Analyse Rapport HijackThis - fichier douteux hnfbtus.exe [résolu]

[chris67380]

J'ai détecté un fichier douteux nommé hnfbtus.exe sur zonealarm et je n'ai rien trouvé sur google ! Ca ressemble a ce que j'ai déjà eu malheureusement et je joins a ce post un rapport HijackThis !

 

D'avance merci si une nouvelle fois vous pouvez m'aider..

 

Chris.

 

Logfile of HijackThis v1.99.1

Scan saved at 00:34:33, on 09/04/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16414)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe

C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Launch Manager\LaunchAp.exe

C:\Program Files\Launch Manager\HotkeyApp.exe

C:\Program Files\Launch Manager\OSD.exe

C:\Program Files\Launch Manager\Wbutton.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Wistron\AVManager\AVManager.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe

C:\Program Files\Home Cinema\PowerCinema\PCMService.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\HijackThis\scanner.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.live.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe

O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe

O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSD.exe

O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"

O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [AVManager] "C:\Program Files\Wistron\AVManager\AVManager.exe"

O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML

O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm

O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll

O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1106233521554

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion...canner37880.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe

O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Modifié le 12 avril 2007 par chris67380

[bruce lee]

Bonjour chris67380,

 

==> Télécharge navilog1.zip (de IL-MAFIOSO) http://perso.orange.fr/il.mafioso/Navifix/navilog1.zip enregistre ce fichier sur le bureau.

Extraie la totalité de navilog1.zip sur le bureau

==> double clic sur navilog1.bat choisis l'option 1 appuie sur la touche Entrée.

 

Laisse le scan se dérouler, ne touche pas à la souris et au clavier.

 

Le scan fini un rapport portant ce fixnavi.txt souvrira poste le contenu de ce rapport.

Si le résultat du scan ne s'affiche pas tu le trouvera dans C:\fixnavi.txt.

[chris67380]

Merci Bruce lee !

 

Voici le rapport demandé :

 

Search Navipromo version 1.1.3 commencé le 09/04/2007 à 11:40:34,95

 

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!

!!! Poster ce rapport sur le forum pour le faire analyser !!!

!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

 

Fix lancé depuis C:\Documents and Settings\Chris R\Bureau

Mise a jour le 31.03.2007 a 08h00 by IL-MAFIOSO

 

Executé en mode normal

 

*** Recherche Programmes installes ***

 

 

 

 

*** Recherche dossiers dans C:\WINDOWS ***

 

 

 

 

*** Recherche dossiers dans C:\Program Files ***

 

 

 

 

*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***

 

 

 

 

*** Recherche dossiers dans C:\Documents and Settings\Chris R\Application Data ***

 

 

 

*** Recherche avec BlackLight Engine/F-secure ***

BlackLight Engine est un produit de F-secure, pour + d'infos :

http://www.f-secure.com/blacklight/blacklight_help.html

 

 

F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR

======================================

 

Copyright 2005-2006 F-Secure Corporation. All rights reserved.

This is a beta version. It will expire on 1st of April, 2007.

Version information: 2.2.1061.

 

[+] Started on 04/09/07 at 11:40:36.

[+] Initializing ...

[+] Starting scan, press Ctrl-C to abort.

[+] Scanning for hidden items .............................................................................................................................................................................................................................

[+] Scan complete.

[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.

[+] Exited on 04/09/07 at 12:07:35 (return code = 0).

 

 

*** Recherche fichiers ***

 

 

 

 

*** Recherche cles registre ***

 

 

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]

 

 

 

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage]

 

 

 

Recherche Clé Magic Control

 

 

 

*** Module de Recherche complémentaire ***

(Recherche fichiers spécifiques)

 

1)Recherche fichiers connus:

 

 

2)Recherche Heuristique :

*

**

***

****

*****

******

*******

********

 

 

*** Analyse Terminé le 09/04/2007 à 12:07:53,51 ***

 

 

 

 

Bon lundi de Pâques !

[bruce lee]

Re,

 

1/telecharge silent runners http://www.silentrunners.org/Silent%20Runners.vbs

(fait clique droit sur le lien, puis enregistrer la cible sous)

 

2/déconnecte toi du net et ferme toutes les applications en cours.

 

3/lance silent runners laisse le travailler quand il aura finit de scanner tu en sauras averti par un message et un nouveau fichier texte sera crée ouvre ce fichier texte et colle la totalité du rapport.

[chris67380]

voici la totalité du rapport (scan ultra rapide...)

 

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by "{++}"

 

 

Startup items buried in registry:

---------------------------------

 

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"NBJ" = ""C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"" ["Ahead Software AG"]

"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]

"WMPNSCFG" = "C:\Program Files\Windows Media Player\WMPNSCFG.exe" [MS]

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"BluetoothAuthenticationAgent" = "rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" [MS]

"ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]

"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]

"LaunchAp" = "C:\Program Files\Launch Manager\LaunchAp.exe" [empty string]

"HotkeyApp" = "C:\Program Files\Launch Manager\HotkeyApp.exe" ["Wistron"]

"LMgrOSD" = "C:\Program Files\Launch Manager\OSD.exe" ["Wistron"]

"Wbutton" = ""C:\Program Files\Launch Manager\Wbutton.exe"" [empty string]

"CtrlVol" = "C:\Program Files\Launch Manager\CtrlVol.exe" ["Wistron"]

"SynTPLpr" = "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" ["Synaptics, Inc."]

"SynTPEnh" = "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" ["Synaptics, Inc."]

"AGRSMMSG" = "AGRSMMSG.exe" ["Agere Systems"]

"AVManager" = ""C:\Program Files\Wistron\AVManager\AVManager.exe"" ["Wistron Corporation"]

"AOLSAV" = "C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe" ["TechCity Solutions France"]

"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"" ["Sun Microsystems, Inc."]

"RemoteControl" = ""C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."]

"PCMService" = ""C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"" ["CyberLink Corp."]

"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]

"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]

"mmtask" = "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" ["Musicmatch Inc."]

"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data]

"TkBellExe" = ""C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]

"iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Inc."]

"ZoneAlarm Client" = ""C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"" ["Zone Labs, LLC"]

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)

-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"

\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

-> {HKLM...CLSID} = "SSVHelper Class"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."]

{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)

-> {HKLM...CLSID} = "Google Toolbar Helper"

\InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]

{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = (no title provided)

-> {HKLM...CLSID} = "Windows Live Toolbar Helper"

\InProcServer32\(Default) = "C:\Program Files\Windows Live Toolbar\msntb.dll" [MS]

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"

-> {HKLM...CLSID} = "Extension Affichage Panorama du Panneau de configuration"

\InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"

-> {HKLM...CLSID} = "HyperTerminal Icon Ext"

\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]

"{2F603045-309F-11CF-9774-0020AFD0CFF6}" = "Synaptics Control Panel"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Synaptics\SynTP\SynTPCpl.dll" ["Synaptics, Inc."]

"{6af09ec9-b429-11d4-a1fb-0090960218cb}" = "My Bluetooth Places"

-> {HKLM...CLSID} = "Favoris Bluetooth"

\InProcServer32\(Default) = "C:\WINDOWS\system32\btneighborhood.dll" ["Broadcom Corporation."]

"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"

-> {HKLM...CLSID} = "RealOne Player Context Menu Class"

\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]

"{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Périphériques Plug and Play universels"

-> {HKLM...CLSID} = "Périphériques Plug and Play universels"

\InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS]

"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"

-> {HKLM...CLSID} = "avast"

\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]

"{A155339D-CCCD-4714-85EB-3754B804C9DF}" = "a-squared Free Context Menu Shell Extension"

-> {HKLM...CLSID} = "a-squared Free Context Menu"

\InProcServer32\(Default) = "C:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL" ["Emsi Software GmbH"]

"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"

-> {HKLM...CLSID} = "Mes dossiers de partage"

\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll" [MS]

"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"

-> {HKLM...CLSID} = "iTunes"

\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."]

"{D9872D13-7651-4471-9EEE-F0A00218BEBB}" = "Multiscan"

-> {HKLM...CLSID} = "ZLAVShExt Class"

\InProcServer32\(Default) = "C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"]

 

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\

"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

-> {HKLM...CLSID} = "WPDShServiceObj Class"

\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]

 

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\

<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

 

HKLM\Software\Classes\PROTOCOLS\Filter\

<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

 

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\

{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"

-> {HKLM...CLSID} = "PDF Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

 

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\

avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"

-> {HKLM...CLSID} = "avast"

\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]

ZLAVShExt\(Default) = "{D9872D13-7651-4471-9EEE-F0A00218BEBB}"

-> {HKLM...CLSID} = "ZLAVShExt Class"

\InProcServer32\(Default) = "C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"]

 

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

a2FreeContMenu\(Default) = "{A155339D-CCCD-4714-85EB-3754B804C9DF}"

-> {HKLM...CLSID} = "a-squared Free Context Menu"

\InProcServer32\(Default) = "C:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL" ["Emsi Software GmbH"]

avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"

-> {HKLM...CLSID} = "avast"

\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]

ZLAVShExt\(Default) = "{D9872D13-7651-4471-9EEE-F0A00218BEBB}"

-> {HKLM...CLSID} = "ZLAVShExt Class"

\InProcServer32\(Default) = "C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"]

 

HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\

a2FreeContMenu\(Default) = "{A155339D-CCCD-4714-85EB-3754B804C9DF}"

-> {HKLM...CLSID} = "a-squared Free Context Menu"

\InProcServer32\(Default) = "C:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL" ["Emsi Software GmbH"]

 

 

Group Policies {policy setting}:

--------------------------------

 

Note: detected settings may not have any effect.

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

 

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001

{Shutdown: Allow system to be shut down without having to log on}

 

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001

{Devices: Allow undock without having to log on}

 

 

Active Desktop and Wallpaper:

-----------------------------

 

Active Desktop may be disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

 

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\

"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

 

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:

HKCU\Control Panel\Desktop\

"Wallpaper" = "C:\Documents and Settings\Chris R\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

 

 

Enabled Screen Saver:

---------------------

 

HKCU\Control Panel\Desktop\

"SCRNSAVE.EXE" = "C:\WINDOWS\system32\ssmypics.scr" [MS]

 

 

Startup items in "Chris R" & "All Users" startup folders:

---------------------------------------------------------

 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage

"Adobe Gamma Loader.exe" -> shortcut to: "C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]

"BTTray" -> shortcut to: "C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe" ["Broadcom Corporation."]

"Lancement rapide d'Adobe Reader" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]

 

 

Enabled Scheduled Tasks:

------------------------

 

"AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task" ["Apple Computer, Inc."]

"Vérifier les mises à jour de Windows Live Toolbar" -> launches: "C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE" [MS]

 

 

Winsock2 Service Provider DLLs:

-------------------------------

 

Namespace Service Providers

 

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000004\LibraryPath = "%SystemRoot%\system32\wshbth.dll" [MS]

000000000005\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS]

 

Transport Service Providers

 

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 05, 08 - 44

%SystemRoot%\system32\rsvpsp.dll [MS], 06 - 07

 

 

Toolbars, Explorer Bars, Extensions:

------------------------------------

 

Toolbars

 

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"

-> {HKLM...CLSID} = "&Google"

\InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]

"{4982D40A-C53B-4615-B15B-B5B5E98D167C}"

-> {HKLM...CLSID} = "AOL Toolbar"

\InProcServer32\(Default) = "C:\Program Files\AOL Toolbar\toolbar.dll" ["IE Toolbar"]

"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"

-> {HKLM...CLSID} = "Windows Live Toolbar"

\InProcServer32\(Default) = "C:\Program Files\Windows Live Toolbar\msntb.dll" [MS]

 

HKLM\Software\Microsoft\Internet Explorer\Toolbar\

"{4982D40A-C53B-4615-B15B-B5B5E98D167C}" = (no title provided)

-> {HKLM...CLSID} = "AOL Toolbar"

\InProcServer32\(Default) = "C:\Program Files\AOL Toolbar\toolbar.dll" ["IE Toolbar"]

"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)

-> {HKLM...CLSID} = "&Google"

\InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]

"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" = (no title provided)

-> {HKLM...CLSID} = "Windows Live Toolbar"

\InProcServer32\(Default) = "C:\Program Files\Windows Live Toolbar\msntb.dll" [MS]

 

Explorer Bars

 

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

 

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Rechercher"

Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]

InProcServer32\(Default) = "C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL" [MS]

 

Extensions (Tools menu items, main toolbar menu buttons)

 

HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

"MenuText" = "Console Java (Sun)"

"CLSIDExtension" = "{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}"

-> {HKCU...CLSID} = "Java Plug-in 1.5.0_11"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."]

-> {HKLM...CLSID} = "Java Plug-in 1.5.0_11"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll" ["Sun Microsystems, Inc."]

 

{4982D40A-C53B-4615-B15B-B5B5E98D167C}\

"ButtonText" = "AOL Toolbar"

"MenuText" = "AOL Toolbar"

 

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\

"ButtonText" = "Recherche"

 

{B205A35E-1FC4-4CE3-818B-899DBBB3388C}\

 

{CCA281CA-C863-46EF-9331-5C8D4460577F}\

"ButtonText" = "@btrez.dll,-4015"

"MenuText" = "@btrez.dll,-4017"

"Script" = "C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm" [null data]

 

{E2E2DD38-D088-4134-82B7-F2BA38496583}\

"MenuText" = "@xpsp3res.dll,-20001"

"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]

 

{FB5F1910-F110-11D2-BB9E-00C04F795683}\

"ButtonText" = "Messenger"

"MenuText" = "Windows Messenger"

"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]

 

 

Running Services (Display Name, Service Name, Path {Service DLL}):

------------------------------------------------------------------

 

AOL Connectivity Service, AOL ACS, "C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe" ["America Online, Inc."]

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]

avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data]

avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data]

avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"]

avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"]

Bluetooth Service, btwdins, "C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe" ["Broadcom Corporation."]

Bluetooth Support Service, BthServ, "C:\WINDOWS\system32\svchost.exe -k bthsvcs" {"C:\WINDOWS\System32\bthserv.dll" [MS]}

CyberLink Background Capture Service (CBCS), CLCapSvc, ""C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe"" [empty string]

CyberLink Media Library Service, CyberLink Media Library Service, ""C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe"" ["Cyberlink"]

CyberLink Task Scheduler (CTS), CLSched, ""C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe"" [empty string]

Machine Debug Manager, MDM, ""C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe"" [MS]

Service de l'iPod, iPod Service, ""C:\Program Files\iPod\bin\iPodService.exe"" ["Apple Inc."]

Service Partage réseau du Lecteur Windows Media, WMPNetworkSvc, ""C:\Program Files\Windows Media Player\WMPNetwk.exe"" [MS]

TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"]

X10 Device Network Service, x10nets, "C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe" ["X10"]

 

 

Print Monitors:

---------------

 

HKLM\System\CurrentControlSet\Control\Print\Monitors\

Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]

Microsoft Shared Fax Monitor\Driver = "FXSMON.DLL" [MS]

PDFCreator\Driver = "pdfcmnnt.dll" [null data]

Port imprimante Bluetooth\Driver = "bthcrp.dll" ["Broadcom Corporation."]

 

 

----------

<<!>>: Suspicious data at a malware launch point.

 

+ This report excludes default entries except where indicated.

+ To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

+ To search all directories of local fixed drives for DESKTOP.INI

DLL launch points, use the -supp parameter or answer "No" at the

first message box and "Yes" at the second message box.

---------- (total run time: 44 seconds, including 18 seconds for message boxes)

[bruce lee]

Re,

 

Le fichier hnfbtus.exe ou se localise t'il (quel dossier) ?

 

@+

[chris67380]

Sur zonealarm, ce fichier se situe sur

 

c:\WINDOWS\system32\hnfbtus.exe

 

mais je ne le vois pas physiquement dans ce dossier...

 

merci

[bruce lee]

Re,

 

Télécharge Blacklight (de F-Secure); clique sur "I ACCEPT" au bas de la page. Sauvegarde le sur ton Bureau.

 

Double-clique blbeta.exe et accepte la licence; clique Scan puis Next

 

Tu verras une liste de fichiers détectés apparaître. Tu verras également un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres).

 

Copie et colle le contenu de ce rapport dans ta prochaine réponse. NE PAS choisir l'option "rename ou cleaning" de suite : nous devons analyser le rapport, car des fichiers légitimes peuvent être présents, tel wbemtest.exe

[chris67380]

Voici le rapport ! :

 

04/09/07 13:40:49 [info]: BlackLight Engine 1.0.61 initialized

04/09/07 13:40:49 [info]: OS: 5.1 build 2600 (Service Pack 2)

04/09/07 13:40:49 [Note]: 7019 4

04/09/07 13:40:49 [Note]: 7005 0

04/09/07 13:40:52 [Note]: 7006 0

04/09/07 13:40:52 [Note]: 7011 1444

04/09/07 13:40:52 [Note]: 7026 0

04/09/07 13:40:52 [Note]: 7026 0

04/09/07 13:40:55 [Note]: FSRAW library version 1.7.1021

04/09/07 13:45:18 [Note]: 4020 11708 65536

04/09/07 13:45:18 [Note]: 4018 11708 65536

04/09/07 13:45:28 [Note]: 4020 11708 65536

04/09/07 13:45:28 [Note]: 4018 11708 65536

04/09/07 13:45:37 [Note]: 4020 11708 65536

04/09/07 13:45:37 [Note]: 4018 11708 65536

04/09/07 13:45:46 [Note]: 4020 11708 65536

04/09/07 13:45:46 [Note]: 4018 11708 65536

04/09/07 13:45:56 [Note]: 4020 11708 65536

04/09/07 13:45:56 [Note]: 4018 11708 65536

04/09/07 13:46:06 [Note]: 4020 11708 65536

04/09/07 13:46:06 [Note]: 4018 11708 65536

04/09/07 13:46:16 [Note]: 4020 11708 65536

04/09/07 13:46:16 [Note]: 4018 11708 65536

04/09/07 13:46:27 [Note]: 4020 11708 65536

04/09/07 13:46:27 [Note]: 4018 11708 65536

04/09/07 13:46:36 [Note]: 4020 11708 65536

04/09/07 13:46:36 [Note]: 4018 11708 65536

04/09/07 13:46:44 [Note]: 4020 11708 65536

04/09/07 13:46:44 [Note]: 4018 11708 65536

04/09/07 13:46:52 [Note]: 4020 11708 65536

04/09/07 13:46:52 [Note]: 4018 11708 65536

04/09/07 13:47:00 [Note]: 4020 11708 65536

04/09/07 13:47:00 [Note]: 4018 11708 65536

04/09/07 13:47:09 [Note]: 4020 11708 65536

04/09/07 13:47:09 [Note]: 4018 11708 65536

04/09/07 13:47:18 [Note]: 4020 11708 65536

04/09/07 13:47:18 [Note]: 4018 11708 65536

04/09/07 13:47:27 [Note]: 4020 11708 65536

04/09/07 13:47:27 [Note]: 4018 11708 65536

04/09/07 13:47:36 [Note]: 4020 11708 65536

04/09/07 13:47:36 [Note]: 4018 11708 65536

04/09/07 13:47:44 [Note]: 4020 11708 65536

04/09/07 13:47:44 [Note]: 4018 11708 65536

04/09/07 13:47:52 [Note]: 4020 11708 65536

04/09/07 13:47:52 [Note]: 4018 11708 65536

04/09/07 13:48:01 [Note]: 4020 11708 65536

04/09/07 13:48:01 [Note]: 4018 11708 65536

04/09/07 13:48:10 [Note]: 4020 11708 65536

04/09/07 13:48:10 [Note]: 4018 11708 65536

04/09/07 13:48:18 [Note]: 4020 11708 65536

04/09/07 13:48:18 [Note]: 4018 11708 65536

04/09/07 13:48:27 [Note]: 4020 11708 65536

04/09/07 13:48:27 [Note]: 4018 11708 65536

04/09/07 13:48:37 [Note]: 4020 11708 65536

04/09/07 13:48:37 [Note]: 4018 11708 65536

04/09/07 13:48:46 [Note]: 4020 11708 65536

04/09/07 13:48:46 [Note]: 4018 11708 65536

04/09/07 13:48:55 [Note]: 4020 11708 65536

04/09/07 13:48:55 [Note]: 4018 11708 65536

04/09/07 13:49:04 [Note]: 4020 11708 65536

04/09/07 13:49:04 [Note]: 4018 11708 65536

04/09/07 13:49:13 [Note]: 4020 11708 65536

04/09/07 13:49:13 [Note]: 4018 11708 65536

04/09/07 13:49:22 [Note]: 4020 11708 65536

04/09/07 13:49:22 [Note]: 4018 11708 65536

04/09/07 13:49:31 [Note]: 4020 11708 65536

04/09/07 13:49:31 [Note]: 4018 11708 65536

04/09/07 13:49:41 [Note]: 4020 11708 65536

04/09/07 13:49:41 [Note]: 4018 11708 65536

04/09/07 13:49:50 [Note]: 4020 11708 65536

04/09/07 13:49:50 [Note]: 4018 11708 65536

04/09/07 13:49:59 [Note]: 4020 11708 65536

04/09/07 13:49:59 [Note]: 4018 11708 65536

04/09/07 13:50:09 [Note]: 4020 11708 65536

04/09/07 13:50:09 [Note]: 4018 11708 65536

04/09/07 13:50:18 [Note]: 4020 11708 65536

04/09/07 13:50:18 [Note]: 4018 11708 65536

04/09/07 13:50:26 [Note]: 4020 11708 65536

04/09/07 13:50:26 [Note]: 4018 11708 65536

04/09/07 13:50:37 [Note]: 4020 11708 65536

04/09/07 13:50:37 [Note]: 4018 11708 65536

04/09/07 13:50:46 [Note]: 4020 11708 65536

04/09/07 13:50:46 [Note]: 4018 11708 65536

04/09/07 13:50:55 [Note]: 4020 11708 65536

04/09/07 13:50:55 [Note]: 4018 11708 65536

04/09/07 13:51:03 [Note]: 4020 11708 65536

04/09/07 13:51:03 [Note]: 4018 11708 65536

04/09/07 13:51:12 [Note]: 4020 11708 65536

04/09/07 13:51:12 [Note]: 4018 11708 65536

04/09/07 13:51:21 [Note]: 4020 11708 65536

04/09/07 13:51:21 [Note]: 4018 11708 65536

04/09/07 13:51:31 [Note]: 4020 11708 65536

04/09/07 13:51:31 [Note]: 4018 11708 65536

04/09/07 13:51:40 [Note]: 4020 11708 65536

04/09/07 13:51:40 [Note]: 4018 11708 65536

04/09/07 13:51:49 [Note]: 4020 11708 65536

04/09/07 13:51:49 [Note]: 4018 11708 65536

04/09/07 13:51:58 [Note]: 4020 11708 65536

04/09/07 13:51:58 [Note]: 4018 11708 65536

04/09/07 13:52:07 [Note]: 4020 11708 65536

04/09/07 13:52:07 [Note]: 4018 11708 65536

04/09/07 13:52:17 [Note]: 4020 11708 65536

04/09/07 13:52:17 [Note]: 4018 11708 65536

04/09/07 13:52:26 [Note]: 4020 11708 65536

04/09/07 13:52:26 [Note]: 4018 11708 65536

04/09/07 13:52:35 [Note]: 4020 11708 65536

04/09/07 13:52:35 [Note]: 4018 11708 65536

04/09/07 13:52:43 [Note]: 4020 11708 65536

04/09/07 13:52:43 [Note]: 4018 11708 65536

04/09/07 13:52:53 [Note]: 4020 11708 65536

04/09/07 13:52:53 [Note]: 4018 11708 65536

04/09/07 13:53:03 [Note]: 4020 11708 65536

04/09/07 13:53:03 [Note]: 4018 11708 65536

04/09/07 13:53:12 [Note]: 4020 11708 65536

04/09/07 13:53:12 [Note]: 4018 11708 65536

04/09/07 13:53:21 [Note]: 4020 11708 65536

04/09/07 13:53:21 [Note]: 4018 11708 65536

04/09/07 13:53:30 [Note]: 4020 11708 65536

04/09/07 13:53:30 [Note]: 4018 11708 65536

04/09/07 13:53:39 [Note]: 4020 11708 65536

04/09/07 13:53:39 [Note]: 4018 11708 65536

04/09/07 13:53:49 [Note]: 4020 11708 65536

04/09/07 13:53:49 [Note]: 4018 11708 65536

04/09/07 13:53:59 [Note]: 4020 11708 65536

04/09/07 13:53:59 [Note]: 4018 11708 65536

04/09/07 13:54:08 [Note]: 4020 11708 65536

04/09/07 13:54:08 [Note]: 4018 11708 65536

04/09/07 13:54:17 [Note]: 4020 11708 65536

04/09/07 13:54:17 [Note]: 4018 11708 65536

04/09/07 13:54:29 [Note]: 4020 11708 65536

04/09/07 13:54:29 [Note]: 4018 11708 65536

04/09/07 13:54:38 [Note]: 4020 11708 65536

04/09/07 13:54:38 [Note]: 4018 11708 65536

04/09/07 13:54:47 [Note]: 4020 11708 65536

04/09/07 13:54:47 [Note]: 4018 11708 65536

04/09/07 13:54:56 [Note]: 4020 11708 65536

04/09/07 13:54:56 [Note]: 4018 11708 65536

04/09/07 13:55:08 [Note]: 4020 11708 65536

04/09/07 13:55:08 [Note]: 4018 11708 65536

04/09/07 13:55:18 [Note]: 4020 11708 65536

04/09/07 13:55:18 [Note]: 4018 11708 65536

04/09/07 13:55:28 [Note]: 4020 11708 65536

04/09/07 13:55:28 [Note]: 4018 11708 65536

04/09/07 13:55:38 [Note]: 4020 11708 65536

04/09/07 13:55:38 [Note]: 4018 11708 65536

04/09/07 13:55:48 [Note]: 4020 11708 65536

04/09/07 13:55:48 [Note]: 4018 11708 65536

04/09/07 13:55:58 [Note]: 4020 11708 65536

04/09/07 13:55:58 [Note]: 4018 11708 65536

04/09/07 13:56:10 [Note]: 4020 11708 65536

04/09/07 13:56:10 [Note]: 4018 11708 65536

04/09/07 13:56:20 [Note]: 4020 11708 65536

04/09/07 13:56:20 [Note]: 4018 11708 65536

04/09/07 13:56:30 [Note]: 4020 11708 65536

04/09/07 13:56:30 [Note]: 4018 11708 65536

04/09/07 13:56:39 [Note]: 4020 11708 65536

04/09/07 13:56:39 [Note]: 4018 11708 65536

04/09/07 13:56:48 [Note]: 4020 11708 65536

04/09/07 13:56:48 [Note]: 4018 11708 65536

04/09/07 13:56:58 [Note]: 4020 11708 65536

04/09/07 13:56:58 [Note]: 4018 11708 65536

04/09/07 13:57:08 [Note]: 4020 11708 65536

04/09/07 13:57:08 [Note]: 4018 11708 65536

04/09/07 13:57:17 [Note]: 4020 11708 65536

04/09/07 13:57:17 [Note]: 4018 11708 65536

04/09/07 13:57:27 [Note]: 4020 11708 65536

04/09/07 13:57:27 [Note]: 4018 11708 65536

04/09/07 13:57:35 [Note]: 4020 11708 65536

04/09/07 13:57:35 [Note]: 4018 11708 65536

04/09/07 13:57:46 [Note]: 4020 11708 65536

04/09/07 13:57:46 [Note]: 4018 11708 65536

04/09/07 13:57:55 [Note]: 4020 11708 65536

04/09/07 13:57:55 [Note]: 4018 11708 65536

04/09/07 13:58:04 [Note]: 4020 11708 65536

04/09/07 13:58:04 [Note]: 4018 11708 65536

04/09/07 13:58:13 [Note]: 4020 11708 65536

04/09/07 13:58:13 [Note]: 4018 11708 65536

04/09/07 13:58:22 [Note]: 4020 11708 65536

04/09/07 13:58:22 [Note]: 4018 11708 65536

04/09/07 13:58:32 [Note]: 4020 11708 65536

04/09/07 13:58:32 [Note]: 4018 11708 65536

04/09/07 13:58:42 [Note]: 4020 11708 65536

04/09/07 13:58:42 [Note]: 4018 11708 65536

04/09/07 13:58:53 [Note]: 4020 11708 65536

04/09/07 13:58:53 [Note]: 4018 11708 65536

04/09/07 13:59:03 [Note]: 4020 11708 65536

04/09/07 13:59:03 [Note]: 4018 11708 65536

04/09/07 13:59:12 [Note]: 4020 11708 65536

04/09/07 13:59:12 [Note]: 4018 11708 65536

04/09/07 13:59:21 [Note]: 4020 11708 65536

04/09/07 13:59:21 [Note]: 4018 11708 65536

04/09/07 13:59:29 [Note]: 4020 11726 65536

04/09/07 13:59:29 [Note]: 4018 11726 65536

04/09/07 13:59:36 [Note]: 4020 11708 65536

04/09/07 13:59:36 [Note]: 4018 11708 65536

04/09/07 13:59:45 [Note]: 4020 11708 65536

04/09/07 13:59:45 [Note]: 4018 11708 65536

04/09/07 13:59:53 [Note]: 4020 11708 65536

04/09/07 13:59:53 [Note]: 4018 11708 65536

04/09/07 14:00:01 [Note]: 4020 11708 65536

04/09/07 14:00:01 [Note]: 4018 11708 65536

04/09/07 14:00:09 [Note]: 4020 11708 65536

04/09/07 14:00:09 [Note]: 4018 11708 65536

04/09/07 14:00:19 [Note]: 4020 11708 65536

04/09/07 14:00:19 [Note]: 4018 11708 65536

04/09/07 14:00:29 [Note]: 4020 11708 65536

04/09/07 14:00:29 [Note]: 4018 11708 65536

04/09/07 14:00:40 [Note]: 4020 11708 65536

04/09/07 14:00:40 [Note]: 4018 11708 65536

04/09/07 14:00:50 [Note]: 4020 11708 65536

04/09/07 14:00:50 [Note]: 4018 11708 65536

04/09/07 14:00:59 [Note]: 4020 11708 65536

04/09/07 14:00:59 [Note]: 4018 11708 65536

04/09/07 14:01:13 [Note]: 4020 11708 65536

04/09/07 14:01:13 [Note]: 4018 11708 65536

04/09/07 14:01:26 [Note]: 4020 11708 65536

04/09/07 14:01:26 [Note]: 4018 11708 65536

04/09/07 14:01:38 [Note]: 4020 11708 65536

04/09/07 14:01:38 [Note]: 4018 11708 65536

04/09/07 14:01:48 [Note]: 4020 11708 65536

04/09/07 14:01:48 [Note]: 4018 11708 65536

04/09/07 14:02:04 [Note]: 4020 11708 65536

04/09/07 14:02:04 [Note]: 4018 11708 65536

04/09/07 14:02:20 [Note]: 4020 11708 65536

04/09/07 14:02:20 [Note]: 4018 11708 65536

04/09/07 14:02:34 [Note]: 4020 11708 65536

04/09/07 14:02:34 [Note]: 4018 11708 65536

04/09/07 14:02:48 [Note]: 4020 11708 65536

04/09/07 14:02:48 [Note]: 4018 11708 65536

04/09/07 14:03:03 [Note]: 4020 11708 65536

04/09/07 14:03:03 [Note]: 4018 11708 65536

04/09/07 14:03:21 [Note]: 4020 11708 65536

04/09/07 14:03:21 [Note]: 4018 11708 65536

04/09/07 14:03:38 [Note]: 4020 11708 65536

04/09/07 14:03:38 [Note]: 4018 11708 65536

04/09/07 14:03:55 [Note]: 4020 11708 65536

04/09/07 14:03:55 [Note]: 4018 11708 65536

04/09/07 14:04:11 [Note]: 4020 11708 65536

04/09/07 14:04:11 [Note]: 4018 11708 65536

04/09/07 14:04:28 [Note]: 4020 11708 65536

04/09/07 14:04:28 [Note]: 4018 11708 65536

04/09/07 14:04:44 [Note]: 4020 11708 65536

04/09/07 14:04:44 [Note]: 4018 11708 65536

04/09/07 14:05:00 [Note]: 4020 11708 65536

04/09/07 14:05:00 [Note]: 4018 11708 65536

04/09/07 14:05:12 [Note]: 4020 11708 65536

04/09/07 14:05:12 [Note]: 4018 11708 65536

04/09/07 14:05:22 [Note]: 4020 11708 65536

04/09/07 14:05:22 [Note]: 4018 11708 65536

04/09/07 14:05:40 [Note]: 4020 11708 65536

04/09/07 14:05:40 [Note]: 4018 11708 65536

04/09/07 14:05:49 [Note]: 4020 11708 65536

04/09/07 14:05:49 [Note]: 4018 11708 65536

04/09/07 14:06:02 [Note]: 4020 11708 65536

04/09/07 14:06:02 [Note]: 4018 11708 65536

04/09/07 14:06:14 [Note]: 4020 11708 65536

04/09/07 14:06:14 [Note]: 4018 11708 65536

04/09/07 14:06:25 [Note]: 4020 11708 65536

04/09/07 14:06:25 [Note]: 4018 11708 65536

04/09/07 14:06:41 [Note]: 4020 11708 65536

04/09/07 14:06:41 [Note]: 4018 11708 65536

04/09/07 14:06:57 [Note]: 4020 11708 65536

04/09/07 14:06:57 [Note]: 4018 11708 65536

04/09/07 14:07:13 [Note]: 4020 11708 65536

04/09/07 14:07:13 [Note]: 4018 11708 65536

04/09/07 14:07:29 [Note]: 4020 11708 65536

04/09/07 14:07:29 [Note]: 4018 11708 65536

04/09/07 14:07:46 [Note]: 4020 11708 65536

04/09/07 14:07:46 [Note]: 4018 11708 65536

04/09/07 14:08:03 [Note]: 4020 11708 65536

04/09/07 14:08:03 [Note]: 4018 11708 65536

04/09/07 14:08:11 [Note]: 4020 11708 65536

04/09/07 14:08:11 [Note]: 4018 11708 65536

04/09/07 14:08:19 [Note]: 4020 11708 65536

04/09/07 14:08:19 [Note]: 4018 11708 65536

04/09/07 14:09:23 [Note]: 7007 0

[bruce lee]

Re,

 

je te demande une derniere chose avant de supprimer ce fameux fichier :

 

1/Télécharger http://siri.urz.free.fr/Fix/SmitfraudFix.exe ou ici: http://siri.geekstogo.com/SmitfraudFix.exe (de S!Ri) sur ton bureau

 

 

2/Double cliquer sur smitfraudfix.exe

 

Sélectionner 1 dans le menu pour créer un rapport des fichiers responsables de l'infection.

sauvegarde ce rapport et poste le