Antivir xp 2008 la grosse tuille [RESOLU]

jkov · le 20 septembre 2008

Bonsoir à tous,

Je me suis fait prendre par la patrouille antivirxp2008 :'(

maintenant mon pc est incapable de télécharger un prgm .exe, de se connecter normalement sur le net ou meme d'ouvrir un simple dossier...

Je suis obligé d'utiliser le pc de secours alors par pitié AIDEZ MOI

Je vous poste les rapports hijack et DS

Merci d'avance pour l'aide que vous voudrez bien me donner ^^

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:44:01, on 20/09/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Safe mode

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\Documents and Settings\alexis\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll

O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll

O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe

O4 - HKLM\..\Run: [Zooming] ZoomingHook.exe

O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe

O4 - HKLM\..\Run: [TPSMain] TPSMain.exe

O4 - HKLM\..\Run: [TFncKy] TFncKy.exe

O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient

O4 - HKLM\..\Run: [startup Manager Scanner] C:\Program Files\Startup Mechanic\StartupMonitor.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE

O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe

O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe

O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)

O15 - Trusted Zone: http://www.secuser.com

O17 - HKLM\System\CCS\Services\Tcpip\..\{7CF5874A-6C21-4801-9198-03281623350D}: NameServer = 192.168.1.1

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--

End of file - 7470 bytes

Modifié le 22 septembre 2008 par jkov

Falkra · le 20 septembre 2008

Bonsoir, bienvenue.

Messages : 1

Si jamais tu as besoin de quelques infos :

Comment participer à un forum

Retrouver ses messages

Tu ne peux pas télécharger de programmes ?

Par exemple ce lien, si tu cliques ça fait quoi ?

Télécharge Malwarebytes' Anti-Malware (MBAM)

Double clique sur le fichier téléchargé pour lancer le processus d'installation.
Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
Sélectionne "Exécuter un examen rapide"
Clique sur "Rechercher"
L'analyse démarre, le scan est relativement long, c'est normal.
A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.
Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.

NB : Si MBAM te demande à redémarrer, fais-le.

jkov · le 20 septembre 2008

System Report

*************

Run on 20/09/2008 at 19:51

Microsoft Windows XP [version 5.1.2600]

Current user is an administrator

Running Processes:

\SystemRoot\System32\smss.exe [200]

\??\C:\WINDOWS\system32\csrss.exe [248]

\??\C:\WINDOWS\system32\winlogon.exe [272]

C:\WINDOWS\system32\services.exe [316]

C:\WINDOWS\system32\lsass.exe [328]

C:\WINDOWS\system32\svchost.exe [476]

C:\WINDOWS\system32\svchost.exe [564]

C:\WINDOWS\system32\svchost.exe [620]

C:\Program Files\Spyware Doctor\pctsAuxs.exe [676]

C:\Program Files\Spyware Doctor\pctsSvc.exe [736]

C:\WINDOWS\Explorer.EXE [924]

C:\WINDOWS\system32\igfxsrvc.exe [1348]

Drivers - Running:

ACPI

ACPIEC

ApfiltrService

atapi

Beep

Cdfs

Cdrom

Compbatt

Disk

drvmcdb

Fastfat

FltMgr

Ftdisk

GEARAspiWDM

i8042prt

IKFileSec

IKSysFlt

IKSysSec

Imapi

IntelIde

isapnp

Iviaspi

Kbdclass

KSecDD

meiudf

Mouclass

MountMgr

Msfs

mssmbios

Mup

NDIS

Npfs

Ntfs

Null

ohci1394

PartMgr

PCI

PCIIde

Pcmcia

Pfc

PxHelp20

redbook

sptd

sr

sscdbhk5

ssrtln

swenum

TermDD

Udfs

Update

usbehci

usbhub

USBSTOR

usbuhci

VgaSave

VolSnap

Drivers - Stopped:

Aavmker4

Abiosdsk

abp480n5

adpu160m

aec

AFD

AgereSoftModem

Aha154x

aic78u2

aic78xx

ALCXWDM

AliIde

amsint

Arp1394

asc

asc3350p

asc3550

aswFsBlk

aswMon2

aswRdr

aswSP

aswTdi

AsyncMac

Atdisk

ati2mtag

Atmarpc

audstub

avipbb

cbidf2k

cd20xrnt

Cdaudio

Changer

CmBatt

CmdIde

Cpqarray

dac960nt

dmboot

dmio

dmload

DMusic

dpti2o

drmkaud

drvnddm

Fdc

Fips

Flpydisk

Gpc

hpn

HTTP

i2omgmt

i2omp

ialm

ini910u

intelppm

Ip6Fw

IpFilterDriver

IpInIp

IpNat

IPSec

IRENUM

kmixer

lbrtfdc

mnmdd

Modem

mraid35x

MRxDAV

MRxSmb

MSKSSRV

MSPCLOCK

MSPQM

NdisTapi

Ndisuio

NdisWan

NDProxy

NetBIOS

NetBT

Netdevio

NIC1394

NwlnkFlt

NwlnkFwd

Parport

ParVdm

PCAMPR5

PCANDIS5

PCIDump

pcouffin

PDCOMP

PDFRAME

PDRELI

PDRFRAME

perc2

perc2hib

PptpMiniport

PSched

Ptilink

ql1080

Ql10wnt

ql12160

ql1240

ql1280

RasAcd

Rasl2tp

RasPppoe

Raspti

Rdbss

RDPCDD

RDPWD

RTL8023xp

rtl8139

sdbus

SE26bus

Secdrv

Serial

Sfloppy

Simbad

Sparrow

splitter

srescan

Srv

SrvcSSIOMngr

swmidi

symc810

symc8xx

sym_hi

sym_u3

sysaudio

Tcpip

TDPIPE

TDTCP

tfsnboio

tfsncofs

tfsndrct

tfsndres

tfsnifs

tfsnopio

tfsnpool

tfsnudf

tfsnudfa

tifm21

tmcomm

TosIde

tosrfec

TPwSav

Tvs

ultra

USBAAPL

ViaIde

vsdatant

w29n51

Wanarp

WDICA

wdmaud

Services - Running:

CryptSvc

DcomLaunch

Eventlog

helpsvc

PlugPlay

RpcSs

sdAuxService

sdCoreService

srservice

winmgmt

Services - Stopped:

Alerter

ALG

AntiVirScheduler

AntiVirService

Apple

AppMgmt

aspnet_state

aswUpdSv

Ati

AudioSrv

avast!

BITS

Bonjour

Browser

CFSvcs

CiSvc

ClipSrv

clr_optimization_v2.0.50727_32

COMSysApp

Dhcp

dmadmin

dmserver

Dnscache

DVD-RAM_Service

ERSvc

EventSystem

FastUserSwitchingCompatibility

FTRTSVC

gusvc

HidServ

HTTPFilter

ImapiService

iPod

lanmanserver

lanmanworkstation

LicCtrlService

LightScribeService

LmHosts

Messenger

mnmsrvc

MSDTC

MSIServer

NetDDE

NetDDEdsdm

Netlogon

Netman

Nla

NtLmSsp

NtmsSvc

ose

PolicyAgent

ProtectedStorage

RasAuto

RasMan

RDSessMgr

RemoteAccess

RpcLocator

RSVP

SamSs

SCardSvr

Schedule

seclogon

SENS

SharedAccess

ShellHWDetection

Spooler

SSDPSRV

StarWindService

stisvc

SwPrv

SysmonLog

TapiSrv

TermService

Themes

TrkWks

UMWdf

upnphost

UPS

usnjsvc

vsmon

VSS

W32Time

WebClient

WmdmPmSN

WmiApSrv

wscsvc

wuauserv

WZCSVC

xmlprov

Files Created/Modified - 60 Days:

C:\

4 Aug 2008 22:42:28 1 103 A.... "C:\anumanlive.log"

20 Sep 2008 19:39:02 1 610 612 736 A.SH. "C:\pagefile.sys"

20 Sep 2008 19:46:06 338 A.... "C:\rapport.txt"

C:\WINDOWS\

20 Sep 2008 18:41:12 0 A.... "C:\WINDOWS\0.log"

20 Sep 2008 19:39:28 2 048 A.S.. "C:\WINDOWS\bootstat.dat"

17 Sep 2008 19:22:10 3 204 A.... "C:\WINDOWS\mozver.dat"

20 Sep 2008 19:40:14 654 988 A.... "C:\WINDOWS\ntbtlog.txt"

20 Sep 2008 19:36:32 32 190 A.... "C:\WINDOWS\SchedLgU.Txt"

20 Sep 2008 18:16:30 240 A.... "C:\WINDOWS\setupact.log"

20 Sep 2008 1:10:38 7 468 A.... "C:\WINDOWS\setupapi.log"

19 Sep 2008 21:15:44 0 A.... "C:\WINDOWS\setuperr.log"

20 Sep 2008 19:36:28 883 A.... "C:\WINDOWS\WindowsUpdate.log"

20 Sep 2008 19:39:28 0 A.... "C:\WINDOWS\Debug\PASSWD.LOG"

4 Aug 2008 22:21:06 34 816 A.... "C:\WINDOWS\Internet Logs\ALEX.ldb"

4 Aug 2008 22:16:54 1 583 104 A.... "C:\WINDOWS\Internet Logs\BACKUP.RDB"

28 Jul 2008 18:02:08 22 A.... "C:\WINDOWS\Internet Logs\fwdbglog.txt"

20 Sep 2008 19:36:16 22 A.... "C:\WINDOWS\Internet Logs\fwpktlog.txt"

4 Aug 2008 22:21:06 1 583 104 A.... "C:\WINDOWS\Internet Logs\IAMDB.RDB"

28 Jul 2008 18:05:42 846 A.... "C:\WINDOWS\Internet Logs\installer_072808180117.log"

4 Aug 2008 22:21:30 11 432 935 A.... "C:\WINDOWS\Internet Logs\tvDebug.log"

28 Jul 2008 18:19:34 1 541 632 A.... "C:\WINDOWS\Internet Logs\xDB78.tmp"

30 Jul 2008 21:35:22 619 A.... "C:\WINDOWS\Internet Logs\ZALog2008.07.30.txt"

29 Jul 2008 3:07:58 1 968 A.... "C:\WINDOWS\Internet Logs\ZALog2008.07.28.txt"

28 Jul 2008 17:01:52 471 A.... "C:\WINDOWS\Internet Logs\ZALog2008.07.08.txt"

4 Aug 2008 20:07:58 573 A.... "C:\WINDOWS\Internet Logs\ZALog2008.07.31.txt"

30 Jul 2008 18:09:46 600 A.... "C:\WINDOWS\Internet Logs\ZALog2008.07.29.txt"

18 Aug 2008 12:19:04 82 432 A.... "C:\WINDOWS\system32\404Fix.exe"

8 Sep 2008 23:38:56 88 576 A.... "C:\WINDOWS\system32\AntiXPVSTFix.exe"

28 Jul 2008 22:54:02 3 121 A.... "C:\WINDOWS\system32\CONFIG.NT"

19 Sep 2008 12:26:48 82 944 A.... "C:\WINDOWS\system32\IEDFix.C.exe"

20 Sep 2008 19:34:48 5 169 A.SH. "C:\WINDOWS\system32\mmf.sys"

20 Sep 2008 18:08:04 62 678 A.... "C:\WINDOWS\system32\perfc009.dat"

20 Sep 2008 18:08:04 75 704 A.... "C:\WINDOWS\system32\perfc00C.dat"

20 Sep 2008 18:08:04 401 398 A.... "C:\WINDOWS\system32\perfh009.dat"

20 Sep 2008 18:08:04 468 728 A.... "C:\WINDOWS\system32\perfh00C.dat"

20 Sep 2008 18:08:04 1 018 888 A.... "C:\WINDOWS\system32\PerfStringBackup.INI"

17 Sep 2008 18:52:44 625 208 A.... "C:\WINDOWS\system32\phca9dj0ea69.bmp"

20 Sep 2008 18:15:56 2 300 A.... "C:\WINDOWS\system32\tmp.reg"

20 Sep 2008 18:15:56 0 A.... "C:\WINDOWS\system32\tmp.txt"

2 Sep 2008 16:51:48 86 528 A.... "C:\WINDOWS\system32\VACFix.exe"

28 Jul 2008 23:14:54 352 922 A.... "C:\WINDOWS\system32\vsconfig.xml"

19 Sep 2008 21:06:24 1 158 A.... "C:\WINDOWS\system32\wpa.dbl"

28 Jul 2008 18:25:42 4 212 ...H. "C:\WINDOWS\system32\zllictbl.dat"

20 Sep 2008 19:00:02 264 A..H. "C:\WINDOWS\Tasks\A2199CDB93061A6F.job"

20 Sep 2008 19:36:32 6 A..H. "C:\WINDOWS\Tasks\SA.DAT"

20 Sep 2008 7:15:02 334 A.... "C:\WINDOWS\Tasks\[Fansub-Academy]_Death_Note_21v2_VostFr.job"

20 Sep 2008 19:36:34 0 A.... "C:\WINDOWS\Temp\clbtempresp.tmp"

20 Sep 2008 19:47:50 11 074 A.... "C:\WINDOWS\Temp\scs4.tmp"

3 Aug 2008 18:37:50 473 600 A.... "C:\WINDOWS\World War 2 Road to Victory\uninstall.exe"

20 Sep 2008 18:41:12 329 A.... "C:\WINDOWS\system32\dla\DLA.INI"

17 Sep 2008 18:58:42 92 401 696 A.SH. "C:\WINDOWS\system32\drivers\fidbox.dat"

17 Sep 2008 18:58:42 1 087 040 A.SH. "C:\WINDOWS\system32\drivers\fidbox.idx"

28 Jul 2008 18:05:38 208 A.... "C:\WINDOWS\system32\ZoneLabs\streamapi.config.xml"

28 Jul 2008 18:04:30 212 A.... "C:\WINDOWS\system32\ZoneLabs\vsmon.config.xml"

28 Jul 2008 18:05:40 7 039 A.... "C:\WINDOWS\system32\ZoneLabs\ZLCommDB.xml"

28 Jul 2008 18:05:40 702 A.... "C:\WINDOWS\system32\ZoneLabs\ZoneAlarm.xml"

20 Sep 2008 19:35:08 0 A.... "C:\WINDOWS\Temp\_avast4_\Webshlock.txt"

20 Sep 2008 18:15:54 4 158 A.... "C:\WINDOWS\system32\drivers\etc\hosts"

17 Sep 2008 19:02:28 32 029 A.... "C:\WINDOWS\system32\Macromed\Flash\install.log"

28 Jul 2008 18:52:22 152 976 A.... "C:\WINDOWS\system32\ZoneLabs\lib\licenseui.zip.dll"

28 Jul 2008 23:29:34 9 473 A.... "C:\WINDOWS\system32\ZoneLabs\Updates\LocalCatalog.xml"

C:\Program Files\

20 Sep 2008 18:51:44 15 206 A.... "C:\Program Files\Alcohol Toolbar\settings.dat"

11 Sep 2008 19:17:04 13 952 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\AccessibleMarshal.dll"

11 Sep 2008 19:17:12 7 671 408 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\firefox.exe"

11 Sep 2008 19:17:12 200 829 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\freebl3.dll"

11 Sep 2008 19:17:14 458 856 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\js3250.dll"

11 Sep 2008 19:17:14 161 392 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\nspr4.dll"

11 Sep 2008 19:17:16 382 568 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\nss3.dll"

11 Sep 2008 19:17:16 276 080 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\nssckbi.dll"

11 Sep 2008 19:17:16 34 424 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\plc4.dll"

11 Sep 2008 19:17:16 30 320 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\plds4.dll"

11 Sep 2008 19:17:16 112 232 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\smime3.dll"

11 Sep 2008 19:17:18 254 060 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\softokn3.dll"

11 Sep 2008 19:17:18 136 808 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\ssl3.dll"

11 Sep 2008 19:17:18 132 232 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\updater.exe"

11 Sep 2008 19:17:18 13 416 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\xpcom.dll"

11 Sep 2008 19:17:18 73 848 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\xpcom_compat.dll"

11 Sep 2008 19:17:18 422 000 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\xpcom_core.dll"

11 Sep 2008 19:17:18 73 336 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\xpicleanup.exe"

11 Sep 2008 19:17:18 12 400 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\xpistub.dll"

19 Sep 2008 22:02:24 81 164 A.... "C:\Program Files\RogueRemover FREE\rules.dat"

19 Sep 2008 21:08:42 2 205 A.... "C:\Program Files\RogueRemover FREE\unins000.dat"

19 Sep 2008 21:08:24 691 481 A.... "C:\Program Files\RogueRemover FREE\unins000.exe"

18 Aug 2008 18:41:00 1 832 272 A.SHR "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"

23 Jul 2008 16:25:46 348 344 A.... "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe"

28 Jul 2008 15:38:18 528 606 A.... "C:\Program Files\Battlefront\Strategic Command 2 Patton Drives East Expansion\unins000.dat"

28 Jul 2008 15:35:00 695 642 A.... "C:\Program Files\Battlefront\Strategic Command 2 Patton Drives East Expansion\unins000.exe"

20 Sep 2008 7:22:44 2 A.... "C:\Program Files\eMule\config\AC_BootstrapIPs.dat"

20 Sep 2008 7:22:44 976 A.... "C:\Program Files\eMule\config\AC_SearchStrings.dat"

20 Sep 2008 7:22:44 702 A.... "C:\Program Files\eMule\config\AC_ServerMetURLs.dat"

20 Sep 2008 7:22:44 28 A.... "C:\Program Files\eMule\config\key_index.dat"

20 Sep 2008 7:22:44 5 772 A.... "C:\Program Files\eMule\config\load_index.dat"

20 Sep 2008 7:22:44 6 812 A.... "C:\Program Files\eMule\config\nodes.dat"

20 Sep 2008 7:22:48 61 A.... "C:\Program Files\eMule\config\preferences.dat"

20 Sep 2008 7:22:44 23 A.... "C:\Program Files\eMule\config\preferencesKad.dat"

20 Sep 2008 7:22:48 98 A.... "C:\Program Files\eMule\config\shareddir.dat"

20 Sep 2008 7:22:44 12 A.... "C:\Program Files\eMule\config\src_index.dat"

19 Sep 2008 23:04:52 7 140 A.... "C:\Program Files\Hattrick Buddy\dat\Club.dat"

19 Sep 2008 23:04:52 214 A.... "C:\Program Files\Hattrick Buddy\dat\Columns.dat"

19 Sep 2008 23:04:52 2 076 A.... "C:\Program Files\Hattrick Buddy\dat\Finance.dat"

19 Sep 2008 23:04:52 12 A.... "C:\Program Files\Hattrick Buddy\dat\Matches.dat"

19 Sep 2008 23:04:52 1 016 789 A.... "C:\Program Files\Hattrick Buddy\dat\Matches2.dat"

19 Sep 2008 23:04:52 46 638 A.... "C:\Program Files\Hattrick Buddy\dat\Players.dat"

19 Sep 2008 23:04:52 2 912 A.... "C:\Program Files\Hattrick Buddy\dat\Press.dat"

19 Sep 2008 23:04:52 61 A.... "C:\Program Files\Hattrick Buddy\dat\Stadium.dat"

11 Sep 2008 19:17:06 67 696 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\components\jar50.dll"

11 Sep 2008 19:17:06 54 376 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\components\jsd3250.dll"

11 Sep 2008 19:17:06 34 952 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\components\myspell.dll"

11 Sep 2008 19:17:06 46 720 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\components\spellchk.dll"

11 Sep 2008 19:17:08 172 144 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\components\xpinstal.dll"

11 Sep 2008 19:17:16 22 664 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\plugins\npnul32.dll"

11 Sep 2008 19:17:18 451 880 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\uninstall\helper.exe"

30 Jul 2008 20:08:48 501 709 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\help.francais.zip"

3 Sep 2008 23:16:10 86 761 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\includes.pups.zip"

17 Sep 2008 23:16:20 518 328 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\includes.trojans.zip"

3 Sep 2008 23:16:12 178 645 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\includes.spybots.zip"

17 Sep 2008 23:16:26 1 039 669 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\includes.zip"

3 Sep 2008 23:16:02 123 836 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\includes.dialer.zip"

3 Sep 2008 23:16:04 153 019 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\includes.hijackers.zip"

10 Sep 2008 23:16:06 75 787 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\includes.keyloggers.zip"

10 Sep 2008 23:16:08 414 714 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\includes.malware.zip"

23 Jul 2008 20:08:54 28 975 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\lang.francais.zip"

6 Aug 2008 23:16:28 291 043 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\mainapp160.zip"

17 Sep 2008 23:16:16 590 041 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\supplemental.zip"

20 Aug 2008 9:36:54 937 696 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\teatimer161.exe"

20 Aug 2008 23:16:30 908 195 A.... "C:\Program Files\Spybot - Search & Destroy\Updates\teatimer161.zip"

20 Sep 2008 19:36:22 188 600 A.... "C:\Program Files\Alwil Software\Avast4\DATA\aswar0.dll"

20 Sep 2008 19:36:22 391 216 A.... "C:\Program Files\Alwil Software\Avast4\DATA\clnr0.dll"

20 Sep 2008 19:36:22 273 592 A.... "C:\Program Files\Alwil Software\Avast4\DATA\dllcc0.dat"

20 Sep 2008 19:36:22 9 080 A.... "C:\Program Files\Alwil Software\Avast4\DATA\exts0.dll"

28 Jul 2008 22:53:52 70 766 A.... "C:\Program Files\Alwil Software\Avast4\DATA\iNews.htm"

28 Jul 2008 18:37:16 127 024 A.... "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll"

4 Aug 2008 22:40:50 4 608 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\.install4j\i4jdel.exe"

4 Aug 2008 22:40:50 106 496 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\.install4j\i4jinst.dll"

4 Aug 2008 22:40:50 245 408 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\.install4j\unicows.dll"

4 Aug 2008 22:40:50 22 528 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\.install4j\_shfoldr.dll"

4 Aug 2008 22:37:24 998 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\Welcome.html"

8 Aug 2008 14:51:06 1 148 176 A.... "C:\Program Files\Battlefront\Strategic Command 2 Patton Drives East Expansion\Misc\Battlefront.com.exe"

16 Aug 2008 20:14:38 2 490 851 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\data\save\1939.data"

9 Aug 2008 19:36:22 2 424 829 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\data\save\1941.data"

6 Aug 2008 23:33:00 2 428 951 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\data\save\1942.data"

17 Aug 2008 16:27:28 2 494 726 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\data\save\autosave.data"

17 Aug 2008 14:53:02 2 022 031 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\data\save\Default.data"

17 Aug 2008 14:53:36 2 194 772 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\data\scenario\1939.data"

17 Aug 2008 14:53:12 2 194 794 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\data\scenario\1940.data"

17 Aug 2008 14:53:16 2 189 743 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\data\scenario\1941.data"

17 Aug 2008 14:53:22 2 202 941 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\data\scenario\1942.data"

17 Aug 2008 14:53:28 2 201 943 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\data\scenario\1943.data"

17 Aug 2008 14:53:32 2 213 310 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\data\scenario\1944.data"

4 Aug 2008 22:37:26 1 343 589 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\awt.dll"

4 Aug 2008 22:37:26 94 321 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\axbridge.dll"

4 Aug 2008 22:37:26 192 613 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\cmm.dll"

4 Aug 2008 22:37:26 143 462 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\dcpr.dll"

4 Aug 2008 22:37:26 69 632 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\deploy.dll"

4 Aug 2008 22:37:26 32 872 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\dt_shmem.dll"

4 Aug 2008 22:37:26 28 778 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\dt_socket.dll"

4 Aug 2008 22:37:26 327 798 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\fontmanager.dll"

4 Aug 2008 22:37:26 32 878 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\hpi.dll"

4 Aug 2008 22:37:26 122 983 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\hprof.dll"

4 Aug 2008 22:37:26 57 466 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\instrument.dll"

4 Aug 2008 22:37:26 28 802 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\ioser12.dll"

4 Aug 2008 22:37:26 69 768 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\j2pkcs11.dll"

4 Aug 2008 22:37:26 24 698 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\jaas_nt.dll"

4 Aug 2008 22:37:26 118 890 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\java.dll"

4 Aug 2008 22:37:26 49 248 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\java.exe"

4 Aug 2008 22:37:26 45 171 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\javacpl.exe"

4 Aug 2008 22:37:26 53 346 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\javaw.exe"

4 Aug 2008 22:37:26 147 456 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\JavaWebStart.dll"

4 Aug 2008 22:37:26 32 881 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\java_crw_demo.dll"

4 Aug 2008 22:37:26 24 679 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\jawt.dll"

4 Aug 2008 22:37:26 53 365 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\JdbcOdbc.dll"

4 Aug 2008 22:37:26 200 800 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\jdwp.dll"

4 Aug 2008 22:37:26 127 079 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\jpeg.dll"

4 Aug 2008 22:37:26 86 129 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\jpicom32.dll"

4 Aug 2008 22:37:26 98 417 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\jpiexp32.dll"

4 Aug 2008 22:37:26 90 223 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\jpinscp.dll"

4 Aug 2008 22:37:26 49 266 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\jpioji.dll"

4 Aug 2008 22:37:26 77 937 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\jpishare.dll"

4 Aug 2008 22:37:26 147 567 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\jsound.dll"

4 Aug 2008 22:37:26 32 883 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\jsoundds.dll"

4 Aug 2008 22:37:26 251 648 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\jucheck.exe"

4 Aug 2008 22:37:26 75 520 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\jusched.exe"

4 Aug 2008 22:37:26 53 368 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\keytool.exe"

4 Aug 2008 22:37:26 53 364 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\kinit.exe"

4 Aug 2008 22:37:26 53 364 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\klist.exe"

4 Aug 2008 22:37:26 53 362 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\ktab.exe"

4 Aug 2008 22:37:26 32 897 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\management.dll"

4 Aug 2008 22:37:26 77 926 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\net.dll"

4 Aug 2008 22:37:26 36 967 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\nio.dll"

4 Aug 2008 22:37:26 69 743 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\NPJava11.dll"

4 Aug 2008 22:37:26 69 743 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\NPJava12.dll"

4 Aug 2008 22:37:26 69 743 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\NPJava13.dll"

4 Aug 2008 22:37:26 69 743 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\NPJava14.dll"

4 Aug 2008 22:37:26 69 743 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\NPJava32.dll"

4 Aug 2008 22:37:26 75 528 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\NPJPI150_12.dll"

4 Aug 2008 22:37:26 69 743 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\NPOJI610.dll"

4 Aug 2008 22:37:26 53 383 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\orbd.exe"

4 Aug 2008 22:37:26 53 376 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\pack200.exe"

4 Aug 2008 22:37:26 53 374 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\policytool.exe"

4 Aug 2008 22:37:26 151 665 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\RegUtils.dll"

4 Aug 2008 22:37:26 24 677 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\rmi.dll"

4 Aug 2008 22:37:26 53 362 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\rmid.exe"

4 Aug 2008 22:37:26 53 374 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\rmiregistry.exe"

4 Aug 2008 22:37:26 53 395 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\servertool.exe"

4 Aug 2008 22:37:26 440 056 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\ssv.dll"

4 Aug 2008 22:37:26 53 392 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\tnameserv.exe"

4 Aug 2008 22:37:26 245 400 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\unicows.dll"

4 Aug 2008 22:37:26 61 566 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\unpack.dll"

4 Aug 2008 22:37:26 127 101 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\unpack200.exe"

4 Aug 2008 22:37:26 49 252 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\verify.dll"

4 Aug 2008 22:37:26 24 694 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\w2k_lsa_auth.dll"

4 Aug 2008 22:37:26 61 547 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\zip.dll"

11 Sep 2008 19:17:08 99 840 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\extensions\talkback@mozilla.org\components\BrandRes.dll"

11 Sep 2008 19:17:10 156 544 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\extensions\talkback@mozilla.org\components\fullsoft.dll"

11 Sep 2008 19:17:10 14 456 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\extensions\talkback@mozilla.org\components\qfaservices.dll"

11 Sep 2008 19:17:10 407 040 A.... "C:\Program Files\Mozilla Firefox 2 Beta 2\extensions\talkback@mozilla.org\components\talkback.exe"

4 Aug 2008 22:37:26 1 622 137 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\bin\client\jvm.dll"

4 Aug 2008 22:37:26 16 801 A.... "C:\Program Files\Anuman Interactive\Commander - Europe At War\jre\lib\deploy\ffjcext.zip"

Files with hidden attributes:

Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"

Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"

Mon 18 Aug 2008 1,832,272 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"

Sat 20 Sep 2008 5,169 A.SH. --- "C:\WINDOWS\system32\mmf.sys"

Mon 1 Jan 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

Wed 5 Apr 2006 233,425 A..H. --- "C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Mods\MaxRigaModBTS1\Assets\XML\Technologies\~WRL0002.tmp"

Program Folders:

C:\Program Files\

2K Games

3wPlayer

Adobe

Alcohol Soft

Alcohol Toolbar

Alwil Software

Anuman Interactive

Apoint2K

Apple Software Update

ATI Technologies

Avira

Battlefront

Battlefront.com

Bonjour

CCleaner

CDBurnerXP Pro 3

ComPlus Applications

Disc2Phone

DivX

DVD-RAM

eMule

Fichiers communs

Forest

GameSpy

Google

HandballManager

Hattrick Buddy

InstallShield Installation Information

Intel

Internet Download Manager

Internet Explorer

InterVideo

iPod

iTunes

Java

K-Lite Codec Pack

Lavasoft

ltmoh

M Firaxis Games

Matrix Games

Messenger

microsoft frontpage

Microsoft Office

Microsoft Works

Microsoft.NET

Mindscape

Movie Maker

Mozilla Firefox 2 Beta 2

MSN

MSN Games

MSN Gaming Zone

MSN Messenger

MSN Toolbar Suite

Nero

NetMeeting

Notepad++

Offre Wanadoo

Online Services

Ontrack

OpenOffice.org 2.2

OpenTTD

Outlook Express

Panda Security

Paradox Interactive

PPLive

PPStream

RogueRemover FREE

SAGEM

Securitoo

Services en ligne

Sonic

Sony Ericsson

Soulseek

Spamihilator

Sports Interactive

Spybot - Search & Destroy

Spyware Doctor

Startup Mechanic

Steam

StofWare

SystemRequirementsLab

Toshiba

tvants

Uninstall Information

VideoLAN

VSO

Wanadoo

Winamp

Windows Media Lite

Windows Media Player

Windows NT

WindowsUpdate

WinRAR

WZebra

xerox

Xinox Software

xp-AntiSpy

Zero G Registry

Zone Labs

C:\Program Files\Fichiers communs\

Adobe

Ahead

Apple

AVSMedia

InstallShield

Java

LightScribe

Microsoft Shared

MSSoap

ODBC

Services

SpeechEngines

Synacast

System

Teleca Shared

Wise Installation Wizard

Add/Remove Programs:

je vais essayer

Merci

(ça va prendre un peu de temps vu que je jongle d'un pc à l'autre)

ps : je suis obligé de passer par le mode sans échec pour installer un prgm :s

Falkra · le 20 septembre 2008

Oublie SDFix, de toute façon ce n'est pas comme ça qu'il dot être utilisé.

Installe MBAM en mode sans échec (s'il n'y a que ça), et utilise-le en mode normal (mets-le à jour avant la recherche).

Question au passage : si tu installes un programe en mode normal il se passe quoi ? (écran bleu ? ça fige ? message ?).

jkov · le 20 septembre 2008

Oublie SDFix, de toute façon ce n'est pas comme ça qu'il dot être utilisé.

Installe MBAM en mode sans échec (s'il n'y a que ça), et utilise-le en mode normal (mets-le à jour avant la recherche).

Question au passage : si tu installes un programe en mode normal il se passe quoi ? (écran bleu ? ça fige ? message ?).

ça fige et en mode sans échec impossible d'accéder à internet

voici le rapport :

Malwarebytes' Anti-Malware 1.28

Version de la base de données: 1134

Windows 5.1.2600 Service Pack 2

20/09/2008 20:27:03

mbam-log-2008-09-20 (20-27-03).txt

Type de recherche: Examen rapide

Eléments examinés: 41842

Temps écoulé: 10 minute(s), 17 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 5

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 12

Fichier(s) infecté(s): 9

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhce9dj0ea69 (Rogue.Multiple) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\rhce9dj0ea69 (Rogue.Multiple) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

Dossier(s) infecté(s):

C:\Program Files\3wPlayer (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\alexis\Application Data\rhce9dj0ea69 (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\alexis\Application Data\rhce9dj0ea69\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\alexis\Application Data\rhce9dj0ea69\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\alexis\Application Data\rhce9dj0ea69\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\alexis\Application Data\rhce9dj0ea69\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\alexis\Application Data\rhce9dj0ea69\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\alexis\Application Data\rhce9dj0ea69\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\alexis\Application Data\rhce9dj0ea69\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\alexis\Application Data\rhce9dj0ea69\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\alexis\Application Data\rhce9dj0ea69\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\alexis\Application Data\rhce9dj0ea69\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):

C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\tdssserf.dll (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\phca9dj0ea69.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

jkov · le 20 septembre 2008

waouw tout semble refonctionné normalement

MERCI infiniment Falkra pour ton aide, c'est vraiment sympa de prendre de temps pour aider une nouille comme moi ^^

et félicitation au forum pour tous vos bons conseils

THANKS

Falkra · le 20 septembre 2008

On va essayer de régler le reste.

Redémarre, et poste un rapport HijackThis en mode normal stp.

jkov · le 20 septembre 2008

On va essayer de régler le reste.

Redémarre, et poste un rapport HijackThis en mode normal stp.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:33:43, on 21/09/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\WINDOWS\system32\DVDRAMSV.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\WINDOWS\runservice.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ltmoh\Ltmoh.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Apoint2K\Apoint.exe

C:\WINDOWS\system32\ZoomingHook.exe

C:\WINDOWS\system32\TCtrlIOHook.exe

C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Startup Mechanic\StartupMonitor.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Apoint2K\Apntex.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

C:\WINDOWS\system32\TPSBattM.exe

C:\Program Files\Messenger\Msmsgs.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\RAMASST.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Program Files\eMule\emule.exe

C:\Program Files\Mozilla Firefox 2 Beta 2\firefox.exe

C:\Program Files\Winamp\winamp.exe