OPTIMISATION HJT

erbaghju · le 6 août 2008

Bonjour angelique, voici le résultat:

--------------------\\ Lop S&D 4.2.2-5 XP/Vista

[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]

[ USER : Sonia ] [ "C:\Lop SD" ] [ Selection : 1 ]

[ 06/08/2008 | 12:47:55,21 ] [ PC : ACER-29569F1E48 ]

[ MAJ : 01-08-2008 | 01:40 ]

--------------------\\ Listing des dossiers dans APPLIC~1

[24/08/2005|03:27] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini

[24/08/2005|03:39] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities

[09/07/2008|21:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intel

[24/08/2005|03:27] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[08/08/2006|22:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\addr_file.html

[18/01/2006|08:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL

[30/07/2008|15:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira

[30/03/2008|13:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Babylon

[25/08/2005|08:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink

[24/08/2005|03:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini

[12/12/2007|16:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ezsid.dat

[30/09/2006|19:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Five Anti Log Great

[20/10/2006|20:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google

[24/07/2006|22:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log

[09/07/2008|21:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intel

[10/11/2007|09:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macrovision

[24/08/2005|03:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft

[21/10/2007|09:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NtiDvdCopy

[04/12/2005|23:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle

[18/01/2006|08:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime

[16/06/2007|18:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real

[24/12/2005|11:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT

[12/12/2007|16:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype

[25/07/2006|12:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

[04/12/2005|23:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec

[16/03/2008|22:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP

[18/01/2006|08:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint

[25/07/2006|12:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[06/04/2008|13:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[09/07/2008|21:20] C:\DOCUME~1\NETWOR~1\APPLIC~1\Intel

[24/08/2005|03:27] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[18/12/2005|19:15] C:\DOCUME~1\NETWOR~1\APPLIC~1\Symantec

[09/07/2008|21:20] C:\DOCUME~1\LOCALS~1\APPLIC~1\Intel

[24/08/2005|03:27] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[05/12/2005|19:38] C:\DOCUME~1\SONIA\APPLIC~1\Adobe

[05/12/2005|19:45] C:\DOCUME~1\SONIA\APPLIC~1\AdobeUM

[18/01/2006|08:25] C:\DOCUME~1\SONIA\APPLIC~1\AOL

[03/02/2007|14:22] C:\DOCUME~1\SONIA\APPLIC~1\ArcSoft

[30/03/2008|13:44] C:\DOCUME~1\SONIA\APPLIC~1\Babylon

[18/12/2005|10:10] C:\DOCUME~1\SONIA\APPLIC~1\CyberLink

[24/08/2005|03:27] C:\DOCUME~1\SONIA\APPLIC~1\desktop.ini

[30/09/2006|19:30] C:\DOCUME~1\SONIA\APPLIC~1\Else plus

[05/01/2007|12:03] C:\DOCUME~1\SONIA\APPLIC~1\GDIPFONTCACHEV1.DAT

[17/03/2006|20:16] C:\DOCUME~1\SONIA\APPLIC~1\Google

[18/01/2006|08:35] C:\DOCUME~1\SONIA\APPLIC~1\Help

[24/08/2005|03:39] C:\DOCUME~1\SONIA\APPLIC~1\Identities

[18/12/2005|10:16] C:\DOCUME~1\SONIA\APPLIC~1\Intel

[08/08/2006|23:14] C:\DOCUME~1\SONIA\APPLIC~1\Lavasoft

[02/01/2006|12:11] C:\DOCUME~1\SONIA\APPLIC~1\Macromedia

[16/06/2007|18:37] C:\DOCUME~1\SONIA\APPLIC~1\Media Player Classic

[24/08/2005|03:27] C:\DOCUME~1\SONIA\APPLIC~1\Microsoft

[24/12/2005|11:15] C:\DOCUME~1\SONIA\APPLIC~1\Microsoft Web Folders

[22/02/2006|19:33] C:\DOCUME~1\SONIA\APPLIC~1\OpenOffice.org2

[05/12/2005|21:40] C:\DOCUME~1\SONIA\APPLIC~1\Pinnacle Systems

[16/06/2007|18:26] C:\DOCUME~1\SONIA\APPLIC~1\Real

[18/09/2006|18:29] C:\DOCUME~1\SONIA\APPLIC~1\Reallusion

[18/03/2007|12:36] C:\DOCUME~1\SONIA\APPLIC~1\Screenshot Sender

[20/10/2006|20:46] C:\DOCUME~1\SONIA\APPLIC~1\Skype

[12/12/2007|16:14] C:\DOCUME~1\SONIA\APPLIC~1\skypePM

[17/03/2006|20:17] C:\DOCUME~1\SONIA\APPLIC~1\Sun

[04/12/2005|23:06] C:\DOCUME~1\SONIA\APPLIC~1\Symantec

[09/12/2005|19:55] C:\DOCUME~1\SONIA\APPLIC~1\Template

[17/11/2007|09:56] C:\DOCUME~1\SONIA\APPLIC~1\U3

[13/05/2006|12:30] C:\DOCUME~1\SONIA\APPLIC~1\wklnhst.dat

[18/01/2006|08:24] C:\DOCUME~1\SONIA\APPLIC~1\You've Got Pictures Screensaver

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[05/08/2008 22:05][--ah-----] C:\WINDOWS\tasks\AD83BAA8915C343C.job

[06/08/2008 12:39][--a------] C:\WINDOWS\tasks\HP Usg Daily.job

[06/08/2008 12:38][--ah-----] C:\WINDOWS\tasks\SA.DAT

[05/08/2004 05:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

( AD83BAA8915C343C.job )=( c:\docume~1\sonia\applic~1\elsepl~1\Thunkdeafgreat.exe )

--------------------\\ Listing des dossiers dans C:\Program Files

[25/08/2005|08:29] C:\Program Files\Acer

[24/08/2005|03:49] C:\Program Files\Acer Inc

[10/11/2007|08:49] C:\Program Files\Adobe Photoshop 7 (fr) & CS (ang) Manuels

[30/07/2008|15:09] C:\Program Files\Avira

[16/06/2007|19:44] C:\Program Files\CDBurnerXP Pro 3

[24/08/2005|03:46] C:\Program Files\CONEXANT

[10/11/2007|08:51] C:\Program Files\crack

[25/08/2005|08:27] C:\Program Files\CyberLink

[18/06/2007|00:53] C:\Program Files\directx

[05/12/2005|00:06] C:\Program Files\DivX

[01/10/2006|18:02] C:\Program Files\Doc_acc_prog_1

[01/10/2006|18:02] C:\Program Files\Doc_acc_prog_2

[01/10/2006|18:03] C:\Program Files\Doc_acc_prog_3

[24/08/2005|03:28] C:\Program Files\Fichiers communs

[17/03/2006|20:16] C:\Program Files\Google

[07/12/2005|14:33] C:\Program Files\Hewlett-Packard

[07/12/2005|14:36] C:\Program Files\HP

[24/08/2005|03:41] C:\Program Files\InstallShield Installation Information

[24/08/2005|03:42] C:\Program Files\Intel

[24/08/2005|03:33] C:\Program Files\Internet Explorer

[17/12/2006|20:09] C:\Program Files\IZArc

[17/03/2006|20:10] C:\Program Files\Java

[24/06/2008|19:52] C:\Program Files\jv16 PowerTools

[16/06/2007|18:26] C:\Program Files\K-Lite Codec Pack

[24/08/2005|03:32] C:\Program Files\Messenger

[18/06/2007|00:52] C:\Program Files\Micro Application

[06/04/2008|21:59] C:\Program Files\Microsoft CAPICOM 2.1.0.2

[24/08/2005|03:35] C:\Program Files\microsoft frontpage

[04/12/2005|22:55] C:\Program Files\Microsoft Office

[05/12/2005|00:02] C:\Program Files\Microsoft SQL Server

[04/12/2005|22:54] C:\Program Files\Microsoft Works

[24/08/2005|03:33] C:\Program Files\Movie Maker

[24/08/2005|03:32] C:\Program Files\MSN

[03/05/2006|00:19] C:\Program Files\MSN Apps

[24/08/2005|03:32] C:\Program Files\MSN Gaming Zone

[29/04/2006|14:15] C:\Program Files\MSN Messenger

[17/11/2006|06:52] C:\Program Files\MSXML 4.0

[24/08/2005|03:33] C:\Program Files\NetMeeting

[24/08/2005|03:51] C:\Program Files\NewTech Infosystems

[01/06/2007|21:43] C:\Program Files\NimoCodec Pack

[22/02/2006|19:31] C:\Program Files\OpenOffice.org 2.0

[24/08/2005|03:33] C:\Program Files\Outlook Express

[04/12/2005|23:56] C:\Program Files\Pinnacle

[21/01/2006|13:13] C:\Program Files\PowerQuest

[01/10/2006|18:03] C:\Program Files\Prog_ele

[24/08/2005|03:45] C:\Program Files\Realtek

[10/11/2007|08:51] C:\Program Files\Setup

[12/12/2007|16:10] C:\Program Files\Skype

[24/12/2005|11:37] C:\Program Files\Snapshot Viewer

[24/06/2008|21:10] C:\Program Files\Spybot - Search & Destroy

[23/06/2008|19:54] C:\Program Files\SpywareBlaster

[04/08/2008|14:25] C:\Program Files\Sunbelt Software

[24/08/2005|03:47] C:\Program Files\Synaptics

[24/07/2006|21:55] C:\Program Files\ToniArts

[24/08/2005|03:39] C:\Program Files\Uninstall Information

[18/01/2006|08:24] C:\Program Files\Viewpoint

[10/06/2007|13:37] C:\Program Files\Windows Live

[02/06/2007|14:41] C:\Program Files\Windows Media Connect 2

[24/08/2005|03:32] C:\Program Files\Windows Media Player

[24/08/2005|03:32] C:\Program Files\Windows NT

[24/06/2008|19:51] C:\Program Files\WindowsUpdate

[24/08/2005|03:35] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[18/01/2006|08:19] C:\Program Files\Fichiers communs\AOL

[18/01/2006|08:24] C:\Program Files\Fichiers communs\aolback

[05/01/2007|12:00] C:\Program Files\Fichiers communs\Designer

[24/08/2005|03:41] C:\Program Files\Fichiers communs\InstallShield

[17/03/2006|19:34] C:\Program Files\Fichiers communs\Java

[24/08/2005|03:28] C:\Program Files\Fichiers communs\Microsoft Shared

[24/08/2005|03:33] C:\Program Files\Fichiers communs\MSSoap

[24/08/2005|03:51] C:\Program Files\Fichiers communs\muvee Technologies

[24/08/2005|03:51] C:\Program Files\Fichiers communs\NewTech Infosystems

[18/01/2006|08:23] C:\Program Files\Fichiers communs\Nullsoft

[18/01/2006|08:23] C:\Program Files\Fichiers communs\Real

[24/08/2005|03:33] C:\Program Files\Fichiers communs\Services

[12/12/2007|16:10] C:\Program Files\Fichiers communs\Skype

[24/08/2005|03:28] C:\Program Files\Fichiers communs\SpeechEngines

[24/08/2005|03:33] C:\Program Files\Fichiers communs\System

[06/04/2008|13:16] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 30 Processus )

iexplore.exe ~ [3368]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\SONIA\APPLIC~1\ELSE PLUS

C:\DOCUME~1\SONIA\APPLIC~1\elsepl~1

C:\WINDOWS\Tasks\AD83BAA8915C343C.job

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts MODIFIE

127.0.0.1 bin.errorprotector.com ## added by CiD

127.0.0.1 br.errorsafe.com ## added by CiD

127.0.0.1 br.winantivirus.com ## added by CiD

127.0.0.1 br.winfixer.com ## added by CiD

127.0.0.1 cdn.drivecleaner.com ## added by CiD

127.0.0.1 de.errorsafe.com ## added by CiD

127.0.0.1 de.winantivirus.com ## added by CiD

127.0.0.1 download.cdn.winsoftware.com ## added by CiD

127.0.0.1 download.errorsafe.com ## added by CiD

127.0.0.1 download.systemdoctor.com ## added by CiD

127.0.0.1 download.winantispyware.com ## added by CiD

127.0.0.1 download.windrivecleaner.com ## added by CiD

127.0.0.1 download.winfixer.com ## added by CiD

127.0.0.1 drivecleaner.com ## added by CiD

127.0.0.1 dynamique.drivecleaner.com ## added by CiD

127.0.0.1 errorprotector.com ## added by CiD

127.0.0.1 errorsafe.com ## added by CiD

127.0.0.1 es.winantivirus.com ## added by CiD

127.0.0.1 fr.winantivirus.com ## added by CiD

127.0.0.1 fr.winfixer.com ## added by CiD

127.0.0.1 go.drivecleaner.com ## added by CiD

127.0.0.1 go.errorsafe.com ## added by CiD

127.0.0.1 go.winantispyware.com ## added by CiD

127.0.0.1 go.winantivirus.com ## added by CiD

127.0.0.1 hk.winantivirus.com ## added by CiD

127.0.0.1 instlog.errorsafe.com ## added by CiD

127.0.0.1 instlog.winantivirus.com ## added by CiD

127.0.0.1 jsp.drivecleaner.com ## added by CiD

127.0.0.1 kb.errorsafe.com ## added by CiD

127.0.0.1 kb.winantivirus.com ## added by CiD

127.0.0.1 nl.errorsafe.com ## added by CiD

127.0.0.1 se.errorsafe.com ## added by CiD

127.0.0.1 secure.drivecleaner.com ## added by CiD

127.0.0.1 secure.errorsafe.com ## added by CiD

127.0.0.1 secure.winantispam.com ## added by CiD

127.0.0.1 secure.winantispy.com ## added by CiD

127.0.0.1 secure.winantivirus.com ## added by CiD

127.0.0.1 support.winantivirus.com ## added by CiD

127.0.0.1 ulog.winantivirus.com ## added by CiD

127.0.0.1 utils.errorsafe.com ## added by CiD

127.0.0.1 utils.winantivirus.com ## added by CiD

127.0.0.1 winantispyware.com ## added by CiD

127.0.0.1 winantivirus.com ## added by CiD

127.0.0.1 winfixer.com ## added by CiD

127.0.0.1 www.drivecleaner.com ## added by CiD

127.0.0.1 www.errorprotector.com ## added by CiD

127.0.0.1 www.errorsafe.com ## added by CiD

127.0.0.1 www.systemdoctor.com ## added by CiD

127.0.0.1 www.win-anti-virus-pro.com ## added by CiD

127.0.0.1 www.win-virus-pro.com ## added by CiD

127.0.0.1 www.winantispam.com ## added by CiD

127.0.0.1 www.winantispy.com ## added by CiD

127.0.0.1 www.winantispyware.com ## added by CiD

127.0.0.1 www.winantivirus.com ## added by CiD

127.0.0.1 www.winantiviruspro.com ## added by CiD

127.0.0.1 www.windrivecleaner.com ## added by CiD

127.0.0.1 www.windrivesafe.com ## added by CiD

127.0.0.1 www.winfixer.com ## added by CiD

127.0.0.1 cdn.errorsafe.com ## added by CiD

127.0.0.1 cdn.winsoftware.com ## added by CiD

127.0.0.1 download.cdn.drivecleaner.com ## added by CiD

127.0.0.1 download.cdn.errorsafe.com ## added by CiD

127.0.0.1 instlog.winfixer.com ## added by CiD

127.0.0.1 trial.updates.winsoftware.com ## added by CiD

127.0.0.1 utils.winfixer.com ## added by CiD

127.0.0.1 winfixer2006.com ## added by CiD

127.0.0.1 winsoftware.com ## added by CiD

127.0.0.1 www.utils.winfixer.com ## added by CiD

127.0.0.1 www.winfixer2006.com ## added by CiD

127.0.0.1 www.winsoftware.com ## added by CiD

-> 8951 [ 70 ## added by CiD ]

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-06 12:52:08

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 0

--------------------\\ Recherche d'autres infections

C:\WINDOWS\Pack.epk

C:\WINDOWS\System32\egebtl.dat

C:\WINDOWS\System32\egebtl_navps.dat

C:\WINDOWS\System32\egebtl_nav.dat

==> EGDACCESS <==

[F:18][D:29]-> C:\DOCUME~1\Sonia\LOCALS~1\Temp

[F:23][D:0]-> C:\DOCUME~1\Sonia\Cookies

[F:486][D:10]-> C:\DOCUME~1\Sonia\LOCALS~1\TEMPOR~1\content.IE5

[F:2][D:0]-> C:\Recycled

--------------------\\ Fin du rapport a 12:53:31,45

Merci par avance

angelique · le 6 août 2008

et bien tu relances LOP S&D et tu cjoisis l'option2

puis http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

Télécharge Navilog1.exe (Il Mafioso)

Installe le,un raccourci est crée sur le bureau il va se lancer tout seul, choisis l'option 1, une rapport s'affichera , ferme le.

Relance Navilog1 , par le raccourci crée sur ton bureau et choisi l'option 2 et poste le contenu du rapport qui s'affiche

puis:

reposte un nouveau rapport HJT

erbaghju · le 6 août 2008

Alors, voici le rapport de l'option 2 de Navilog plus le rapport de HJT (si il y a des lignes à supprimer, dis moi le!)

Merci par avance

Clean Navipromo version 3.6.1 commencé le 06/08/2008 à 14:07:31,25

Outil exécuté depuis C:\Program Files\navilog1

Session actuelle : "Sonia"

Mise à jour le 19.07.2008 à 20h00 par IL-MAFIOSO

Microsoft Windows XP [version 5.1.2600]

Internet Explorer : 7.0.5730.11

Système de fichiers : FAT32

Mode suppression automatique

avec prise en charge résultats Catchme et GNS

Nettoyage exécuté au redémarrage de l'ordinateur

*** fsbl1.txt non trouvé ***

(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *

* Suppression dans "C:\Documents and Settings\Sonia\locals~1\applic~1" *

*** Suppression dossiers dans "C:\WINDOWS" ***

*** Suppression dossiers dans "C:\Program Files" ***

*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudÉ~1\progra~1" ***

*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudÉ~1" ***

*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***

*** Suppression dossiers dans "C:\Documents and Settings\Sonia\applic~1" ***

*** Suppression dossiers dans "C:\Documents and Settings\Sonia\locals~1\applic~1" ***

*** Suppression dossiers dans "C:\Documents and Settings\Sonia\menud+~1\progra~1" ***

*** Suppression fichiers ***

C:\WINDOWS\pack.epk supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !

Nettoyage contenu C:\Documents and Settings\Sonia\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***

(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :

* Dans "C:\WINDOWS\system32" *

egebtl.dat trouvé !

Copie egebtl.dat réalisée avec succès !

egebtl.dat supprimé !

egebtl_nav.dat trouvé !

Copie egebtl_nav.dat réalisée avec succès !

egebtl_nav.dat supprimé !

egebtl_navps.dat trouvé !

Copie egebtl_navps.dat réalisée avec succès !

egebtl_navps.dat supprimé !

* Dans "C:\Documents and Settings\Sonia\locals~1\applic~1" *

*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

*** Certificats ***

Certificat Egroup supprimé !

Certificat Electronic-Group absent !

Certificat OOO-Favorit absent !

Certificat Sunny-Day-Design-Ltdt absent !

*** Nettoyage terminé le 06/08/2008 à 14:14:39,82 ***

-----------------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:18:57, on 06/08/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe

C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe

C:\WINDOWS\NOTEPAD.EXE

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\PROGRA~1\IZARC\IZARC.EXE

C:\DOCUME~1\Sonia\LOCALS~1\Temp\ARC1\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/webhp?sourceid=navclient&ie=UTF-8

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O15 - Trusted Zone: http://toolbar.imageshack.us

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {983AB2CC-3D50-11D9-ADFE-00062919A34C} (ActiveXUpload.UserCtrl) - http://www.photoservice.com/activeX/newUpload.CAB

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe

--

End of file - 6162 bytes

angelique · le 6 août 2008

• desinstalle navilog1 via ajout\supp de programmes

supp son dossier restant ensuite c:\Program Files\navilog1

• poste le rapport option2 de LOP S&D

• HJT ne doit pas etre dans un fichier temporaire.

creer un nouveau dossier en c:\ nommé HJT

telecharger HijackThis.exe dans ce nouveau dossier crée::

http://www.trendsecure.com/portal/en-US/_d.../HiJackThis.exe

la lancer, Choisis l'option "Do a system scan and save a log file"

Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note

Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport

Colle le rapport que tu viens de copier sur ce forum

erbaghju · le 6 août 2008

--------------------\\ Lop S&D 4.2.2-5 XP/Vista

[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]

[ USER : Sonia ] [ "C:\Lop SD" ] [ Selection : 2 ]

[ 06/08/2008 | 16:45:36,53 ] [ PC : ACER-29569F1E48 ]

[ MAJ : 01-08-2008 | 01:40 ]

//////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing des dossiers dans APPLIC~1

[24/08/2005|03:27] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini

[24/08/2005|03:39] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities

[09/07/2008|21:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intel

[24/08/2005|03:27] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[08/08/2006|22:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\addr_file.html

[18/01/2006|08:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL

[30/07/2008|15:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira

[30/03/2008|13:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Babylon

[25/08/2005|08:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink

[24/08/2005|03:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini

[12/12/2007|16:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ezsid.dat

[30/09/2006|19:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Five Anti Log Great

[20/10/2006|20:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google

[24/07/2006|22:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log

[09/07/2008|21:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intel

[10/11/2007|09:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macrovision

[24/08/2005|03:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft

[21/10/2007|09:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NtiDvdCopy

[04/12/2005|23:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle

[18/01/2006|08:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime

[16/06/2007|18:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real

[24/12/2005|11:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT

[12/12/2007|16:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype

[25/07/2006|12:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

[04/12/2005|23:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec

[16/03/2008|22:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP

[25/07/2006|12:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[06/04/2008|13:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[09/07/2008|21:20] C:\DOCUME~1\NETWOR~1\APPLIC~1\Intel

[24/08/2005|03:27] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[18/12/2005|19:15] C:\DOCUME~1\NETWOR~1\APPLIC~1\Symantec

[09/07/2008|21:20] C:\DOCUME~1\LOCALS~1\APPLIC~1\Intel

[24/08/2005|03:27] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[05/12/2005|19:38] C:\DOCUME~1\SONIA\APPLIC~1\Adobe

[05/12/2005|19:45] C:\DOCUME~1\SONIA\APPLIC~1\AdobeUM

[18/01/2006|08:25] C:\DOCUME~1\SONIA\APPLIC~1\AOL

[03/02/2007|14:22] C:\DOCUME~1\SONIA\APPLIC~1\ArcSoft

[30/03/2008|13:44] C:\DOCUME~1\SONIA\APPLIC~1\Babylon

[18/12/2005|10:10] C:\DOCUME~1\SONIA\APPLIC~1\CyberLink

[24/08/2005|03:27] C:\DOCUME~1\SONIA\APPLIC~1\desktop.ini

[05/01/2007|12:03] C:\DOCUME~1\SONIA\APPLIC~1\GDIPFONTCACHEV1.DAT

[17/03/2006|20:16] C:\DOCUME~1\SONIA\APPLIC~1\Google

[18/01/2006|08:35] C:\DOCUME~1\SONIA\APPLIC~1\Help

[24/08/2005|03:39] C:\DOCUME~1\SONIA\APPLIC~1\Identities

[18/12/2005|10:16] C:\DOCUME~1\SONIA\APPLIC~1\Intel

[08/08/2006|23:14] C:\DOCUME~1\SONIA\APPLIC~1\Lavasoft

[02/01/2006|12:11] C:\DOCUME~1\SONIA\APPLIC~1\Macromedia

[16/06/2007|18:37] C:\DOCUME~1\SONIA\APPLIC~1\Media Player Classic

[24/08/2005|03:27] C:\DOCUME~1\SONIA\APPLIC~1\Microsoft

[24/12/2005|11:15] C:\DOCUME~1\SONIA\APPLIC~1\Microsoft Web Folders

[22/02/2006|19:33] C:\DOCUME~1\SONIA\APPLIC~1\OpenOffice.org2

[05/12/2005|21:40] C:\DOCUME~1\SONIA\APPLIC~1\Pinnacle Systems

[16/06/2007|18:26] C:\DOCUME~1\SONIA\APPLIC~1\Real

[18/09/2006|18:29] C:\DOCUME~1\SONIA\APPLIC~1\Reallusion

[18/03/2007|12:36] C:\DOCUME~1\SONIA\APPLIC~1\Screenshot Sender

[20/10/2006|20:46] C:\DOCUME~1\SONIA\APPLIC~1\Skype

[12/12/2007|16:14] C:\DOCUME~1\SONIA\APPLIC~1\skypePM

[17/03/2006|20:17] C:\DOCUME~1\SONIA\APPLIC~1\Sun

[04/12/2005|23:06] C:\DOCUME~1\SONIA\APPLIC~1\Symantec

[09/12/2005|19:55] C:\DOCUME~1\SONIA\APPLIC~1\Template

[17/11/2007|09:56] C:\DOCUME~1\SONIA\APPLIC~1\U3

[13/05/2006|12:30] C:\DOCUME~1\SONIA\APPLIC~1\wklnhst.dat

[18/01/2006|08:24] C:\DOCUME~1\SONIA\APPLIC~1\You've Got Pictures Screensaver

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[06/08/2008 12:39][--a------] C:\WINDOWS\tasks\HP Usg Daily.job

[06/08/2008 16:43][--ah-----] C:\WINDOWS\tasks\SA.DAT

[05/08/2004 05:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[25/08/2005|08:29] C:\Program Files\Acer

[24/08/2005|03:49] C:\Program Files\Acer Inc

[10/11/2007|08:49] C:\Program Files\Adobe Photoshop 7 (fr) & CS (ang) Manuels

[30/07/2008|15:09] C:\Program Files\Avira

[16/06/2007|19:44] C:\Program Files\CDBurnerXP Pro 3

[24/08/2005|03:46] C:\Program Files\CONEXANT

[10/11/2007|08:51] C:\Program Files\crack

[25/08/2005|08:27] C:\Program Files\CyberLink

[18/06/2007|00:53] C:\Program Files\directx

[05/12/2005|00:06] C:\Program Files\DivX

[01/10/2006|18:02] C:\Program Files\Doc_acc_prog_1

[01/10/2006|18:02] C:\Program Files\Doc_acc_prog_2

[01/10/2006|18:03] C:\Program Files\Doc_acc_prog_3

[24/08/2005|03:28] C:\Program Files\Fichiers communs

[17/03/2006|20:16] C:\Program Files\Google

[07/12/2005|14:33] C:\Program Files\Hewlett-Packard

[07/12/2005|14:36] C:\Program Files\HP

[24/08/2005|03:41] C:\Program Files\InstallShield Installation Information

[24/08/2005|03:42] C:\Program Files\Intel

[24/08/2005|03:33] C:\Program Files\Internet Explorer

[17/12/2006|20:09] C:\Program Files\IZArc

[17/03/2006|20:10] C:\Program Files\Java

[24/06/2008|19:52] C:\Program Files\jv16 PowerTools

[16/06/2007|18:26] C:\Program Files\K-Lite Codec Pack

[24/08/2005|03:32] C:\Program Files\Messenger

[18/06/2007|00:52] C:\Program Files\Micro Application

[06/04/2008|21:59] C:\Program Files\Microsoft CAPICOM 2.1.0.2

[24/08/2005|03:35] C:\Program Files\microsoft frontpage

[04/12/2005|22:55] C:\Program Files\Microsoft Office

[05/12/2005|00:02] C:\Program Files\Microsoft SQL Server

[04/12/2005|22:54] C:\Program Files\Microsoft Works

[24/08/2005|03:33] C:\Program Files\Movie Maker

[24/08/2005|03:32] C:\Program Files\MSN

[03/05/2006|00:19] C:\Program Files\MSN Apps

[24/08/2005|03:32] C:\Program Files\MSN Gaming Zone

[29/04/2006|14:15] C:\Program Files\MSN Messenger

[17/11/2006|06:52] C:\Program Files\MSXML 4.0

[06/08/2008|13:53] C:\Program Files\Navilog1

[24/08/2005|03:33] C:\Program Files\NetMeeting

[24/08/2005|03:51] C:\Program Files\NewTech Infosystems

[01/06/2007|21:43] C:\Program Files\NimoCodec Pack

[22/02/2006|19:31] C:\Program Files\OpenOffice.org 2.0

[24/08/2005|03:33] C:\Program Files\Outlook Express

[04/12/2005|23:56] C:\Program Files\Pinnacle

[21/01/2006|13:13] C:\Program Files\PowerQuest

[01/10/2006|18:03] C:\Program Files\Prog_ele

[24/08/2005|03:45] C:\Program Files\Realtek

[10/11/2007|08:51] C:\Program Files\Setup

[12/12/2007|16:10] C:\Program Files\Skype

[24/12/2005|11:37] C:\Program Files\Snapshot Viewer

[24/06/2008|21:10] C:\Program Files\Spybot - Search & Destroy

[23/06/2008|19:54] C:\Program Files\SpywareBlaster

[04/08/2008|14:25] C:\Program Files\Sunbelt Software

[24/08/2005|03:47] C:\Program Files\Synaptics

[24/07/2006|21:55] C:\Program Files\ToniArts

[24/08/2005|03:39] C:\Program Files\Uninstall Information

[10/06/2007|13:37] C:\Program Files\Windows Live

[02/06/2007|14:41] C:\Program Files\Windows Media Connect 2

[24/08/2005|03:32] C:\Program Files\Windows Media Player

[24/08/2005|03:32] C:\Program Files\Windows NT

[24/06/2008|19:51] C:\Program Files\WindowsUpdate

[24/08/2005|03:35] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[18/01/2006|08:19] C:\Program Files\Fichiers communs\AOL

[18/01/2006|08:24] C:\Program Files\Fichiers communs\aolback

[05/01/2007|12:00] C:\Program Files\Fichiers communs\Designer

[24/08/2005|03:41] C:\Program Files\Fichiers communs\InstallShield

[17/03/2006|19:34] C:\Program Files\Fichiers communs\Java

[24/08/2005|03:28] C:\Program Files\Fichiers communs\Microsoft Shared

[24/08/2005|03:33] C:\Program Files\Fichiers communs\MSSoap

[24/08/2005|03:51] C:\Program Files\Fichiers communs\muvee Technologies

[24/08/2005|03:51] C:\Program Files\Fichiers communs\NewTech Infosystems

[18/01/2006|08:23] C:\Program Files\Fichiers communs\Nullsoft

[18/01/2006|08:23] C:\Program Files\Fichiers communs\Real

[24/08/2005|03:33] C:\Program Files\Fichiers communs\Services

[12/12/2007|16:10] C:\Program Files\Fichiers communs\Skype

[24/08/2005|03:28] C:\Program Files\Fichiers communs\SpeechEngines

[24/08/2005|03:33] C:\Program Files\Fichiers communs\System

[06/04/2008|13:16] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 29 Processus )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-06 16:54:11

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 0

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[F:3][D:2]-> C:\DOCUME~1\Sonia\LOCALS~1\Temp

[F:34][D:0]-> C:\DOCUME~1\Sonia\Cookies

[F:854][D:10]-> C:\DOCUME~1\Sonia\LOCALS~1\TEMPOR~1\content.IE5

[F:2][D:0]-> C:\Recycled

--------------------\\ Fin du rapport a 16:55:32,01

----------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:59:58, on 06/08/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe

C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe