Infection Win32/Adware.Virtumonde Application

Fear · le 30 novembre 2007

Bonjour à tous!

Voila depuis hier nod32 m'affiche sans cesse que la menace "Win32/Adware.Virtumonde Application" est présente sur mon pc et qu'il va la supprimer. Malheureusement dès que ce dernier procède à sa suppression l'application se relance.. Mon UC est constament utilisé à 100%. Nod32 m'indique aussi que l'objet infecté est "C:\WINDOWS\system32\ljjjjjhe.dll".

J'ai essayé divers scan (spybot, AVG Anti-Spyware..) mais ces derniers ne trouvent rien d'anormal.

Je vous laisse un rapport HijackThis si ça peut vous aider:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:06:37, on 30/11/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe

C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Logitech\SetPoint II\SetpointII.exe

C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE

C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe

C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe

C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Raxco\PerfectDisk\PDSched.exe

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Program Files\Opera\Opera.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM\..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"

O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe

O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

O4 - Global Startup: SetPointII.lnk = ?

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by123fd.bay123.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1165224092442

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-fr.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...950/mcfscan.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{6A261226-2E76-4E44-A934-3F35D6304DE9}: NameServer = 192.168.0.1

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe

O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

--

End of file - 8399 bytes

Merci d'avance

Thanos · le 30 novembre 2007

salut et bienvenue

Poste stp le rapport suivant >

Télécharge et lance DiagHelp comme montré dans ce tutoriel> http://www.malekal.com/DiagHelp/DiagHelp.php

Ne lance que l'option 1 et poste le rapport stp.

Notes: lors du scan, une fenêtre "Sysinternals Software Licence Terms" va s'ouvrir > clique sur Agree

Tu va certainement reçevoir une alerte du parefeu te demandant si tu acceptes que le processus sigcheck.exe puisse se connecter à internet > accepte.

A la fin du scan tu sera dirigé vers la page de l'auteur afin d'expédier le fichier c:\upload_moi_xxxxx.zip

Envoie le fichier stp : si tu reçois un message d'erreur ferme simplement la page internet et clique sur la touche [Enter]

pour obtenir le rapport. S'il ne s'affiche pas, tu le trouvera dans le répertoire C:\ > il se nomme resultat.txt

@++

Fear · le 30 novembre 2007

Merci beaucoup pour ta reponse rapide =)

Voici le rapport Diaghelp:

DiagHelp version v1.4 - http://www.malekal.com
excute le 30/11/2007 à 7:02:12,04

Liste des derniers fichies modifies/crees dans windir\system32 et prefetch

C:\WINDOWS\prefetch\CHCP.COM-18156052.pf -->30/11/2007 07:01:55

C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->30/11/2007 07:01:38

C:\WINDOWS\prefetch\WINRAR.EXE-39C6DAD9.pf -->30/11/2007 07:00:51

C:\WINDOWS\prefetch\OPERA.EXE-12085680.pf -->30/11/2007 06:58:26

C:\WINDOWS\prefetch\PHOTOFILTRE.EXE-00101112.pf -->30/11/2007 06:57:51

C:\WINDOWS\prefetch\IMAPI.EXE-0BF740A4.pf -->30/11/2007 06:54:52

C:\WINDOWS\prefetch\VERCLSID.EXE-3667BD89.pf -->30/11/2007 06:54:39

C:\WINDOWS\prefetch\EXPLORER.EXE-082F38A9.pf -->30/11/2007 06:54:23

C:\WINDOWS\prefetch\TASKMGR.EXE-20256C55.pf -->30/11/2007 06:54:22

C:\WINDOWS\prefetch\RUNDLL32.EXE-451FC2C0.pf -->30/11/2007 06:53:00

C:\WINDOWS\System32\drivers\epfwtdir.sys -->08/11/2007 16:17:34

C:\WINDOWS\System32\drivers\easdrv.sys -->08/11/2007 16:10:12

C:\WINDOWS\System32\drivers\eamon.sys -->08/11/2007 16:09:22

C:\WINDOWS\System32\drivers\Msft_Kernel_LMouFilt_01005.Wdf -->07/11/2007 12:50:33

C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf -->07/11/2007 12:50:32

C:\WINDOWS\System32\drivers\pxhelp20.sys -->20/10/2007 01:56:10

C:\WINDOWS\System32\drivers\sptd.sys -->25/09/2007 11:29:53

C:\WINDOWS\System32\svvwa.ini -->30/11/2007 07:02:13

C:\WINDOWS\System32\svvwa.ini2 -->30/11/2007 07:00:26

C:\WINDOWS\System32\wpa.dbl -->30/11/2007 03:50:55

C:\WINDOWS\System32\aycjgjbl.dll -->29/11/2007 20:31:05

C:\WINDOWS\System32\awvvs.dll -->26/11/2007 19:47:48

C:\WINDOWS\System32\ljjjjhe.dll -->26/11/2007 19:42:20

C:\WINDOWS\System32\CONFIG.NT -->26/11/2007 07:40:53

C:\WINDOWS\System32\lvcoinst.log -->17/11/2007 14:24:57

C:\WINDOWS\System32\MRT.exe -->02/11/2007 08:12:57

C:\WINDOWS\System32\PerfStringBackup.TMP -->01/11/2007 14:16:14

C:\WINDOWS\System32\perfh00C.dat -->01/11/2007 14:16:14

C:\WINDOWS\System32\perfh009.dat -->01/11/2007 14:16:14

C:\WINDOWS\System32\perfc00C.dat -->01/11/2007 14:16:14

C:\WINDOWS\System32\perfc009.dat -->01/11/2007 14:16:14

C:\WINDOWS\System32\xpsp3res.dll -->29/10/2007 16:07:16

C:\WINDOWS\System32\PerfStringBackup.INI -->28/10/2007 12:08:16

C:\WINDOWS\System32\shell32.dll -->25/10/2007 17:43:25

C:\WINDOWS\System32\imon1.dat -->24/10/2007 12:30:28

C:\WINDOWS\System32\slidess.scr.log -->21/10/2007 08:03:41

C:\WINDOWS\System32\dsm_fr.qm -->20/10/2007 01:56:22

C:\WINDOWS\System32\divxsm.tlb -->20/10/2007 01:56:22

C:\WINDOWS\System32\DivXsm.exe -->20/10/2007 01:56:22

C:\WINDOWS\System32\qt-dx331.dll -->20/10/2007 01:56:16

C:\WINDOWS\System32\pxwave.dll -->20/10/2007 01:56:12

C:\WINDOWS\System32\pxmas.dll -->20/10/2007 01:56:12

C:\WINDOWS\wmsetup.log -->30/11/2007 06:07:14

C:\WINDOWS\WindowsUpdate.log -->30/11/2007 06:07:10

C:\WINDOWS.log -->30/11/2007 03:50:37

C:\WINDOWS\wiadebug.log -->30/11/2007 03:50:35

C:\WINDOWS\wiaservc.log -->30/11/2007 03:50:32

C:\WINDOWS\Sti_Trace.log -->30/11/2007 03:50:30

C:\WINDOWS\SchedLgU.Txt -->30/11/2007 03:50:20

C:\WINDOWS\bootstat.dat -->30/11/2007 03:50:16

C:\WINDOWS\ntbtlog.txt -->30/11/2007 03:19:08

C:\WINDOWS\win.ini -->28/11/2007 00:46:09

C:\WINDOWS\system.ini -->28/11/2007 00:46:09

C:\WINDOWS\17PHolmes1061.exe -->26/11/2007 19:41:52

C:\WINDOWS\WLXPGSS.SCR -->23/10/2007 17:49:46

C:\WINDOWS\AIMPR.INI -->23/10/2007 17:28:25

C:\WINDOWS\War3Unin.dat -->20/10/2007 18:20:34

winlogon.exe

Verified: Signed

svchost.exe

Verified: Signed

ws2_32.dll

Verified: Signed

user32.dll

Verified: Signed

tcpip.sys

Verified: Unsigned

ndis.sys

Verified: Signed

null.sys

Verified: Signed

ListDLLs v2.25 - DLL lister for Win9x/NT

Copyright © 1997-2004 Mark Russinovich

Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------

explorer.exe pid: 3596

Command line: "C:\WINDOWS\explorer.exe"

Base Size Version Path

0x44080000 0xcf000 7.00.6000.16544 C:\WINDOWS\system32\WININET.dll

0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll

0x43e00000 0x45000 7.00.6000.16544 C:\WINDOWS\system32\iertutil.dll

0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll

0x009b0000 0x1c000 11.00.0000.1217 C:\Program Files\Fichiers communs\Logishrd\LVMVFM\LVPrcInj.dll

0x10000000 0xe000 1.09.0000.0000 C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.dll

0x002d0000 0x11000 C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll

0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL

0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll

0x01450000 0xa3000 C:\WINDOWS\system32\awvvs.dll

0x44160000 0x124000 7.00.6000.16544 C:\WINDOWS\system32\urlmon.dll

0x44360000 0x5cb000 7.00.6000.16544 C:\WINDOWS\system32\ieframe.dll

0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL

0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll

0x442b0000 0x3c000 7.00.6000.16544 C:\WINDOWS\system32\webcheck.dll

0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\WPDShServiceObj.dll

0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceTypes.dll

0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll

0x62350000 0x53000 2.00.0500.0000 C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll

0x60400000 0x18000 2.00.0500.0000 C:\Program Files\OpenOffice.org 2.3\program\uwinapi.dll

0x7c340000 0x56000 7.10.3052.0004 C:\Program Files\OpenOffice.org 2.3\program\MSVCR71.dll

0x61e70000 0x8e000 4.05.2003.0120 C:\Program Files\OpenOffice.org 2.3\program\stlport_vc7145.dll

0x7c3a0000 0x7b000 7.10.3077.0000 C:\Program Files\OpenOffice.org 2.3\program\MSVCP71.dll

0x026b0000 0x1c000 7.00.0000.0000 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

0x02420000 0x13000 7.05.0001.0036 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll

0x029b0000 0x28000 C:\WINDOWS\system32\aycjgjbl.dll

0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll

0x02cf0000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll

0x03270000 0x76d000 6.14.0010.9371 C:\WINDOWS\system32\nvcpl.dll

0x74bf0000 0x2c000 4.02.5406.0000 C:\WINDOWS\system32\OLEACC.dll

0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll

0x02710000 0x44000 6.14.0010.9371 C:\WINDOWS\system32\NVRSFR.DLL

0x02a60000 0x36000 6.14.0010.9371 C:\WINDOWS\system32\nvapi.dll

0x02aa0000 0x13000 2.00.0000.0000 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

0x02ad0000 0x73000 6.14.0010.11060 C:\WINDOWS\system32\nvshell.dll

0x02b70000 0x2b000 C:\Program Files\WinRAR\rarext.dll

0x00f70000 0x6000 C:\Program Files\Unlocker\UnlockerCOM.dll

0x22000000 0x27000 3.00.0563.0000 C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll

0x02bb0000 0x2a000 7.05.0001.0036 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll

0x00930000 0xe000 7.00.0007.0142 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

ListDLLs v2.25 - DLL lister for Win9x/NT

Copyright © 1997-2004 Mark Russinovich

Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------

winlogon.exe pid: 1000

Command line: winlogon.exe

Base Size Version Path

0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe

0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll

0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll

0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll

0x10000000 0x11000 6.14.0010.4129 C:\WINDOWS\system32\Ati2evxx.dll

0x01220000 0x3b000 1.07.0018.0005 C:\WINDOWS\system32\WgaLogon.dll

0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL

0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll

0x011f0000 0x15000 C:\WINDOWS\system32\ljjjjhe.dll

0x44160000 0x124000 7.00.6000.16544 C:\WINDOWS\system32\urlmon.dll

0x43e00000 0x45000 7.00.6000.16544 C:\WINDOWS\system32\iertutil.dll

0x44080000 0xcf000 7.00.6000.16544 C:\WINDOWS\system32\WININET.dll

0x013b0000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll

0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est 68E6-FB1F

Répertoire de C:\WINDOWS\system32

05/08/2004 13:00 6 144 csrss.exe

1 fichier(s) 6 144 octets

0 Rép(s) 4 714 901 504 octets libres

Contenu de Downloaded Program Files

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est 68E6-FB1F

Répertoire de C:\WINDOWS\Downloaded Program Files

15/11/2007 20:39 <REP> .

15/11/2007 20:39 <REP> ..

24/08/2006 08:28 141 424 asinst.dll

22/08/2006 09:06 537 asinst.inf

07/12/2004 16:07 32 bdcore.dll

25/05/2006 00:21 118 784 bdupd.dll

13/01/2005 14:59 233 Crusher.inf

27/11/2006 20:10 65 desktop.ini

13/04/2007 02:14 382 344 GAME_UNO1.dll

17/01/2007 15:44 316 GAME_UNO1.INF

25/05/2006 00:21 53 248 ipsupd.dll

16/03/2005 11:34 7 407 lang.ini

07/12/2004 16:07 32 libfn.dll

14/03/2005 13:38 126 live.ini

18/12/2006 10:02 882 mcfscan.inf

22/02/2007 22:41 304 544 MessengerStatsPAClient.dll

28/02/2007 14:21 131 472 msgrchkr.dll

08/10/2004 15:01 372 736 MsnPUpld.dll

08/10/2004 15:13 587 MSNPupld.inf

01/06/2006 01:57 1 331 oscan8.inf

01/06/2006 01:54 471 040 oscan8.ocx

31/05/2006 03:15 10 oscan81.ocx_x

22/09/2004 14:59 110 592 PURen-us.dll

15/10/2004 06:59 110 592 PURfr-xx.dll

04/12/2006 15:16 144 QTPlugin.inf

14/03/2005 13:58 7 073 scanoptions.tsi

09/11/2006 14:36 5 019 swflash.inf

26/05/2005 04:19 291 wuweb.inf

02/11/2005 18:01 1 777 xscan.inf

02/11/2005 18:07 435 712 xscan53.ocx

28 fichier(s) 2 658 350 octets

Total des fichiers listés :

28 fichier(s) 2 658 350 octets

2 Rép(s) 4 714 901 504 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..

Liste des fichiers en exception sur le pare-feu XP SP2

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\Java SATARaid\\SiITray.exe"="C:\\Program Files\\Java SATARaid\\SiITray.exe:*:Enabled:SiITray"

"C:\\WINDOWS\\system32\\javaw.exe"="C:\\WINDOWS\\system32\\javaw.exe:*:Enabled:javaw"

"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe"="C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe:*:Enabled:Kaspersky Anti-Virus"

"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"D:\\eMule\\emule.exe"="D:\\eMule\\emule.exe:*:Enabled:eMule"

"D:\\Azureus\\Azureus.exe"="D:\\Azureus\\Azureus.exe:*:Enabled:Azureus"

"C:\\Program Files\\Ocean Technology\\GG E-Sports Platform\\GGclient.exe"="C:\\Program Files\\Ocean Technology\\GG E-Sports Platform\\GGclient.exe:*:Enabled:GG E-Sports Platform Client"

"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"="C:\\Program Files\\IncrediMail\\bin\\IMApp.exe:*:Enabled:IncrediMail"

"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail"

"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"="C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail"

"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"

"D:\\LimeWire\\LimeWire.exe"="D:\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"

"C:\\Program Files\\PPLive\\PPLive.exe"="C:\\Program Files\\PPLive\\PPLive.exe:*:Enabled:PPLive"

"C:\\Program Files\\xchat\\xchat.exe"="C:\\Program Files\\xchat\\xchat.exe:*:Enabled:XChat IRC Client"

"C:\\Program Files\\FlashGet\\FlashGet.exe"="C:\\Program Files\\FlashGet\\FlashGet.exe:*:Enabled:Flashget"

"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Export de la clef SharedTaskScheduler

[sharedTaskScheduler]

"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"

"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

exports des policies

REGEDIT4

[system]

"dontdisplaylastusername"=dword:00000000

"legalnoticecaption"=""

"legalnoticetext"=""

"shutdownwithoutlogon"=dword:00000001

"undockwithoutlogon"=dword:00000001

Export des clefs sensibles..

Rechercher adresses sensibles dans le fichier HOSTS...

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-11-30 07:03:26

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]

"s1"=dword:e2bda958

"s2"=dword:762dbb43

"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"h0"=dword:00000000

"khjeh"=hex:2f,d7,93,86,fa,17,9f,43,95,ad,97,0d,ab,46,83,77,e5,ed,68,2e,11,..

"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001]

"khjeh"=hex:a8,01,be,36,3e,75,f5,5c,10,17,80,95,a0,4b,5a,9c,5f,b8,3f,fd,f0,..

"a0"=hex:20,01,00,00,90,2c,06,2b,81,39,e4,22,08,90,49,59,44,b9,7f,e5,c6,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf40]

"khjeh"=hex:de,84,bb,fe,33,8c,b5,ba,cc,bc,c0,e8,62,31,47,ec,1a,01,1f,75,76,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf41]

"khjeh"=hex:9f,42,62,8f,b4,21,08,e0,f8,3b,71,9a,2c,df,d4,4c,22,0a,d9,81,46,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"h0"=dword:00000000

"khjeh"=hex:2f,d7,93,86,fa,17,9f,43,95,ad,97,0d,ab,46,83,77,e5,ed,68,2e,11,..

"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001]

"khjeh"=hex:a8,01,be,36,3e,75,f5,5c,10,17,80,95,a0,4b,5a,9c,5f,b8,3f,fd,f0,..

"a0"=hex:20,01,00,00,90,2c,06,2b,81,39,e4,22,08,90,49,59,44,b9,7f,e5,c6,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf40]

"khjeh"=hex:de,84,bb,fe,33,8c,b5,ba,cc,bc,c0,e8,62,31,47,ec,1a,01,1f,75,76,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf41]

"khjeh"=hex:9f,42,62,8f,b4,21,08,e0,f8,3b,71,9a,2c,df,d4,4c,22,0a,d9,81,46,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully

hidden services: 0

hidden files: 0

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System

544 - LCDMon.exe

552 - LGDCore.exe

560 - egui.exe

572 - avgas.exe

604 - MOM.exe

612 - msnmsgr.exe

792 - LCDClock.exe

800 - LCDPop3.exe

820 - LCDMedia.exe

936 - YzShadow.exe

972 - csrss.exe

1000 - winlogon.exe

1048 - services.exe

1060 - lsass.exe

1256 - svchost.exe

1336 - svchost.exe

1452 - svchost.exe

1516 - usnsvc.exe

1528 - guard.exe

1556 - CCC.exe

1580 - svchost.exe

1604 - ekrn.exe

1760 - LVComSer.exe

1952 - spoolsv.exe

1996 - LVPrcSrv.exe

2580 - cmd.exe

3312 - alg.exe

3596 - explorer.exe

3612 - Opera.exe

Total number of processes = 30

NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\ntoskrnl.exe

806EC000 - \WINDOWS\system32\hal.dll

F7D2F000 - \WINDOWS\system32\KDCOM.DLL

F7C3F000 - \WINDOWS\system32\BOOTVID.dll

F7724000 - sptd.sys

F7D31000 - \WINDOWS\System32\Drivers\WMILIB.SYS

F770C000 - \WINDOWS\System32\Drivers\SCSIPORT.SYS

F76DD000 - ACPI.sys

F76CC000 - pci.sys

F782F000 - ohci1394.sys

F783F000 - \WINDOWS\system32\DRIVERS\1394BUS.SYS

F784F000 - isapnp.sys

F7DF7000 - pciide.sys

F7AAF000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

F785F000 - MountMgr.sys

F76AD000 - ftdisk.sys

F7AB7000 - PartMgr.sys

F786F000 - sfsync02.sys

F787F000 - VolSnap.sys

F7695000 - atapi.sys

F767B000 - si3112r.sys

F7C43000 - SiWinAcc.sys

F788F000 - disk.sys

F789F000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

F765B000 - fltMgr.sys

F7649000 - sr.sys

F78AF000 - PxHelp20.sys

F7632000 - KSecDD.sys

F78BF000 - Defrag32b.sys

F75A5000 - Ntfs.sys

F7578000 - NDIS.sys

F7564000 - sfvfs02.sys

F7ABF000 - sfhlp02.sys

F7552000 - sfdrv01.sys

F7AC7000 - nv_agp.sys

F7537000 - Mup.sys

F79CF000 - \SystemRoot\system32\DRIVERS\amdk7.sys

F7BEF000 - \SystemRoot\system32\DRIVERS\usbohci.sys

F6F82000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS

F7BF7000 - \SystemRoot\system32\DRIVERS\usbehci.sys

F6F70000 - \SystemRoot\system32\DRIVERS\NVENET.sys

F79EF000 - \SystemRoot\system32\drivers\nvax.sys

F6D9B000 - \SystemRoot\system32\DRIVERS\yk51x86.sys

F7105000 - \SystemRoot\system32\DRIVERS\imapi.sys

F7D1F000 - \SystemRoot\system32\drivers\pfc.sys

F70F5000 - \SystemRoot\system32\DRIVERS\cdrom.sys

F70E5000 - \SystemRoot\system32\DRIVERS\redbook.sys

F6D78000 - \SystemRoot\system32\DRIVERS\ks.sys

F70D5000 - \SystemRoot\system32\DRIVERS\nic1394.sys

F6BFA000 - \SystemRoot\system32\DRIVERS\ati2mtag.sys

F6BE6000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

F6B7F000 - \SystemRoot\System32\Drivers\ajr61j2m.SYS

F7B7F000 - \SystemRoot\system32\DRIVERS\fdc.sys

F694C000 - \SystemRoot\system32\DRIVERS\serial.sys

F6FA5000 - \SystemRoot\system32\DRIVERS\serenum.sys

F6938000 - \SystemRoot\system32\DRIVERS\parport.sys

F7F51000 - \SystemRoot\system32\drivers\msmpu401.sys

F6398000 - \SystemRoot\system32\drivers\portcls.sys

F7A4F000 - \SystemRoot\system32\drivers\drmk.sys

F64D9000 - \SystemRoot\system32\DRIVERS\gameenum.sys

F7E12000 - \SystemRoot\system32\DRIVERS\audstub.sys

F47CF000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys

F5924000 - \SystemRoot\system32\DRIVERS\ndistapi.sys

F35E5000 - \SystemRoot\system32\DRIVERS\ndiswan.sys

F47BF000 - \SystemRoot\system32\DRIVERS\raspppoe.sys

F47AF000 - \SystemRoot\system32\DRIVERS\raspptp.sys

F472C000 - \SystemRoot\system32\DRIVERS\TDI.SYS

F35D4000 - \SystemRoot\system32\DRIVERS\psched.sys

F479F000 - \SystemRoot\system32\DRIVERS\msgpc.sys

F4724000 - \SystemRoot\system32\DRIVERS\ptilink.sys

F471C000 - \SystemRoot\system32\DRIVERS\raspti.sys

F7A5F000 - \SystemRoot\system32\DRIVERS\termdd.sys

F4714000 - \SystemRoot\system32\DRIVERS\kbdclass.sys

F6274000 - \SystemRoot\system32\DRIVERS\mouclass.sys

F7D57000 - \SystemRoot\system32\DRIVERS\swenum.sys

F3421000 - \SystemRoot\system32\DRIVERS\update.sys

F56C7000 - \SystemRoot\system32\DRIVERS\mssmbios.sys

F468C000 - \SystemRoot\system32\DRIVERS\usbhub.sys

F7D5F000 - \SystemRoot\system32\DRIVERS\USBD.SYS

F6354000 - \SystemRoot\System32\Drivers\NDProxy.SYS

F28B9000 - \SystemRoot\system32\drivers\nvapu.sys

F27C8000 - \SystemRoot\system32\drivers\nvmcp.sys

F27B7000 - \SystemRoot\system32\drivers\nvarm.sys

F26BA000 - \SystemRoot\system32\DRIVERS\flpydisk.sys

F484D000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS

F7EAE000 - \SystemRoot\System32\Drivers\Null.SYS

F484B000 - \SystemRoot\System32\Drivers\Beep.SYS

B23A5000 - \SystemRoot\System32\DRIVERS\AvgAsCln.sys

B191D000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

B1915000 - \SystemRoot\System32\drivers\vga.sys

F7D6D000 - \SystemRoot\System32\Drivers\mnmdd.SYS

F7D6F000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys

B190D000 - \SystemRoot\System32\Drivers\Msfs.SYS

B1905000 - \SystemRoot\System32\Drivers\Npfs.SYS

F26E6000 - \SystemRoot\system32\DRIVERS\rasacd.sys

B1012000 - \SystemRoot\system32\DRIVERS\ipsec.sys

B0FBA000 - \SystemRoot\system32\DRIVERS\tcpip.sys

B0F92000 - \SystemRoot\system32\DRIVERS\netbt.sys

F24C6000 - \SystemRoot\system32\DRIVERS\epfwtdir.sys

B0F66000 - \SystemRoot\System32\drivers\afd.sys

F24A6000 - \SystemRoot\system32\DRIVERS\netbios.sys

B0F3B000 - \SystemRoot\system32\DRIVERS\rdbss.sys

B0ECC000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys

F2496000 - \SystemRoot\System32\Drivers\Fips.SYS

B0EAB000 - \SystemRoot\system32\DRIVERS\ipnat.sys

B17B2000 - \SystemRoot\system32\DRIVERS\wanarp.sys

B17A2000 - \SystemRoot\system32\DRIVERS\arp1394.sys

B1782000 - \SystemRoot\system32\DRIVERS\easdrv.sys

B04CF000 - \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys

B11FE000 - \SystemRoot\system32\DRIVERS\usbccgp.sys

F2B53000 - \SystemRoot\system32\DRIVERS\hidusb.sys

B0360000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

B01E4000 - \SystemRoot\system32\DRIVERS\kbdhid.sys

F7C0F000 - \SystemRoot\system32\DRIVERS\LHidFilt.Sys

F7145000 - \SystemRoot\system32\DRIVERS\WDFLDR.SYS

AFAC0000 - \SystemRoot\system32\DRIVERS\Wdf01000.sys

B1404000 - \SystemRoot\system32\DRIVERS\mouhid.sys

F7C2F000 - \SystemRoot\system32\DRIVERS\LMouFilt.Sys

AA4AF000 - \SystemRoot\System32\Drivers\Cdfs.SYS

A8CB8000 - \SystemRoot\System32\Drivers\dump_diskdump.sys

A8883000 - \SystemRoot\System32\Drivers\dump_si3112r.sys

BF800000 - \SystemRoot\System32\win32k.sys

A8CA0000 - \SystemRoot\System32\drivers\Dxapi.sys

F7BBF000 - \SystemRoot\System32\watchdog.sys

BF9C3000 - \SystemRoot\System32\drivers\dxg.sys

F7F50000 - \SystemRoot\System32\drivers\dxgthk.sys

BF9D5000 - \SystemRoot\System32\ati2dvag.dll

BFA17000 - \SystemRoot\System32\ati2cqag.dll

BFA56000 - \SystemRoot\System32\atikvmag.dll

BFA8C000 - \SystemRoot\System32\atiok3x2.dll

BFAB7000 - \SystemRoot\System32\ati3duag.dll

BFD3B000 - \SystemRoot\System32\ativvaxx.dll

BFFA0000 - \SystemRoot\System32\ATMFD.DLL

B01FC000 - \SystemRoot\system32\DRIVERS\ndisuio.sys

A67F6000 - \SystemRoot\system32\drivers\wdmaud.sys

F7A3F000 - \SystemRoot\system32\drivers\sysaudio.sys

A631F000 - \SystemRoot\system32\DRIVERS\mrxdav.sys

B104D000 - \SystemRoot\System32\Drivers\ParVdm.SYS

A6474000 - \SystemRoot\System32\Drivers\Defrag32.SYS

A6294000 - \SystemRoot\system32\DRIVERS\eamon.sys

A618B000 - \SystemRoot\System32\Drivers\HTTP.sys

A6111000 - \SystemRoot\system32\DRIVERS\srv.sys

F7B17000 - \SystemRoot\system32\DRIVERS\LVPr2Mon.sys

A542A000 - \SystemRoot\system32\drivers\kmixer.sys

A5407000 - \SystemRoot\System32\Drivers\Fastfat.SYS

B04D8000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 146

Liste des programmes installes

Adobe Flash Player 9 ActiveX

Adobe Flash Player Plugin

Adobe Reader 7.0.8

Archiveur WinRAR

Assistant de connexion Windows Live

ATI - Utilitaire de désinstallation du logiciel

ATI Catalyst Control Center

ATI Display Driver

Audacity 1.2.6

AutoUpdate

AVG Anti-Spyware 7.5

Azureus Vuze

Bibliothèques GTK+ 2.6.9 rev a (supprimer uniquement)

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Graphics Previews Common

ccc-core-preinstall

ccc-core-static

ccc-utility

CCC Help English

CCleaner (remove only)

Client Windows Rights Management avec Service Pack 2

DeepBurner v1.8.0.224

Disc2Phone

DivX Codec

DivX Content Uploader

DivX Converter

DivX Player

DivX Web Player

eMule

EPSON Logiciel imprimante

er100LT

ESET NOD32 Antivirus

Galerie de photos Windows Live

HijackThis 2.0.2

J2SE Runtime Environment 5.0 Update 10

J2SE Runtime Environment 5.0 Update 3

Java 2 Runtime Environment, SE v1.4.2_05

Java SATARaid

Java 6 Update 2

Java 6 Update 3

Lecteur Windows Media 11

Logitech Audio Echo Cancellation Component

Logitech GamePanel Software 2.00

Logitech QuickCam

Logitech SetPoint 5.00

Logitech Video Enumerator

Ma-Config.com plugin

Messenger Plus! Live

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 French Language Pack

Microsoft .NET Framework 1.1 Hotfix (KB928366)

Microsoft .NET Framework 2.0

Microsoft .NET Framework 2.0

Microsoft .NET Framework 2.0 Language Pack - FRA

Microsoft .NET Framework 3.0

Microsoft .NET Framework 3.0

Microsoft .NET Framework 3.0 French Language Pack

Microsoft Bootvis

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

Microsoft National Language Support Downlevel APIs

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft User-Mode Driver Framework Feature Pack 1.0

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)

Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)

Mise à jour de sécurité pour Windows XP (KB923789)

Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA

Module de prise en charge linguistique du français de Microsoft .NET Framework 3.0

Mozilla Firefox (2.0.0.9)

MSXML 4.0 SP2 (KB927978)

MSXML 4.0 SP2 (KB936181)

MSXML 6.0 Parser (KB933579)

MVision

NVIDIA Drivers

OpenOffice.org 2.3

Opera 9.22

Pack Vista Inspirat 2 1.0

Package de base Microsoft de service de chiffrement pour cartes à puce

PerfectDisk

PhotoFiltre

Programme de gestion Camera de Logitech®

QuickTime

Security Update for CAPICOM (KB931906)

Security Update for CAPICOM (KB931906)

Security Update pour Microsoft .NET Framework 2.0 (KB928365)

Skins

SLD Codec Pack

SMPlayer

SP2 de compatibilité descendante du client Windows Rights Management

Spybot - Search & Destroy 1.4

Ulead GIF Animator 5 Evaluation

Unlocker 1.8.5

VideoLAN VLC media player 0.8.6a

WC3Banlist

WebFldrs XP

Windows Communication Foundation

Windows Communication Foundation Language Pack - FRA

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Imaging Component

Windows Internet Explorer 7

Windows Live Mail

Windows Live Messenger

Windows Media Format 11 runtime

Windows Media Format 11 runtime

Windows Media Player 11

Windows Presentation Foundation

Windows Presentation Foundation Language Pack (FRA)

Windows Workflow Foundation

Windows Workflow Foundation FR Language Pack

WinPcap 4.0

WLM OSD Plugin

World of Warcraft

XML Paper Specification Shared Components Language Pack 1.0

XML Paper Specification Shared Components Pack 1.0

Xvid 1.1.2 final uninstall

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est 68E6-FB1F

Répertoire de C:\Program Files

30/11/2007 03:12 <REP> .

30/11/2007 03:12 <REP> ..

28/11/2006 09:16 <REP> Adobe

01/11/2007 14:24 <REP> Alwil Software

28/11/2007 00:47 <REP> a-squared Free

27/08/2007 10:41 <REP> ATI Technologies

20/11/2007 22:23 <REP> Audacity

28/11/2006 08:24 <REP> CCleaner

27/11/2006 20:08 <REP> ComPlus Applications

25/09/2007 11:46 <REP> DAEMON Tools

01/10/2007 19:39 <REP> DeepBurner

27/04/2007 16:07 <REP> Disc2Phone

03/10/2007 06:40 <REP> Diskeeper Corporation

20/11/2007 22:50 <REP> DivX

01/11/2007 14:18 <REP> ElcomSoft

30/11/2007 03:10 <REP> Enigma Software Group

28/11/2006 08:16 <REP> EPSON

26/11/2007 07:48 <REP> ESET

16/11/2007 18:59 <REP> Fichiers communs

23/09/2007 16:15 <REP> FileZilla

29/11/2007 00:24 <REP> Firefox

01/09/2007 23:33 <REP> FlashGet

13/08/2007 17:30 <REP> FoxitReader

10/05/2007 14:54 <REP> Google

29/11/2007 17:31 <REP> Grisoft

10/10/2007 06:48 <REP> Internet Explorer

04/10/2007 06:09 <REP> Java

27/11/2006 20:17 <REP> Java SATARaid

16/11/2007 18:59 <REP> Logitech

29/09/2007 06:27 <REP> ma-config.com

04/12/2006 11:42 <REP> Messenger

19/06/2007 12:27 <REP> Messenger Plus! Live

03/02/2007 11:08 <REP> Microsoft Bootvis

29/09/2007 15:54 <REP> Microsoft CAPICOM 2.1.0.2

30/11/2006 13:16 <REP> microsoft frontpage

13/11/2007 07:43 <REP> Microsoft SQL Server Compact Edition

08/11/2007 19:21 <REP> mIRC

07/10/2007 17:06 <REP> Movie Maker

27/04/2007 17:07 <REP> mp3DirectCut

22/06/2007 21:25 <REP> mresreg

29/09/2007 15:33 <REP> MSBuild

01/11/2007 14:18 <REP> MSECACHE

20/06/2007 13:43 <REP> MSN

27/11/2006 20:07 <REP> MSN Gaming Zone

17/11/2007 16:20 <REP> MSN Messenger

15/05/2007 18:22 <REP> Msncolor

12/04/2007 09:39 <REP> MSXML 4.0

22/05/2007 00:24 <REP> MSXML 6.0

29/01/2007 12:29 <REP> Musicmatch

01/10/2007 20:43 <REP> Nero Burning Rom

27/11/2006 20:09 <REP> NetMeeting

24/07/2007 11:57 <REP> Nicolas MERLET

27/11/2006 20:22 <REP> Nvidia

17/12/2006 17:12 <REP> Ocean Technology

28/11/2007 00:43 <REP> Octoshape Streaming Services

27/11/2006 20:08 <REP> Online Services

01/10/2007 20:40 <REP> OpenOffice.org 2.3

18/11/2007 01:54 <REP> Opera

01/11/2007 14:17 <REP> Opera 9.5 beta

07/10/2007 17:06 <REP> Outlook Express

28/01/2007 12:27 <REP> PhotoFiltre

09/08/2007 23:56 <REP> QuickTime

06/08/2007 14:56 <REP> Raxco

09/05/2007 10:48 <REP> Reference Assemblies

13/02/2007 13:46 <REP> RegCleaner

27/11/2006 20:09 <REP> Services en ligne

13/09/2007 14:54 <REP> Skype

28/11/2006 08:23 <REP> SLD Codec Pack

22/07/2007 18:35 <REP> smplayer

08/08/2007 13:29 <REP> Spybot - Search & Destroy

05/10/2007 13:17 <REP> Stardock

01/11/2007 14:18 <REP> SuperCopier2

28/11/2007 00:45 <REP> Teamspeak2_RC2

16/11/2007 18:56 <REP> Thunderbird

30/11/2007 03:12 <REP> Trend Micro

05/09/2007 19:22 <REP> Ulead Systems

03/10/2007 17:53 <REP> Unlocker

02/02/2007 23:18 <REP> VideoLAN

15/08/2007 23:18 <REP> Vista Start Menu

08/08/2007 10:24 <REP> VISUAL PETANQUE

17/11/2007 22:01 <REP> WC3Banlist

10/07/2007 08:31 <REP> WinAce

17/11/2007 16:18 <REP> Windows Live

31/01/2007 18:42 <REP> Windows Live Safety Center

12/05/2007 16:37 <REP> Windows Media Connect 2

12/05/2007 16:37 <REP> Windows Media Player

27/11/2006 20:07 <REP> Windows NT

01/11/2007 14:18 <REP> WinPcap

28/11/2006 08:18 <REP> WinRAR

01/09/2007 23:35 <REP> xchat

27/11/2006 20:10 <REP> xerox

02/02/2007 15:38 <REP> Xvid

15/04/2007 14:27 <REP> Zeb-Utility

0 fichier(s) 0 octets

93 Rép(s) 4 699 422 720 octets libres

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est 68E6-FB1F

Répertoire de C:\Program Files\fichiers communs

16/11/2007 18:59 <REP> .

16/11/2007 18:59 <REP> ..

12/09/2007 10:05 <REP> ACD Systems

28/11/2006 09:16 <REP> Adobe

01/10/2007 20:43 <REP> Ahead

29/09/2007 18:20 <REP> Blizzard Entertainment

06/01/2007 20:39 <REP> GTK

28/11/2006 09:17 <REP> InstallShield

27/11/2006 20:18 <REP> Java

07/11/2007 12:50 <REP> LogiShrd

16/11/2007 18:47 <REP> Microsoft Shared

27/11/2006 20:09 <REP> MSSoap

27/11/2006 20:59 <REP> ODBC

06/08/2007 14:56 <REP> Raxco

27/11/2006 20:09 <REP> Services

28/09/2007 21:59 <REP> Softwin

27/11/2006 20:59 <REP> SpeechEngines

08/06/2007 12:10 <REP> Synacast

29/09/2007 15:31 <REP> System

19/05/2007 17:54 <REP> Teleca Shared

0 fichier(s) 0 octets

20 Rép(s) 4 699 422 720 octets libres

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est 68E6-FB1F

Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders

29/09/2007 15:33 <REP> .

29/09/2007 15:33 <REP> ..

29/09/2007 15:30 <REP> 1036

26/10/2006 18:49 970 528 MSONSEXT.DLL

03/06/1999 12:09 122 937 MSOWS409.DLL

07/03/2001 07:00 127 033 MSOWS40c.DLL

18/03/1999 05:37 593 977 RAGENT.DLL

4 fichier(s) 1 814 475 octets

3 Rép(s) 4 699 668 480 octets libres

c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.0.125\French\setup.exe

c:\Documents and Settings\William\.housecall6.6\getMac.exe

c:\Documents and Settings\William\.housecall6.6\patch.exe

c:\Documents and Settings\William\.housecall6.6\tsc.exe

c:\Documents and Settings\William\Application Data\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_18be6784.exe

c:\Documents and Settings\William\Application Data\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_294823.exe

c:\Documents and Settings\William\Application Data\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_2cd672ae.exe

c:\Documents and Settings\William\Application Data\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_4ae13d6c.exe

c:\Documents and Settings\William\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe

c:\Documents and Settings\William\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

c:\Documents and Settings\William\Application Data\Microsoft\Installer\{AF708E87-ACA2-42FC-AF41-B50226F4C787}\ARPPRODUCTICON.exe

c:\Documents and Settings\William\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe

c:\Documents and Settings\William\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe

c:\Documents and Settings\William\Application Data\Mozilla\Firefox\Profiles\fn4ytr74.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\setupmconfig.exe

c:\Documents and Settings\William\Bureau\w3chart.exe

c:\Documents and Settings\William\Bureau\wtvClient.exe

c:\Documents and Settings\William\Bureau\DiagHelp\catchme.exe

c:\Documents and Settings\William\Bureau\DiagHelp\diff.exe

c:\Documents and Settings\William\Bureau\DiagHelp\dumphive.exe

c:\Documents and Settings\William\Bureau\DiagHelp\FilesInfoCmd.exe

c:\Documents and Settings\William\Bureau\DiagHelp\find2.exe

c:\Documents and Settings\William\Bureau\DiagHelp\Fport.exe

c:\Documents and Settings\William\Bureau\DiagHelp\grep.exe

c:\Documents and Settings\William\Bureau\DiagHelp\gzip.exe

c:\Documents and Settings\William\Bureau\DiagHelp\KProcCheck.exe

c:\Documents and Settings\William\Bureau\DiagHelp\LFiles.exe

c:\Documents and Settings\William\Bureau\DiagHelp\LISTDLLS.exe

c:\Documents and Settings\William\Bureau\DiagHelp\md5sums.exe

c:\Documents and Settings\William\Bureau\DiagHelp\pslist.exe

c:\Documents and Settings\William\Bureau\DiagHelp\sigcheck.exe

c:\Documents and Settings\William\Bureau\DiagHelp\streams.exe

c:\Documents and Settings\William\Bureau\DiagHelp\swreg.exe

c:\Documents and Settings\William\Bureau\DiagHelp\tar.exe

c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll

c:\Documents and Settings\All Users\Application Data\Logishrd\LQCVFX\Filters\MMSEF.dll

c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll

c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

c:\Documents and Settings\William\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll

c:\Documents and Settings\William\Application Data\Mozilla\Firefox\Profiles\fn4ytr74.default\extensions\{0784CD66-62FE-4cef-ABF4-F8ED9B654ACC}\components\tab_effect_xpcom.dll

c:\Documents and Settings\William\Application Data\Mozilla\Firefox\Profiles\fn4ytr74.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll

c:\Documents and Settings\William\Application Data\Mozilla\Firefox\Profiles\fn4ytr74.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll

c:\Documents and Settings\William\Application Data\Mozilla\Firefox\Profiles\fn4ytr74.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}\plugins\npietab.dll

c:\Documents and Settings\William\Application Data\Mozilla\Firefox\Profiles\fn4ytr74.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll

c:\Documents and Settings\William\Application Data\Slide\MSVCR71.DLL

****** Fin du rapport DiagHelp

Veuillez svp envoyer le fichier C:\upload_moi_FEAR.tar.gz a l'adresse http://upload.malekal.com

Connexion

Pas encore inscrit ?

Infection Win32/Adware.Virtumonde Application

Messages recommandés

Fear

Thanos

Fear

Rejoindre la conversation

En ligne récemment 0 membre est en ligne

Zebulon

Outils en ligne

Naviguer