rapport shaman91

shaman91 · le 9 février 2006

Bonjours à tous,

je vous envoie mon rapport hijackthis afin que quelqu'un puisse m'indiquer si mon pc est sain ou infecté. je soupçonne des intrusions et particulièrement sur l'application eee2.exe. Merci par avance de votre aide et de vos précieux conseils à venir.

Logfile of HijackThis v1.99.1

Scan saved at 23:23:49, on 07/02/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE

C:\windows\eee2.exe

C:\WINDOWS\CTHELPER.EXE

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Tweak-XP Pro 4\AdBlocker.exe

C:\Program Files\Antipub\antipub.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\System32\svchost.exe

D:\Karim\Téléchargement\eMule\emule.exe

C:\Program Files\Spyware Doctor\swdoctor.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Outlook Express\msimn.exe

D:\Karim\SoS PC\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE

O4 - HKLM\..\Run: [ahmb] c:\windows\eee2.exe

O4 - HKLM\..\Run: [TIAP] C:\windows\eee2.exe

O4 - HKLM\..\Run: [ahkw] C:\windows\eee2.exe

O4 - HKLM\..\Run: [wahm] C:\windows\eee2.exe

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [29HA] C:\windows\eee2.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit

O4 - HKCU\..\Run: [spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q

O4 - HKCU\..\Run: [blockAds] "C:\Program Files\Tweak-XP Pro 4\AdBlocker.exe"

O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe

O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present

O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1138800432654

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/hardwaredetection.cab

O20 - Winlogon Notify: BITS - C:\WINDOWS\system32\en42l1ho1.dll

O20 - Winlogon Notify: DateTime - C:\WINDOWS\system32\f02mlaf11d2.dll (file missing)

O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

O23 - Service: Microsoft Network Service (Network) - Unknown owner - C:\WINDOWS\msnet32.exe (file missing)

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe

O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

Thanos · le 10 février 2006

salut shaman91

Plusieurs infections d'apres le rapport:

Commence par détecter et effacer les fichiers relatifs au spyware L2M comme ceci=>

1)-Télécharge L2mfix (de Shadowwar) de l'un de ces liens :

http://www.atribune.org/downloads/l2mfix.exe

http://www.downloads.subratam.org/l2mfix.exe

Sauvegarde-le sur ton Bureau et double-clique l2mfix.exe. Clique sur le bouton Install pour en extraire le contenu et suis les directives, puis ouvre le nouveau dossier "l2mfix" qui se trouve sur le Bureau. Double-clique l2mfix.bat et choisis l'option #1 pour Run Find Log en tapant 1 et ensuite Entrée. Le scan débutera sans générer d'indications, puis, après une minute ou deux, un fichier texte apparaîtra. Copie/colle le contenu de ce rapport ("report.txt") dans ta prochaine réponse.

Par contre, si une erreur s'affiche en lançant l'option #1, similaire à ceci : ''C:\windows\system32\cmd.exe

C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. Choose close to terminate the application.."...alors utilise l'option #5 ou le lien web fourni dans le dossier "l2mfix" afin de résoudre cette erreur. Ne pas lancer d'autres options avant d'avoir réglé ce pépin.

2)-Ferme toutes les applications en cours, car cette étape nécessite un redémarrage.

Du dossier l2mfix situé sur ton Bureau, double-clique l2mfix.bat et choisis l'option #2 pour Run Fix en tapant 2 et ensuite "Entrée". Les icônes du Bureau vont disparaître (tout à fait normal). L2mfix poursuivra le scan et lorsque terminé, il sera prêt à redémarrer le PC. Appuie sur n'importe quelle touche pour redémarrer. Après le redémarrage, un fichier texte devrait apparaître. Copie/colle le contenu de ce rapport dans ta prochaine réponse

IMPORTANT: NE PAS lancer d'autres fichiers situés dans le dossier "l2mfix" sans l'avis d'un conseiller ! Ne pas lancer cet outil en mode Sans Échec !!

**Si le fichier texte (rapport) n'apparaît pas au redémarrage, double-clique sur le fichier texte ("log.txt") situé dans le dossier "l2mfix".

shaman91 · le 10 février 2006

Merci pour ta réponse et voici :

le 1er report :

L2MFIX find log 010406

These are the registry keys present

**********************************************************************************

Winlogon/notify:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Controls Folder]

"Asynchronous"=dword:00000000

"DllName"="C:\\WINDOWS\\system32\\mvl0l93m1.dll"

"Impersonate"=dword:00000000

"Logon"="WinLogon"

"Logoff"="WinLogoff"

"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]

"Asynchronous"=dword:00000000

"Impersonate"=dword:00000000

"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\

6c,00,00,00

"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]

"Asynchronous"=dword:00000000

"Impersonate"=dword:00000000

"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]

"DLLName"="cscdll.dll"

"Logon"="WinlogonLogonEvent"

"Logoff"="WinlogonLogoffEvent"

"ScreenSaver"="WinlogonScreenSaverEvent"

"Startup"="WinlogonStartupEvent"

"Shutdown"="WinlogonShutdownEvent"

"StartShell"="WinlogonStartShellEvent"

"Impersonate"=dword:00000000

"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DateTime]

"Asynchronous"=dword:00000000

"DllName"="C:\\WINDOWS\\system32\\f02mlaf11d2.dll"

"Impersonate"=dword:00000000

"Logon"="WinLogon"

"Logoff"="WinLogoff"

"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Dynamic Directory]

"Asynchronous"=dword:00000000

"DllName"="C:\\WINDOWS\\system32\\i660lgjm16oa.dll"

"Impersonate"=dword:00000000

"Logon"="WinLogon"

"Logoff"="WinLogoff"

"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]

"DLLName"="wlnotify.dll"

"Logon"="SCardStartCertProp"

"Logoff"="SCardStopCertProp"

"Lock"="SCardSuspendCertProp"

"Unlock"="SCardResumeCertProp"

"Enabled"=dword:00000001

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]

"Asynchronous"=dword:00000000

"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Impersonate"=dword:00000000

"StartShell"="SchedStartShell"

"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]

"Logoff"="WLEventLogoff"

"Impersonate"=dword:00000000

"Asynchronous"=dword:00000001

"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]

"DLLName"="WlNotify.dll"

"Lock"="SensLockEvent"

"Logon"="SensLogonEvent"

"Logoff"="SensLogoffEvent"

"Safe"=dword:00000001

"MaxWait"=dword:00000258

"StartScreenSaver"="SensStartScreenSaverEvent"

"StopScreenSaver"="SensStopScreenSaverEvent"

"Startup"="SensStartupEvent"

"Shutdown"="SensShutdownEvent"

"StartShell"="SensStartShellEvent"

"PostShell"="SensPostShellEvent"

"Disconnect"="SensDisconnectEvent"

"Reconnect"="SensReconnectEvent"

"Unlock"="SensUnlockEvent"

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]

"Asynchronous"=dword:00000000

"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Impersonate"=dword:00000000

"Logoff"="TSEventLogoff"

"Logon"="TSEventLogon"

"PostShell"="TSEventPostShell"

"Shutdown"="TSEventShutdown"

"StartShell"="TSEventStartShell"

"Startup"="TSEventStartup"

"MaxWait"=dword:00000258

"Reconnect"="TSEventReconnect"

"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]

"DLLName"="wlnotify.dll"

"Logon"="RegisterTicketExpiredNotificationEvent"

"Logoff"="UnregisterTicketExpiredNotificationEvent"

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

**********************************************************************************

useragent:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

"{DF8DF131-F5D4-F07C-4567-7C8969C0FA16}"=""

**********************************************************************************

Shell Extension key:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"

"{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"

"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"

"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"

"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"

"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"

"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"

"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage ?cran du Panneau de configuration"

"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"

"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"

"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"

"{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"

"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"

"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"

"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"

"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"

"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"

"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"

"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"

"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"

"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"

"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"

"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"

"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"

"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"

"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"

"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"

"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"

"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"

"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"

"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"

"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"

"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"

"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"

"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"

"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"

"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"

"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"

"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extension de l'interpr‚teur de commande pour Windows Script Host"

"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"

"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"

"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"

"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"

"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"

"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"

"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"

"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"

"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."

"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"

"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"

"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"

"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"

"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"

"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"

"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"

"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"

"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"

"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"

"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"

"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="?tat du t‚l‚chargement"

"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"

"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"

"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"

"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"

"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"

"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"

"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"

"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"

"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"

"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"

"{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"

"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"

"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"

"{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"

"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"

"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"

"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"

"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"

"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"

"{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"

"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"

"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"

"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"

"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"

"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"

"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"

"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"

"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"

"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"

"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"

"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"

"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"

"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"

"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"

"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"

"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"

"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"

"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"

"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"

"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"

"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"

"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"

"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"

"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"

"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"

"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"

"{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"

"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"

"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"

"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"

"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"

"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"

"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"

"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"

"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"

"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"

"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"

"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"

"{0B124F8F-91F0-11D1-B8B5-006008059382}"="?num‚rateur d'applications install‚es"

"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"

"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"

"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"

"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"

"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"

"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"

"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"

"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"

"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"

"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"

"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"

"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"

"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"

"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"

"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"

"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"

"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"

"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"

"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"

"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"

"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"

"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"

"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"

"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"

"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"

"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"

"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"

"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"

"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"

"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"

"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"

"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"

"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"

"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"

"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"

"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"

"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"

"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"

"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"

"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"

"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"

"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"

"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"

"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."

"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"

"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"

"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"

"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Explorateur de Bureau"

"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"

"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"

"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"

"{5207B4CC-057E-44A5-9E7E-E403B0612D02}"=""

"{D9872D13-7651-4471-9EEE-F0A00218BEBB}"="Multiscan"

"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"

"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"

"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"

"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"

"{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band"

"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"

"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"

"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"

"{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"="TuneUp Shredder Shell Context Menu Extension"

"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"="Shell Extension for Malware scanning"

"{30BA1945-A5EB-4A25-A514-F90EA0B20D42}"=""

"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"

"{1A8CBCF6-6684-4A23-A4EA-F41BC4700666}"=""

**********************************************************************************

HKEY ROOT CLASSIDS:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{30BA1945-A5EB-4A25-A514-F90EA0B20D42}]

@=""

[HKEY_CLASSES_ROOT\CLSID\{30BA1945-A5EB-4A25-A514-F90EA0B20D42}\Implemented Categories]

@=""

[HKEY_CLASSES_ROOT\CLSID\{30BA1945-A5EB-4A25-A514-F90EA0B20D42}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]

@=""

[HKEY_CLASSES_ROOT\CLSID\{30BA1945-A5EB-4A25-A514-F90EA0B20D42}\InprocServer32]

@="C:\\WINDOWS\\system32\\mjieftp.dll"

"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{1A8CBCF6-6684-4A23-A4EA-F41BC4700666}]

@=""

[HKEY_CLASSES_ROOT\CLSID\{1A8CBCF6-6684-4A23-A4EA-F41BC4700666}\Implemented Categories]

@=""

[HKEY_CLASSES_ROOT\CLSID\{1A8CBCF6-6684-4A23-A4EA-F41BC4700666}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]

@=""

[HKEY_CLASSES_ROOT\CLSID\{1A8CBCF6-6684-4A23-A4EA-F41BC4700666}\InprocServer32]

@="C:\\WINDOWS\\system32\\dmcpsapi.dll"

"ThreadingModel"="Apartment"

**********************************************************************************

Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\

a3d.dll Thu 8 Dec 2005 12:17:46 A.... 33 792 33,00 K

ac3api.dll Thu 8 Dec 2005 12:15:16 A.... 26 624 26,00 K

aqicap32.dll Wed 8 Feb 2006 17:18:00 ..S.R 233 868 228,39 K

avsda.dll Wed 18 Jan 2006 13:06:02 A.... 57 344 56,00 K

browseui.dll Thu 24 Nov 2005 1:08:34 A.... 1 022 976 999,00 K

commonfx.dll Thu 8 Dec 2005 11:58:10 A.... 87 552 85,50 K

ctagent.dll Thu 8 Dec 2005 12:06:10 A.... 7 168 7,00 K

ctasio.dll Thu 8 Dec 2005 11:55:38 A.... 73 728 72,00 K

ctaudfx.dll Thu 8 Dec 2005 11:58:14 A.... 536 576 524,00 K

ctburst.dll Thu 8 Dec 2005 12:24:52 A.... 38 400 37,50 K

ctcoinst.dll Thu 8 Dec 2005 12:23:16 A.... 81 920 80,00 K

ctdc0000.dll Thu 8 Dec 2005 12:05:50 A.... 190 976 186,50 K

ctdc0001.dll Thu 8 Dec 2005 12:05:50 A.... 286 208 279,50 K

ctdcifce.dll Thu 8 Dec 2005 12:05:50 A.... 129 536 126,50 K

ctdproxy.dll Thu 8 Dec 2005 11:55:34 A.... 71 168 69,50 K

ctdvinst.dll Thu 8 Dec 2005 12:23:16 A.... 146 432 143,00 K

cteapsfx.dll Thu 8 Dec 2005 11:58:30 A.... 157 696 154,00 K

ctedasio.dll Thu 8 Dec 2005 11:55:40 A.... 47 616 46,50 K

ctedspfx.dll Thu 8 Dec 2005 11:55:50 A.... 269 824 263,50 K

ctedspio.dll Thu 8 Dec 2005 11:55:56 A.... 115 200 112,50 K

ctedspsy.dll Thu 8 Dec 2005 11:58:08 A.... 317 952 310,50 K

ctemupia.dll Thu 8 Dec 2005 11:58:58 A.... 106 496 104,00 K

ctmmep.dll Thu 8 Dec 2005 12:06:08 A.... 11 776 11,50 K

ctosuser.dll Thu 8 Dec 2005 11:54:48 A.... 129 024 126,00 K

ctpcmcia.dll Thu 8 Dec 2005 12:06:08 A.... 30 208 29,50 K

ctpres.dll Thu 8 Dec 2005 12:05:54 A.... 9 216 9,00 K

ctsblfx.dll Thu 8 Dec 2005 11:58:38 A.... 548 352 535,50 K

ctscal.dll Thu 8 Dec 2005 12:05:52 A.... 75 264 73,50 K

ctspkhlp.dll Thu 8 Dec 2005 12:06:10 A.... 23 552 23,00 K

ctthxcal.dll Thu 8 Dec 2005 12:05:52 A.... 64 000 62,50 K

ct_oal.dll Thu 8 Dec 2005 11:55:40 A.... 119 808 117,00 K

devreg.dll Thu 8 Dec 2005 11:51:54 A.... 47 104 46,00 K

divx.dll Wed 18 Jan 2006 20:47:36 A.... 574 976 561,50 K

dmcpsapi.dll Fri 10 Feb 2006 17:21:46 ..S.R 234 202 228,71 K

dpl100.dll Mon 26 Dec 2005 22:35:12 A.... 86 016 84,00 K

dpu11.dll Fri 6 Jan 2006 17:34:58 A.... 294 912 288,00 K

dpugui11.dll Fri 6 Jan 2006 17:35:00 A.... 593 920 580,00 K

dpus11.dll Fri 6 Jan 2006 17:34:58 A.... 339 968 332,00 K

dtu100.dll Fri 6 Jan 2006 17:35:00 A.... 200 704 196,00 K

dynwsock.dll Wed 8 Feb 2006 22:14:22 ..S.R 234 202 228,71 K

ff_vfw.dll Thu 22 Dec 2005 21:31:16 A.... 6 144 6,00 K

g6lm0g~1.dll Sat 4 Feb 2006 11:29:44 ..S.R 233 687 228,21 K

gdi32(2).dll Thu 29 Dec 2005 3:56:04 A.... 280 064 273,50 K

gdi32.dll Thu 29 Dec 2005 3:56:04 A.... 280 064 273,50 K

gp4ml3~1.dll Sat 4 Feb 2006 12:56:00 ..S.R 234 830 229,32 K

i660lg~1.dll Fri 10 Feb 2006 13:37:42 ..S.R 234 202 228,71 K

igircl.dll Sat 4 Feb 2006 12:43:46 ..S.R 233 687 228,21 K

ijetcplc.dll Sat 4 Feb 2006 14:43:42 ..S.R 233 687 228,21 K

imsins~2.dll Tue 15 Nov 2005 0:35:56 A.... 30 384 29,67 K

imslsp~3.dll Tue 15 Nov 2005 0:31:14 A.... 2 807 560 2,68 M

ir60l5~1.dll Sat 4 Feb 2006 14:53:46 ..S.R 234 895 229,39 K

ir8sl5~1.dll Sat 4 Feb 2006 1:21:20 ..S.R 237 332 231,77 K

irlol5~1.dll Wed 8 Feb 2006 22:06:56 ..S.R 233 868 228,39 K

irlql5~1.dll Fri 10 Feb 2006 17:21:46 ..S.R 235 737 230,21 K

irmontr.dll Wed 8 Feb 2006 21:02:28 ..S.R 234 202 228,71 K

l42sle~1.dll Sat 4 Feb 2006 14:16:38 ..S.R 235 747 230,22 K

libdivx.dll Fri 6 Jan 2006 17:17:36 A.... 1 044 480 1020,00 K

libeay~2.dll Tue 15 Nov 2005 0:31:46 A.... 796 336 777,67 K

m4rm0e~1.dll Sun 5 Feb 2006 12:50:26 ..S.R 234 227 228,73 K

mshtml.dll Thu 24 Nov 2005 1:08:36 A.... 3 013 632 2,87 M

openal32.dll Thu 8 Dec 2005 12:08:40 A.... 51 200 50,00 K

pathon~1.dll Tue 7 Feb 2006 17:20:52 ..S.R 233 868 228,39 K

piaproxy.dll Thu 8 Dec 2005 11:54:34 A.... 73 728 72,00 K

pncrt.dll Sun 5 Feb 2006 15:00:22 A.... 278 528 272,00 K

pndx5016.dll Sun 5 Feb 2006 15:00:24 A.... 6 656 6,50 K

pndx5032.dll Sun 5 Feb 2006 15:00:24 A.... 5 632 5,50 K

ppdlib32.dll Wed 8 Feb 2006 14:51:26 ..S.R 234 202 228,71 K

qt-dx331.dll Fri 6 Jan 2006 17:35:00 A.... 3 596 288 3,43 M

rmoc3260.dll Tue 15 Nov 2005 9:38:10 A.... 176 167 172,04 K

sfman32.dll Thu 8 Dec 2005 11:54:46 A.... 21 504 21,00 K

sfms32.dll Thu 8 Dec 2005 11:54:44 A.... 120 832 118,00 K

shdocvw.dll Thu 1 Dec 2005 5:01:16 A.... 1 492 992 1,42 M

ssldivx.dll Fri 6 Jan 2006 17:17:36 A.... 200 704 196,00 K

swsbkup.dll Sat 4 Feb 2006 21:40:38 ..S.R 235 186 229,67 K

vp7vfw.dll Fri 2 Dec 2005 16:42:38 A.... 630 784 616,00 K

vsdata.dll Tue 15 Nov 2005 0:50:30 A.... 83 720 81,76 K

vsinit.dll Tue 15 Nov 2005 0:50:42 A.... 141 064 137,76 K

vsmonapi.dll Tue 15 Nov 2005 0:50:52 A.... 104 208 101,77 K

vspubapi.dll Tue 15 Nov 2005 0:50:56 A.... 227 088 221,77 K

vsregexp.dll Tue 15 Nov 2005 0:51:00 A.... 71 440 69,77 K

vsutil.dll Tue 15 Nov 2005 0:51:12 A.... 382 728 373,76 K

vsxml.dll Tue 15 Nov 2005 0:51:20 ..... 100 104 97,76 K

wiweb.dll Wed 8 Feb 2006 22:04:56 ..S.R 233 868 228,39 K

wrap_oal.dll Thu 8 Dec 2005 12:12:52 A.... 212 480 207,50 K

xvidcore.dll Fri 30 Dec 2005 20:10:30 A.... 761 856 744,00 K

xvidvfw.dll Fri 30 Dec 2005 20:18:26 A.... 180 224 176,00 K

zlcomm.dll Tue 15 Nov 2005 0:51:40 A.... 79 624 77,76 K

zlcommdb.dll Tue 15 Nov 2005 0:51:44 A.... 71 440 69,77 K

88 items found: 88 files (19 H/S), 0 directories.

Total of file sizes: 28 739 136 bytes 27,41 M

Locate .tmp files:

No matches found.

**********************************************************************************

Directory Listing of system files:

Le volume dans le lecteur C n'a pas de nom.

Le num‚ro de s‚rie du volume est 60DB-92E5

R‚pertoire de C:\WINDOWS\System32

10/02/2006 17:21 234ÿ202 dmcpsapi.dll

10/02/2006 17:21 235ÿ737 irlql5351.dll

10/02/2006 13:37 234ÿ202 i660lgjm16oa.dll

08/02/2006 22:14 234ÿ202 dynwsock.dll

08/02/2006 22:12 <REP> dllcache

08/02/2006 22:06 233ÿ868 irlol5331.dll

08/02/2006 22:04 233ÿ868 wiweb.dll

08/02/2006 21:02 234ÿ202 irmontr.dll

08/02/2006 17:17 233ÿ868 aqicap32.dll

08/02/2006 14:51 234ÿ202 PPDLIB32.DLL

07/02/2006 17:20 233ÿ868 pathoncom21.dll

05/02/2006 12:50 234ÿ227 m4rm0e91eh.dll

04/02/2006 21:40 235ÿ186 swsbkup.dll

04/02/2006 14:53 234ÿ895 ir60l5jm1.dll

04/02/2006 14:43 233ÿ687 ijetcplc.dll

04/02/2006 14:16 235ÿ747 l42slef71h2.dll

04/02/2006 12:55 234ÿ830 gp4ml3h11.dll

04/02/2006 12:43 233ÿ687 igircl.dll

04/02/2006 11:29 233ÿ687 g6lm0g31e6.dll

04/02/2006 01:21 237ÿ332 ir8sl5l71.dll

31/01/2006 22:49 <REP> Microsoft

06/12/2000 13:02 209ÿ608 TABCTL32.OCX

05/05/1999 18:14 200ÿ704 THREED32.OCX

26/03/1999 00:00 101ÿ888 VB6STKIT.DLL

22 fichier(s) 4ÿ967ÿ697 octets

2 R‚p(s) 29ÿ183ÿ619ÿ072 octets libres

et le 2ème report :

L2mfix 010406

Creating Account.

La commande s'est termin‚e correctement.

Adding Administrative privleges.

Checking for L2MFix account(0=no 1=yes):

1

Granting SeDebugPrivilege to L2MFIX ... successful

Running From:

C:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03

Killing PID 500 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03

Killing PID 592 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03

Killing PID 236 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03

Killing PID 1320 'rundll32.exe'

Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrateurs ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!

1 fichier(s) copi‚(s).

Deleting: C:\WINDOWS\system32\aqicap32.dll

Successfully Deleted: C:\WINDOWS\system32\aqicap32.dll

Deleting: C:\WINDOWS\system32\dmcpsapi.dll

Successfully Deleted: C:\WINDOWS\system32\dmcpsapi.dll

Deleting: C:\WINDOWS\system32\dynwsock.dll

Successfully Deleted: C:\WINDOWS\system32\dynwsock.dll

Deleting: C:\WINDOWS\system32\g6lm0g31e6.dll

Successfully Deleted: C:\WINDOWS\system32\g6lm0g31e6.dll

Deleting: C:\WINDOWS\system32\gp4ml3h11.dll

Successfully Deleted: C:\WINDOWS\system32\gp4ml3h11.dll

Deleting: C:\WINDOWS\system32\i660lgjm16oa.dll

Successfully Deleted: C:\WINDOWS\system32\i660lgjm16oa.dll

Deleting: C:\WINDOWS\system32\igircl.dll

Successfully Deleted: C:\WINDOWS\system32\igircl.dll

Deleting: C:\WINDOWS\system32\ijetcplc.dll

Successfully Deleted: C:\WINDOWS\system32\ijetcplc.dll

Deleting: C:\WINDOWS\system32\ir60l5jm1.dll

Successfully Deleted: C:\WINDOWS\system32\ir60l5jm1.dll

Deleting: C:\WINDOWS\system32\ir8sl5l71.dll

Successfully Deleted: C:\WINDOWS\system32\ir8sl5l71.dll

Deleting: C:\WINDOWS\system32\irlol5331.dll

Successfully Deleted: C:\WINDOWS\system32\irlol5331.dll

Deleting: C:\WINDOWS\system32\irlql5351.dll

Successfully Deleted: C:\WINDOWS\system32\irlql5351.dll

Deleting: C:\WINDOWS\system32\irmontr.dll

Successfully Deleted: C:\WINDOWS\system32\irmontr.dll

Deleting: C:\WINDOWS\system32\l42slef71h2.dll

Successfully Deleted: C:\WINDOWS\system32\l42slef71h2.dll

Deleting: C:\WINDOWS\system32\m4rm0e91eh.dll

Successfully Deleted: C:\WINDOWS\system32\m4rm0e91eh.dll

Deleting: C:\WINDOWS\system32\pathoncom21.dll

Successfully Deleted: C:\WINDOWS\system32\pathoncom21.dll

Deleting: C:\WINDOWS\system32\PPDLIB32.DLL

Successfully Deleted: C:\WINDOWS\system32\PPDLIB32.DLL

Deleting: C:\WINDOWS\system32\swsbkup.dll

Successfully Deleted: C:\WINDOWS\system32\swsbkup.dll

Deleting: C:\WINDOWS\system32\wiweb.dll

Successfully Deleted: C:\WINDOWS\system32\wiweb.dll

msg11?.dll

0 fichier(s) copi‚(s).

Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:

****************************************************************************

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Controls Folder]

"Asynchronous"=dword:00000000

"DllName"="C:\\WINDOWS\\system32\\mvl0l93m1.dll"

"Impersonate"=dword:00000000

"Logon"="WinLogon"

"Logoff"="WinLogoff"

"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]

"Asynchronous"=dword:00000000

"Impersonate"=dword:00000000

"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\

6c,00,00,00

"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]

"Asynchronous"=dword:00000000

"Impersonate"=dword:00000000

"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]

"DLLName"="cscdll.dll"

"Logon"="WinlogonLogonEvent"

"Logoff"="WinlogonLogoffEvent"

"ScreenSaver"="WinlogonScreenSaverEvent"

"Startup"="WinlogonStartupEvent"

"Shutdown"="WinlogonShutdownEvent"

"StartShell"="WinlogonStartShellEvent"

"Impersonate"=dword:00000000

"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DateTime]

"Asynchronous"=dword:00000000

"DllName"="C:\\WINDOWS\\system32\\f02mlaf11d2.dll"

"Impersonate"=dword:00000000

"Logon"="WinLogon"

"Logoff"="WinLogoff"

"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Dynamic Directory]

"Asynchronous"=dword:00000000

"DllName"="C:\\WINDOWS\\system32\\i660lgjm16oa.dll"

"Impersonate"=dword:00000000

"Logon"="WinLogon"

"Logoff"="WinLogoff"

"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]

"DLLName"="wlnotify.dll"

"Logon"="SCardStartCertProp"

"Logoff"="SCardStopCertProp"

"Lock"="SCardSuspendCertProp"

"Unlock"="SCardResumeCertProp"

"Enabled"=dword:00000001

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]

"Asynchronous"=dword:00000000

"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Impersonate"=dword:00000000

"StartShell"="SchedStartShell"

"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]

"Logoff"="WLEventLogoff"

"Impersonate"=dword:00000000

"Asynchronous"=dword:00000001

"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]

"DLLName"="WlNotify.dll"

"Lock"="SensLockEvent"

"Logon"="SensLogonEvent"

"Logoff"="SensLogoffEvent"

"Safe"=dword:00000001

"MaxWait"=dword:00000258

"StartScreenSaver"="SensStartScreenSaverEvent"

"StopScreenSaver"="SensStopScreenSaverEvent"

"Startup"="SensStartupEvent"

"Shutdown"="SensShutdownEvent"

"StartShell"="SensStartShellEvent"

"PostShell"="SensPostShellEvent"

"Disconnect"="SensDisconnectEvent"

"Reconnect"="SensReconnectEvent"

"Unlock"="SensUnlockEvent"

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]

"Asynchronous"=dword:00000000

"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Impersonate"=dword:00000000

"Logoff"="TSEventLogoff"

"Logon"="TSEventLogon"

"PostShell"="TSEventPostShell"

"Shutdown"="TSEventShutdown"

"StartShell"="TSEventStartShell"

"Startup"="TSEventStartup"

"MaxWait"=dword:00000258

"Reconnect"="TSEventReconnect"

"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]

"DLLName"="wlnotify.dll"

"Logon"="RegisterTicketExpiredNotificationEvent"

"Logoff"="UnregisterTicketExpiredNotificationEvent"

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

The following are the files found:

****************************************************************************

C:\WINDOWS\system32\aqicap32.dll

C:\WINDOWS\system32\dmcpsapi.dll

C:\WINDOWS\system32\dynwsock.dll

C:\WINDOWS\system32\g6lm0g31e6.dll

C:\WINDOWS\system32\gp4ml3h11.dll

C:\WINDOWS\system32\i660lgjm16oa.dll

C:\WINDOWS\system32\igircl.dll

C:\WINDOWS\system32\ijetcplc.dll

C:\WINDOWS\system32\ir60l5jm1.dll

C:\WINDOWS\system32\ir8sl5l71.dll

C:\WINDOWS\system32\irlol5331.dll

C:\WINDOWS\system32\irlql5351.dll

C:\WINDOWS\system32\irmontr.dll

C:\WINDOWS\system32\l42slef71h2.dll

C:\WINDOWS\system32\m4rm0e91eh.dll

C:\WINDOWS\system32\pathoncom21.dll

C:\WINDOWS\system32\PPDLIB32.DLL

C:\WINDOWS\system32\swsbkup.dll

C:\WINDOWS\system32\wiweb.dll

Registry Entries that were Deleted:

Please verify that the listing looks ok.

If there was something deleted wrongly there are backups in the backreg folder.

****************************************************************************

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{30BA1945-A5EB-4A25-A514-F90EA0B20D42}]

@=""

[HKEY_CLASSES_ROOT\CLSID\{30BA1945-A5EB-4A25-A514-F90EA0B20D42}\Implemented Categories]

@=""

[HKEY_CLASSES_ROOT\CLSID\{30BA1945-A5EB-4A25-A514-F90EA0B20D42}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]

@=""

[HKEY_CLASSES_ROOT\CLSID\{30BA1945-A5EB-4A25-A514-F90EA0B20D42}\InprocServer32]

@="C:\\WINDOWS\\system32\\mjieftp.dll"

"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{1A8CBCF6-6684-4A23-A4EA-F41BC4700666}]

@=""

[HKEY_CLASSES_ROOT\CLSID\{1A8CBCF6-6684-4A23-A4EA-F41BC4700666}\Implemented Categories]

@=""

[HKEY_CLASSES_ROOT\CLSID\{1A8CBCF6-6684-4A23-A4EA-F41BC4700666}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]

@=""

[HKEY_CLASSES_ROOT\CLSID\{1A8CBCF6-6684-4A23-A4EA-F41BC4700666}\InprocServer32]

@="C:\\WINDOWS\\system32\\dmcpsapi.dll"

"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

"{5207B4CC-057E-44A5-9E7E-E403B0612D02}"=-

"{30BA1945-A5EB-4A25-A514-F90EA0B20D42}"=-

"{1A8CBCF6-6684-4A23-A4EA-F41BC4700666}"=-

[-HKEY_CLASSES_ROOT\CLSID\{5207B4CC-057E-44A5-9E7E-E403B0612D02}]

[-HKEY_CLASSES_ROOT\CLSID\{30BA1945-A5EB-4A25-A514-F90EA0B20D42}]

[-HKEY_CLASSES_ROOT\CLSID\{1A8CBCF6-6684-4A23-A4EA-F41BC4700666}]

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

"SV1"=""

****************************************************************************

Desktop.ini Contents:

****************************************************************************

Checking for L2MFix account(0=no 1=yes):

0

Zipping up files for submission:

adding: dlls/aqicap32.dll (164 bytes security) (deflated 4%)

adding: dlls/dmcpsapi.dll (164 bytes security) (deflated 5%)

adding: dlls/dynwsock.dll (164 bytes security) (deflated 5%)

adding: dlls/g6lm0g31e6.dll (164 bytes security) (deflated 4%)

adding: dlls/gp4ml3h11.dll (164 bytes security) (deflated 5%)

adding: dlls/i660lgjm16oa.dll (164 bytes security) (deflated 5%)

adding: dlls/igircl.dll (164 bytes security) (deflated 4%)

adding: dlls/ijetcplc.dll (164 bytes security) (deflated 4%)

adding: dlls/ir60l5jm1.dll (164 bytes security) (deflated 5%)

adding: dlls/ir8sl5l71.dll (164 bytes security) (deflated 6%)

adding: dlls/irlol5331.dll (164 bytes security) (deflated 4%)

adding: dlls/irlql5351.dll (164 bytes security) (deflated 5%)

adding: dlls/irmontr.dll (164 bytes security) (deflated 5%)

adding: dlls/l42slef71h2.dll (164 bytes security) (deflated 5%)

adding: dlls/m4rm0e91eh.dll (164 bytes security) (deflated 5%)

adding: dlls/pathoncom21.dll (164 bytes security) (deflated 4%)

adding: dlls/PPDLIB32.DLL (164 bytes security) (deflated 5%)

adding: dlls/swsbkup.dll (164 bytes security) (deflated 5%)

adding: dlls/wiweb.dll (164 bytes security) (deflated 4%)

adding: backregs/1A8CBCF6-6684-4A23-A4EA-F41BC4700666.reg (212 bytes security) (deflated 70%)

adding: backregs/30BA1945-A5EB-4A25-A514-F90EA0B20D42.reg (212 bytes security) (deflated 70%)

adding: backregs/notibac.reg (164 bytes security) (deflated 88%)

adding: backregs/shell.reg (164 bytes security) (deflated 73%)

Voilà merci des conseils que tu me communiqueras au regard de ces deux reports.

Jack_Burton · le 10 février 2006

Bonjour shaman & Charly

shaman91, peux tu poster un nouveau rapport hijackthis, merci

Modifié le 10 février 2006 par Jack_Burton

Mark · le 10 février 2006

Ok, l'infection Look2Me semble neutralisée !

Pourrais-tu poster un nouveau rapport HijackThis! s'il te plaît ? Merci..

Modifié le 10 février 2006 par Qc001

shaman91 · le 10 février 2006

Bonjour à vous merci encore de votre aide,

voici mon nouveau rapport . J'ai toujours des doutes sur l'application eee2.exe. Est-ce une bonne application car je n'ai pas souvenir l'avoir installé.

Logfile of HijackThis v1.99.1

Scan saved at 20:49:22, on 10/02/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE

C:\windows\eee2.exe

C:\WINDOWS\CTHELPER.EXE

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\WINDOWS\System32\alg.exe

D:\Karim\SoS PC\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE

O4 - HKLM\..\Run: [ahmb] c:\windows\eee2.exe

O4 - HKLM\..\Run: [TIAP] C:\windows\eee2.exe

O4 - HKLM\..\Run: [ahkw] C:\windows\eee2.exe

O4 - HKLM\..\Run: [wahm] C:\windows\eee2.exe

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [29HA] C:\windows\eee2.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize