antivirusxp 2008 résolu !

thiemec · le 26 juillet 2008

bonjour pouvez vous m aider svp, j ai le virus antivirusxp2008 , voici le rapport

merci de votre aide précieuse, mon ordi est mon outil de travail!!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:38:24, on 26/07/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

D:\Prog\avast\aswUpdSv.exe

D:\Prog\avast\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Cyberlink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\svchost.exe

D:\Prog\avast\ashMaiSv.exe

D:\Prog\avast\ashWebSv.exe

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Neuf\Kit\WiFi\9wifi.exe

D:\Prog\avast\ashDisp.exe

D:\prog\EnMixCPL.exe

D:\Prog\Winamp\winampa.exe

D:\PDVDServ.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\hphmon05.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\CyberLink\PCM4Everio\EverioService.exe

C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Logitech\QuickCam10\QuickCam10.exe

C:\WINDOWS\system32\cssrss.exe

C:\WINDOWS\system32\lphcgq1j0eeqn.exe

C:\Program Files\rhclq1j0eeqn\rhclq1j0eeqn.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe

C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.fr/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaul...earch.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {3AA6678D-1CE0-499E-B9F6-8444DEE39D88} - C:\WINDOWS\system32\nnnlkhfF.dll (file missing)

O2 - BHO: (no name) - {FA5C4026-14B7-4FE2-8A6E-2787E9486A40} - C:\WINDOWS\system32\vtUNFwWQ.dll (file missing)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] C:\Program Files\Neuf\Kit\WiFi\9wifi.exe

O4 - HKLM\..\Run: [avast!] D:\Prog\avast\ashDisp.exe

O4 - HKLM\..\Run: [EnvyHFCPL] d:\prog\EnMixCPL.exe

O4 - HKLM\..\Run: [WinampAgent] D:\Prog\Winamp\winampa.exe

O4 - HKLM\..\Run: [RemoteControl] D:\PDVDServ.exe

O4 - HKLM\..\Run: [LanguageShortcut] D:\Language\Language.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [EverioService] "C:\Program Files\CyberLink\PCM4Everio\EverioService.exe"

O4 - HKLM\..\Run: [bMaea4f2aa] Rundll32.exe "C:\WINDOWS\system32\fexrojbk.dll",s

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden

O4 - HKCU\..\Run: [sfKg6wIPu] C:\Documents and Settings\Thierry\Application Data\Microsoft\Windows\jcauhi.exe

O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe

O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe

O4 - HKCU\..\Run: [sign Love] C:\DOCUME~1\Thierry\APPLIC~1\COPYFA~1\typeseekmpeg.exe

O4 - HKCU\..\Policies\Explorer\Run: [system Patcher] BTCPatcher.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.0.0.1213 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.0.0.1213 (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1211745107059

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_...geUploader4.cab

O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-1.0.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photobox.fr/discount/clients/up...er_v2.2.0.6.cab

O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/a...zylomloader.cab

O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/layou...IPSUploader.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab

O20 - Winlogon Notify: efcaxvs - efcaxvs.dll (file missing)

O20 - Winlogon Notify: nnnlkhfF - nnnlkhfF.dll (file missing)

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Prog\avast\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - ALWIL Software - D:\Prog\avast\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Prog\avast\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - D:\Prog\avast\ashWebSv.exe

O23 - Service: Droppix Service - Droppix - C:\Program Files\Fichiers communs\Droppix\DxService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared Files\RichVideo.exe

O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--

End of file - 10964 bytes

Modifié le 29 juillet 2008 par thiemec

Falkra · le 26 juillet 2008

Bonsoir, il y a au moins 3 familles d'infections sur la machine.

On peut nettoyer ça proprement.

Désactive tes protections résidentes ( Antivirus , ... ) tu les réactiveras ensuite

Télécharge Lop S&D (d'Eric_71) sur ton bureau

Double-clique dessus pour lancer l'installation
Puis double-clique sur le raccourci Lop S&D présent sur ton bureau
Sélectionne la langue souhaitée, puis choisis l'Option 1 ( Recherche )
Patiente jusqu'à la fin du scan
Poste le rapport généré ( C:\lopR.txt )

( Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide).

thiemec · le 26 juillet 2008

merci , voici le nouveau rapport

--------------------\\ Lop S&D 4.2.2-4 XP/Vista

[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]

[ USER : Thierry ] [ "C:\Lop SD" ] [ Selection : 1 ]

[ 26/07/2008 | 23:18:29.37 ] [ PC : P4-BUREAU ]

[ MAJ : 25-07-2008 | 17:45 ]

--------------------\\ Listing des dossiers dans APPLIC~1

[26/07/2008|21:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\.zreglib

[04/06/2007|17:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe

[06/03/2008|16:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink

[25/05/2007|00:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini

[28/10/2007|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Droppix

[24/07/2008|20:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink

[28/10/2007|10:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Elaborate Bytes

[27/06/2007|18:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google

[25/05/2007|19:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log

[03/02/2008|03:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft

[28/10/2007|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LightScribe

[08/04/2008|23:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LogiShrd

[08/04/2008|23:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech

[26/07/2008|20:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes

[26/05/2008|00:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!

[08/04/2008|23:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft

[17/07/2008|11:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Name beep copy real

[04/06/2007|17:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle

[17/07/2007|17:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime

[04/06/2007|22:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SlySoft

[03/02/2008|04:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

[24/05/2007|23:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec

[06/03/2008|07:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP

[31/08/2007|13:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[25/05/2007|12:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!

[25/05/2007|12:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

[15/09/2007|13:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

[25/05/2007|00:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini

[01/12/2007|01:12] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[31/08/2007|13:36] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[24/05/2007|22:57] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[08/04/2008|01:55] C:\DOCUME~1\Thierry\APPLIC~1\Adobe

[10/06/2008|21:22] C:\DOCUME~1\Thierry\APPLIC~1\AdobeUM

[21/07/2008|13:55] C:\DOCUME~1\Thierry\APPLIC~1\CopyFaceLong

[06/03/2008|16:18] C:\DOCUME~1\Thierry\APPLIC~1\CyberLink

[25/05/2007|00:45] C:\DOCUME~1\Thierry\APPLIC~1\desktop.ini

[28/10/2007|11:49] C:\DOCUME~1\Thierry\APPLIC~1\Droppix

[28/10/2007|11:10] C:\DOCUME~1\Thierry\APPLIC~1\DVD Shrink

[27/10/2007|20:55] C:\DOCUME~1\Thierry\APPLIC~1\DVD Shrink 3.0

[15/01/2008|01:32] C:\DOCUME~1\Thierry\APPLIC~1\dvdcss

[24/05/2007|23:13] C:\DOCUME~1\Thierry\APPLIC~1\Help

[24/05/2007|23:02] C:\DOCUME~1\Thierry\APPLIC~1\Identities

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\inst.exe

[24/05/2007|23:15] C:\DOCUME~1\Thierry\APPLIC~1\IsolatedStorage

[24/05/2007|23:40] C:\DOCUME~1\Thierry\APPLIC~1\Macromedia

[26/07/2008|20:03] C:\DOCUME~1\Thierry\APPLIC~1\Malwarebytes

[26/05/2008|10:07] C:\DOCUME~1\Thierry\APPLIC~1\Microsoft

[06/06/2007|23:03] C:\DOCUME~1\Thierry\APPLIC~1\Microsoft Web Folders

[24/05/2007|23:52] C:\DOCUME~1\Thierry\APPLIC~1\Mozilla

[25/05/2007|13:53] C:\DOCUME~1\Thierry\APPLIC~1\MSNInstaller

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\pcouffin.cat

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\pcouffin.inf

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\pcouffin.log

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\pcouffin.sys

[26/07/2008|11:35] C:\DOCUME~1\Thierry\APPLIC~1\rhclq1j0eeqn

[04/06/2007|22:32] C:\DOCUME~1\Thierry\APPLIC~1\SlySoft

[13/11/2007|19:03] C:\DOCUME~1\Thierry\APPLIC~1\STOIK

[05/07/2007|15:54] C:\DOCUME~1\Thierry\APPLIC~1\Sun

[03/06/2008|23:52] C:\DOCUME~1\Thierry\APPLIC~1\UseNeXT

[21/06/2007|21:52] C:\DOCUME~1\Thierry\APPLIC~1\vlc

[27/06/2008|21:11] C:\DOCUME~1\Thierry\APPLIC~1\Vso

[03/11/2007|15:03] C:\DOCUME~1\Thierry\APPLIC~1\Yahoo!

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[26/07/2008 19:22][--a------] C:\WINDOWS\tasks\HP Usg Daily.job

[26/07/2008 21:08][--ah-----] C:\WINDOWS\tasks\SA.DAT

[05/08/2004 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[25/01/2008|13:51] C:\Program Files\.autoreg

[19/01/2008|17:22] C:\Program Files\321Studios

[03/06/2007|19:21] C:\Program Files\Ahead

[11/07/2008|14:55] C:\Program Files\aMSN

[01/07/2007|17:29] C:\Program Files\aswclnr.log

[24/05/2007|23:08] C:\Program Files\ATI Technologies

[20/11/2007|19:20] C:\Program Files\Audacity

[01/09/2007|15:18] C:\Program Files\AviSynth 2.5

[21/07/2008|14:03] C:\Program Files\Circle Developement

[24/05/2007|22:53] C:\Program Files\ComPlus Applications

[04/07/2008|07:18] C:\Program Files\CopyFaceLong

[23/06/2008|15:26] C:\Program Files\CruX

[06/03/2008|16:13] C:\Program Files\Cyberlink

[06/03/2008|16:06] C:\Program Files\Digital Photo Navigator 1.5

[28/10/2007|11:48] C:\Program Files\Droppix

[16/07/2007|17:30] C:\Program Files\DVD Decrypter

[28/10/2007|11:43] C:\Program Files\DVD Shrink

[08/09/2007|16:50] C:\Program Files\DVDFab HD Decrypter 3

[13/01/2008|12:10] C:\Program Files\DVDFab Platinum 4

[19/01/2008|15:59] C:\Program Files\Elaborate Bytes

[19/01/2008|16:49] C:\Program Files\FairUse Wizard 2

[02/04/2008|20:41] C:\Program Files\Fichiers communs

[25/05/2007|19:22] C:\Program Files\Hewlett-Packard

[26/07/2008|21:16] C:\Program Files\hjt.exe

[25/05/2007|19:22] C:\Program Files\HP

[28/10/2007|11:48] C:\Program Files\illiminable

[06/03/2008|16:14] C:\Program Files\InstallShield Installation Information

[11/06/2008|12:45] C:\Program Files\Internet Explorer

[21/10/2007|20:32] C:\Program Files\Java

[03/02/2008|03:27] C:\Program Files\Lavasoft

[27/03/2008|17:54] C:\Program Files\Live_TV

[08/04/2008|23:07] C:\Program Files\Logitech

[26/07/2008|20:03] C:\Program Files\Malwarebytes' Anti-Malware

[16/07/2007|22:04] C:\Program Files\Messenger

[26/05/2008|00:12] C:\Program Files\Messenger Plus! Live

[26/05/2008|00:46] C:\Program Files\Microsoft CAPICOM 2.1.0.2

[06/06/2007|23:02] C:\Program Files\microsoft frontpage

[02/06/2007|11:14] C:\Program Files\Microsoft IntelliPoint

[06/06/2007|23:03] C:\Program Files\Microsoft Office

[06/06/2007|23:07] C:\Program Files\Microsoft Visual Studio

[24/05/2007|22:54] C:\Program Files\Movie Maker

[25/07/2008|16:37] C:\Program Files\Mozilla Firefox

[25/05/2007|13:53] C:\Program Files\MSN

[24/05/2007|22:53] C:\Program Files\MSN Gaming Zone

[26/05/2008|00:12] C:\Program Files\MSN Messenger

[16/07/2007|22:01] C:\Program Files\MSXML 4.0

[24/05/2007|22:54] C:\Program Files\NetMeeting

[05/07/2007|03:05] C:\Program Files\Neuf

[24/05/2007|22:53] C:\Program Files\Online Services

[16/07/2007|22:03] C:\Program Files\Outlook Express

[28/08/2007|13:26] C:\Program Files\Pinnacle

[25/05/2007|14:07] C:\Program Files\Program Files

[04/06/2007|17:56] C:\Program Files\QuickTime

[26/07/2008|11:35] C:\Program Files\rhclq1j0eeqn

[08/09/2007|19:13] C:\Program Files\SlySoft

[03/02/2008|03:43] C:\Program Files\Spybot - Search & Destroy

[13/11/2007|19:02] C:\Program Files\STOIK Imaging

[26/07/2008|21:16] C:\Program Files\Trend Micro

[24/05/2007|23:02] C:\Program Files\Uninstall Information

[17/04/2008|23:54] C:\Program Files\UseNeXT

[25/05/2007|15:09] C:\Program Files\Winamp

[26/05/2008|00:12] C:\Program Files\Windows Live

[31/08/2007|13:25] C:\Program Files\Windows Media Connect 2

[31/08/2007|13:25] C:\Program Files\Windows Media Player

[24/05/2007|22:52] C:\Program Files\Windows NT

[24/05/2007|22:55] C:\Program Files\WindowsUpdate

[03/06/2007|20:02] C:\Program Files\WinRAR

[24/05/2007|22:57] C:\Program Files\xerox

[25/05/2007|12:54] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[05/06/2007|21:36] C:\Program Files\Fichiers communs\Adobe

[03/06/2007|20:05] C:\Program Files\Fichiers communs\Ahead

[06/06/2007|23:07] C:\Program Files\Fichiers communs\Designer

[28/10/2007|11:49] C:\Program Files\Fichiers communs\Droppix

[04/06/2007|17:18] C:\Program Files\Fichiers communs\InstallShield

[05/07/2007|15:52] C:\Program Files\Fichiers communs\Java

[28/10/2007|11:48] C:\Program Files\Fichiers communs\LightScribe

[08/04/2008|23:08] C:\Program Files\Fichiers communs\LogiShrd

[16/09/2007|23:31] C:\Program Files\Fichiers communs\Microsoft Shared

[24/05/2007|22:54] C:\Program Files\Fichiers communs\MSSoap

[25/05/2007|00:45] C:\Program Files\Fichiers communs\ODBC

[24/05/2007|22:54] C:\Program Files\Fichiers communs\Services

[25/05/2007|00:45] C:\Program Files\Fichiers communs\SpeechEngines

[16/07/2007|22:03] C:\Program Files\Fichiers communs\System

[03/02/2008|03:27] C:\Program Files\Fichiers communs\Wise Installation Wizard

--------------------\\ Process

( 57 Processus )

IEXPLORE.EXE ~ [2344]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Name beep copy real

C:\Program Files\Circle Developement

C:\DOCUME~1\Thierry\Cookies\thierry@bizadverts[2].txt

C:\DOCUME~1\Thierry\Cookies\thierry@www.adserver5[1].txt

C:\DOCUME~1\Thierry\Cookies\thierry@banner.cotedazurpalace[2].txt

C:\DOCUME~1\Thierry\Cookies\thierry@banner.cotedazurpalace[3].txt

C:\DOCUME~1\Thierry\Cookies\thierry@cotedazurpalace[1].txt

C:\DOCUME~1\Thierry\Cookies\thierry@cotedazurpalace[2].txt

C:\DOCUME~1\Thierry\Cookies\thierry@adopt.euroclick[1].txt

C:\DOCUME~1\Thierry\Cookies\thierry@adopt.euroclick[2].txt

C:\DOCUME~1\Thierry\Cookies\thierry@pacificpoker[2].txt

C:\DOCUME~1\Thierry\Cookies\thierry@pacificpoker[3].txt

C:\DOCUME~1\Thierry\Cookies\thierry@partygaming.122.2o7[1].txt

C:\DOCUME~1\Thierry\Cookies\thierry@partypoker[1].txt

C:\DOCUME~1\Thierry\Cookies\thierry@fr1.seafight.bigpoint[1].txt

C:\DOCUME~1\Thierry\Cookies\thierry@32vegas[1].txt

C:\DOCUME~1\Thierry\Cookies\thierry@banner.32vegas[2].txt

C:\DOCUME~1\Thierry\Cookies\thierry@vegas-millions[1].txt

C:\DOCUME~1\Thierry\Cookies\thierry@www.lop[1].txt

C:\DOCUME~1\Thierry\Cookies\thierry@2xmoinscher[1].txt

C:\DOCUME~1\Thierry\Cookies\thierry@2xmoinscher[2].txt

C:\DOCUME~1\Thierry\Cookies\thierry@www.2xmoinscher[2].txt

C:\DOCUME~1\Thierry\Cookies\thierry@www.2xmoinscher[3].txt

C:\DOCUME~1\Thierry\Cookies\thierry@888[1].txt

C:\DOCUME~1\Thierry\Cookies\thierry@888[2].txt

C:\DOCUME~1\Thierry\Cookies\thierry@888[3].txt

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-26 23:19:52

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden files ...

C:\WINDOWS\System32\cssrss.exe 24400 bytes executable

scan completed successfully

hidden processes: 0

hidden files: 19

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

[F:7083][D:45]-> C:\DOCUME~1\Thierry\LOCALS~1\Temp

[F:2229][D:0]-> C:\DOCUME~1\Thierry\Cookies

[F:16951][D:32]-> C:\DOCUME~1\Thierry\LOCALS~1\TEMPOR~1\content.IE5

--------------------\\ Fin du rapport a 23:21:32.37

Falkra · le 26 juillet 2008

On va faire 2 choses ensuite.

**1**

Relance Lop S&D

Choisis cette fois ci l'Option 2 ( Suppression )
Ne ferme pas la fenêtre lors de la suppression !
Poste le rapport généré ( C:\lopR.txt )

(Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide)

**2**

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.

***Si le lien ne fonctionne pas, essaie celui-ci : http://download.bleepingcomputer.com/andymanchesta/SDFix.exe ***

Double clique sur SDFix.exe et choisis Install pour l'extraire à la racine de C:\. (cela donne C:\SDfix).

:!: Imprime ou note ce qui suit, tu n'auras pas accès à internet.

Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

Redémarre ton ordinateur.
Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde suffit).
A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
Choisis ton compte.

Suis la liste des instructions ci-dessous :

Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
Appuie sur Y pour commencer le nettoyage.
SDFix va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis.

Si SDfix ne se lance pas (ça arrive!)

* Démarrer->Exécuter
* Copie/colle ceci:
%systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe
* Clique sur ok, et valide.
* Redémarre et essaye de nouveau de lancer SDfix.

thiemec · le 26 juillet 2008

1ere partie

merci

--------------------\\ Lop S&D 4.2.2-4 XP/Vista

[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]

[ USER : Thierry ] [ "C:\Lop SD" ] [ Selection : 2 ]

[ 27/07/2008 | 1:05:12.50 ] [ PC : P4-BUREAU ]

[ MAJ : 25-07-2008 | 17:45 ]

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@bizadverts[2].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@www.adserver5[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@advertising[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@advertising[2].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@advertising[3].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@adin.bigpoint[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@bigpoint[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@fr1.darkorbit.bigpoint[2].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@fr1.seafight.bigpoint[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@banner.casinoking[2].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@casinoking[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@banner.cotedazurpalace[2].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@banner.cotedazurpalace[3].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@cotedazurpalace[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@cotedazurpalace[2].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@adopt.euroclick[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@adopt.euroclick[2].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@pacificpoker[2].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@pacificpoker[3].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@partygaming.122.2o7[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@partypoker[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@32vegas[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@banner.32vegas[2].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@vegas-millions[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@www.lop[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@2xmoinscher[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@2xmoinscher[2].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@www.2xmoinscher[2].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@www.2xmoinscher[3].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@888[1].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@888[2].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@888[3].txt

Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Name beep copy real

Supprime! - C:\Program Files\Circle Developement

//////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing des dossiers dans APPLIC~1

[27/07/2008|00:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\.zreglib

[04/06/2007|17:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe

[06/03/2008|16:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink

[25/05/2007|00:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini

[28/10/2007|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Droppix

[24/07/2008|20:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink

[28/10/2007|10:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Elaborate Bytes

[27/06/2007|18:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google

[25/05/2007|19:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log

[03/02/2008|03:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft

[28/10/2007|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LightScribe

[08/04/2008|23:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LogiShrd

[08/04/2008|23:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech

[26/07/2008|20:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes

[26/05/2008|00:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!

[08/04/2008|23:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft

[04/06/2007|17:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle

[17/07/2007|17:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime

[04/06/2007|22:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SlySoft

[03/02/2008|04:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

[24/05/2007|23:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec

[06/03/2008|07:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP

[31/08/2007|13:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[25/05/2007|12:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!

[25/05/2007|12:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

[15/09/2007|13:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

[25/05/2007|00:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini

[01/12/2007|01:12] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[31/08/2007|13:36] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[24/05/2007|22:57] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[08/04/2008|01:55] C:\DOCUME~1\Thierry\APPLIC~1\Adobe

[10/06/2008|21:22] C:\DOCUME~1\Thierry\APPLIC~1\AdobeUM

[21/07/2008|13:55] C:\DOCUME~1\Thierry\APPLIC~1\CopyFaceLong

[06/03/2008|16:18] C:\DOCUME~1\Thierry\APPLIC~1\CyberLink

[25/05/2007|00:45] C:\DOCUME~1\Thierry\APPLIC~1\desktop.ini

[28/10/2007|11:49] C:\DOCUME~1\Thierry\APPLIC~1\Droppix

[28/10/2007|11:10] C:\DOCUME~1\Thierry\APPLIC~1\DVD Shrink

[27/10/2007|20:55] C:\DOCUME~1\Thierry\APPLIC~1\DVD Shrink 3.0

[15/01/2008|01:32] C:\DOCUME~1\Thierry\APPLIC~1\dvdcss

[24/05/2007|23:13] C:\DOCUME~1\Thierry\APPLIC~1\Help

[24/05/2007|23:02] C:\DOCUME~1\Thierry\APPLIC~1\Identities

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\inst.exe

[24/05/2007|23:15] C:\DOCUME~1\Thierry\APPLIC~1\IsolatedStorage

[24/05/2007|23:40] C:\DOCUME~1\Thierry\APPLIC~1\Macromedia

[26/07/2008|20:03] C:\DOCUME~1\Thierry\APPLIC~1\Malwarebytes

[26/05/2008|10:07] C:\DOCUME~1\Thierry\APPLIC~1\Microsoft

[06/06/2007|23:03] C:\DOCUME~1\Thierry\APPLIC~1\Microsoft Web Folders

[24/05/2007|23:52] C:\DOCUME~1\Thierry\APPLIC~1\Mozilla

[25/05/2007|13:53] C:\DOCUME~1\Thierry\APPLIC~1\MSNInstaller

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\pcouffin.cat

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\pcouffin.inf

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\pcouffin.log

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\pcouffin.sys

[26/07/2008|11:35] C:\DOCUME~1\Thierry\APPLIC~1\rhclq1j0eeqn

[04/06/2007|22:32] C:\DOCUME~1\Thierry\APPLIC~1\SlySoft

[13/11/2007|19:03] C:\DOCUME~1\Thierry\APPLIC~1\STOIK

[05/07/2007|15:54] C:\DOCUME~1\Thierry\APPLIC~1\Sun

[03/06/2008|23:52] C:\DOCUME~1\Thierry\APPLIC~1\UseNeXT

[21/06/2007|21:52] C:\DOCUME~1\Thierry\APPLIC~1\vlc

[27/06/2008|21:11] C:\DOCUME~1\Thierry\APPLIC~1\Vso

[03/11/2007|15:03] C:\DOCUME~1\Thierry\APPLIC~1\Yahoo!

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[26/07/2008 23:22][--a------] C:\WINDOWS\tasks\HP Usg Daily.job

[27/07/2008 00:59][--ah-----] C:\WINDOWS\tasks\SA.DAT

[05/08/2004 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[25/01/2008|13:51] C:\Program Files\.autoreg

[19/01/2008|17:22] C:\Program Files\321Studios

[03/06/2007|19:21] C:\Program Files\Ahead

[11/07/2008|14:55] C:\Program Files\aMSN

[01/07/2007|17:29] C:\Program Files\aswclnr.log

[24/05/2007|23:08] C:\Program Files\ATI Technologies

[20/11/2007|19:20] C:\Program Files\Audacity

[01/09/2007|15:18] C:\Program Files\AviSynth 2.5

[24/05/2007|22:53] C:\Program Files\ComPlus Applications

[04/07/2008|07:18] C:\Program Files\CopyFaceLong

[23/06/2008|15:26] C:\Program Files\CruX

[06/03/2008|16:13] C:\Program Files\Cyberlink

[06/03/2008|16:06] C:\Program Files\Digital Photo Navigator 1.5

[28/10/2007|11:48] C:\Program Files\Droppix

[16/07/2007|17:30] C:\Program Files\DVD Decrypter

[28/10/2007|11:43] C:\Program Files\DVD Shrink

[08/09/2007|16:50] C:\Program Files\DVDFab HD Decrypter 3

[13/01/2008|12:10] C:\Program Files\DVDFab Platinum 4

[19/01/2008|15:59] C:\Program Files\Elaborate Bytes

[19/01/2008|16:49] C:\Program Files\FairUse Wizard 2

[02/04/2008|20:41] C:\Program Files\Fichiers communs

[25/05/2007|19:22] C:\Program Files\Hewlett-Packard

[26/07/2008|21:16] C:\Program Files\hjt.exe

[25/05/2007|19:22] C:\Program Files\HP

[28/10/2007|11:48] C:\Program Files\illiminable

[06/03/2008|16:14] C:\Program Files\InstallShield Installation Information

[11/06/2008|12:45] C:\Program Files\Internet Explorer

[21/10/2007|20:32] C:\Program Files\Java

[03/02/2008|03:27] C:\Program Files\Lavasoft

[27/03/2008|17:54] C:\Program Files\Live_TV

[08/04/2008|23:07] C:\Program Files\Logitech

[26/07/2008|20:03] C:\Program Files\Malwarebytes' Anti-Malware

[16/07/2007|22:04] C:\Program Files\Messenger

[26/05/2008|00:12] C:\Program Files\Messenger Plus! Live

[26/05/2008|00:46] C:\Program Files\Microsoft CAPICOM 2.1.0.2

[06/06/2007|23:02] C:\Program Files\microsoft frontpage

[02/06/2007|11:14] C:\Program Files\Microsoft IntelliPoint

[06/06/2007|23:03] C:\Program Files\Microsoft Office

[06/06/2007|23:07] C:\Program Files\Microsoft Visual Studio

[24/05/2007|22:54] C:\Program Files\Movie Maker

[25/07/2008|16:37] C:\Program Files\Mozilla Firefox

[25/05/2007|13:53] C:\Program Files\MSN

[24/05/2007|22:53] C:\Program Files\MSN Gaming Zone

[26/05/2008|00:12] C:\Program Files\MSN Messenger

[16/07/2007|22:01] C:\Program Files\MSXML 4.0

[24/05/2007|22:54] C:\Program Files\NetMeeting

[05/07/2007|03:05] C:\Program Files\Neuf

[24/05/2007|22:53] C:\Program Files\Online Services

[16/07/2007|22:03] C:\Program Files\Outlook Express

[28/08/2007|13:26] C:\Program Files\Pinnacle

[25/05/2007|14:07] C:\Program Files\Program Files

[04/06/2007|17:56] C:\Program Files\QuickTime

[26/07/2008|11:35] C:\Program Files\rhclq1j0eeqn

[08/09/2007|19:13] C:\Program Files\SlySoft

[03/02/2008|03:43] C:\Program Files\Spybot - Search & Destroy

[13/11/2007|19:02] C:\Program Files\STOIK Imaging

[26/07/2008|21:16] C:\Program Files\Trend Micro

[24/05/2007|23:02] C:\Program Files\Uninstall Information

[17/04/2008|23:54] C:\Program Files\UseNeXT

[25/05/2007|15:09] C:\Program Files\Winamp

[26/05/2008|00:12] C:\Program Files\Windows Live

[31/08/2007|13:25] C:\Program Files\Windows Media Connect 2

[31/08/2007|13:25] C:\Program Files\Windows Media Player

[24/05/2007|22:52] C:\Program Files\Windows NT

[24/05/2007|22:55] C:\Program Files\WindowsUpdate

[03/06/2007|20:02] C:\Program Files\WinRAR

[24/05/2007|22:57] C:\Program Files\xerox

[25/05/2007|12:54] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[05/06/2007|21:36] C:\Program Files\Fichiers communs\Adobe

[03/06/2007|20:05] C:\Program Files\Fichiers communs\Ahead

[06/06/2007|23:07] C:\Program Files\Fichiers communs\Designer

[28/10/2007|11:49] C:\Program Files\Fichiers communs\Droppix

[04/06/2007|17:18] C:\Program Files\Fichiers communs\InstallShield

[05/07/2007|15:52] C:\Program Files\Fichiers communs\Java

[28/10/2007|11:48] C:\Program Files\Fichiers communs\LightScribe

[08/04/2008|23:08] C:\Program Files\Fichiers communs\LogiShrd

[16/09/2007|23:31] C:\Program Files\Fichiers communs\Microsoft Shared

[24/05/2007|22:54] C:\Program Files\Fichiers communs\MSSoap

[25/05/2007|00:45] C:\Program Files\Fichiers communs\ODBC

[24/05/2007|22:54] C:\Program Files\Fichiers communs\Services

[25/05/2007|00:45] C:\Program Files\Fichiers communs\SpeechEngines

[16/07/2007|22:03] C:\Program Files\Fichiers communs\System

[03/02/2008|03:27] C:\Program Files\Fichiers communs\Wise Installation Wizard

--------------------\\ Process

( 57 Processus )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-27 01:06:56

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden files ...

C:\WINDOWS\System32\cssrss.exe 24400 bytes executable

C:\WINDOWS\System32\sysrest.sys 15328 bytes executable

C:\WINDOWS\System32\sysrest32.exe 23040 bytes executable

scan completed successfully

hidden processes: 0

hidden files: 21

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

[F:7098][D:45]-> C:\DOCUME~1\Thierry\LOCALS~1\Temp

[F:2188][D:0]-> C:\DOCUME~1\Thierry\Cookies

[F:16923][D:32]-> C:\DOCUME~1\Thierry\LOCALS~1\TEMPOR~1\content.IE5

--------------------\\ Fin du rapport a 1:08:29.67

thiemec · le 26 juillet 2008

2eme partie

SDFix: Version 1.208

Run by Thierry on 27/07/2008 at 01:33

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Checking Services :

Name :

sysrest.sys

Path :

\??\C:\WINDOWS\system32\sysrest.sys

sysrest.sys - Deleted

Restoring Default Security Values

Restoring Default Hosts File

Restoring Default Desktop Wallpaper

Restoring Default ScreenSaver value

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\SYSTEM32\PPHCGQ~1.EXE - Deleted

C:\WINDOWS\SYSTEM32\PHCGQ1~1.BMP - Deleted

C:\WINDOWS\SYSTEM32\BLPHCG~1.SCR - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\privacy_danger\index.htm - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\privacy_danger\images\capt.gif - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\privacy_danger\images\danger.jpg - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\privacy_danger\images\down.gif - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\privacy_danger\images\spacer.gif - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt10.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt11.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt13.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt14.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt15.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt16.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt17.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt18.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt19.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt1A.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt1C.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt1D.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt1E.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt1F.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt21.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt22.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt23.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt24.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt25.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt26.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt27.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt29.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt2A.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt2B.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt2C.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt2D.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt2E.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt2F.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt3.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt31.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt32.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt33.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt34.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt35.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt36.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt37.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt38.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt3A.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt3B.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt3C.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt3E.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt3F.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt4.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt41.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt42.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt44.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt47.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt48.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt49.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt4B.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt4C.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt4D.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt4F.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt5.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt52.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt6.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt7.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt8.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.tt9.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.ttA.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.ttB.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.ttC.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.ttD.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.ttE.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.ttF.tmp - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\.ttC.tmp.vbs - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\bindsrv2.exe.bat - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\dssc32.exe.bat - Deleted

C:\Program Files\.autoreg - Deleted

C:\Documents and Settings\Thierry\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\bindsrv2.exe.bat - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\removalfile.bat - Deleted

C:\DOCUME~1\Thierry\LOCALS~1\Temp\s1265.php.bat - Deleted

C:\WINDOWS\agpqlrfm.exe - Deleted

C:\WINDOWS\evgratsm.dll - Deleted

C:\WINDOWS\system32\cssrss.exe - Deleted

C:\WINDOWS\Temp\bca4e2da.$$$ - Deleted

C:\WINDOWS\Temp\ed47fa.$ - Deleted

C:\WINDOWS\Temp\fa56d7ec.$$$ - Deleted

C:\WINDOWS\system32\sysrest.sys - Deleted

Note - Files associated with the MBR Rootkit have been found on this system, to check the PC use the MBR Rootkit Detector by Gmer or CureIt by Dr.Web

Folder C:\DOCUME~1\Thierry\LOCALS~1\Temp\privacy_danger - Removed

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-27 01:40:15

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]

"TracesProcessed"=dword:0000009f

"TracesSuccessful"=dword:0000006f

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"

"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"

"M:\\eMule\\emule.exe"="M:\\eMule\\emule.exe:*:Enabled:eMule"

"D:\\emulette\\eMule\\emule.exe"="D:\\emulette\\eMule\\emule.exe:*:Enabled:eMule"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"C:\\Documents and Settings\\Thierry\\Local Settings\\Temp\\Rar$EX00.219\\emule\\eMule.exe"="C:\\Documents and Settings\\Thierry\\Local Settings\\Temp\\Rar$EX00.219\\emule\\eMule.exe:*:Enabled:eMule"

"C:\\Program Files\\Cyberlink\\PowerDirector Express\\PDX.exe"="C:\\Program Files\\Cyberlink\\PowerDirector Express\\PDX.exe:*:Enabled:CyberLink PowerDirector Express"

"C:\\Program Files\\Cyberlink\\PCM4Everio\\PCM4Everio.exe"="C:\\Program Files\\Cyberlink\\PCM4Everio\\PCM4Everio.exe:*:Enabled:CyberLink PowerCinema NE for Everio"

"C:\\Program Files\\Cyberlink\\PCM4Everio\\EverioService.exe"="C:\\Program Files\\Cyberlink\\PCM4Everio\\EverioService.exe:*:Enabled:CyberLink PowerCinema NE for Everio Resident Program"

"C:\\DOCUME~1\\Thierry\\LOCALS~1\\Temp\\pQcj.exe"="C:\\DOCUME~1\\Thierry\\LOCALS~1\\Temp\\pQcj.exe:*:Enabled:DHCP Client"

"C:\\WINDOWS\\system32\\cssrss.exe"="C:\\WINDOWS\\system32\\cssrss.exe:*:Enabled:DHCP Client"

"C:\\Documents and Settings\\Thierry\\Local Settings\\Temp\\.tt14.tmp"="C:\\Documents and Settings\\Thierry\\Local Settings\\Temp\\.tt14.tmp:*:Enabled:enable"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sun 28 Oct 2007 72 ..SH. --- "C:\WINDOWS\S27669A5F.tmp"

Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"

Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"

Thu 26 Jul 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

Fri 31 Aug 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"

Wed 16 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\BIT3.tmp"

Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\71fa8e4b1f1c72b0e3a5d30a0a049f55\BIT3.tmp"

Mon 16 Jul 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\dc58dd52590bc7e4adcfec0586c072ce\BIT8.tmp"

Finished!

thiemec · le 26 juillet 2008

nouveau hijack apres manoeuvre...virus toujours la...

ogfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:49:15, on 27/07/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

D:\Prog\avast\aswUpdSv.exe

D:\Prog\avast\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Cyberlink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Neuf\Kit\WiFi\9wifi.exe

D:\Prog\avast\ashDisp.exe

D:\prog\EnMixCPL.exe

D:\Prog\Winamp\winampa.exe

D:\PDVDServ.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\hphmon05.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\CyberLink\PCM4Everio\EverioService.exe

C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Logitech\QuickCam10\QuickCam10.exe

C:\WINDOWS\system32\lphcgq1j0eeqn.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe

C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\rhclq1j0eeqn\rhclq1j0eeqn.exe

C:\WINDOWS\system32\pphcgq1j0eeqn.exe