Plusieurs trojan m'enbetes

djidane · le 29 décembre 2008

Bonsoir à tous

,

j'ai été recemment infecté pas plusieurs trojan , qui me ralentissent le PC et qui me font apparaitre des pop-up...

Voilà , si quelque pouvait m'aider ^^

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:53:36, on 29/12/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\MESSAG~1\StartMessager.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Logitech\Video\LogiTray.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Thrustmaster\FunAccess\PSPAP.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\PROGRA~1\Wanadoo\CnxMon.exe

C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

C:\PROGRA~1\Wanadoo\TaskbarIcon.exe

C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS\windsvc.exe

C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Logitech\Video\FxSvr2.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\internet explorer\iexplore.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe

C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe

C:\PROGRA~1\Wanadoo\ComComp.exe

C:\PROGRA~1\Wanadoo\Watch.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\Explorer.exe

L:\Mes documents\Images et autres\Bazar\Utilitaire\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\mchost.exe"

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,"C:\WINDOWS\mchost.exe",

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Microsoft copyright - {32C620D6-CC10-4e6a-9715-BACACD5B0E61} - ckds16.dll (file missing)

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll

O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\khfDspPj.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [MessagerStarter Wanadoo] C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [PSPAP] C:\Program Files\Thrustmaster\FunAccess\PSPAP.exe min

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe

O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe

O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe

O4 - HKLM\..\Run: [btTray] "C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [windsvc] windsvc.exe

O4 - HKLM\..\Run: [AutoUpdate_1] C:\WINDOWS\winlogon.exe

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [settings] C:\WINDOWS\mchost.exe

O4 - HKCU\..\Policies\Explorer\Run: [settings] C:\WINDOWS\mchost.exe

O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'Default user')

O4 - Startup: PowerReg Scheduler.exe

O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Envoyer via Bluetooth - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm

O8 - Extra context menu item: Envoyer via message(&M)... - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm

O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/fichier...ion_3_0_4_0.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=24931

O17 - HKLM\System\CCS\Services\Tcpip\..\{372487D2-0708-43A4-A7B0-C23CF98F861A}: NameServer = 80.10.246.130 81.253.149.10

O17 - HKLM\System\CS1\Services\Tcpip\..\{372487D2-0708-43A4-A7B0-C23CF98F861A}: NameServer = 80.10.246.130 81.253.149.10

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\skype4com.dll

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll

O20 - Winlogon Notify: awttutTM - awttutTM.dll (file missing)

O20 - Winlogon Notify: geBuSIyV - geBuSIyV.dll (file missing)

O20 - Winlogon Notify: khfDspPj - C:\WINDOWS\SYSTEM32\khfDspPj.dll

O21 - SSODL: WebProxy - {A744F16C-B2D5-4138-81A2-085CDFCDE83A} - ckds16.dll (file missing)

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe

O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe

O23 - Service: BsMobileCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 10407 bytes

angelique · le 29 décembre 2008

• relance HJT "do a system scan only" , coche uniquement et clic Fixchecked les lignes ci dessous:

F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\mchost.exe"

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,"C:\WINDOWS\mchost.exe",

O2 - BHO: Microsoft copyright - {32C620D6-CC10-4e6a-9715-BACACD5B0E61} - ckds16.dll (file missing)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [windsvc] windsvc.exe

O4 - HKLM\..\Run: [AutoUpdate_1] C:\WINDOWS\winlogon.exe

O4 - HKCU\..\Run: [settings] C:\WINDOWS\mchost.exe

O4 - HKCU\..\Policies\Explorer\Run: [settings] C:\WINDOWS\mchost.exe

O20 - Winlogon Notify: awttutTM - awttutTM.dll (file missing)

O20 - Winlogon Notify: geBuSIyV - geBuSIyV.dll (file missing)

O20 - Winlogon Notify: khfDspPj - C:\WINDOWS\SYSTEM32\khfDspPj.dll

O21 - SSODL: WebProxy - {A744F16C-B2D5-4138-81A2-085CDFCDE83A} - ckds16.dll (file missing)

==> clic Fixchecked

• Télécharge combofix.exe (par sUBs) et sauvegarde le sur ton bureau

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

http://www.forospyware.com/sUBs/ComboFix.exe

http://subs.geekstogo.com/ComboFix.exe

* Double-clique combofix.exe, accepte le CluF qui s'affiche, la console de reparation est proposée à ton choix choix à l'installation , afin de l'exécuter et suis les instructions.Ton Kaspersky peut empecher le deroulement de ComboFix , donc desactive l'av temporairement

* Lorsque l'analyse sera complétée, un rapport apparaîtra que tu me posteras.

* Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

djidane · le 29 décembre 2008

ComboFix 08-12-28.04 - Maison Botte 2008-12-29 18:27:06.1 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1535.815 [GMT 1:00]

Lancé depuis: c:\documents and settings\Maison Botte\Bureau\ComboFix.exe

* Un nouveau point de restauration a été créé

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\MAISON~1\LOCALS~1\Temp\service.exe

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb

c:\windows\IE4 Error Log.txt

c:\windows\system32\khfDspPj.dll

c:\windows\system32\rnaph.dll

c:\windows\system32\sft.res

c:\windows\winlogon.exe

c:\windows\youtubex.dll

----- BITS: Il y a peut-être des sites infectés -----

hxxp://dealsforfun.com

.

((((((((((((((((((((((((((((( Fichiers créés du 2008-11-28 au 2008-12-29 ))))))))))))))))))))))))))))))))))))

.

2008-12-29 16:14 . 2008-12-29 16:14 90,242 --a------ c:\windows\DSC00133.zip

2008-12-29 16:14 . 2008-12-29 16:14 90,242 --a------ c:\windows\DSC00116.zip

2008-12-29 16:14 . 2008-12-29 16:14 90,242 --a------ c:\windows\DSC00107.zip

2008-12-29 16:14 . 2008-12-29 16:14 90,242 --a------ c:\windows\DSC00102.zip

2008-12-29 16:14 . 2008-12-29 16:14 90,242 --a------ c:\windows\DSC00012.zip

2008-12-29 16:14 . 2008-12-29 16:14 90,242 --a------ c:\windows\DSC00006.zip

2008-12-29 16:14 . 2008-12-29 16:14 90,242 --a------ c:\windows\DSC00001.zip

2008-12-29 14:49 . 2008-12-29 14:49 96,976 --a------ c:\windows\system32\drivers\klin.dat

2008-12-29 14:49 . 2008-12-29 14:49 87,855 --a------ c:\windows\system32\drivers\klick.dat

2008-12-29 14:48 . 2008-12-29 14:48 <REP> d-------- c:\program files\Kaspersky Lab

2008-12-29 14:48 . 2008-12-29 18:32 <REP> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab

2008-12-29 14:48 . 2008-12-29 18:29 32 --ahs---- c:\windows\system32\drivers\fidbox2.idx

2008-12-29 14:48 . 2008-12-29 18:29 32 --ahs---- c:\windows\system32\drivers\fidbox2.dat

2008-12-29 14:48 . 2008-12-29 18:29 32 --ahs---- c:\windows\system32\drivers\fidbox.idx

2008-12-29 14:48 . 2008-12-29 18:29 32 --ahs---- c:\windows\system32\drivers\fidbox.dat

2008-12-29 14:07 . 2008-12-29 14:07 203 --a------ c:\windows\GSdx9.INI

2008-12-29 11:15 . 2008-12-29 11:15 90,112 --a------ C:\filledout.exe

2008-12-29 09:58 . 2008-12-29 09:58 <REP> d-------- C:\VundoFix Backups

2008-12-29 09:57 . 2008-12-29 09:57 3,048,982 --a------ C:\upload_moi_XPSP2-FCDDCF03A.tar.gz

2008-12-29 09:52 . 2008-12-29 09:52 <REP> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files

2008-12-28 15:48 . 2008-12-28 15:48 90,242 --a------ c:\windows\DSC00130.zip

2008-12-28 15:48 . 2008-12-28 15:48 90,242 --a------ c:\windows\DSC00121.zip

2008-12-28 15:48 . 2008-12-28 15:48 90,242 --a------ c:\windows\DSC00113.zip

2008-12-28 15:48 . 2008-12-28 15:48 90,242 --a------ c:\windows\DSC00106.zip

2008-12-28 15:48 . 2008-12-29 16:14 90,242 --a------ c:\windows\DSC00034.zip

2008-12-28 15:48 . 2008-12-28 15:48 90,242 --a------ c:\windows\DSC00008.zip

2008-12-28 15:48 . 2008-12-28 15:48 90,242 --a------ c:\windows\DSC00005.zip

2008-12-28 15:48 . 2008-12-28 15:48 90,242 --a------ c:\windows\DSC00003.zip

2008-12-28 15:48 . 2008-12-29 17:02 77,824 --a------ C:\aom4144.exe

2008-12-28 15:48 . 2008-12-29 16:14 64,558 --a------ c:\windows\pic0382.zip

2008-12-28 15:47 . 2008-12-28 15:47 90,112 -r-hs---- c:\windows\windsvc.exe

2008-12-28 15:47 . 2008-12-28 15:47 90,112 --a------ C:\fildfe45fd.exe

2008-12-28 14:57 . 2008-12-28 14:57 268 --ah----- C:\sqmdata02.sqm

2008-12-28 14:57 . 2008-12-28 14:57 244 --ah----- C:\sqmnoopt02.sqm

2008-12-28 14:28 . 2008-12-11 17:33 344,064 -rahs---- c:\documents and settings\Maison Botte\Application Data\mchost.exe

2008-12-28 14:27 . 2008-12-11 17:33 344,064 -rahs---- c:\windows\mchost.exe

2008-12-18 13:31 . 2008-12-29 16:55 <REP> d-------- c:\program files\Pcsx2_0.9.4

2008-12-17 17:27 . 2008-12-17 17:27 <REP> d-------- c:\program files\CSO-DAX Compressor

2008-12-15 14:35 . 2008-12-15 14:36 <REP> d--h----- c:\windows\msdownld.tmp

2008-12-15 14:35 . 2008-12-15 14:35 <REP> d-------- c:\windows\Logs

2008-12-15 14:35 . 2008-12-15 14:37 <REP> d-------- c:\program files\VBAM

2008-12-15 01:10 . 2008-12-15 01:10 8,192 --a------ c:\windows\d3dx.dat

2008-12-14 22:40 . 2008-12-14 22:57 <REP> d-------- c:\program files\WinAce

2008-12-14 22:25 . 2008-12-14 22:25 <REP> d-------- c:\program files\CCleaner

2008-12-11 12:30 . 2008-12-11 12:30 248 --a------ c:\windows\RomeTW.ini

2008-12-11 12:18 . 2008-12-11 12:18 <REP> d-------- c:\program files\Activision

2008-12-10 17:03 . 2008-12-10 17:03 <REP> d-------- c:\documents and settings\Maison Botte\My Games

2008-12-10 17:03 . 2008-12-10 17:03 <REP> d-------- c:\documents and settings\All Users\Microsoft

2008-12-09 16:18 . 2008-12-09 16:18 <REP> d-------- c:\windows\system32\QuickTime

2008-12-09 16:18 . 2008-12-09 16:19 <REP> d-------- c:\program files\QuickTime

2008-12-09 16:18 . 2008-12-20 00:24 <REP> d-------- c:\documents and settings\All Users\Application Data\QuickTime

2008-12-09 16:18 . 1999-11-10 12:05 86,016 --a------ c:\windows\unvise32qt.exe

2008-12-09 16:18 . 2008-12-09 16:21 575 --a------ c:\windows\BADMOJO.INI

2008-12-08 16:19 . 2008-12-08 16:19 1,226 --a------ c:\windows\system32\SHORTCUT.INI

2008-12-08 16:19 . 2008-12-08 16:31 130 --a------ c:\windows\system32\REMOTEDEVICE.INI

2008-12-08 16:18 . 2008-12-29 18:31 5,982 --a------ c:\windows\system32\LOCALSERVICE.INI

2008-12-08 16:18 . 2008-12-08 16:31 107 --a------ c:\windows\system32\LOCALDEVICE.INI

2008-12-08 16:16 . 2008-12-08 16:16 0 --a------ c:\windows\system32\BSPRINT.INI

2008-12-08 16:15 . 2008-12-08 16:15 <REP> d-------- c:\program files\IVT Corporation

2008-12-08 16:15 . 2008-12-08 16:16 32 --a------ c:\windows\0

2008-12-08 16:15 . 2008-12-08 16:15 0 --a------ c:\windows\system32\0

2008-12-04 12:03 . 2008-12-04 12:03 <REP> d-------- c:\program files\vixy.net

2008-12-03 21:41 . 2008-12-03 21:41 <REP> d-------- c:\documents and settings\Maison Botte\Application Data\Media Player Classic

2008-11-29 22:38 . 2007-06-21 09:53 32,768 --a------ c:\windows\system32\mf.dll

2008-11-29 21:11 . 2008-11-29 21:11 <REP> d-------- c:\documents and settings\botte\Bureau

2008-11-29 21:11 . 2008-11-29 21:11 <REP> d-------- c:\documents and settings\botte

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-29 17:25 --------- d-----w c:\program files\Wanadoo

2008-12-29 13:03 --------- d-----w c:\documents and settings\Maison Botte\Application Data\Azureus

2008-12-28 20:20 --------- d-----w c:\documents and settings\Maison Botte\Application Data\Skype

2008-12-28 17:07 --------- d-----w c:\documents and settings\Maison Botte\Application Data\dvdcss

2008-12-28 15:37 --------- d-----w c:\documents and settings\Maison Botte\Application Data\skypePM

2008-12-11 11:31 11,973 ----a-w c:\windows\system32\drivers\secdrv.sys

2008-12-11 11:31 --------- d--h--w c:\program files\InstallShield Installation Information

2008-11-28 17:13 --------- d-----w c:\documents and settings\Maison Botte\Application Data\Leadertech

2008-11-26 13:50 --------- d-----w c:\program files\DAEMON Tools Lite

2008-11-26 13:47 717,296 ----a-w c:\windows\system32\drivers\sptd.sys

2008-11-26 13:47 --------- d-----w c:\documents and settings\Maison Botte\Application Data\DAEMON Tools

2008-11-26 13:38 451,072 ----a-w c:\windows\uninstall.exe

2008-11-23 22:19 --------- d-----w c:\program files\SHARP

2008-11-23 14:24 --------- d-----w c:\program files\Azureus

2008-11-20 17:58 --------- d-----w c:\program files\Lavalys

2008-11-19 22:52 22 ----a-w c:\windows\system32\drivers\adidsl.cfg

2008-11-19 22:52 --------- d-----w c:\program files\SAGEM

2008-11-18 14:53 --------- d-----w c:\program files\7-Zip

2008-11-17 21:33 --------- d-----w c:\program files\Oxin's Style!

2008-11-17 20:15 --------- d-----w c:\program files\Microsoft IntelliPoint

2008-11-17 20:02 --------- d-----w c:\program files\IDETOOL

2008-11-17 20:01 --------- d-----w c:\program files\VIA

2008-11-17 20:01 --------- d-----w c:\program files\Fichiers communs\InstallShield

2008-11-17 19:53 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

2008-11-17 19:53 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf

2008-11-17 19:52 --------- d-----w c:\program files\Microsoft IntelliType Pro

2008-11-17 19:51 --------- d-----w c:\program files\MSXML 6.0

2008-11-17 19:42 --------- d-----w c:\program files\ma-config.com

2008-11-17 19:42 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com

2008-11-16 22:45 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

2008-11-16 22:44 --------- d-----w c:\program files\Lavasoft

2008-11-16 22:43 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard

2008-11-16 10:58 --------- d-----w c:\program files\MSXML 4.0

2008-11-14 13:15 --------- d-----w c:\program files\Microsoft.NET

2008-11-14 12:55 --------- d-----w c:\program files\HP

2008-11-14 12:47 --------- d-----w c:\program files\Fichiers communs\HP

2008-11-14 12:46 --------- d-----w c:\program files\Hewlett-Packard

2008-11-14 12:46 --------- d-----w c:\documents and settings\All Users\Application Data\Hewlett-Packard

2008-11-14 12:44 --------- d-----w c:\program files\Fichiers communs\Hewlett-Packard

2008-11-13 18:30 --------- d-----w c:\documents and settings\Maison Botte\Application Data\vlc

2008-11-12 21:06 --------- d-----w c:\program files\Thrustmaster

2008-11-12 21:00 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!

2008-11-12 20:59 --------- d-----w c:\program files\Satsuki Decoder Pack

2008-11-12 20:58 --------- d-----w c:\program files\Intel Desktop Board

2008-11-12 20:31 --------- d-----w c:\program files\Realtek AC97

2008-11-12 20:04 --------- d-----w c:\program files\Java

2008-11-12 19:36 --------- d-----w c:\program files\VIA Technologies, Inc

2008-11-12 19:35 --------- d-----w c:\program files\Realtek Sound Manager

2008-11-12 19:35 --------- d-----w c:\program files\AvRack

2008-11-12 19:30 --------- d-----w c:\program files\Windows Live

2008-11-12 19:30 --------- d-----w c:\program files\MSN Messenger

2008-11-12 19:30 --------- d-----w c:\program files\Messenger Plus! Live

2008-11-12 19:26 --------- d-----w c:\program files\Fichiers communs\Ahead

2008-11-12 19:26 --------- d-----w c:\program files\Ahead

2008-11-12 19:22 --------- d-----w c:\program files\Logitech

2008-11-12 19:22 --------- d-----w c:\program files\Fichiers communs\FotoWire

2008-11-12 19:22 --------- d-----w c:\documents and settings\Maison Botte\Application Data\FotoWire

2008-11-12 19:20 --------- d-----w c:\program files\Fichiers communs\Logitech

2008-11-12 19:12 --------- d-----w c:\program files\Skype

2008-11-12 19:12 --------- d-----w c:\program files\Fichiers communs\Skype

2008-11-12 19:12 --------- d-----w c:\documents and settings\All Users\Application Data\Skype

2008-11-12 19:09 --------- d-----w c:\program files\Fichiers communs\Adobe

2008-11-12 19:08 --------- d-----w c:\program files\Alwil Software

2008-11-12 19:07 --------- d-----w c:\program files\VideoLAN

2008-11-12 18:56 --------- d-----w c:\program files\Messager Wanadoo

2008-11-12 18:46 --------- d-----w c:\program files\microsoft frontpage

2008-11-12 18:45 --------- d-----w c:\program files\Services en ligne

2008-11-11 18:58 25,601 ----a-w c:\windows\system32\drivers\klopp.dat

.

------- Sigcheck -------

2008-04-13 20:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\SoftwareDistribution\Download\7a1946fba2b8886ae6be37be6d51ae57\tcpip.sys

2006-02-14 20:56 359808 667192a11db19f36624119c0dd4de4f2 c:\windows\system32\drivers\tcpip.sys

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]

"settings"="c:\windows\mchost.exe" [2008-12-11 344064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MessagerStarter Wanadoo"="c:\progra~1\MESSAG~1\StartMessager.exe" [2003-04-04 32768]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-05-27 221184]

"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]

"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-12 136600]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]

"PSPAP"="c:\program files\Thrustmaster\FunAccess\PSPAP.exe" [2007-02-02 2990080]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]

"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]

"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]

"WooCnxMon"="c:\progra~1\Wanadoo\CnxMon.exe" [2003-05-23 24576]

"WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2003-05-23 20480]

"WOOTASKBARICON"="c:\progra~1\Wanadoo\TaskbarIcon.exe" [2003-05-23 53248]

"BtTray"="c:\program files\IVT Corporation\BlueSoleil\BtTray.exe" [2008-11-01 281600]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-12-09 98304]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-11-11 206088]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 c:\windows\soundman.exe]

"nwiz"="nwiz.exe" [2008-05-03 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nlsf"="move" [X]

"Config"="c:\windows\system32\run.cmd" [2006-02-14 248]

"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544]

[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]

"settings"="c:\windows\mchost.exe" [2008-12-11 344064]

c:\documents and settings\Maison Botte\Menu D‚marrer\Programmes\D‚marrage\

PowerReg Scheduler.exe [2008-11-28 233472]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-11-19 954475]

D‚marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"MemCheckBoxInRunDlg"= 1 (0x1)

"NoSMBalloonTip"= 1 (0x1)

"NoWelcomeScreen"= 1 (0x1)

"NoStrCmpLogical"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"MemCheckBoxInRunDlg"= 1 (0x1)

"NoSMBalloonTip"= 1 (0x1)

"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Shell"="Explorer.exe \"c:\\WINDOWS\\mchost.exe\""

"Userinit"="c:\\WINDOWS\\system32\\userinit.exe,\"c:\\WINDOWS\\mchost.exe\","

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"DisablePagingExecutive"=dword:00000001

"SecondLevelDataCache"=dword:00000200

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\MSN Messenger\\livecall.exe"=

"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\Drivers\BtHidBus.sys [2008-07-31 20616]

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]

R0 viadsk;viadsk;c:\windows\system32\DRIVERS\viadsk.sys [2003-06-19 56576]

R2 BsMobileCS;BsMobileCS;c:\program files\IVT Corporation\BlueSoleil\BsMobileCS.exe [2008-11-01 143467]

R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\Drivers\IvtBtBus.sys [2008-07-02 26248]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]

S3 maconfservice;Ma-Config Service;"c:\program files\ma-config.com\maconfservice.exe" [2008-11-17 195752]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0eef35d7-b0fb-11dd-9aad-4d6564696130}]

\Shell\AutoRun\command - e9ehn1m8.com

\Shell\explore\Command - e9ehn1m8.com

\Shell\open\Command - e9ehn1m8.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ca4b5ac-b4e4-11dd-9ac0-4d6564696130}]

\Shell\AutoRun\command - e9ehn1m8.com

\Shell\explore\Command - e9ehn1m8.com

\Shell\open\Command - e9ehn1m8.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8770aad4-bb09-11dd-bb0f-4d6564696130}]

\Shell\AutoRun\command - ipy.cmd

\Shell\explore\Command - ipy.cmd

\Shell\open\Command - ipy.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}]

rundll32 ckds16.dll,InitModule

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{NQQ5L861-82LC-FV28-BC5R-EK164PT2UCAG}]

"c:\windows\mchost.exe"

.

Contenu du dossier 'Tâches planifiées'

2008-11-18 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job

- c:\program files\Microsoft IntelliPoint\ipoint.exe [2008-06-10 12:56]

2008-11-17 c:\windows\Tasks\Microsoft_Hardware_Launch_IType_exe.job

- c:\program files\Microsoft IntelliType Pro\itype.exe [2008-06-10 12:56]

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.wanadoo.fr

uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Envoyer via Bluetooth - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm

IE: Envoyer via message(&M)... - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm

O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://fichiers.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_3_0_4_0.cab

c:\windows\Downloaded Program Files\hardwaredetection.inf

FF - ProfilePath - c:\documents and settings\Maison Botte\Application Data\Mozilla\Firefox\Profiles\on84c6p2.default\

FF - prefs.js: browser.startup.homepage - www.google.fr

FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPPandBr.dll

.

**************************************************************************

disk not found C:\

please note that you need administrator rights to perform deep scan

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés:

**************************************************************************

.

------------------------ Autres processus actifs ------------------------

.

c:\program files\Lavasoft\Ad-Aware\aawservice.exe

c:\program files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\MDM.EXE

c:\windows\system32\nvsvc32.exe

c:\program files\IVT Corporation\BlueSoleil\BsHelpCS.exe

c:\program files\Logitech\Video\FxSvr2.exe

c:\windows\system32\rundll32.exe

c:\program files\HP\Digital Imaging\bin\hpqgalry.exe

c:\program files\Internet Explorer\IEXPLORE.EXE

.

**************************************************************************

.

Heure de fin: 2008-12-29 18:35:00 - La machine a redémarré

ComboFix-quarantined-files.txt 2008-12-29 17:34:55

Avant-CF: 81 092 698 112 octets libres

Après-CF: 81,423,286,272 octets libres

314 --- E O F --- 2008-12-21 11:49:56

angelique · le 29 décembre 2008

• ouvre ton bloc note[executer--notepad] et copies/colles TOUT le contenu du cadre ci dessous:

File::
c:\windows\DSC00133.zip
c:\windows\DSC00116.zip
c:\windows\DSC00107.zip
c:\windows\DSC00102.zip
c:\windows\DSC00012.zip
c:\windows\DSC00006.zip
c:\windows\DSC00001.zip
C:\filledout.exe
c:\windows\DSC00130.zip
c:\windows\DSC00121.zip
c:\windows\DSC00113.zip
c:\windows\DSC00106.zip
c:\windows\DSC00034.zip
c:\windows\DSC00008.zip
c:\windows\DSC00005.zip
c:\windows\DSC00003.zip
C:\aom4144.exe
c:\windows\pic0382.zip
c:\windows\windsvc.exe
C:\fildfe45fd.exe
C:\sqmdata02.sqm
C:\sqmnoopt02.sqm
c:\documents and settings\Maison Botte\Application Data\mchost.exe
c:\windows\mchost.exe
c:\windows\unvise32qt.exe
c:\windows\mchost.exe
Folder::
c:\program files\Alwil Software
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"settings"=-
[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"settings"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="Explorer.exe"
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0eef35d7-b0fb-11dd-9aad-4d6564696130}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ca4b5ac-b4e4-11dd-9ac0-4d6564696130}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8770aad4-bb09-11dd-bb0f-4d6564696130}]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{NQQ5L861-82LC-FV28-BC5R-EK164PT2UCAG}]

[*]Va en haut de la page et clique sur le menu"Fichier" , une liste apparait=>

[*]Choisis "Enregistrer sous" et choisis "Bureau"

[*]Dans le champs "Nom du fichier" en bas de page donne le nom suivant:CFScript

[*]Clique sur le bouton "Enregistrer" à droite du champs "nom du fichier"

[*]Quitte le Bloc Notes.

[*]Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture

* suis les instructions

* Patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

* Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

djidane · le 29 décembre 2008

ComboFix 08-12-28.04 - Maison Botte 2008-12-29 19:24:37.2 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1535.946 [GMT 1:00]

Lancé depuis: c:\documents and settings\Maison Botte\Bureau\ComboFix.exe

Commutateurs utilisés :: c:\documents and settings\Maison Botte\Bureau\CFScript.txt

* Un nouveau point de restauration a été créé

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

FILE ::

C:\aom4144.exe

c:\documents and settings\Maison Botte\Application Data\mchost.exe

C:\fildfe45fd.exe

C:\filledout.exe

C:\sqmdata02.sqm

C:\sqmnoopt02.sqm

c:\windows\DSC00001.zip

c:\windows\DSC00003.zip

c:\windows\DSC00005.zip

c:\windows\DSC00006.zip

c:\windows\DSC00008.zip

c:\windows\DSC00012.zip

c:\windows\DSC00034.zip

c:\windows\DSC00102.zip

c:\windows\DSC00106.zip

c:\windows\DSC00107.zip

c:\windows\DSC00113.zip

c:\windows\DSC00116.zip

c:\windows\DSC00121.zip

c:\windows\DSC00130.zip

c:\windows\DSC00133.zip

c:\windows\mchost.exe

c:\windows\pic0382.zip

c:\windows\unvise32qt.exe

c:\windows\windsvc.exe

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\aom4144.exe

c:\documents and settings\Maison Botte\Application Data\mchost.exe

C:\fildfe45fd.exe

C:\filledout.exe

c:\program files\Alwil Software

c:\program files\Alwil Software\Avast4\Setup\setup.ini