probleme extrèmement génant, rapport hijackthis

sachadso · le 31 octobre 2007

Bonjour, je fais appel à votre aide car j'ai deja essayé bien des choses...

J'explique mon problème: de puis quelques jours, lorsque je clique sur un lien google, 1 fois sur 2 cela me redirige vers un site porno, ou alors un autre site n'ayant rien avoir. Au passage j'ai meme eu du mal à atterir sur Zebulon...pour ariver a mes fins je suis obligé de copier coller le liens de la page et de le mettre dans la barre d'adresse et encore ca ne marche pas a tous les coups.

J'ai fait une Analyse complète +scan des archives en mode sans echec Avast et enlevé des cheveaux de troie, meme si queleque fichier resstent aparement impossibles à scaner ou à supprimer (car "protegés par mot de passe" + analyse spybot, avast, a-squared free.

Mais le probleme à l'aire d'etre extremement coriace...

De plus j'ai fait la préparation que vous suggerez (antivir etc...)

je post mon log Hijackthis et je vous remecie d'avance de votre aide. En espérant que votre analyse experte fasse des miracles!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:11:10, on 31/10/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

C:\WINDOWS\system32\netdde.exe

c:\program files\a-squared free\a2service.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe

C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Proprietaire\Bureau\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Microsoft MSJava 32 - {43F7497C-7687-4DEA-A057-F21BD81BC896} - C:\WINDOWS\system32\msjava32.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe

O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O15 - Trusted Zone: http://www.secuser.com

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200609...ex/qtplugin.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://www.touslesdrivers.com/fichiers/har...on.cab?version=

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{348F44FD-10F9-403D-9298-52879B1FDB5B}: NameServer = 85.255.116.162,85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip\..\{8877B78E-588E-49DC-815C-F27867515BDA}: NameServer = 85.255.116.162,85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip\..\{8908573B-36E2-4404-8AE1-C4385C193552}: NameServer = 85.255.116.162,85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip\..\{A4EB9683-70B3-41B9-ABBC-C944CDAFE890}: NameServer = 85.255.116.162,85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip\..\{FB8948CA-06D1-46F3-8059-4AC9E5810120}: NameServer = 85.255.116.162,85.255.112.110

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.110

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.110

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe

O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe

--

End of file - 7940 bytes

Thanos · le 31 octobre 2007

salut & bienvenue

1) Démarre Hijackthis et clique sur la case "Do a system scan only",puis coche les lignes suivantes :

O2 - BHO: Microsoft MSJava 32 - {43F7497C-7687-4DEA-A057-F21BD81BC896} - C:\WINDOWS\system32\msjava32.dll

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O17 - HKLM\System\CCS\Services\Tcpip\..\{348F44FD-10F9-403D-9298-52879B1FDB5B}: NameServer = 85.255.116.162,85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip\..\{8877B78E-588E-49DC-815C-F27867515BDA}: NameServer = 85.255.116.162,85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip\..\{8908573B-36E2-4404-8AE1-C4385C193552}: NameServer = 85.255.116.162,85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip\..\{A4EB9683-70B3-41B9-ABBC-C944CDAFE890}: NameServer = 85.255.116.162,85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip\..\{FB8948CA-06D1-46F3-8059-4AC9E5810120}: NameServer = 85.255.116.162,85.255.112.110

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.110

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.110

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.110

-Ferme tous les programmes et clique sur "Fix Checked"

2) Télécharge le FixWareout (LonnyRJones) sur le Bureau.

**Si le lien ne fonctionne pas, clique ici**

Lance le fix (FixWareout.exe), clique sur Next puis Install.

Assure-toi que Run fixit soit bien activé puis clique sur Finish.

Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le.

Ton système mettra un peu plus de temps au démarrage, c'est normal.

3) Télécharge et lance DiagHelp comme montré dans ce tutoriel> http://www.malekal.com/DiagHelp/DiagHelp.php

Ne lance que l'option 1 et poste le rapport stp.

Au final, poste le contenu du rapport C:\fixwareout\report.txt avec un nouveau rapport HijackThis et le rapport de FixWareOut

@++

sachadso · le 31 octobre 2007

Alors le post fixwareout:

Username "Proprietaire" - 31/10/2007 22:45:23 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

HKLM\SOFTWARE\~\Winlogon\ "System"="kdefx.exe"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{345A15D6-E35B-4BEA-AE33-ED08201AE099}

"DhcpNameServer"="85.255.116.162,85.255.112.110" <Value cleared.

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{348F44FD-10F9-403D-9298-52879B1FDB5B}

"DhcpNameServer"="85.255.116.162,85.255.112.110" <Value cleared.

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{8877B78E-588E-49DC-815C-F27867515BDA}

"DhcpNameServer"="85.255.116.162,85.255.112.110" <Value cleared.

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{8908573B-36E2-4404-8AE1-C4385C193552}

"DhcpNameServer"="85.255.116.162,85.255.112.110" <Value cleared.

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{FB8948CA-06D1-46F3-8059-4AC9E5810120}

"DhcpNameServer"="85.255.116.162,85.255.112.110" <Value cleared.

Cache de résolution DNS vidé.

System was rebooted successfully.

~~~~~ Postrun check

HKLM\SOFTWARE\~\Winlogon\ "system"=""

....

~~~~~ Misc files.

....

~~~~~ Checking for older varients.

....

~~~~~ Other

C:\WINDOWS\Temp\kdefx.ren 72285 05/08/2004

~~~~~ Current runs (hklm hkcu "run" Keys Only)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"

"amd_dc_opt"="C:\\Program Files\\AMD\\Dual-Core Optimizer\\amd_dc_opt.exe"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

....

Hosts file was reset, If you use a custom hosts file please replace it...

~~~~~ End report ~~~~~

le report Diaghelp

DiagHelp version v1.3 - http://www.malekal.com

excute le 31/10/2007 à 22:55:18,23

Liste des derniers fichies modifies/crees dans windir\system32 et prefetch

C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->31/10/2007 22:54:18

C:\WINDOWS\prefetch\WINRAR.EXE-39C6DAD9.pf -->31/10/2007 22:53:18

C:\WINDOWS\prefetch\IEXPLORE.EXE-27122324.pf -->31/10/2007 22:52:14

C:\WINDOWS\prefetch\DRWTSN32.EXE-2B4B52AC.pf -->31/10/2007 22:52:08

C:\WINDOWS\prefetch\DWWIN.EXE-30875ADC.pf -->31/10/2007 22:52:07

C:\WINDOWS\prefetch\WMIADAP.EXE-2DF425B2.pf -->31/10/2007 22:51:18

C:\WINDOWS\prefetch\CTFMON.EXE-0E17969B.pf -->31/10/2007 22:49:24

C:\WINDOWS\prefetch\NOTEPAD.EXE-336351A9.pf -->31/10/2007 22:49:20

C:\WINDOWS\prefetch\VERCLSID.EXE-3667BD89.pf -->31/10/2007 22:49:14

C:\WINDOWS\prefetch\DUMPHIVE.EXE-11673944.pf -->31/10/2007 22:49:09

C:\WINDOWS\System32\drivers\aswmon.sys -->06/09/2007 11:05:25

C:\WINDOWS\System32\drivers\aswmon2.sys -->06/09/2007 11:05:10

C:\WINDOWS\System32\drivers\aswRdr.sys -->06/09/2007 11:03:02

C:\WINDOWS\System32\drivers\aswTdi.sys -->06/09/2007 11:02:20

C:\WINDOWS\System32\drivers\aavmker4.sys -->06/09/2007 11:00:53

C:\WINDOWS\System32\drivers\oreans32.sys -->23/08/2007 13:50:33

C:\WINDOWS\System32\drivers\AmdLLD.sys -->01/11/2006 14:42:14

C:\WINDOWS\System32\PerfStringBackup.INI -->31/10/2007 22:51:17

C:\WINDOWS\System32\perfh00C.dat -->31/10/2007 22:51:17

C:\WINDOWS\System32\perfh009.dat -->31/10/2007 22:51:17

C:\WINDOWS\System32\perfc00C.dat -->31/10/2007 22:51:17

C:\WINDOWS\System32\perfc009.dat -->31/10/2007 22:51:17

C:\WINDOWS\System32\wpa.dbl -->31/10/2007 22:47:28

C:\WINDOWS\System32\initdebug.nfo -->27/10/2007 09:57:03

C:\WINDOWS\System32\CONFIG.NT -->22/10/2007 21:04:22

C:\WINDOWS\System32\nscompat.tlb -->13/10/2007 18:31:21

C:\WINDOWS\System32\amcompat.tlb -->13/10/2007 18:31:21

C:\WINDOWS\System32\MRT.exe -->27/09/2007 22:19:40

C:\WINDOWS\System32\advpack.dll.mui -->26/09/2007 18:30:50

C:\WINDOWS\System32\uxtheme.dll -->23/09/2007 20:02:06

C:\WINDOWS\System32\aswBoot.exe -->06/09/2007 11:09:49

C:\WINDOWS\System32\AVASTSS.scr -->06/09/2007 11:00:07

C:\WINDOWS\System32\CmdLineExt.dll -->26/08/2007 10:07:21

C:\WINDOWS\System32\mshtml.dll -->20/08/2007 15:29:32

C:\WINDOWS\System32\wininet.dll -->20/08/2007 10:59:31

C:\WINDOWS\System32\webcheck.dll -->20/08/2007 10:59:31

C:\WINDOWS\System32\urlmon.dll -->20/08/2007 10:59:31

C:\WINDOWS\System32\url.dll -->20/08/2007 10:59:31

C:\WINDOWS\System32\occache.dll -->20/08/2007 10:59:31

C:\WINDOWS\System32\mstime.dll -->20/08/2007 10:59:30

C:\WINDOWS\System32\msrating.dll -->20/08/2007 10:59:30

C:\WINDOWS\System32\mshtmled.dll -->20/08/2007 10:59:30

C:\WINDOWS.log -->31/10/2007 22:47:16

C:\WINDOWS\wiadebug.log -->31/10/2007 22:47:13

C:\WINDOWS\spupdsvc.log -->31/10/2007 22:47:13

C:\WINDOWS\WindowsUpdate.log -->31/10/2007 22:47:09

C:\WINDOWS\wiaservc.log -->31/10/2007 22:47:09

C:\WINDOWS\bootstat.dat -->31/10/2007 22:46:55

C:\WINDOWS\SchedLgU.Txt -->31/10/2007 22:45:48

C:\WINDOWS\ie7_main.log -->31/10/2007 22:43:13

C:\WINDOWS\tsoc.log -->31/10/2007 22:37:59

C:\WINDOWS\setupapi.log -->31/10/2007 22:37:59

C:\WINDOWS\ocmsn.log -->31/10/2007 22:37:59

C:\WINDOWS\ocgen.log -->31/10/2007 22:37:59

C:\WINDOWS\ntdtcsetup.log -->31/10/2007 22:37:59

C:\WINDOWS\msgsocm.log -->31/10/2007 22:37:59

C:\WINDOWS\KB939653-IE7.log -->31/10/2007 22:37:59

MD5 des fichiers sensibles

tcpip.sys b2220c618b42a2212a59d91ebd6fc4b4

ndis.sys 558635d3af1c7546d26067d5d9b6959e

null.sys 73c1e1f395918bc2c6dd67af7591a3ad

svchost.exe 1bd6c2f707a275cb7c16fd99fe0f31ca

ListDLLs v2.25 - DLL lister for Win9x/NT

Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------

explorer.exe pid: 444

Command line: C:\WINDOWS\Explorer.EXE

Base Size Version Path

0x44080000 0xcf000 7.00.6000.16544 C:\WINDOWS\system32\WININET.dll

0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll

0x43e00000 0x45000 7.00.6000.16544 C:\WINDOWS\system32\iertutil.dll

0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll

0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL

0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll

0x5f800000 0x16000 1.01.1593.0000 C:\PROGRA~1\WINDOW~4\MpShHook.dll

0x78130000 0x9b000 8.00.50727.0163 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\MSVCR80.dll

0x7c420000 0x87000 8.00.50727.0163 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\MSVCP80.dll

0x44160000 0x124000 7.00.6000.16544 C:\WINDOWS\system32\urlmon.dll

0x44360000 0x5cb000 7.00.6000.16544 C:\WINDOWS\system32\ieframe.dll

0x13420000 0x1a000 11.00.5721.5145 C:\PROGRA~1\WINDOW~2\wmpband.dll

0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL

0x745e0000 0x2c6000 3.01.4000.2435 C:\WINDOWS\system32\msi.dll

0x00d60000 0x11000 C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll

0x00fd0000 0xe000 1.09.0000.0000 C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.dll

0x00d20000 0x12000 C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll

0x442b0000 0x3c000 7.00.6000.16544 C:\WINDOWS\system32\webcheck.dll

0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\WPDShServiceObj.dll

0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceTypes.dll

0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll

0x01360000 0x2c000 C:\Program Files\WinRAR\rarext.dll

0x64f00000 0x12000 4.07.1043.0000 C:\Program Files\Alwil Software\Avast4\ashShell.dll

0x02c30000 0xd5000 1.04.0000.0000 C:\PROGRA~1\SPYBOT~1\SDHelper.dll

0x62860000 0x4d000 8.00.0000.9005 C:\Program Files\OpenOffice.org 2.0\program\shlxthdl.dll

0x60b30000 0x18000 8.00.0000.8975 C:\Program Files\OpenOffice.org 2.0\program\uwinapi.dll

0x7c340000 0x56000 7.10.3052.0004 C:\Program Files\OpenOffice.org 2.0\program\MSVCR71.dll

0x62410000 0x8e000 4.05.2003.0120 C:\Program Files\OpenOffice.org 2.0\program\stlport_vc7145.dll

0x7c3a0000 0x7b000 7.10.3077.0000 C:\Program Files\OpenOffice.org 2.0\program\MSVCP71.dll

0x10000000 0x1c000 7.00.0000.0000 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

ListDLLs v2.25 - DLL lister for Win9x/NT

Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------

winlogon.exe pid: 936

Command line: winlogon.exe

Base Size Version Path

0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe

0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll

0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll

0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll

0x10000000 0x11000 6.14.0010.4129 C:\WINDOWS\system32\Ati2evxx.dll

0x01320000 0xae000 1.05.0540.0000 C:\WINDOWS\system32\WgaLogon.dll

0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL

0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est ACDB-8857

Répertoire de C:\WINDOWS\system32

05/08/2004 13:00 6 144 csrss.exe

1 fichier(s) 6 144 octets

0 Rép(s) 39 063 617 536 octets libres

Contenu de Downloaded Program Files

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est ACDB-8857

Répertoire de C:\WINDOWS\Downloaded Program Files

01/08/2007 18:20 <REP> .

01/08/2007 18:20 <REP> ..

09/03/2006 10:48 65 desktop.ini

25/07/2002 18:13 24 576 dwusplay.dll

25/07/2002 18:13 196 608 dwusplay.exe

26/03/2007 11:46 1 570 hardwaredetection.inf

10/06/2005 10:44 417 792 isusweb.dll

24/10/2006 17:15 367 LegitCheckControl.inf

29/05/2003 14:00 160 864 messengerstatsclient.dll

29/05/2003 14:00 84 064 minesweeper.dll

03/06/2002 16:53 144 QTPlugin.inf

27/03/2006 12:00 5 019 swflash.inf

12/03/2006 17:50 23 600 tvichw32.sys

02/11/2005 17:01 1 777 xscan.inf

02/11/2005 17:07 435 712 xscan53.ocx

13 fichier(s) 1 352 158 octets

Total des fichiers listés :

13 fichier(s) 1 352 158 octets

2 Rép(s) 39 063 613 440 octets libres

Recherche de rootkit! (Merci S!Ri)

infection possible Magic.Control : un scan F-Secure BlackLight est recommandé

Recherche d'infections connues

Export des clefs sensibles..

Liste des fichiers en exception sur le pare-feu XP SP2

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\Steam\\SteamApps\\sachatouille\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\sachatouille\\counter-strike source\\hl2.exe:*:Enabled:hl2"

"C:\\Program Files\\Steam\\SteamApps\\sachatouille\\condition zero\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\sachatouille\\condition zero\\hl.exe:*:Enabled:Half-Life Launcher"

"C:\\Program Files\\i-voyager46\\Scol.exe"="C:\\Program Files\\i-voyager46\\Scol.exe:*:Enabled:Scol"

"C:\\Program Files\\Steam\\SteamApps\\sachatouille\\counter-strike\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\sachatouille\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"

"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

"C:\\Program Files\\Warcraft III\\Warcraft III.exe"="C:\\Program Files\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III"

"C:\\Program Files\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-frFR-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-frFR-downloader.exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\Steam\\SteamApps\\sachatouille\\half-life\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\sachatouille\\half-life\\hl.exe:*:Enabled:Half-Life Launcher"

"C:\\Program Files\\Steam\\SteamApps\\benlayer\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\benlayer\\counter-strike source\\hl2.exe:*:Enabled:hl2"

"C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"

"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"

"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe:*:Enabled:Blizzard Downloader"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Documents and Settings\\Proprietaire\\Bureau\\WowExpansionMaster_1024_2100_B_French-avi-downloader.exe"="C:\\Documents and Settings\\Proprietaire\\Bureau\\WowExpansionMaster_1024_2100_B_French-avi-downloader.exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\Steam\\SteamApps\\sachatouille\\half-life 2\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\sachatouille\\half-life 2\\hl2.exe:*:Enabled:hl2"

"C:\\Program Files\\World of Warcraft\\WoW-2.0.3-frFR-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.3-frFR-downloader.exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\EA GAMES\\Need for Speed Most Wanted\\speed.exe"="C:\\Program Files\\EA GAMES\\Need for Speed Most Wanted\\speed.exe:*:Enabled:speed"

"C:\\Program Files\\World of Warcraft\\WoW-2.0.4.6314-to-2.0.5.6320-frFR-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.4.6314-to-2.0.5.6320-frFR-downloader.exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\World of Warcraft\\WoW-2.0.5.6320-to-2.0.6.6337-frFR-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.5.6320-to-2.0.6.6337-frFR-downloader.exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\Sierra\\FEAR\\FEAR.exe"="C:\\Program Files\\Sierra\\FEAR\\FEAR.exe:*:Enabled:FEAR"

"C:\\Program Files\\Sierra\\FEAR\\FEARMP.exe"="C:\\Program Files\\Sierra\\FEAR\\FEARMP.exe:*:Enabled:FEAR"

"C:\\Program Files\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-frFR-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-frFR-downloader.exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-frFR-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-frFR-downloader.exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe:*:Enabled:Render Manager"

"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe:*:Enabled:Studio"

"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile"

"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"="C:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe:*:Enabled:umi"

"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe:*:Enabled:MediaManager Application"

"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Exécuter une DLL en tant qu'application"

"C:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-frFR-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-frFR-downloader.exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\Steam\\SteamApps\\sachatouille\\condition zero deleted scenes\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\sachatouille\\condition zero deleted scenes\\hl.exe:*:Disabled:Half-Life Launcher"

"C:\\Documents and Settings\\Proprietaire\\Bureau\\WoW-BurningCrusade-frFR-Installer-downloader.exe"="C:\\Documents and Settings\\Proprietaire\\Bureau\\WoW-BurningCrusade-frFR-Installer-downloader.exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

"C:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.12.6546-frFR-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.12.6546-frFR-downloader.exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

"C:\\Program Files\\Empire Interactive\\FlatOut2\\flatout2.exe"="C:\\Program Files\\Empire Interactive\\FlatOut2\\flatout2.exe:*:Enabled:FlatOut2"

"C:\\Documents and Settings\\Proprietaire\\mapbrq.exe"="C:\\Documents and Settings\\Proprietaire\\mapbrq.exe:*:Disabled:mapbrq"

"C:\\Program Files\\Steam\\steam.exe"="C:\\Program Files\\Steam\\steam.exe:*:Enabled:Steam"

"C:\\Program Files\\MessengerDiscovery\\MessengerDiscovery Live.exe"="C:\\Program Files\\MessengerDiscovery\\MessengerDiscovery Live.exe:*:Enabled:MessengerDiscovery Live the Windows Live Messenger addon"

"C:\\Documents and Settings\\Proprietaire\\Bureau\\counter\\hl.exe"="C:\\Documents and Settings\\Proprietaire\\Bureau\\counter\\hl.exe:*:Enabled:Half-Life Launcher"

"C:\\Documents and Settings\\Proprietaire\\Bureau\\Counter-Strike Source\\hl2.exe"="C:\\Documents and Settings\\Proprietaire\\Bureau\\Counter-Strike Source\\hl2.exe:*:Enabled:hl2"

"C:\\Program Files\\Steam\\SteamApps\\sachatouille\\half-life 2 deathmatch\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\sachatouille\\half-life 2 deathmatch\\hl2.exe:*:Enabled:hl2"

"C:\\Program Files\\Steam\\SteamApps\\sachatouille\\source sdk base\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\sachatouille\\source sdk base\\hl2.exe:*:Enabled:hl2"

"C:\\Documents and Settings\\Proprietaire\\Bureau\\sacha\\Counter-Strike Source\\hl2.exe"="C:\\Documents and Settings\\Proprietaire\\Bureau\\sacha\\Counter-Strike Source\\hl2.exe:*:Enabled:hl2"

"E:\\Nouveau dossier\\cs cracké\\counter-stricke\\counter\\hl.exe"="E:\\Nouveau dossier\\cs cracké\\counter-stricke\\counter\\hl.exe:*:Enabled:Half-Life Launcher"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"C:\\Program Files\\Empire Interactive\\FlatOut2\\flatout2.exe"="C:\\Program Files\\Empire Interactive\\FlatOut2\\flatout2.exe:*:Enabled:FlatOut2"

Export de la clef SharedTaskScheduler

[sharedTaskScheduler]

"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"

"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

exports des policies

REGEDIT4

[system]

"dontdisplaylastusername"=dword:00000000

"legalnoticecaption"=""

"legalnoticetext"=""

"shutdownwithoutlogon"=dword:00000001

"undockwithoutlogon"=dword:00000001

Export des clefs sensibles..

Rechercher adresses sensibles dans le fichier HOSTS...

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System

444 - explorer.exe

900 - sqlservr.exe

908 - csrss.exe

936 - winlogon.exe

984 - services.exe

996 - lsass.exe

1176 - svchost.exe

1252 - svchost.exe

1396 - MsMpEng.exe

1436 - svchost.exe

1448 - svchost.exe

1496 - svchost.exe

1540 - iexplore.exe

1616 - svchost.exe

1688 - ashServ.exe

1736 - cmd.exe

2460 - PMSHost.exe

2512 - CLSched.exe

2720 - ashMaiSv.exe

2736 - ashWebSv.exe

2824 - wmiprvse.exe

3084 - alg.exe

3628 - ashDisp.exe

3772 - ctfmon.exe

3820 - RocketDock.exe

3940 - YzShadow.exe

Total number of processes = 27

NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\ntkrnlpa.exe

806E2000 - \WINDOWS\system32\hal.dll

F7987000 - \WINDOWS\system32\KDCOM.DLL

F7897000 - \WINDOWS\system32\BOOTVID.dll

F72B6000 - sptd.sys

F7989000 - \WINDOWS\System32\Drivers\WMILIB.SYS

F729E000 - \WINDOWS\System32\Drivers\SPTD8269.SYS

F726F000 - ACPI.sys

F725E000 - pci.sys

F7487000 - isapnp.sys

F7497000 - ohci1394.sys

F74A7000 - \WINDOWS\system32\DRIVERS\1394BUS.SYS

F724B000 - sfsync04.sys

F7A4F000 - pciide.sys

F7707000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

F74B7000 - MountMgr.sys

F722C000 - ftdisk.sys

F770F000 - PartMgr.sys

F74C7000 - VolSnap.sys

F7214000 - atapi.sys

F71FE000 - nvatabus.sys

F71E7000 - nvata.sys

F74D7000 - disk.sys

F74E7000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

F71C7000 - fltMgr.sys

F71B5000 - sr.sys

F719E000 - KSecDD.sys

F7111000 - Ntfs.sys

F70E4000 - NDIS.sys

F798B000 - W9967STI.SYS

F798D000 - speedfan.sys

F7717000 - sfhlp02.sys

F70D0000 - sfdrv01a.sys

F771F000 - nvcchflt.sys

F70B6000 - Mup.sys

F7A50000 - giveio.sys

F7527000 - \SystemRoot\system32\DRIVERS\nic1394.sys

F6B0D000 - \SystemRoot\system32\DRIVERS\AmdK8.sys

F77EF000 - \SystemRoot\system32\DRIVERS\usbohci.sys

F6380000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS

F77F7000 - \SystemRoot\system32\DRIVERS\usbehci.sys

F6AFD000 - \SystemRoot\system32\drivers\nvax.sys

F6AED000 - \SystemRoot\system32\DRIVERS\imapi.sys

F77FF000 - \SystemRoot\system32\drivers\ASAPIW2k.sys

F6ADD000 - \SystemRoot\system32\DRIVERS\cdrom.sys

F6ACD000 - \SystemRoot\system32\DRIVERS\redbook.sys

F635D000 - \SystemRoot\system32\DRIVERS\ks.sys

F7807000 - \SystemRoot\System32\Drivers\GEARAspiWDM.sys

F6299000 - \SystemRoot\system32\DRIVERS\3xHybrid.sys

F6BAD000 - \SystemRoot\system32\DRIVERS\BdaSup.SYS

F6BA9000 - \SystemRoot\system32\DRIVERS\nvnetbus.sys

F6259000 - \SystemRoot\system32\DRIVERS\NVNRM.SYS

F6226000 - \SystemRoot\system32\DRIVERS\NVSNPU.SYS

F60A8000 - \SystemRoot\system32\DRIVERS\ati2mtag.sys

F6094000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

F604A000 - \SystemRoot\System32\Drivers\dtscsi.sys

F6032000 - \SystemRoot\System32\Drivers\SCSIPORT.SYS

F5AC5000 - \SystemRoot\system32\DRIVERS\serial.sys

F7983000 - \SystemRoot\system32\DRIVERS\serenum.sys

F5AB1000 - \SystemRoot\system32\DRIVERS\parport.sys

F7B4D000 - \SystemRoot\system32\DRIVERS\audstub.sys

F6413000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys

F7092000 - \SystemRoot\system32\DRIVERS\ndistapi.sys

F5A9A000 - \SystemRoot\system32\DRIVERS\ndiswan.sys

F6403000 - \SystemRoot\system32\DRIVERS\raspppoe.sys

F63F3000 - \SystemRoot\system32\DRIVERS\raspptp.sys

F7877000 - \SystemRoot\system32\DRIVERS\TDI.SYS

F5A89000 - \SystemRoot\system32\DRIVERS\psched.sys

F63E3000 - \SystemRoot\system32\DRIVERS\msgpc.sys

F787F000 - \SystemRoot\system32\DRIVERS\ptilink.sys

F7887000 - \SystemRoot\system32\DRIVERS\raspti.sys

F63D3000 - \SystemRoot\system32\DRIVERS\termdd.sys

F788F000 - \SystemRoot\system32\DRIVERS\kbdclass.sys

F772F000 - \SystemRoot\system32\DRIVERS\mouclass.sys

F7A0B000 - \SystemRoot\system32\DRIVERS\swenum.sys

F5A55000 - \SystemRoot\system32\DRIVERS\update.sys

F7086000 - \SystemRoot\system32\DRIVERS\mssmbios.sys

F63C3000 - \SystemRoot\system32\DRIVERS\AmdLLD.sys

F5A27000 - \SystemRoot\system32\DRIVERS\MarvinBus.sys

F63B3000 - \SystemRoot\system32\DRIVERS\usbhub.sys

F7A0F000 - \SystemRoot\system32\DRIVERS\USBD.SYS

F75A7000 - \SystemRoot\System32\Drivers\NDProxy.SYS

F5295000 - \SystemRoot\system32\drivers\nvapu.sys

F5271000 - \SystemRoot\system32\drivers\portcls.sys

F7637000 - \SystemRoot\system32\drivers\drmk.sys

F518C000 - \SystemRoot\system32\drivers\nvmcp.sys

F517B000 - \SystemRoot\system32\drivers\nvarm.sys

F089C000 - \SystemRoot\system32\DRIVERS\NVENETFD.sys

F79C3000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS

F0C67000 - \SystemRoot\System32\Drivers\Null.SYS

F79C5000 - \SystemRoot\System32\Drivers\Beep.SYS

F0824000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

F081C000 - \SystemRoot\System32\drivers\vga.sys

F79CF000 - \SystemRoot\System32\Drivers\mnmdd.SYS

F79D1000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys

F0814000 - \SystemRoot\System32\Drivers\Msfs.SYS

F080C000 - \SystemRoot\System32\Drivers\Npfs.SYS

F0CC3000 - \SystemRoot\system32\DRIVERS\rasacd.sys

AAF91000 - \SystemRoot\system32\DRIVERS\ipsec.sys

AAF38000 - \SystemRoot\system32\DRIVERS\tcpip.sys

F083C000 - \SystemRoot\System32\Drivers\aswTdi.SYS

AAF17000 - \SystemRoot\system32\DRIVERS\ipnat.sys

AAEEF000 - \SystemRoot\system32\DRIVERS\netbt.sys

F0AE8000 - \SystemRoot\system32\DRIVERS\wanarp.sys

AAECD000 - \SystemRoot\System32\drivers\afd.sys

F0E64000 - \SystemRoot\system32\DRIVERS\arp1394.sys

F0E54000 - \SystemRoot\system32\DRIVERS\netbios.sys

AAEA2000 - \SystemRoot\system32\DRIVERS\rdbss.sys

F12BD000 - \??\C:\WINDOWS\system32\drivers\pclepci.sys

F0E34000 - \??\C:\WINDOWS\system32\drivers\oreans32.sys

AAE33000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys

F0E24000 - \SystemRoot\System32\Drivers\Fips.SYS

F0804000 - \SystemRoot\system32\DRIVERS\usbccgp.sys

F12B5000 - \SystemRoot\system32\DRIVERS\hidusb.sys

F0E14000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

AAE1C000 - \SystemRoot\system32\DRIVERS\P0620Vid.sys

F0E04000 - \SystemRoot\system32\DRIVERS\STREAM.SYS

F07FC000 - \SystemRoot\system32\DRIVERS\USBSTOR.SYS

AADE7000 - \SystemRoot\system32\DRIVERS\sis163u.sys

F07EC000 - \SystemRoot\System32\Drivers\Aavmker4.SYS

F12AD000 - \SystemRoot\system32\DRIVERS\mouhid.sys

EF38B000 - \SystemRoot\system32\DRIVERS\kbdhid.sys

F0FF0000 - \SystemRoot\System32\Drivers\Cdfs.SYS

AADD0000 - \SystemRoot\System32\Drivers\dump_nvata.sys

F79F7000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS

BF800000 - \SystemRoot\System32\win32k.sys

ED753000 - \SystemRoot\System32\drivers\Dxapi.sys

ED09F000 - \SystemRoot\System32\watchdog.sys

BF9C3000 - \SystemRoot\System32\drivers\dxg.sys

EC738000 - \SystemRoot\System32\drivers\dxgthk.sys

BF9D5000 - \SystemRoot\System32\ati2dvag.dll

BFA17000 - \SystemRoot\System32\ati2cqag.dll

BFA56000 - \SystemRoot\System32\atikvmag.dll

BFA8C000 - \SystemRoot\System32\ati3duag.dll

BFD10000 - \SystemRoot\System32\ativvaxx.dll

A8DBA000 - \SystemRoot\System32\Drivers\aswMon2.SYS

A8C8D000 - \SystemRoot\system32\drivers\wdmaud.sys

F3250000 - \SystemRoot\system32\drivers\sysaudio.sys

A89E6000 - \SystemRoot\system32\DRIVERS\mrxdav.sys

F066B000 - \SystemRoot\System32\Drivers\ParVdm.SYS

A89D6000 - \SystemRoot\system32\DRIVERS\secdrv.sys

A8854000 - \SystemRoot\system32\DRIVERS\srv.sys

A8612000 - \SystemRoot\System32\Drivers\aswRdr.SYS

A8342000 - \SystemRoot\System32\Drivers\HTTP.sys

F0C6C000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 145

Liste des programmes installes

a-squared Free 2.1

Ad-Aware SE Personal

Adobe Bridge 1.0

Adobe Common File Installer

Adobe Help Center 1.0

Adobe Photoshop CS2

Adobe Reader 7.0.5 - Français

Adobe Stock Photos 1.0

AP Tuner 3.06

Apple Software Update

Archiveur WinRAR

ATI Catalyst Control Center

ATI Display Driver

Audacity 1.2.6

avast! Antivirus

Barre d'outils MSN

Blender (remove only)

CamStudio

CCleaner (remove only)

Code::Blocks

Correctif pour Windows XP (KB914440)

Counter-Strike

Creative Photo Manager

Creative WebCam Center

Creative WebCam Instant Driver (1.03.02.0425)

DH Driver Cleaner Professional Edition

DiscAPI (Studio 10)

Dual-Core Optimizer

DVD de bonus Studio 10

DVD Shrink 3.2

EVEREST Ultimate Edition v2.80

FEAR

FlatOut2

Fraps

Fujitsu Siemens Computers WLAN 802.11b/g D1705/D1706

Google Earth

Google Video Player

Google Video Uploader

Half-Life

Half-Life® 2

HardwareDetection

HijackThis 2.0.2

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows XP (KB926239)

hp deskjet 3600

hp deskjet 3600 series

iTunes

J2SE Runtime Environment 5.0

Java SE Runtime Environment 6 Update 1

Lecteur Windows Media 11

Macromedia Flash Player 8

Macromedia Shockwave Player

Messenger Plus! Live

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 French Language Pack

Microsoft .NET Framework 1.1 Hotfix (KB886903)

Microsoft .NET Framework 2.0

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft National Language Support Downlevel APIs

Microsoft Office PowerPoint Viewer 2003

Microsoft SQL Server Desktop Engine (PINNACLESYS)

Microsoft User-Mode Driver Framework Feature Pack 1.0

Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)

Mise à jour de sécurité pour Windows XP (KB914388)

Mise à jour de sécurité pour Windows XP (KB917159)

Mise à jour de sécurité pour Windows XP (KB917422)

Mise à jour de sécurité pour Windows XP (KB918118)

Mise à jour de sécurité pour Windows XP (KB919007)

Mise à jour de sécurité pour Windows XP (KB920213)

Mise à jour de sécurité pour Windows XP (KB920214)

Mise à jour de sécurité pour Windows XP (KB920670)

Mise à jour de sécurité pour Windows XP (KB920683)

Mise à jour de sécurité pour Windows XP (KB920685)

Mise à jour de sécurité pour Windows XP (KB921398)

Mise à jour de sécurité pour Windows XP (KB921883)

Mise à jour de sécurité pour Windows XP (KB922616)

Mise à jour de sécurité pour Windows XP (KB922819)

Mise à jour de sécurité pour Windows XP (KB923191)

Mise à jour de sécurité pour Windows XP (KB923414)

Mise à jour de sécurité pour Windows XP (KB923694)

Mise à jour de sécurité pour Windows XP (KB923980)

Mise à jour de sécurité pour Windows XP (KB924191)

Mise à jour de sécurité pour Windows XP (KB924270)

Mise à jour de sécurité pour Windows XP (KB924496)

Mise à jour de sécurité pour Windows XP (KB924667)

Mise à jour de sécurité pour Windows XP (KB925902)

Mise à jour de sécurité pour Windows XP (KB926255)

Mise à jour de sécurité pour Windows XP (KB926436)

Mise à jour de sécurité pour Windows XP (KB927779)

Mise à jour de sécurité pour Windows XP (KB927802)

Mise à jour de sécurité pour Windows XP (KB928255)

Mise à jour de sécurité pour Windows XP (KB928843)

Mise à jour de sécurité pour Windows XP (KB930178)

Mise à jour de sécurité pour Windows XP (KB931261)

Mise à jour de sécurité pour Windows XP (KB931784)

Mise à jour de sécurité pour Windows XP (KB932168)

Mise à jour pour Windows XP (KB916595)

Mise à jour pour Windows XP (KB920872)

Mise à jour pour Windows XP (KB922582)

Mise à jour pour Windows XP (KB929338)

Mise à jour pour Windows XP (KB931836)

Mozilla Firefox (2.0.0.1)

MSN

MSXML 4.0 SP2 (KB925672)

MSXML 4.0 SP2 (KB927978)

Need for Speed™ Most Wanted

Nero Suite

NVIDIA Drivers

NvMixer

OpenOffice.org 2.0

Pack Vista Inspirat 2 1.0

Pinnacle Instant DVD Recorder

Pinnacle MediaServer

PowerCinema

PowerDVD

QuickTime

RAPID (Studio 10)

RealPlayer

Realtek AC'97 Audio

SAMSUNG CDMA Modem Driver Set

SAMSUNG Mobile Composite Device Software

Samsung Mobile phone USB driver Software

SAMSUNG Mobile USB Modem 1.0 Software

SAMSUNG Mobile USB Modem Software

Satsuki Decoder Pack

Security Update for Microsoft .NET Framework 2.0 (KB917283)

Security Update pour Microsoft .NET Framework 2.0 (KB922770)

Source SDK Base

SpeedFan (remove only)

Spybot - Search & Destroy 1.4

Steam

SteamKeyFr

Studio 10

Studio Premium Pack 1

Studio RTFx Volume 2

TeamSpeak 2 RC2

Utilitaire Effets vidéos avancés

Vapour 2.0 Beta

Videora iPod Converter 2.19

WebFldrs XP

Windows Defender

Windows Defender Signatures

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Installer 3.1 (KB893803)

Windows Internet Explorer 7

Windows Live Messenger

Windows Live Sign-in Assistant

Windows Media Format 11 runtime

Windows Media Player 11

Wow Cartographe 1.07

YouTUBE movie downloader

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est ACDB-8857

Répertoire de C:\Program Files

31/10/2007 19:04 <REP> .

31/10/2007 19:04 <REP> ..

18/04/2006 20:32 <REP> Adobe

03/03/2007 19:09 <REP> AdorageI-GfxDatas

03/03/2007 19:08 <REP> AdorageI-SAL

10/03/2006 20:45 <REP> Ahead

20/04/2006 09:48 <REP> Alwil Software

16/02/2007 22:11 <REP> AMD

17/09/2006 13:34 <REP> AP Tuner

30/05/2007 21:43 <REP> Apple Software Update

28/10/2007 09:10 <REP> a-squared Free

19/04/2006 14:47 <REP> ATI Technologies

19/02/2007 12:14 <REP> Audacity

11/03/2006 20:53 <REP> AvantGo Connect

17/03/2007 14:44 <REP> Blender Foundation

23/08/2006 18:26 <REP> CamStudio

05/07/2006 18:25 <REP> CCleaner

22/09/2007 14:33 <REP> CodeBlocks

11/03/2006 20:53 <REP> Common Files

09/03/2006 10:47 <REP> ComPlus Applications

10/03/2006 22:11 <REP> Creative

10/03/2006 20:41 <REP> CyberLink

03/06/2006 10:03 <REP> DAEMON Tools

20/04/2007 17:35 <REP> DivX

19/04/2006 14:17 <REP> Driver Cleaner Pro

26/03/2006 12:28 <REP> DVD Shrink

05/06/2006 22:44 <REP> EA GAMES

07/07/2007 09:28 <REP> Empire Interactive

09/09/2007 12:01 <REP> EoRezo

09/09/2007 12:01 <REP> EuroPoker

31/03/2007 12:04 <REP> Fichiers communs

09/09/2007 12:01 <REP> FileZilla

23/09/2006 18:51 <REP> Google

12/06/2006 18:18 <REP> Google Video

16/09/2006 07:57 <REP> Guitar Pro 5

18/06/2007 20:50 <REP> hardwaredetection

21/04/2006 12:40 <REP> Hewlett-Packard

21/04/2006 12:40 <REP> HP

31/10/2007 22:46 <REP> Internet Explorer

14/06/2006 22:39 <REP> IPexpress

30/05/2007 21:45 <REP> iPod

30/05/2007 21:45 <REP> iTunes

31/05/2007 16:00 <REP> Java

22/04/2006 17:30 <REP> LANGMaster CC

17/04/2006 12:03 <REP> Lavalys

31/07/2006 11:21 <REP> Lavasoft

18/06/2006 17:05 <REP> LG PC Suite

20/04/2006 11:18 <REP> Messenger

23/06/2007 19:12 <REP> Messenger Plus! Live

13/10/2007 17:51 <REP> MessengerDiscovery

12/05/2006 18:39 <REP> Microsoft ActiveSync

09/03/2006 10:51 <REP> microsoft frontpage

20/01/2007 14:35 <REP> Microsoft Office

03/03/2007 18:36 <REP> Microsoft SQL Server

23/09/2007 20:54 <REP> Movie Maker

31/10/2007 22:43 <REP> Mozilla Firefox

11/03/2006 18:07 <REP> MSN

12/03/2006 13:56 <REP> MSN Apps

09/03/2006 10:46 <REP> MSN Gaming Zone

27/10/2007 10:11 <REP> MSN Messenger

15/10/2006 02:00 <REP> MSXML 4.0

09/03/2006 10:47 <REP> NetMeeting

07/05/2006 16:31 <REP> Nextreaming

20/06/2006 10:02 <REP> NVIDIA Corporation

09/03/2006 10:46 <REP> Online Services

13/04/2006 21:11 <REP> OpenOffice.org 2.0

23/09/2007 20:54 <REP> Outlook Express

23/04/2006 11:50 <REP> Paint.NET

03/03/2007 18:39 <REP> Pinnacle

03/03/2007 19:19 <REP> proDAD

30/05/2007 21:45 <REP> QuickTime

31/03/2007 12:03 <REP> Real

18/03/2006 09:37 <REP> Realtek AC97

30/05/2007 23:22 <REP> Red Kawa

20/04/2007 13:54 <REP> RM-X Player V4.2

03/09/2007 16:19 <REP> Samsung

03/09/2007 16:12 <REP> Samsung PC Studio 3

11/03/2007 10:54 <REP> Satsuki Decoder Pack

17/06/2006 11:49 <REP> Services en ligne

10/02/2007 20:07 <REP> Sierra

12/03/2006 01:12 <REP> Skype

03/03/2007 18:30 <REP> SmartSound Software

28/10/2007 09:01 <REP> SpeedFan

05/05/2007 08:23 <REP> Spybot - Search & Destroy

29/10/2007 10:57 <REP> Steam

03/07/2007 21:52 <REP> SteamKeyFr

20/04/2006 02:23 <REP> Teamspeak2_RC2

12/06/2006 22:51 <REP> UxTheme Multipatcher Fr

20/05/2006 23:24 <REP> Vapour 2.0 Beta

09/09/2007 12:02 <REP> VideoLAN

25/05/2006 07:36 <REP> Visicom Media

21/04/2006 13:10 <REP> Wanadoo

19/11/2006 21:01 <REP> Warcraft III

04/07/2006 21:59 <REP> WebMediaPlayer

31/10/2007 14:37 <REP> Windows Defender

23/06/2007 19:12 <REP> Windows Live

16/12/2006 14:45 <REP> Windows Media Connect 2

13/10/2007 18:31 <REP> Windows Media Player

09/03/2006 10:46 <REP> Windows NT

19/03/2006 14:53 <REP> WinRAR

09/09/2007 16:00 <REP> World of Warcraft

31/12/2006 10:41 <REP> WowCartographe

09/03/2006 10:51 <REP> xerox

31/05/2007 18:48 <REP> XMPEG 4.2a

20/04/2006 11:16 <REP> XnView

14/06/2006 22:40 <REP> Yahoo!

07/10/2007 14:38 <REP> YouTUBE movie downloader

0 fichier(s) 0 octets

107 Rép(s) 39 049 605 120 octets libres

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est ACDB-8857

Répertoire de C:\Program Files\fichiers communs

31/03/2007 12:04 <REP> .

31/03/2007 12:04 <REP> ..

18/04/2006 20:32 <REP> Adobe

18/03/2006 12:13 <REP> Adobe Systems Shared

10/03/2006 20:43 <REP> Ahead

05/05/2007 05:54 <REP> Blizzard Entertainment

03/01/2007 13:04 <REP> InstallShield

09/03/2006 10:50 <REP> Java

06/07/2006 13:00 <REP> Microsoft Shared

09/03/2006 10:47 <REP> MSSoap

10/03/2006 20:44 <REP> Nero

20/06/2006 10:02 <REP> NVIDIA Shared

09/03/2006 11:34 <REP> ODBC

31/03/2007 12:04 <REP> Real

09/03/2006 10:47 <REP> Services

09/03/2006 11:34 <REP> SpeechEngines

17/12/2006 03:01 <REP> System

20/04/2006 22:56 <REP> Wise Installation Wizard

31/03/2007 12:04 <REP> xing shared

0 fichier(s) 0 octets

19 Rép(s) 39 049 613 312 octets libres

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est ACDB-8857

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

09/03/2006 11:11 <REP> .

09/03/2006 11:11 <REP> ..

18/05/2001 15:57 561 209 MSONSEXT.DLL

03/06/1999 12:09 122 937 MSOWS409.DLL

07/03/2001 07:00 127 033 MSOWS40c.DLL

3 fichier(s) 811 179 octets

2 Rép(s) 39 049 613 312 octets libres

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est ACDB-8857

Répertoire de C:\Program Files\common files

11/03/2006 20:53 <REP> .

11/03/2006 20:53 <REP> ..

11/03/2006 20:53 <REP> Microsoft Shared

0 fichier(s) 0 octets

3 Rép(s) 39 049 613 312 octets libres

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est ACDB-8857

Répertoire de C:\

24/05/2001 11:59 162 304 UNWISE.EXE

1 fichier(s) 162 304 octets

0 Rép(s) 39 049 613 312 octets libres

c:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.2.0.34\iTunesSetupAdmin.exe

c:\Documents and Settings\Proprietaire\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_fr_FR.exe

c:\Documents and Settings\Proprietaire\Application Data\Microsoft\Installer\{AFBF6A33-DA20-4739-91D9-24EE1B2485C2}\_24e018e9.exe

c:\Documents and Settings\Proprietaire\Application Data\Microsoft\Installer\{AFBF6A33-DA20-4739-91D9-24EE1B2485C2}\_5fe64311.exe

c:\Documents and Settings\Proprietaire\Application Data\MSNInstaller\msnauins.exe

c:\Documents and Settings\Proprietaire\Bureau\antivir_workstation_win7u_en_h.exe

c:\Documents and Settings\Proprietaire\Bureau\Fixwareout.exe

c:\Documents and Settings\Proprietaire\Bureau\HijackThis.exe

c:\Documents and Settings\Proprietaire\Bureau\internet-explorer_internet_explorer_7.0_francais_18706.exe

c:\Documents and Settings\Proprietaire\Bureau\cpu-z_cpu-z_1.41_anglais_11090\cpuz.exe

c:\Documents and Settings\Proprietaire\Bureau\cpu-z_cpu-z_1.41_anglais_11090\latency.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\catchme.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\diff.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\dumphive.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\FilesInfoCmd.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\find2.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\Fport.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\grep.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\gzip.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\KProcCheck.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\LFiles.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\LISTDLLS.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\md5sums.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\pslist.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\streams.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\swreg.exe

c:\Documents and Settings\Proprietaire\Bureau\DiagHelp\tar.exe

c:\Documents and Settings\Proprietaire\Bureau\programation\console.exe

c:\Documents and Settings\Proprietaire\Bureau\programation\main.exe

c:\Documents and Settings\Proprietaire\Bureau\programation\neW file.exe

c:\Documents and Settings\Proprietaire\Bureau\programation\sachaprog.exe

c:\Documents and Settings\Proprietaire\Bureau\programation\variables.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\Call of Duty sur Thurin1\CoDMP.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\Call of Duty sur Thurin1\CoDSP.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\Call of Duty sur Thurin1\Uninstall\UNWISE.EXE

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\Counter Strike - Multiplayer Crack.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\Crack Won.net By Galcrash.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\hl.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\hlds.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\hltv.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\hlupdate.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\SierraUp.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\voice_tweak.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\mediabrowser\MediaBrowser.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\platform\Steam.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\platform\steam_dev.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\platform\SteamEngine.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\platform\WriteMiniDump.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\counter 1.6\platform\bin\vlocalize.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\Counter-Strike Source\cssconfig.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\Counter-Strike Source\csslauncher.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\Counter-Strike Source\hl2.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\Counter-Strike Source\srcds.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\Counter-Strike Source\Uninstal(2).exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\jeux pour LAN\Counter-Strike Source\Uninstal.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\Photos\sachaphotos\clé papa\mes docs\anciens travx\windows2000-kb829558-x86-fra.exe

c:\Documents and Settings\Proprietaire\Bureau\sacha\war 3\TCPOptimizer.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\20070326080439031_Samsung_PC_Studio_312_GCB_Setup.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\a2FreeSetup.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\ad aware setup.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\audacity-win-1.2.6.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\blender_blender_2.43_anglais_11002.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\C cleaner setup.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\camstudio20setup.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\codeblocks-1.0rc2_mingw.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\Firefox Setup 2.0.0.1.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\flvplayer_setup.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\FRAPS272.EXE

c:\Documents and Settings\Proprietaire\Bureau\setups importants\GoogleEarthWin.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\GoogleVideoPlayerSetup.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\GoogleVideoUploaderInstaller.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\Install_MSN_Messenger.EXE

c:\Documents and Settings\Proprietaire\Bureau\setups importants\iTunesSetup.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\IvoyagerV46.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\MsgPlusLive-400.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\paint pro shop setup.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\PowerPoint_2000_SR-1_31012001.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\PPVIEWER.EXE

c:\Documents and Settings\Proprietaire\Bureau\setups importants\QuickTimeInstaller.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\realplayer_realplayer_10.5_francais_9527.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\Satsuki.Decoder.Pack.3.1.1.2.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\Satsuki.Decoder.WM.Module.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\setupfre.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\SkypeSetup.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\spybotsd14.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\Steam setup.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\teamspeak install.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\videoraipodconverter_Installer.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\vlc_vlc_0.8.6a_francais_10829.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\Windows_Movie_Maker_2.0.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\windows-media-player-11_windows_media_player_11.0_francais_20085.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\wmp11-windowsxp-x86-FR-FR.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\WoW-BurningCrusade-frFR-Installer-downloader.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\wow-cartographe_wow_cartographe_1.05_francais_14391.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\WowCartoInstall107.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\WowExpansionMaster_1024_2100_B_French-avi-downloader.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\youtube-video-downloader_youtube_video_downloader_anglais_24719.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\driver X 600\Radeon_FSC_8.231\ACE\atishlx.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\driver X 600\Radeon_FSC_8.231\ACE\DXStress.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\driver X 600\Radeon_FSC_8.231\ACE\setup.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\samsung\Samsung_PC_Studio_312_GCB.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\SmitfraudFix\dumphive.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\SmitfraudFix\GenericRenosFix.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\SmitfraudFix\Process.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\SmitfraudFix\SmiUpdate.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\SmitfraudFix\SrchSTS.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\SmitfraudFix\swreg.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\SmitfraudFix\swsc.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\SmitfraudFix\unzip.exe

c:\Documents and Settings\Proprietaire\Bureau\setups importants\WoW-1.12.x-to-2.0.1-frFR-patch\Updater.exe

c:\Documents and Settings\Proprietaire\Bureau\SharePod\SharePod.exe

c:\Documents and Settings\Proprietaire\Local Settings\Temp\Rar$EX00.484\HijackThis.exe

c:\Documents and Settings\Proprietaire\Mes documents\audacity_audacity_1.2.6_francais_10372.exe

c:\Documents and Settings\Proprietaire\Mes documents\nForce4_amd_6.70_winxp2k_international.exe

c:\Documents and Settings\Proprietaire\Mes documents\Setup.exe

c:\Documents and Settings\Proprietaire\Mes documents\WDM_A384.exe

c:\Documents and Settings\Proprietaire\Mes documents\wrar351fr.exe

c:\Documents and Settings\Proprietaire\Mes documents\Driver Samsung SCL770\DVC.exe

c:\Documents and Settings\Proprietaire\Mes documents\Driver Samsung SCL770\Setup.exe

c:\Documents and Settings\Proprietaire\Mes documents\everestultimate280\everest.exe

c:\Documents and Settings\Proprietaire\Mes documents\Updater\bridge1\AdobeBridge_1.0.4_updater.exe

c:\Documents and Settings\Proprietaire\Mes documents\Updater\bridge1\OLSUpdater_1.exe

c:\Documents and Settings\Proprietaire\Mes documents\Updater\helpcenter1\AdobeUpdater_404.exe

c:\Documents and Settings\Proprietaire\Mes documents\Updater\photoshop9-fr_FR-RET\CameraRawUpdater3.7.exe

c:\Documents and Settings\Proprietaire\Mes documents\Updater\stockphotos1\UpdateInstaller1_0_8.exe

c:\Documents and Settings\Proprietaire\Mes documents\WoW-BurningCrusade-frFR-Slim-Installer\Installer.exe

c:\Documents and Settings\All Users\Application Data\DVD X Studios\DVD X Player 4.1 Professional\DVDXPlayer.dll

c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll

c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll

c:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

c:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Default\MpEngine.dll

c:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{7DBB42F0-DC4C-490C-A57B-61C112600C1A}\mpengine.dll

c:\Documents and Settings\Proprietaire\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll

c:\Documents and Settings\Proprietaire\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll

****** Fin du rapport DiagHelp

Veuillez svp envoyer le fichier C:\upload_moi_PCDESACHA.tar.gz a l'adresse http://upload.malekal.com

ouf!

enfin le dernier hijackthis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:09:06, on 31/10/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\netdde.exe

c:\program files\a-squared free\a2service.exe

C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe

C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\wscntfy.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Proprietaire\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime