GP Video Converter\Uninstall.exe Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe" Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe" Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31} Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00BA-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-00BA-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B} Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE} Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE} Microsoft Office Groove 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall GROOVER /dll OSETUP.DLL Microsoft Office Groove 2007-->MsiExec.exe /X{91120000-00BA-0000-0000-0000000FF1CE} Microsoft Office Groove MUI (French) 2007-->MsiExec.exe /X{90120000-00BA-040C-0000-0000000FF1CE} Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE} Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE} Microsoft Office Professional Hybrid 2007-->MsiExec.exe /X{91120000-0031-0000-0000-0000000FF1CE} Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE} Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE} Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE} Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE} Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE} Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE} Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9} Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE} Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE} Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE} Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs-->MsiExec.exe /X{90120000-00B2-0409-0000-0000000FF1CE} Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118} Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Microsoft Visual J# Redistributable Package 2.0-->C:\Windows\Microsoft.NET\Framework\v2.0.50727\Microsoft Visual J# 2.0 Redistributable Package\install.exe Microsoft Visual Web Developer 2005 Express - FRA Service Pack 1 (KB926751)-->C:\Windows\system32\msiexec.exe /promptrestart /uninstall {D07A13F7-D30C-47DD-AD95-7D0105811327} /package {C9301CC8-66FD-4040-9C9B-B850E8DFA70A} Microsoft Visual Web Developer 2005 Express - FRA-->C:\Program Files\Microsoft Visual Studio 8\Microsoft Visual Web Developer 2005 Express Edition - FRA\setup.exe Microsoft Visual Web Developer 2005 Express Edition - FRA-->MsiExec.exe /X{C9301CC8-66FD-4040-9C9B-B850E8DFA70A} Mise à jour Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C} Mise à jour Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {51EFB347-1F3D-4BAC-8B79-F056B904FE21} Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3} Mise à jour Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223} Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe Mozilla Firefox (3.5.7)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe Mozilla Thunderbird (2.0.0.23)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94} MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71} MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC} Nokia Connectivity Cable Driver-->MsiExec.exe /X{15AC0C5D-A6FB-4CE2-8CD0-28179EEB5625} Nokia Flashing Cable Driver-->MsiExec.exe /X{D99C322D-C21B-40C7-AE71-EE51AA096B6E} Nokia Ovi Application Installer 6.85.3010-->msiexec /qn /x {5C2909FF-1E30-48B3-8820-6F40D3E4A0C7} Nokia Ovi Application Installer-->MsiExec.exe /I{5C2909FF-1E30-48B3-8820-6F40D3E4A0C7} Nokia Ovi Content Copier 6.85.3010-->msiexec /qn /x {4371DBFF-8F97-4A64-A18D-EF8F6EA06A69} Nokia Ovi Content Copier-->MsiExec.exe /X{4371DBFF-8F97-4A64-A18D-EF8F6EA06A69} Nokia Ovi One Touch Access 6.85.3010-->msiexec /qn /x {C0A957EF-B8F2-449A-98E4-00F1872EC4BD} Nokia Ovi One Touch Access-->MsiExec.exe /I{C0A957EF-B8F2-449A-98E4-00F1872EC4BD} Nokia Ovi Suite-->MsiExec.exe /I{8CF2565F-894C-4F11-8DCB-FBA97CADE10B} Nokia Ovi System Utilities 6.85.3010-->msiexec /qn /x {A272197C-D2EE-4DF9-8AB0-B05F4CFFDEA0} Nokia Ovi System Utilities-->MsiExec.exe /X{A272197C-D2EE-4DF9-8AB0-B05F4CFFDEA0} Nokia Software Updater-->MsiExec.exe /X{EF4F620F-F295-41D7-92C0-6B635709C850} NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI Opera 9.23-->MsiExec.exe /X{45A54FAD-AADB-4CD2-9E56-2507A15F013D} Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238} Package de pilotes Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\system32\DRVSTORE\pccsmcfd_A3B3916E5D8138F59EE218321B27B044D3B18294\pccsmcfd.inf Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe Panda Antivirus Pro 2010-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E55FB276-73C9-4776-AB53-BC028C0509ED}\SETUP.exe" -l0x40c -removeonly PC Connectivity Solution-->MsiExec.exe /I{83258E90-1F76-4E13-9F60-A0F8ED41E76F} QuickTime-->MsiExec.exe /I{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC} Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08} Security Update for 2007 Microsoft Office System (KB973704)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F} Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for Microsoft Office Excel 2007 (KB973593)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {7D6255E3-3423-4D8B-A328-F6F8D28DD5FE} Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0} Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D} Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E} Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF} Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-00BA-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF} Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C} Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC} Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-00BA-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC} Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D} Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003} Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe" Trillian-->C:\Program Files\Trillian\trillian.exe /uninstall twhirl-->msiexec /qb /x {B73BEEBE-3D94-2634-B5D1-28B8269489FF} twhirl-->MsiExec.exe /I{B73BEEBE-3D94-2634-B5D1-28B8269489FF} Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D} Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-00BA-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D} Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT="" Update for Microsoft Office InfoPath 2007 (KB976416)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {432C5EE4-8096-4FF1-95E1-65219365DFF7} Update for Microsoft Office InfoPath 2007 (KB976416)-->msiexec /package {91120000-00BA-0000-0000-0000000FF1CE} /uninstall {432C5EE4-8096-4FF1-95E1-65219365DFF7} Update for Microsoft Office Word 2007 (KB974561)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {0CDDBAA2-2111-4A0E-A1B0-76C40C635331} Update for Outlook 2007 Junk Email Filter (kb976884)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {FB60F280-C70F-4174-BADB-471412AA42F0} Update pour Microsoft Visual Web Developer 2005 Express - FRA (KB932233)-->C:\Windows\system32\msiexec.exe /promptrestart /uninstall {DC43742B-E3C0-41DC-A476-E8B8722E8871} /package {C9301CC8-66FD-4040-9C9B-B850E8DFA70A} VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B} Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27} Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\Windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT="" Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41} Windows Live Communications Platform-->MsiExec.exe /I{ED00D08A-3C5F-488D-93A0-A04F21F23956} Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1} Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4} WinHTTrack Website Copier 3.42-->"C:\Program Files\WinHTTrack\unins000.exe" XviD MPEG-4 Codec-->"C:\Program Files\XviD\UninstXviD.exe" ======Hosts File====== 127.0.0.1 localhost ::1 localhost 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com ======Security center information====== AS: Spybot - Search and Destroy (disabled) AS: Lavasoft Ad-Watch Live! (disabled) AS: Windows Defender ======System event log====== Computer Name: croquis2 Event Code: 4227 Message: TCP/IP n’a pas pu établir une connexion sortante car le point de terminaison local sélectionné a été récemment utilisé pour se connecter au même point de terminaison distant. Cette erreur se produit généralement lorsque les connexions sortantes sont ouvertes et fermées à un débit élevé, provoquant l’utilisation de tous les ports locaux disponibles et obligeant TCP/IP à réutiliser un port local pour une connexion sortante. Pour réduire le risque d’altération des données, la norme TCP/IP exige qu’un laps de temps minimal s’écoule entre des connexions successives d’un point de terminaison local à un point de terminaison distant. Record Number: 68912 Source Name: Tcpip Time Written: 20090330080101.185000-000 Event Type: Avertissement User: Computer Name: croquis2 Event Code: 7011 Message: Le dépassement de délai (30000 millisecondes) a été atteint lors de l’attente de la réponse transactionnelle du service Dnscache. Record Number: 68887 Source Name: Service Control Manager Time Written: 20090330075816.000000-000 Event Type: Erreur User: Computer Name: croquis2 Event Code: 15016 Message: Impossible d’initialiser le package de sécurité Kerberos pour l’authentification côté serveur. Le champ de données contient le numéro de l’erreur. Record Number: 68804 Source Name: Microsoft-Windows-HttpEvent Time Written: 20090330075248.535346-000 Event Type: Erreur User: Computer Name: croquis2 Event Code: 4 Message: Carte Connexion réseau Intel® PRO/100 : la liaison à la carte est interrompue Record Number: 68799 Source Name: E100B Time Written: 20090330075213.427702-000 Event Type: Avertissement User: Computer Name: croquis2 Event Code: 4001 Message: Le Service d’autoconfiguration WLAN s’est arrêté correctement. Record Number: 68788 Source Name: Microsoft-Windows-WLAN-AutoConfig Time Written: 20090328191928.595000-000 Event Type: Avertissement User: AUTORITE NT\SYSTEM =====Application event log===== Computer Name: PC-de-croquis Event Code: 1530 Message: Windows a détecté que votre fichier de Registre est toujours utilisé par d'autres applications ou services. Le fichier va être déchargé. Les applications ou services qui ont accès à votre Registre risquent de ne pas fonctionner correctement après cela. DÉTAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-3537258838-819066368-241578538-1000: Process 524 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-3537258838-819066368-241578538-1000 Record Number: 61 Source Name: Microsoft-Windows-User Profiles Service Time Written: 20070504101203.000000-000 Event Type: Avertissement User: AUTORITE NT\SYSTEM Computer Name: PC-de-croquis Event Code: 63 Message: Le fournisseur WmiPerfClass a été inscrit dans l’espace de noms Windows Management Instrumentation root\cimv2, afin d’utiliser le compte LocalSystem. Ce compte bénéficie de privilèges et le fournisseur peut provoquer une violation de sécurité s’il ne représente pas correctement les demandes utilisateur. Record Number: 41 Source Name: Microsoft-Windows-WMI Time Written: 20070504092250.000000-000 Event Type: Avertissement User: AUTORITE NT\SYSTEM Computer Name: PC-de-croquis Event Code: 63 Message: Le fournisseur WmiPerfClass a été inscrit dans l’espace de noms Windows Management Instrumentation root\cimv2, afin d’utiliser le compte LocalSystem. Ce compte bénéficie de privilèges et le fournisseur peut provoquer une violation de sécurité s’il ne représente pas correctement les demandes utilisateur. Record Number: 40 Source Name: Microsoft-Windows-WMI Time Written: 20070504092250.000000-000 Event Type: Avertissement User: AUTORITE NT\SYSTEM Computer Name: PC-de-croquis Event Code: 1008 Message: Le service Windows Search tente de supprimer l’ancien catalogue. Record Number: 24 Source Name: Microsoft-Windows-Search Time Written: 20070504091849.000000-000 Event Type: Avertissement User: Computer Name: 26L2233B2-12 Event Code: 1036 Message: Échec de InitializePrintProvider pour le fournisseur inetpp.dll. Cela peut se produire à la suite d’une instabilité du système ou d’une insuffisance des ressources système. Record Number: 13 Source Name: Microsoft-Windows-SpoolerSpoolss Time Written: 20070504091423.000000-000 Event Type: Avertissement User: AUTORITE NT\SYSTEM =====Security event log===== Computer Name: croquis2 Event Code: 4624 Message: L’ouverture de session d’un compte s’est correctement déroulée. Sujet : ID de sécurité : S-1-0-0 Nom du compte : - Domaine du compte : - ID d’ouverture de session : 0x0 Type d’ouverture de session : 3 Nouvelle ouverture de session : ID de sécurité : S-1-5-7 Nom du compte : ANONYMOUS LOGON Domaine du compte : AUTORITE NT ID d’ouverture de session : 0x98e2c61 GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Informations sur le processus : ID du processus : 0x0 Nom du processus : - Informations sur le réseau : Nom de la station de travail : biray Adresse du réseau source : 192.168.1.14 Port source : 3355 Informations détaillées sur l’authentification : Processus d’ouverture de session : NtLmSsp Package d’authentification : NTLM Services en transit : - Nom du package (NTLM uniquement) : NTLM V1 Longueur de la clé : 0 Cet événement est généré lors de la création d’une ouverture de session. Il est généré sur l’ordinateur sur lequel l’ouverture de session a été effectuée. Le champ Objet indique le compte sur le système local qui a demandé l’ouverture de session. Il s’agit le plus souvent d’un service, comme le service Serveur, ou un processus local tel que Winlogon.exe ou Services.exe. Le champ Type d’ouverture de session indique le type d’ouverture de session qui s’est produit. Les types les plus courants sont 2 (interactif) et 3 (réseau). Le champ Nouvelle ouverture de session indique le compte pour lequel la nouvelle ouverture de session a été créée, par exemple, le compte qui s’est connecté. Les champs relatifs au réseau indiquent la provenance d’une demande d’ouverture de session à distance. Le nom de la station de travail n’étant pas toujours disponible, peut être laissé vide dans certains cas. Les champs relatifs aux informations d’authentification fournissent des détails sur cette demande d’ouverture de session spécifique. - Le GUID d’ouverture de session est un identificateur unique pouvant servir à associer cet événement à un événement KDC . - Les services en transit indiquent les services intermédiaires qui ont participé à cette demande d’ouverture de session. - Nom du package indique quel est le sous-protocole qui a été utilisé parmi les protocoles NTLM. - La longueur de la clé indique la longueur de la clé de session générée. Elle a la valeur 0 si aucune clé de session n’a été demandée. Record Number: 140943 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090922111956.513000-000 Event Type: Succès de l'audit User: Computer Name: croquis2 Event Code: 4648 Message: Tentative d’ouverture de session en utilisant des informations d’identification explicites. Sujet : ID de sécurité : S-1-5-21-3537258838-819066368-241578538-1000 Nom du compte : croquis Domaine du compte : croquis2 ID d’ouverture de session : 0x31c74 GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Compte dont les informations d’identification ont été utilisées : Nom du compte : contact Domaine du compte : biray.com GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Serveur cible : Nom du serveur cible : domaine3.gandi.com Informations supplémentaires : domaine3.gandi.com Informations sur le processus : ID du processus : 0x201c Nom du processus : C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE Informations sur le réseau : Adresse du réseau : - Port : - Cet événement est généré lorsqu’un processus tente d’ouvrir une session pour un compte en spécifiant explicitement les informations d’identification de ce compte. Ceci se produit le plus souvent dans les configurations par lot comme les tâches planifiées, ou avec l’utilisation de la commande RUNAS. Record Number: 140942 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090922111844.913000-000 Event Type: Succès de l'audit User: Computer Name: croquis2 Event Code: 4648 Message: Tentative d’ouverture de session en utilisant des informations d’identification explicites. Sujet : ID de sécurité : S-1-5-21-3537258838-819066368-241578538-1000 Nom du compte : croquis Domaine du compte : croquis2 ID d’ouverture de session : 0x31c74 GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Compte dont les informations d’identification ont été utilisées : Nom du compte : contact Domaine du compte : biray.com GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Serveur cible : Nom du serveur cible : domaine3.gandi.com Informations supplémentaires : domaine3.gandi.com Informations sur le processus : ID du processus : 0x201c Nom du processus : C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE Informations sur le réseau : Adresse du réseau : - Port : - Cet événement est généré lorsqu’un processus tente d’ouvrir une session pour un compte en spécifiant explicitement les informations d’identification de ce compte. Ceci se produit le plus souvent dans les configurations par lot comme les tâches planifiées, ou avec l’utilisation de la commande RUNAS. Record Number: 140941 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090922111434.534000-000 Event Type: Succès de l'audit User: Computer Name: croquis2 Event Code: 4648 Message: Tentative d’ouverture de session en utilisant des informations d’identification explicites. Sujet : ID de sécurité : S-1-5-21-3537258838-819066368-241578538-1000 Nom du compte : croquis Domaine du compte : croquis2 ID d’ouverture de session : 0x31c74 GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Compte dont les informations d’identification ont été utilisées : Nom du compte : stephane Domaine du compte : biray.com GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Serveur cible : Nom du serveur cible : domaine3.gandi.com Informations supplémentaires : domaine3.gandi.com Informations sur le processus : ID du processus : 0x201c Nom du processus : C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE Informations sur le réseau : Adresse du réseau : - Port : - Cet événement est généré lorsqu’un processus tente d’ouvrir une session pour un compte en spécifiant explicitement les informations d’identification de ce compte. Ceci se produit le plus souvent dans les configurations par lot comme les tâches planifiées, ou avec l’utilisation de la commande RUNAS. Record Number: 140940 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090922111127.304000-000 Event Type: Succès de l'audit User: Computer Name: croquis2 Event Code: 4648 Message: Tentative d’ouverture de session en utilisant des informations d’identification explicites. Sujet : ID de sécurité : S-1-5-21-3537258838-819066368-241578538-1000 Nom du compte : croquis Domaine du compte : croquis2 ID d’ouverture de session : 0x31c74 GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Compte dont les informations d’identification ont été utilisées : Nom du compte : stephane Domaine du compte : biray.com GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Serveur cible : Nom du serveur cible : domaine3.gandi.com Informations supplémentaires : domaine3.gandi.com Informations sur le processus : ID du processus : 0x201c Nom du processus : C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE Informations sur le réseau : Adresse du réseau : - Port : - Cet événement est généré lorsqu’un processus tente d’ouvrir une session pour un compte en spécifiant explicitement les informations d’identification de ce compte. Ceci se produit le plus souvent dans les configurations par lot comme les tâches planifiées, ou avec l’utilisation de la commande RUNAS. Record Number: 140939 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090922110251.643000-000 Event Type: Succès de l'audit User: ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "Path"=C:\Program Files\Nokia\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Panda Security\Panda Antivirus Pro 2010\ "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC "PROCESSOR_ARCHITECTURE"=x86 "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "USERNAME"=SYSTEM "windir"=%SystemRoot% "PROCESSOR_LEVEL"=15 "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 6 Stepping 5, GenuineIntel "PROCESSOR_REVISION"=0605 "NUMBER_OF_PROCESSORS"=2 "CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip "QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip -----------------EOF----------------- Logfile of random's system information tool 1.06 (written by random/random) Run by croquis at 2010-01-13 14:41:40 Microsoft® Windows Vista™ Édition Familiale Basique Service Pack 2 System drive C: has 87 GB (55%) free of 157 GB Total RAM: 2045 MB (38% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:43:06, on 13/01/2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18865) Boot mode: Normal Running processes: C:\PROGRAM FILES\PANDA SECURITY\PANDA ANTIVIRUS PRO 2010\WebProxy.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe C:\Windows\System32\rundll32.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Panda Security\Panda Antivirus Pro 2010\ApVxdWin.exe C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Brother\ControlCenter3\brccMCtl.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe C:\Program Files\Druide\Antidote\Gestionnaire Antidote.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Users\croquis\Program Files\DNA\btdna.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Program Files\Microsoft Office\Office12\GROOVE.EXE C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE C:\Windows\system32\wuauclt.exe C:\Program Files\Microsoft Office\Office12\WINWORD.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\twhirl\twhirl.exe C:\Users\croquis\Desktop\RSIT.exe C:\Program Files\trend micro\croquis.exe C:\Program Files\Panda Security\Panda Antivirus Pro 2010\avciman.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {4FFCA75C-B1F0-4C32-B917-1928D2D338E8} - c:\windows\system32\zwpagdt.dll (file missing) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Ask Toolbar BHO - {F4D76F01-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL (file missing) O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [brMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Antivirus Pro 2010\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [sCANINICIO] "C:\Program Files\Panda Security\Panda Antivirus Pro 2010\Inicio.exe" O4 - HKLM\..\Run: ['Ashampoo AntiSpyWare 2 Guard'] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\Program Files\Druide\Antidote\Gestionnaire Antidote.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Users\croquis\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [Ashampoo AntiSpyWare 2 Guard] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [Gestionnaire Antidote.exe] C:\Program Files\Druide\Antidote\Gestionnaire Antidote.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Gestionnaire Antidote.exe] C:\Program Files\Druide\Antidote\Gestionnaire Antidote.exe (User 'Default user') O4 - Startup: Microsoft Office Groove.lnk = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Nokia Ovi Suite.lnk = C:\Program Files\Nokia\Ovi\Suite\RunLauncher.exe O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\Program Files\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU) O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\Program Files\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU) O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\Program Files\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU) O13 - Gopher Prefix: O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/Tran...ransferCtrl.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas...ent/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O20 - Winlogon Notify: emtxcdbi - zwpagdt.dll (file missing) O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PsCtrls.exe O23 - Service: Panda Function Service (PAVFNSVR) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PavFnSvr.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Security, S.L. - C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2010\pavsrvx86.exe O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PsImSvc.exe O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PskSvc.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2010\TPSrv.exe -- End of file - 12168 bytes ======Scheduled tasks folder====== C:\Windows\tasks\Ad-Aware Update (Weekly).job C:\Windows\tasks\Spybot - Search & Destroy - Scheduled Task.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4FFCA75C-B1F0-4C32-B917-1928D2D338E8}] c:\windows\system32\zwpagdt.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2007-08-10 2161728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}] Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2007-05-10 321120] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4D76F01-7896-458a-890F-E1F05C46069F}] Ask Toolbar BHO - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {F4D76F09-7896-458a-890F-E1F05C46069F} - Ask Toolbar - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL [] {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2007-08-10 2161728] {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2007-05-10 321120] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184] "GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072] "BrMfcWnd"=C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2006-12-18 622592] "ControlCenter3"=C:\Program Files\Brother\ControlCenter3\brctrcen.exe [2006-07-19 65536] "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2007-06-29 286720] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792] "Acrobat Assistant 8.0"=C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [2007-05-10 624248] ""= [] "NokiaMServer"=C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles [] "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-09-17 13580832] "NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-09-17 92704] "Ad-Watch"=C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe [2009-09-25 520024] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280] "APVXDWIN"=C:\Program Files\Panda Security\Panda Antivirus Pro 2010\APVXDWIN.EXE [2009-09-25 906496] "SCANINICIO"=C:\Program Files\Panda Security\Panda Antivirus Pro 2010\Inicio.exe [2009-08-12 56064] "'Ashampoo AntiSpyWare 2 Guard'"=C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe [2009-07-15 2376536] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920] "MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2009-07-26 3883856] "AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2007-07-02 219520] "swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe [2007-08-10 165304] "Gestionnaire Antidote.exe"=C:\Program Files\Druide\Antidote\Gestionnaire Antidote.exe [2007-04-16 534200] "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240] "BitTorrent DNA"=C:\Users\croquis\Program Files\DNA\btdna.exe [2009-10-07 323392] "Ashampoo AntiSpyWare 2 Guard"=C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe [2009-07-15 2376536] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe Nokia Ovi Suite.lnk - C:\Program Files\Nokia\Ovi\Suite\RunLauncher.exe C:\Users\croquis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup Microsoft Office Groove.lnk - C:\Program Files\Microsoft Office\Office12\GROOVE.EXE [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avldr] C:\Windows\system32\avldr.dll [2008-03-18 58672] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\emtxcdbi] zwpagdt.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "BindDirectlyToPropertySetStorage"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] shell\AutoRun\command - F:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3d8b98aa-fae3-11db-8942-0019d1580fed}] shell\AutoRun\command - F:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5462c555-43ed-11dc-804e-0019d1580fed}] shell\AutoRun\command - setupSNK.exe ======File associations====== .js - edit - C:\Windows\System32\Notepad.exe %1 .js - open - "C:\Program Files\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe","%1" .vbs - open - C:\PROGRA~1\PANDAS~1\PANDAA~1\PAVSCRIP.EXE "%1" %* ======List of files/folders created in the last 1 months====== 2010-01-13 14:41:40 ----D---- C:\rsit 2010-01-06 18:50:23 ----A---- C:\Windows\ntbtlog.txt 2010-01-06 15:29:25 ----HD---- C:\Windows\PIF 2010-01-06 14:44:04 ----D---- C:\Windows\Minidump 2010-01-06 14:27:57 ----D---- C:\Program Files\CCleaner 2010-01-06 14:06:08 ----A---- C:\Windows\system32\HHActiveX.dll 2010-01-06 14:05:56 ----A---- C:\Windows\system32\TpUtil.dll 2010-01-06 14:05:56 ----A---- C:\Windows\system32\SYSTOOLS.DLL 2010-01-06 14:05:56 ----A---- C:\Windows\system32\PavLspHook.dll 2010-01-06 14:05:56 ----A---- C:\Windows\system32\pavipc.dll 2010-01-06 14:05:55 ----A---- C:\Windows\system32\PavSHook.dll 2010-01-06 14:05:49 ----A---- C:\Windows\system32\avldr.dll 2010-01-06 13:57:08 ----D---- C:\Program Files\Common Files\Panda Security 2010-01-06 12:45:08 ----A---- C:\Windows\system32\javaws.exe 2010-01-06 12:45:08 ----A---- C:\Windows\system32\javaw.exe 2010-01-06 12:45:08 ----A---- C:\Windows\system32\java.exe 2010-01-05 12:34:53 ----D---- C:\Program Files\Ashampoo 2010-01-05 11:38:15 ----D---- C:\Program Files\Java(365) 2010-01-04 19:23:06 ----D---- C:\ProgramData\Panda Software 2009-12-31 17:33:29 ----D---- C:\Program Files\Trend Micro 2009-12-31 14:39:07 ----D---- C:\Windows\system32\PAV 2009-12-31 14:39:06 ----D---- C:\Users\croquis\AppData\Roaming\Panda Security 2009-12-31 14:39:06 ----D---- C:\ProgramData\Panda Security 2009-12-31 13:45:09 ----D---- C:\Users\croquis\AppData\Roaming\QuickScan 2009-12-30 11:19:35 ----D---- C:\Program Files\gs 2009-12-30 11:19:09 ----D---- C:\Program Files\SmartDraw PDF Filter 2009-12-30 11:14:00 ----D---- C:\Program Files\SmartDraw 2010(556) 2009-12-29 20:47:13 ----D---- C:\ProgramData\ESET 2009-12-29 20:16:14 ----D---- C:\Program Files\Enigma Software Group 2009-12-17 10:33:32 ----D---- C:\Users\croquis\AppData\Roaming\SmartDraw 2009-12-17 10:31:29 ----D---- C:\Program Files\SmartDraw 2010 ======List of files/folders modified in the last 1 months====== 2010-01-13 14:42:07 ----D---- C:\Windows\Temp 2010-01-13 14:33:39 ----D---- C:\Users\croquis\AppData\Roaming\DNA 2010-01-13 13:14:01 ----D---- C:\Windows\Prefetch 2010-01-13 10:07:06 ----D---- C:\Windows\system32\catroot 2010-01-13 10:07:03 ----D---- C:\Windows\winsxs 2010-01-13 09:52:11 ----D---- C:\Windows\system32\drivers 2010-01-13 09:51:28 ----D---- C:\Windows\System32 2010-01-13 09:50:07 ----D---- C:\Windows\system32\catroot2 2010-01-13 09:42:34 ----D---- C:\Windows 2010-01-11 11:23:30 ----A---- C:\Windows\BRWMARK.INI 2010-01-07 17:27:37 ----SHD---- C:\System Volume Information 2010-01-06 21:34:50 ----D---- C:\Windows\Microsoft.NET 2010-01-06 21:34:43 ----RSD---- C:\Windows\assembly 2010-01-06 21:08:36 ----SHD---- C:\Windows\Installer 2010-01-06 20:56:21 ----D---- C:\Program Files\Mozilla Firefox 2010-01-06 20:55:27 ----D---- C:\ProgramData\FLEXnet 2010-01-06 20:46:52 ----D---- C:\Windows\system32\Tasks 2010-01-06 18:13:23 ----D---- C:\Program Files\MSECache 2010-01-06 16:24:36 ----A---- C:\Windows\Antidote.ini 2010-01-06 15:53:26 ----HD---- C:\ProgramData 2010-01-06 15:53:25 ----HD---- C:\Windows\system32\GroupPolicy 2010-01-06 15:20:38 ----D---- C:\ProgramData\Spybot - Search & Destroy 2010-01-06 14:46:02 ----D---- C:\Program Files\DNA 2010-01-06 14:27:57 ----RD---- C:\Program Files 2010-01-06 14:10:40 ----D---- C:\Program Files\Spybot - Search & Destroy 2010-01-06 14:08:08 ----A---- C:\Windows\win.ini 2010-01-06 14:06:26 ----D---- C:\Program Files\Panda Security 2010-01-06 13:57:08 ----D---- C:\Program Files\Common Files 2010-01-06 13:56:04 ----D---- C:\Program Files\Alwil Software 2010-01-06 12:52:57 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2010-01-06 12:45:03 ----D---- C:\Program Files\Java 2010-01-06 12:32:34 ----RSD---- C:\Windows\Fonts 2010-01-06 12:32:34 ----D---- C:\Windows\system32\Msdtc 2010-01-06 12:32:26 ----D---- C:\Windows\system32\wbem 2010-01-06 12:25:50 ----D---- C:\Windows\system32\config 2010-01-06 12:24:55 ----D---- C:\Windows\Tasks 2010-01-06 12:24:55 ----D---- C:\Windows\system32\spool 2010-01-06 12:24:55 ----D---- C:\Windows\system32\restore 2010-01-06 12:24:55 ----D---- C:\Program Files\Internet Explorer 2010-01-06 12:24:54 ----D---- C:\Windows\system32\CodeIntegrity 2010-01-06 12:24:41 ----D---- C:\Windows\inf 2010-01-06 12:24:32 ----D---- C:\Users\croquis\AppData\Roaming\Mozilla 2010-01-06 12:24:30 ----D---- C:\Users\croquis\AppData\Roaming\BitTorrent 2010-01-06 12:24:25 ----D---- C:\Program Files\Microsoft Works 2010-01-06 12:24:24 ----D---- C:\Program Files\Google 2010-01-06 12:24:23 ----D---- C:\Program Files\BitTorrent 2010-01-06 12:24:22 ----D---- C:\Program Files\Adobe 2010-01-06 12:23:30 ----D---- C:\Windows\registration 2010-01-06 11:54:02 ----D---- C:\Windows\Logs 2010-01-05 11:59:53 ----D---- C:\ProgramData\Adobe 2010-01-05 11:32:21 ----D---- C:\Program Files\Common Files\Adobe 2010-01-05 11:12:09 ----D---- C:\ProgramData\NOS 2010-01-04 13:37:02 ----D---- C:\Windows\Debug 2010-01-04 13:19:25 ----D---- C:\Windows\nvtmpinst 2009-12-31 14:39:06 ----HD---- C:\Program Files\InstallShield Installation Information 2009-12-31 10:07:08 ----D---- C:\Windows\Branding 2009-12-22 16:43:23 ----D---- C:\Program Files\Common Files\Adobe AIR 2009-12-18 14:27:29 ----D---- C:\ProgramData\Microsoft Help ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 ShldDrv;Panda File Shield Driver; C:\Windows\System32\DRIVERS\ShlDrv51.sys [2008-03-04 41144] R2 AmFSM;AmFSM; C:\Windows\system32\DRIVERS\amm8660.sys [2009-08-06 49160] R2 PavProc;Panda Process Protection Driver; \??\C:\Windows\system32\DRIVERS\PavProc.sys [2009-06-30 163336] R3 AvFlt;Antivirus Filter Driver; C:\Windows\system32\drivers\av5flt.sys [] R3 E100B;Pilote de carte Intel ® PRO; C:\Windows\system32\DRIVERS\e100b325.sys [2008-01-19 159744] R3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544] R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-09-17 7379872] R3 PavSRK.sys;PavSRK.sys; \??\C:\Windows\system32\PavSRK.sys [] R3 PavTPK.sys;PavTPK.sys; \??\C:\Windows\system32\PavTPK.sys [] R3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328] S3 aoffkuef;aoffkuef; C:\Windows\system32\drivers\aoffkuef.sys [] S3 AR5211;Atheros Wireless Network Adapter Service; C:\Windows\system32\DRIVERS\ar5211.sys [2007-07-30 583915] S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2007-03-15 2427392] S3 BCM43XV;Pilote de la carte réseau extensible Broadcom 802.11; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384] S3 BCM43XX;BCM 802.11b Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl5.sys [2004-02-07 306944] S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632] S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192] S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888] S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504] S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016] S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2008-09-15 17664] S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2008-09-15 22016] S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\Windows\system32\drivers\nmwcdnsu.sys [2008-02-01 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\Windows\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320] S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816] S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2007-03-15 2427392] S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2008-09-15 8064] S3 usbaudio;Pilote USB audio (WDM); C:\Windows\system32\drivers\usbaudio.sys [2009-04-11 73216] S3 usbser;Nokia USB Serial Port; C:\Windows\system32\drivers\usbser.sys [2009-04-11 27648] S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2008-09-15 8064] S3 vsbus;Virtual Serial Bus Enumerator; C:\Windows\system32\DRIVERS\vsb.sys [2008-07-23 15264] S3 vserial;ELTIMA Virtual Serial Ports Driver; C:\Windows\System32\DRIVERS\vserial.sys [2008-07-23 47744] S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448] S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328] S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AASW2_Service;Ashampoo AntiSpyWare 2 Service; C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe [2009-07-15 749912] R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376] R2 Gwmsrv;Panda Goodware Cache Manager; C:\Windows\system32\svchost -k Panda [] R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-09-17 196608] R2 Panda Software Controller;Panda Software Controller; C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PsCtrls.exe [2009-08-10 173312] R2 PAVFNSVR;Panda Function Service; C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PavFnSvr.exe [2009-08-10 169216] R2 PavPrSrv;Panda Process Protection Service; C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe [2008-02-04 62768] R2 PAVSRV;Panda On-Access Anti-Malware Service; C:\Program Files\Panda Security\Panda Antivirus Pro 2010\pavsrvx86.exe [2009-09-17 293120] R2 PSIMSVC;Panda IManager Service; C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PsImSvc.exe [2008-06-19 108288] R2 PskSvcRetail;Panda PSK service; C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PskSvc.exe [2009-08-25 28928] R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968] R2 TPSrv;Panda TPSrv; C:\Program Files\Panda Security\Panda Antivirus Pro 2010\TPSrv.exe [2009-04-17 157440] R3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2007-07-31 654848] S2 anggutih;PnP ISA/EISA Bus Monitor; C:\Windows\System32\svchost.exe [2008-01-19 21504] S2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2007-03-15 569344] S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2009-09-25 1028432] S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 ServiceLayer;ServiceLayer; C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe [2008-09-08 575488] -----------------EOF-----------------

Je vais modifier ça se soir et te donner le résulta demain, mais j'ai déjà les logs MalwareByte Malwarebytes' Anti-Malware 1.42 Version de la base de données: 3450 Windows 6.0.6002 Service Pack 2 (Safe Mode) Internet Explorer 8.0.6001.18865 31/12/2009 10:05:27 mbam-log-2009-12-31 (10-05-27).txt Type de recherche: Examen complet (C:\|D:\|E:\|) Eléments examinés: 339656 Temps écoulé: 4 hour(s), 22 minute(s), 30 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 4 Valeur(s) du Registre infectée(s): 1 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 16 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\PUT2VIDQLG (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\B1RQJ7YJ0U (Trojan.FakeAlert) -> Quarantined and deleted successfully. Valeur(s) du Registre infectée(s): HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully. Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): C:\cuqceyq.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\vttgyjt.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1K4ZLQ3S\hnkppz[1].htm (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JHTGOIOV\hohhveswgc[1].htm (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JHTGOIOV\wcyijjt[1].htm (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OFIISOEN\mvNat[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QB6W0Y8R\e42appc[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T2EY2NIO\icmntr[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Local\Temp\arcotray.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Local\Temp\mvNat.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Local\Temp\wbemperf.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Windows\System32\drivers\tkwowuj.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9635938.lnk (Malware.Trace) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Local\Temp\a.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Local\Temp\b.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Windows\System32\sshnas.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. un autre Malwarebytes' Anti-Malware 1.43 Version de la base de données: 3490 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18865 04/01/2010 13:16:00 mbam-log-2010-01-04 (13-16-00).txt Type de recherche: Examen complet (C:\|D:\|E:\|) Eléments examinés: 344371 Temps écoulé: 3 hour(s), 19 minute(s), 46 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 3 Valeur(s) du Registre infectée(s): 1 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 5 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT (Rootkit.TDSS) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\h8srtd.sys (Rootkit.TDSS) -> Quarantined and deleted successfully. Valeur(s) du Registre infectée(s): HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\settdebugx.exe (Rogue.Installer) -> Quarantined and deleted successfully. Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): C:\Windows\Temp\settdebugx.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Local\Temp\a2dspi.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\croquis\AppData\Local\Temp\nsy74D3.tmp\SimpleFC.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Windows\Temp\wscsvc32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Windows\Temp\H8SRT9ff8.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

Salut, J’ai le PC qui plante à chaque fois que je lance le programme, de temps en temps j’ai un écran bleu, mais trop rapide de voir le message pour l’œil humain. Je ne lance bien sûr en mode Administrateur rien à faire. Quand je fais "scan" avec le programme il gratte et plante.

Bonjour et merci pour cette réponse. J’ai voulu lancer programme comme indiqué, mais lorsque je tente de le faire mon ordi plante (blocage ou écran bleu) Je n’ai pas tenté le mode sans échec,je dois essayer ? Panda antivirus me repère Cookie/Atlas DMT et Trj/Boaxxe.Q qui revient a chaque démarrage machine.

Personne pour me guider dans ma désinfection

Bonjour, Voici ma situation, j’ai ouvert un fichier qu’un ami m’a envoyé et la seule fois ou je n’ai pas fait attention c’était une pourriture debackdoor malware et virus tout ça avec un seul ficher. Depuis je me demande si c’est vraiment un ami ^^ J’ai passé mon PC sous Malwarebytes en mode sans échec, fait un CCleaner juste après, mais j’ai encore pas mal de problèmes(j’ai fait tourné aussi Adaware, spybots,antyspyware2,avast , panda antivirus). 1-Sous FF et IE j’ai des redirections sauvages pour des pubs quand je clique sur des liens de temps en temps 2- Mon framework.net ne fonctionne plus du tout, impossible de faire démarrer certain logiciel, je l’ai réinstallé, mais rien n’à faire Si vous pouviez me venir en aide, je vous baiserais les pieds (bon je vais peut être un peu loin) Merci d’avance OS: Vista édition familiale basique service pack 2 32bits