INFECTION ADW_NaviPromo !!!! RESOLU
Dernière réponse : dans Sécurité
Bonjour à toutes et à tous et BONNE ANNEE !!
J'ai déjà lu plusieurs sujets concernant NaviPromo mais je pose quand même le mien car j'ai aussi lu des différences et les sujets dataient ... J'ai besoin que l'on me tienne la main sur ce coup là alors MERCI d'avance!
Je suis sous Windows 2000 pro pack4 avec trend micro PCcillin V.14, j'utilise aussi a2free,firefox et K9web (control parental.J'ai HiJackFree (que je ne sais pas utiliser).
Donc, depuis un moment déjà,Trend bloque l'accès à ADW_NaviPromo qui se trouve dans "C:/WINNT/System 32/msclock32.dll" bien que le fichier infecté (msclock32.dll) se supprime facilement, il revient toujours!En espérant qu'il n'y ai rien de plus...
Voilà, S.O.S et merci d'avance à tous pour votre aide !
Kalo
Autres pages sur : infection adw navipromo resolu
Lassé par la pub ? Créez un compte
Bonsoir,
Avant de commencer, lis la licence de Blacklight (F-Secure)
En lisant ce document, tu as pris connaissance et accepté les conditions d'utilisation de ce programme inclus dans Navilog1.zip.
Télécharge maintenant Navilog1.zip (Il Mafioso)
Enregistre-le sur ton Bureau.
Dézippe le contenu de l'archive en faisant un Clique droit sur Navilog1.zip puis en choisissant Tout Extraire.
Double clique sur Navilog1.bat.
Laisse-toi guider par l'utilitaire. Choisis l'option 1 puis valide.
! N'utilise pas l'option 2, 3 et 4 sans notre accord !
Patiente jusqu'à l'apparition de ce message :
"*** Analyse Termine le ..... ***"
Appuie sur une touche comme demandé. Le Bloc-notes va s'ouvrir. Poste-nous son contenu de cette manière :
-> Edition / Sélectionner tout
-> Edition / Copier
-> Clique-Droit / Coller dans ta réponse
NOTE : Le rapport se trouve également ici : C:\fixnavi.txt
Avant de commencer, lis la licence de Blacklight (F-Secure)
En lisant ce document, tu as pris connaissance et accepté les conditions d'utilisation de ce programme inclus dans Navilog1.zip.
Télécharge maintenant Navilog1.zip (Il Mafioso)
Enregistre-le sur ton Bureau.
Dézippe le contenu de l'archive en faisant un Clique droit sur Navilog1.zip puis en choisissant Tout Extraire.
Double clique sur Navilog1.bat.
Laisse-toi guider par l'utilitaire. Choisis l'option 1 puis valide.
! N'utilise pas l'option 2, 3 et 4 sans notre accord !
Patiente jusqu'à l'apparition de ce message :
"*** Analyse Termine le ..... ***"
Appuie sur une touche comme demandé. Le Bloc-notes va s'ouvrir. Poste-nous son contenu de cette manière :
-> Edition / Sélectionner tout
-> Edition / Copier
-> Clique-Droit / Coller dans ta réponse
NOTE : Le rapport se trouve également ici : C:\fixnavi.txt
Bonsoir Angeldark
Tout d'abord merci pour ta réponse super rapide!
J'ai lu puis télécharger et extrait Navilog1 comme tu ma l'a demandé sauf que je n'ai pas dans le dossier dézippé Navilog1.bat. mais juste Navilog1.
Lorsque je double clic dessus il me dit qu'il ne fonctionne que sous windows xp or je suis sous 2000 pro.
ouppsss ...
que faire?
je suis en congés jeudi et j'aurais alors du temps pour m'occuper au mieux de ce virus très très méchant !
merci à toi et bonne nuit !
kalo
Tout d'abord merci pour ta réponse super rapide!
J'ai lu puis télécharger et extrait Navilog1 comme tu ma l'a demandé sauf que je n'ai pas dans le dossier dézippé Navilog1.bat. mais juste Navilog1.
Lorsque je double clic dessus il me dit qu'il ne fonctionne que sous windows xp or je suis sous 2000 pro.
ouppsss ...
que faire?
je suis en congés jeudi et j'aurais alors du temps pour m'occuper au mieux de ce virus très très méchant !
merci à toi et bonne nuit !
kalo
Ok.
Tu n'es pas obligé de voir les extensions.
Les manipulations sont à faire sans interruption et dans l'ordre
Si tu ne comprends pas quelque chose, demande des explications avant de commencer.
Enregistre cette page pour avoir accès à la procédure en mode sans échec :
- Fichier
- Enregistrer Sous...
- Nom du fichier : Procédure
- Type : Page Web, complète
- Pour l'emplacement, chosis ton Bureau
- Clique maintenant sur Enregistrer
Télécharge :
Brute Force Uninstaller (de Merjin).
Créé un nouveau dossier directement sur le C:\ et nomme-le BFU. Décompresse le fichier téléchargé dans ce nouveau dossier (C:\BFU)
Navipromo.zip et décompresse-le sur ton bureau.
FAIS UN CLIQUE-DROIT ICI et choisis "Enregistrer la cible du lien sous..." afin de télécharger EGDACCESS.bfu (de Metallica). Sauvegarde-le dans le dossier créé (C:\BFU).
Tu dois maintenant avoir deux fichiers dans le dossier C:\BFU : EGDACCESS.bfu et BFU.exe (très important).
Note : Si tu utlises Internet Explorer; lors de la sauvegarde, assure-toi que le champs "Type :" affiche "Tous les fichiers".
AIDE : Comment installer et utiliser BFU ?
Redémarre en mode Sans Échec : au redémarrage, tapote immédiatement la touche F8; tu verras un écran avec choix de démarrages apparaître. Utilisant les flèches du clavier, choisis "Mode Sans Échec" et valide avec "Entrée". Choisis ton compte usuel, et non Administrateur.
Lance le fichier Navipromo.bat qui se trouve sur ton bureau dans le dossier Navipromo.
Sélectionne d'abord l'option "Vérifications", et patiente quelques minutes. Lorsqu'il a terminé, ferme le rapport qui s'est ouvert.
Sélectionne ensuite l'option "Recherche et suppression automatique" en tapant sur la touche R.
S'il trouve quelque chose, tu verras défiler des lignes dans la fenêtre de commande et au bout de quelques instants, il faudra que tu appuies sur une touche pour que le nettoyage soit lancé.
Démarre "Brute Force Uninstaller" en double-cliquant BFU.exe (du dossier C:\BFU)
- Clique sur le petit dossier jaune, à la droite de la boîte Scriptline to execute, et double-clique sur :
EGDACCESS.bfu
- Dans la boîte "Scriptline to execute", tu devrais maintenant voir ceci : C:\BFU\EGDACCESS.bfu
Clique sur Execute et laisse-le faire son travail.
Attends que Complete script execution apparaisse pour cliquer sur OK.
Clique Exit pour fermer le programme BFU.
Redémarre normalement.
Poste les rapports :
- Hijackthis
- C:\egd.txt
- C:\Navipromo.txt
Tu n'es pas obligé de voir les extensions.
Les manipulations sont à faire sans interruption et dans l'ordre
Si tu ne comprends pas quelque chose, demande des explications avant de commencer.
Enregistre cette page pour avoir accès à la procédure en mode sans échec :
- Fichier
- Enregistrer Sous...
- Nom du fichier : Procédure
- Type : Page Web, complète
- Pour l'emplacement, chosis ton Bureau
- Clique maintenant sur Enregistrer
Télécharge :
Brute Force Uninstaller (de Merjin).
Créé un nouveau dossier directement sur le C:\ et nomme-le BFU. Décompresse le fichier téléchargé dans ce nouveau dossier (C:\BFU)
Navipromo.zip et décompresse-le sur ton bureau.
FAIS UN CLIQUE-DROIT ICI et choisis "Enregistrer la cible du lien sous..." afin de télécharger EGDACCESS.bfu (de Metallica). Sauvegarde-le dans le dossier créé (C:\BFU).
Tu dois maintenant avoir deux fichiers dans le dossier C:\BFU : EGDACCESS.bfu et BFU.exe (très important).
Note : Si tu utlises Internet Explorer; lors de la sauvegarde, assure-toi que le champs "Type :" affiche "Tous les fichiers".
AIDE : Comment installer et utiliser BFU ?
Redémarre en mode Sans Échec : au redémarrage, tapote immédiatement la touche F8; tu verras un écran avec choix de démarrages apparaître. Utilisant les flèches du clavier, choisis "Mode Sans Échec" et valide avec "Entrée". Choisis ton compte usuel, et non Administrateur.
Lance le fichier Navipromo.bat qui se trouve sur ton bureau dans le dossier Navipromo.
Sélectionne d'abord l'option "Vérifications", et patiente quelques minutes. Lorsqu'il a terminé, ferme le rapport qui s'est ouvert.
Sélectionne ensuite l'option "Recherche et suppression automatique" en tapant sur la touche R.
S'il trouve quelque chose, tu verras défiler des lignes dans la fenêtre de commande et au bout de quelques instants, il faudra que tu appuies sur une touche pour que le nettoyage soit lancé.
Démarre "Brute Force Uninstaller" en double-cliquant BFU.exe (du dossier C:\BFU)
- Clique sur le petit dossier jaune, à la droite de la boîte Scriptline to execute, et double-clique sur :
EGDACCESS.bfu
- Dans la boîte "Scriptline to execute", tu devrais maintenant voir ceci : C:\BFU\EGDACCESS.bfu
Clique sur Execute et laisse-le faire son travail.
Attends que Complete script execution apparaisse pour cliquer sur OK.
Clique Exit pour fermer le programme BFU.
Redémarre normalement.
Poste les rapports :
- Hijackthis
- C:\egd.txt
- C:\Navipromo.txt
Sorry !
Pour Hijackthis :
- Dézippe le dans un dossier ou sur ton bureau.
- Lance l'application.
- Choisis l'option "Do a system scan and save a logfile"
-- Le Bloc-Notes s'ouvre :
-> Edition / Sélectionner Tout
-> Edition / Copier
- Colle le rapport ici.
AIDE : Tuto sur Hijackthis (Malekal)
Pour Hijackthis :
Citation :
- Télécharge Hijackthis (de Merjin).- Dézippe le dans un dossier ou sur ton bureau.
- Lance l'application.
- Choisis l'option "Do a system scan and save a logfile"
-- Le Bloc-Notes s'ouvre :
-> Edition / Sélectionner Tout
-> Edition / Copier
- Colle le rapport ici.
AIDE : Tuto sur Hijackthis (Malekal)
oki merci je m'occupe d'Hijckthis de suite et te poste les deux autres rapports en attendant !! merci...merci...merci...
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe /logon"
"AudioDeck"="C:\\Program Files\\VIAudioi\\SBADeck\\ADeck.exe 1"
"pccguide.exe"="\"C:\\Program Files\\Trend Micro\\Internet Security 14\\pccguide.exe\""
"a-squared Anti-Dialer"="\"C:\\Program Files\\a-squared Anti-Dialer\\a2adguard.exe\""
"eCarteBleue-LP-P1"="\"C:\\Program Files\\e-Carte Bleue\\LA BANQUE POSTALE\\CVD ADESIO\\ECB.exe\" /dontopenmycards"
"hldrrr"="C:\\WINNT\\system32\\hldrrr.exe"
"ParentalControl"="C:\\Program Files\\Parental Control\\ParentalControl.exe /SERVICE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
Navipromo:
Rapport Navipromo.bat 0.71 effectué le mer. 24/01/2007 à 20:35:32,92
L'opération se déroule en mode sans échec sous le compte Administrateur
## Vérifications supplémentaires
Note : cette section est expérimentale, aucun fichier ne sera supprimé. Si des fichiers sont trouvés à l'aide de cette méthode, ils ne seront pas nécessairement dangereux.
* Navipromo
C:\WINNT\System32
smzwhyu.exe
auycbkzir.exe
smzwhyu.exe
auycbkzir_nav.dat
auycbkzir_navps.dat
bohsfqltd_navps.dat
smzwhyu_navps.dat
auycbkzir.dat
bohsfqltd.dat
smzwhyu.dat
auycbkzir.dat
bohsfqltd.dat
smzwhyu.dat
* Trojan Nebula
* Trojan Vundo
-------------
Rapport Navipromo.bat 0.71 effectué le mer. 24/01/2007 à 21:02:10,93
L'opération se déroule en mode sans échec sous le compte Administrateur
** Recherche...
1/ smzwhyu trouvé, recherche de smzwhyu*
C:\WINNT\system32\smzwhyu.dat
C:\WINNT\system32\smzwhyu.exe
C:\WINNT\system32\smzwhyu_nav.dat
C:\WINNT\system32\smzwhyu_navps.dat
-------------
Rapport Navipromo.bat 0.71 effectué le mer. 24/01/2007 à 21:02:36,42
L'opération se déroule en mode sans échec sous le compte Administrateur
** Recherche...
1/ smzwhyu trouvé, recherche de smzwhyu*
C:\WINNT\system32\smzwhyu.dat
C:\WINNT\system32\smzwhyu.exe
C:\WINNT\system32\smzwhyu_nav.dat
C:\WINNT\system32\smzwhyu_navps.dat
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe /logon"
"AudioDeck"="C:\\Program Files\\VIAudioi\\SBADeck\\ADeck.exe 1"
"pccguide.exe"="\"C:\\Program Files\\Trend Micro\\Internet Security 14\\pccguide.exe\""
"a-squared Anti-Dialer"="\"C:\\Program Files\\a-squared Anti-Dialer\\a2adguard.exe\""
"eCarteBleue-LP-P1"="\"C:\\Program Files\\e-Carte Bleue\\LA BANQUE POSTALE\\CVD ADESIO\\ECB.exe\" /dontopenmycards"
"hldrrr"="C:\\WINNT\\system32\\hldrrr.exe"
"ParentalControl"="C:\\Program Files\\Parental Control\\ParentalControl.exe /SERVICE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
Navipromo:
Rapport Navipromo.bat 0.71 effectué le mer. 24/01/2007 à 20:35:32,92
L'opération se déroule en mode sans échec sous le compte Administrateur
## Vérifications supplémentaires
Note : cette section est expérimentale, aucun fichier ne sera supprimé. Si des fichiers sont trouvés à l'aide de cette méthode, ils ne seront pas nécessairement dangereux.
* Navipromo
C:\WINNT\System32
smzwhyu.exe
auycbkzir.exe
smzwhyu.exe
auycbkzir_nav.dat
auycbkzir_navps.dat
bohsfqltd_navps.dat
smzwhyu_navps.dat
auycbkzir.dat
bohsfqltd.dat
smzwhyu.dat
auycbkzir.dat
bohsfqltd.dat
smzwhyu.dat
* Trojan Nebula
* Trojan Vundo
-------------
Rapport Navipromo.bat 0.71 effectué le mer. 24/01/2007 à 21:02:10,93
L'opération se déroule en mode sans échec sous le compte Administrateur
** Recherche...
1/ smzwhyu trouvé, recherche de smzwhyu*
C:\WINNT\system32\smzwhyu.dat
C:\WINNT\system32\smzwhyu.exe
C:\WINNT\system32\smzwhyu_nav.dat
C:\WINNT\system32\smzwhyu_navps.dat
-------------
Rapport Navipromo.bat 0.71 effectué le mer. 24/01/2007 à 21:02:36,42
L'opération se déroule en mode sans échec sous le compte Administrateur
** Recherche...
1/ smzwhyu trouvé, recherche de smzwhyu*
C:\WINNT\system32\smzwhyu.dat
C:\WINNT\system32\smzwhyu.exe
C:\WINNT\system32\smzwhyu_nav.dat
C:\WINNT\system32\smzwhyu_navps.dat
Le rapport n'est pas complet ![:D]( ":D")
Télécharge Blacklight (F-Secure), clique sur " I ACCEPT " en bas de la page :
Clique sur le premier " Download " afin de télécharger le programme
Sauvegarde le sur ton Bureau
Double-clique blbeta.exe et accepte la licence; clique Scan puis Next.
A la fin du scan, NE TOUCHE A RIEN !
Tu verras un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres).
Nous devons analyser ce rapport, ferme donc le BlackLight.
Poste le rapport sur le forum.
AIDE : Tuto sur BlackLight (Malekal)
Télécharge Blacklight (F-Secure), clique sur " I ACCEPT " en bas de la page :
Clique sur le premier " Download " afin de télécharger le programme
Sauvegarde le sur ton Bureau
Double-clique blbeta.exe et accepte la licence; clique Scan puis Next.
A la fin du scan, NE TOUCHE A RIEN !
Tu verras un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres).
Nous devons analyser ce rapport, ferme donc le BlackLight.
Poste le rapport sur le forum.
AIDE : Tuto sur BlackLight (Malekal)
HEuuu.... vi... je fais ça aussi...
je te poste Hijackthis là ... (c'est grave doc? ...)
Logfile of HijackThis v1.99.1
Scan saved at 21:25:46, on 24/01/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\cisvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\WINNT\system32\hldrrr.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINNT\system32\hldrrr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINNT\system32\cidaemon.exe
C:\Documents and Settings\Administrateur\Bureau\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Barre d'outils du menu Anti-fraude de Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINNT\system32\BhoECart.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Barre d'outils du menu Anti-fraude de Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKLM\..\Run: [eCarteBleue-LP-P1] "C:\Program Files\e-Carte Bleue\LA BANQUE POSTALE\CVD ADESIO\ECB.exe" /dontopenmycards
O4 - HKLM\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKLM\..\Run: [ParentalControl] C:\Program Files\Parental Control\ParentalControl.exe /SERVICE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Contro...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.pixdiscount.fr/clients/uploader_v2.1.0.53.ca...
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader/i...
O23 - Service: a-squared Anti-Spam Service (A2AntiSpamService) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Spam\A2AntiSpamSrv.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: Blue Coat K9 Web Protection (WebFilter) - Unknown owner - C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
je te poste Hijackthis là ... (c'est grave doc? ...)
Logfile of HijackThis v1.99.1
Scan saved at 21:25:46, on 24/01/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\cisvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\WINNT\system32\hldrrr.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINNT\system32\hldrrr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINNT\system32\cidaemon.exe
C:\Documents and Settings\Administrateur\Bureau\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Barre d'outils du menu Anti-fraude de Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINNT\system32\BhoECart.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Barre d'outils du menu Anti-fraude de Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKLM\..\Run: [eCarteBleue-LP-P1] "C:\Program Files\e-Carte Bleue\LA BANQUE POSTALE\CVD ADESIO\ECB.exe" /dontopenmycards
O4 - HKLM\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKLM\..\Run: [ParentalControl] C:\Program Files\Parental Control\ParentalControl.exe /SERVICE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Contro...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.pixdiscount.fr/clients/uploader_v2.1.0.53.ca...
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader/i...
O23 - Service: a-squared Anti-Spam Service (A2AntiSpamService) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Spam\A2AntiSpamSrv.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: Blue Coat K9 Web Protection (WebFilter) - Unknown owner - C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
Bien... alors... J'espère que j'ai bien compris la consigne: NE TOUCHE A RIEN... ;-(
bref.. voilà le rapport fsbl.
01/24/07 21:32:15 [Info]: BlackLight Engine 1.0.55 initialized
01/24/07 21:32:15 [Info]: OS: 5.0 build 2195 (Service Pack 4)
01/24/07 21:32:15 [Note]: 7019 4
01/24/07 21:32:15 [Note]: 7005 0
01/24/07 21:32:21 [Note]: 7006 0
01/24/07 21:32:21 [Note]: 7011 1556
01/24/07 21:32:21 [Note]: 7026 0
01/24/07 21:32:21 [Note]: 7026 0
01/24/07 21:32:26 [Note]: FSRAW library version 1.7.1021
01/24/07 21:36:53 [Note]: 2000 1012
01/24/07 21:48:16 [Note]: 7007 0
J'espère que ça va....
MERCIIIIIIIII ....
bref.. voilà le rapport fsbl.
01/24/07 21:32:15 [Info]: BlackLight Engine 1.0.55 initialized
01/24/07 21:32:15 [Info]: OS: 5.0 build 2195 (Service Pack 4)
01/24/07 21:32:15 [Note]: 7019 4
01/24/07 21:32:15 [Note]: 7005 0
01/24/07 21:32:21 [Note]: 7006 0
01/24/07 21:32:21 [Note]: 7011 1556
01/24/07 21:32:21 [Note]: 7026 0
01/24/07 21:32:21 [Note]: 7026 0
01/24/07 21:32:26 [Note]: FSRAW library version 1.7.1021
01/24/07 21:36:53 [Note]: 2000 1012
01/24/07 21:48:16 [Note]: 7007 0
J'espère que ça va....
MERCIIIIIIIII ....
Rapport Blacklight clean ![;)]( ";)")
Télécharge Clean.zip (de Malekal),
Décompresse-le sur ton bureau (Clique-Droit/Extraire tout), tu dois obtenir un dossier Clean.
Ouvre le dossier clean, double-clique sur clean.cmd.
Choisis l'option 1 puis patiente. Poste ensuite le contenu du rapport.
Télécharge Clean.zip (de Malekal),
Décompresse-le sur ton bureau (Clique-Droit/Extraire tout), tu dois obtenir un dossier Clean.
Ouvre le dossier clean, double-clique sur clean.cmd.
Choisis l'option 1 puis patiente. Poste ensuite le contenu du rapport.
tu me parles des virus que j'ai chopé quand tu dis ça (et d'ailleurs ça se choppe comment ces mer...)? c'est quoi des rootkits ? c'est comme des cookies ?
Moi je te demandais ce qu'étaient et ce que faisaient les programmes que tu me demandes d'utiliser...
et puis, comment être sûre que ça ne reviendra pas?
j'arrête mes questions.. désolée...
Moi je te demandais ce qu'étaient et ce que faisaient les programmes que tu me demandes d'utiliser...
et puis, comment être sûre que ça ne reviendra pas?
j'arrête mes questions.. désolée...
Citation :
tu me parles des virus que j'ai chopé quand tu dis ça (et d'ailleurs ça se choppe comment ces mer...)? P2P, Cracks, XXX...
Citation :
c'est quoi des rootkits ? c'est comme des cookies ? Rien à voir :
http://fr.wikipedia.org/wiki/Rootkit
Clean.cmd = Clean
bonjour Angeldark,
Je voulais t'informer de l'ouverture d'1 fenêtre "ERROR" au démarrage de windows qui dit: Unable to load function FT_Thunk (KERNEL 32.dll).
Je ne sais pas si ça a 1 rapport mais ces ouvertures soïncident avec l'arrivée de Navipromo.
Aussi ma corbeille est pleine d'1 tas de trucs !! c'est impressionnant... que faire?
j'aimerais juste comprendre ce qui s'est passé pour ne pas que cela recommence et mieux me prévenir même si je pensais être bien protégée !!
MERCI à toi !
Je m'occupe de clean alors?
Je voulais t'informer de l'ouverture d'1 fenêtre "ERROR" au démarrage de windows qui dit: Unable to load function FT_Thunk (KERNEL 32.dll).
Je ne sais pas si ça a 1 rapport mais ces ouvertures soïncident avec l'arrivée de Navipromo.
Aussi ma corbeille est pleine d'1 tas de trucs !! c'est impressionnant... que faire?
j'aimerais juste comprendre ce qui s'est passé pour ne pas que cela recommence et mieux me prévenir même si je pensais être bien protégée !!
MERCI à toi !
Je m'occupe de clean alors?
voilà le rapport de clean :
Rapport clean par Malekal_morte - http://www.malekal.com
Option 1, executee le jeu. 25/01/2007 a 13:03:59,40
*** Recherche de fichiers sur C:
C:\unwise.exe FOUND
*** Recherche des fichiers dans C:\WINNT\
C:\WINNT\exefld\ FOUND
C:\WINNT\HelperVer.exe FOUND
*** Recherche des fichiers dans C:\WINNT\system32
C:\WINNT\system32\hldrrr.exe FOUND
C:\WINNT\system32\SpoonUninstall.exe FOUND
C:\WINNT\system32\cmirmdrv.exe FOUND
"C:\WINNT\Downloaded Program Files\imloader.exe" FOUND
"C:\Program Files\Montorgueil\" FOUND
"C:\Program Files\Montorgueil\" FOUND
C:\PROGRA~1\UNIVER~1\ FOUND
*** Fin du rapport !
Rapport clean par Malekal_morte - http://www.malekal.com
Option 1, executee le jeu. 25/01/2007 a 13:03:59,40
*** Recherche de fichiers sur C:
C:\unwise.exe FOUND
*** Recherche des fichiers dans C:\WINNT\
C:\WINNT\exefld\ FOUND
C:\WINNT\HelperVer.exe FOUND
*** Recherche des fichiers dans C:\WINNT\system32
C:\WINNT\system32\hldrrr.exe FOUND
C:\WINNT\system32\SpoonUninstall.exe FOUND
C:\WINNT\system32\cmirmdrv.exe FOUND
"C:\WINNT\Downloaded Program Files\imloader.exe" FOUND
"C:\Program Files\Montorgueil\" FOUND
"C:\Program Files\Montorgueil\" FOUND
C:\PROGRA~1\UNIVER~1\ FOUND
*** Fin du rapport !
Re,
Redémarre en mode sans échec
Ouvre le dossier clean, double-clique sur clean.cmd.
Choisis l'option 2 puis patiente.
Redémarre normalement
- Le rapport clean : Poste de travail / double clic sur disque C / double-clic sur rapport_clean.txt et copier/coller le contenu ici C:\rapport_clean.txt
Redémarre en mode sans échec
Ouvre le dossier clean, double-clique sur clean.cmd.
Choisis l'option 2 puis patiente.
Redémarre normalement
- Le rapport clean : Poste de travail / double clic sur disque C / double-clic sur rapport_clean.txt et copier/coller le contenu ici C:\rapport_clean.txt
le voici : (le fenêtre "ERROR" s'ouvre toujours...)
Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Option 2, executee le jeu. 25/01/2007 a 13:21:43,93
Microsoft Windows 2000 [Version 5.00.2195]
*** Suppression de fichiers sur C:
tentative de suppression de C:\unwise.exe
*** Suppression des fichiers dans C:\WINNT\
tentative de suppression de C:\WINNT\exefld\
tentative de suppression de C:\WINNT\HelperVer.exe
*** Suppression des fichiers dans C:\WINNT\system32
tentative de suppression de C:\WINNT\system32\hldrrr.exe
tentative de suppression de C:\WINNT\system32\SpoonUninstall.exe
tentative de suppression de C:\WINNT\system32\cmirmdrv.exe
tentative de suppression de "C:\WINNT\Downloaded Program Files\imloader.exe"
tentative de suppression de "C:\Program Files\Montorgueil\"
tentative de suppression de C:\PROGRA~1\UNIVER~1\
*** Suppression des clefs du registre effectuee..
*** Fin du rapport !
Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Option 2, executee le jeu. 25/01/2007 a 13:21:43,93
Microsoft Windows 2000 [Version 5.00.2195]
*** Suppression de fichiers sur C:
tentative de suppression de C:\unwise.exe
*** Suppression des fichiers dans C:\WINNT\
tentative de suppression de C:\WINNT\exefld\
tentative de suppression de C:\WINNT\HelperVer.exe
*** Suppression des fichiers dans C:\WINNT\system32
tentative de suppression de C:\WINNT\system32\hldrrr.exe
tentative de suppression de C:\WINNT\system32\SpoonUninstall.exe
tentative de suppression de C:\WINNT\system32\cmirmdrv.exe
tentative de suppression de "C:\WINNT\Downloaded Program Files\imloader.exe"
tentative de suppression de "C:\Program Files\Montorgueil\"
tentative de suppression de C:\PROGRA~1\UNIVER~1\
*** Suppression des clefs du registre effectuee..
*** Fin du rapport !
le voici ...
Logfile of HijackThis v1.99.1
Scan saved at 18:57:47, on 25/01/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\cisvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINNT\system32\cidaemon.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Administrateur\Bureau\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Barre d'outils du menu Anti-fraude de Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINNT\system32\BhoECart.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Barre d'outils du menu Anti-fraude de Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKLM\..\Run: [eCarteBleue-LP-P1] "C:\Program Files\e-Carte Bleue\LA BANQUE POSTALE\CVD ADESIO\ECB.exe" /dontopenmycards
O4 - HKLM\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKLM\..\Run: [ParentalControl] C:\Program Files\Parental Control\ParentalControl.exe /SERVICE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Contro...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.pixdiscount.fr/clients/uploader_v2.1.0.53.ca...
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader/i...
O23 - Service: a-squared Anti-Spam Service (A2AntiSpamService) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Spam\A2AntiSpamSrv.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: Blue Coat K9 Web Protection (WebFilter) - Unknown owner - C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
Logfile of HijackThis v1.99.1
Scan saved at 18:57:47, on 25/01/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\cisvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINNT\system32\cidaemon.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Administrateur\Bureau\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Barre d'outils du menu Anti-fraude de Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINNT\system32\BhoECart.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Barre d'outils du menu Anti-fraude de Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKLM\..\Run: [eCarteBleue-LP-P1] "C:\Program Files\e-Carte Bleue\LA BANQUE POSTALE\CVD ADESIO\ECB.exe" /dontopenmycards
O4 - HKLM\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKLM\..\Run: [ParentalControl] C:\Program Files\Parental Control\ParentalControl.exe /SERVICE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Contro...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.pixdiscount.fr/clients/uploader_v2.1.0.53.ca...
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader/i...
O23 - Service: a-squared Anti-Spam Service (A2AntiSpamService) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Spam\A2AntiSpamSrv.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: Blue Coat K9 Web Protection (WebFilter) - Unknown owner - C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
Re,
Toujours là...
Fais un scan en ligne Kaspersky avec Internet Explorer :
Clique sur ![]()
Clique maintenant sur J'accepte.
Valide l'installation d'un ou de plusieurs ActiveX si c'est nécessaire.
Patiente pendant l'installation des Mises à jour.
Choisis par la suite l'analyse du Poste de travail
Sauvegarde puis colle le rapport généré en fin d'analyse.
AIDE : Configurer le contrôle des ActiveX
NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte toi sur le site de Kaspersky pour retenter le scan en ligne.
Toujours là...
AIDE : Configurer le contrôle des ActiveX
NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte toi sur le site de Kaspersky pour retenter le scan en ligne.
Re,
On va faire autrement.
Avec Internet Explorer
Fais un scan en ligne Panda
- Clique sur " Scan your PC "
- Ensuite sur " Check Now "
- /!\ Clique en bas sur " I don't Accept "
Entre ton adresse e-mail puis commence le scan
- Poste le rapport en fin d'analyse
Si tu as Avast! désactive-le lors du scan
On va faire autrement.
Avec Internet Explorer
Fais un scan en ligne Panda
- Clique sur " Scan your PC "
- Ensuite sur " Check Now "
- /!\ Clique en bas sur " I don't Accept "
Entre ton adresse e-mail puis commence le scan
- Poste le rapport en fin d'analyse
Si tu as Avast! désactive-le lors du scan
Pendant le scan, peux-tu me dire si je peux vider la corbeille?si tu sais ce qu'est cette fenêtre: "ERROR" au démarrage de windows qui dit: Unable to load function FT_Thunk (KERNEL 32.dll) ? et ce qu'il me reste à faire à l'avenir pour éviter ça ou si ça recommence me guérir toute seule? quels sont tes précieux conseils ? MERCI vraiment...
Alors... j'ai vidé la corbeille et je me sens déjà mieux...;-)
Voilà le rapport de Panda:
Incident Statut Analyse
Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Weborama No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Serving-sys No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/Doubleclick No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/RealMedia No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Atlas DMT No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/RealMedia No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Bluestreak No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Tradedoubler No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Comclick No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[fl01.ct2.comclick.com/]
Spyware:Cookie/MetriWeb No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.metriweb.be/]
Spyware:Cookie/Advertising No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Mediaplex No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/YieldManager No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/HotLog No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.hotlog.ru/]
Spyware:Cookie/Statcounter No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Adtech No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Overture No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.overture.com/]
Spyware:Cookie/2o7 No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Hitbox No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/Tribalfusion No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Com.com No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.com.com/]
Spyware:Cookie/FastClick No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/QuestionMarket No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/PointRoll No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/Casalemedia No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Hbmediapro No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/Yadro No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.yadro.ru/]
Spyware:Cookie/Zedo No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Apmebf No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.apmebf.com/]
Outil indésirable:Application/Pskill.K No Désinfecté C:\Documents and Settings\Administrateur\Bureau\NaviPromo 1\clean\pskill.exe
Outil indésirable:Application/Processor No Désinfecté C:\Documents and Settings\Administrateur\Bureau\NaviPromo 1\navilog1\Process.exe
Spyware:Cookie/2o7 No Désinfecté C:\Documents and Settings\Administrateur\Cookies\isa et nico@2o7[2].txt
Spyware:Cookie/Bluestreak No Désinfecté C:\Documents and Settings\Administrateur\Cookies\isa et nico@bluestreak[1].txt
Spyware:Cookie/Doubleclick No Désinfecté C:\Documents and Settings\Administrateur\Cookies\isa et nico@doubleclick[1].txt
Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\Administrateur\Cookies\isa et nico@xiti[1].txt
Outil indésirable:Application/Pskill.K No Désinfecté C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\Cache\3CD27B45d01[clean/pskill.exe]
Outil indésirable:Application/Processor No Désinfecté C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\Cache\408E70EBd01[Process.exe]
Spyware:Cookie/Weborama No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Mediaplex No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Adtech No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Doubleclick No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Tradedoubler No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Bluestreak No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Falkag No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.as-eu.falkag.net/]
Spyware:Cookie/RealMedia No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Zedo No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.zedo.com/]
Spyware:Cookie/FastClick No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Atlas DMT No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Casalemedia No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Advertising No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Serving-sys No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/2o7 No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Apmebf No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/Hitbox No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/fe.lea.lycos No Désinfecté C:\Documents and Settings\Vincent\Cookies\vincent@fe.lea.lycos[1].txt
Spyware:Cookie/Searchportal No Désinfecté C:\Documents and Settings\Vincent\Cookies\vincent@searchportal.information[1].txt
Spyware:Cookie/Winantivirus No Désinfecté C:\Documents and Settings\Vincent\Cookies\vincent@winantivirus[1].txt
Spyware:Cookie/Winantivirus No Désinfecté C:\Documents and Settings\Vincent\Cookies\vincent@www.winantivirus[1].txt
Adware:Adware/NaviPromo No Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc1.dll
Virus:W32/SimpleP2P.A.worm Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc1364.exe
Virus:Eicar.Mod No Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc3044\Setup\program files\Trend Micro\PC-cillin\tmhelp.chm[/PCC12/Test_virus.htm]
Adware:Adware/Seekmo No Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc3343.exe
Adware:Adware/NaviPromo No Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc3548.exe
Adware:Adware/NaviPromo No Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc3549.exe
Outil indésirable:Application/Pskill.K No Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc3554.zip[clean/pskill.exe]
Adware:Adware/NaviPromo No Désinfecté C:\WINNT\system32\auycbkzir.exe
Adware:Adware/NaviPromo No Désinfecté C:\WINNT\system32\bfubackups\tghsvmnckw.exe
Adware:Adware/NaviPromo No Désinfecté C:\WINNT\system32\smzwhyu.exe
Adware:Adware/EShopper No Désinfecté C:\WINNT\UnInstallKey.exe
Virus:Trj/Mitglieder.LX Désinfecté D:\MES LOGICIELS\STOPGAME\StopGame_Office_Edition_1.2.3.exe
Virus:Trj/Mitglieder.LT Désinfecté D:\MES LOGICIELS\stopgame home edition 1.2.2 crack.zip[stopgame home edition 1.2.2 crack.exe]
Virus:Trj/Mitglieder.LX Désinfecté D:\MES LOGICIELS\stopgame1.3\StopGame_Home_Edition_1.3.exe
Virus:Trj/Mitglieder.LX Désinfecté D:\MES LOGICIELS\TimeWatch\TimeWatch_-_Soho_430105.exe
Virus:Trj/Mitglieder.LX Désinfecté D:\MES LOGICIELS\Win nanny\Win_Nanny_2.14.exe
Virus:Trj/Mitglieder.LX Désinfecté D:\MES LOGICIELS\Win nanny 1.01\Win_Nanny_1.01.exe
Voilà le rapport de Panda:
Incident Statut Analyse
Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Weborama No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Serving-sys No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/Doubleclick No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/RealMedia No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Atlas DMT No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/RealMedia No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Bluestreak No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Tradedoubler No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Comclick No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[fl01.ct2.comclick.com/]
Spyware:Cookie/MetriWeb No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.metriweb.be/]
Spyware:Cookie/Advertising No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Mediaplex No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/YieldManager No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/HotLog No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.hotlog.ru/]
Spyware:Cookie/Statcounter No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Adtech No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Overture No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.overture.com/]
Spyware:Cookie/2o7 No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Hitbox No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/Tribalfusion No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Com.com No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.com.com/]
Spyware:Cookie/FastClick No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/QuestionMarket No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/PointRoll No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/Casalemedia No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Hbmediapro No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/Yadro No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.yadro.ru/]
Spyware:Cookie/Zedo No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Apmebf No Désinfecté C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.apmebf.com/]
Outil indésirable:Application/Pskill.K No Désinfecté C:\Documents and Settings\Administrateur\Bureau\NaviPromo 1\clean\pskill.exe
Outil indésirable:Application/Processor No Désinfecté C:\Documents and Settings\Administrateur\Bureau\NaviPromo 1\navilog1\Process.exe
Spyware:Cookie/2o7 No Désinfecté C:\Documents and Settings\Administrateur\Cookies\isa et nico@2o7[2].txt
Spyware:Cookie/Bluestreak No Désinfecté C:\Documents and Settings\Administrateur\Cookies\isa et nico@bluestreak[1].txt
Spyware:Cookie/Doubleclick No Désinfecté C:\Documents and Settings\Administrateur\Cookies\isa et nico@doubleclick[1].txt
Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\Administrateur\Cookies\isa et nico@xiti[1].txt
Outil indésirable:Application/Pskill.K No Désinfecté C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\Cache\3CD27B45d01[clean/pskill.exe]
Outil indésirable:Application/Processor No Désinfecté C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\Cache\408E70EBd01[Process.exe]
Spyware:Cookie/Weborama No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Mediaplex No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Adtech No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Doubleclick No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Tradedoubler No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Bluestreak No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Falkag No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.as-eu.falkag.net/]
Spyware:Cookie/RealMedia No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Zedo No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.zedo.com/]
Spyware:Cookie/FastClick No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Atlas DMT No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Casalemedia No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Advertising No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Serving-sys No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/2o7 No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Apmebf No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/Hitbox No Désinfecté C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/fe.lea.lycos No Désinfecté C:\Documents and Settings\Vincent\Cookies\vincent@fe.lea.lycos[1].txt
Spyware:Cookie/Searchportal No Désinfecté C:\Documents and Settings\Vincent\Cookies\vincent@searchportal.information[1].txt
Spyware:Cookie/Winantivirus No Désinfecté C:\Documents and Settings\Vincent\Cookies\vincent@winantivirus[1].txt
Spyware:Cookie/Winantivirus No Désinfecté C:\Documents and Settings\Vincent\Cookies\vincent@www.winantivirus[1].txt
Adware:Adware/NaviPromo No Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc1.dll
Virus:W32/SimpleP2P.A.worm Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc1364.exe
Virus:Eicar.Mod No Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc3044\Setup\program files\Trend Micro\PC-cillin\tmhelp.chm[/PCC12/Test_virus.htm]
Adware:Adware/Seekmo No Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc3343.exe
Adware:Adware/NaviPromo No Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc3548.exe
Adware:Adware/NaviPromo No Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc3549.exe
Outil indésirable:Application/Pskill.K No Désinfecté C:\RECYCLER\S-1-5-21-776561741-1604221776-839522115-500\Dc3554.zip[clean/pskill.exe]
Adware:Adware/NaviPromo No Désinfecté C:\WINNT\system32\auycbkzir.exe
Adware:Adware/NaviPromo No Désinfecté C:\WINNT\system32\bfubackups\tghsvmnckw.exe
Adware:Adware/NaviPromo No Désinfecté C:\WINNT\system32\smzwhyu.exe
Adware:Adware/EShopper No Désinfecté C:\WINNT\UnInstallKey.exe
Virus:Trj/Mitglieder.LX Désinfecté D:\MES LOGICIELS\STOPGAME\StopGame_Office_Edition_1.2.3.exe
Virus:Trj/Mitglieder.LT Désinfecté D:\MES LOGICIELS\stopgame home edition 1.2.2 crack.zip[stopgame home edition 1.2.2 crack.exe]
Virus:Trj/Mitglieder.LX Désinfecté D:\MES LOGICIELS\stopgame1.3\StopGame_Home_Edition_1.3.exe
Virus:Trj/Mitglieder.LX Désinfecté D:\MES LOGICIELS\TimeWatch\TimeWatch_-_Soho_430105.exe
Virus:Trj/Mitglieder.LX Désinfecté D:\MES LOGICIELS\Win nanny\Win_Nanny_2.14.exe
Virus:Trj/Mitglieder.LX Désinfecté D:\MES LOGICIELS\Win nanny 1.01\Win_Nanny_1.01.exe
Re,
Ah les cracks...
Télécharge KillBox d'Option^Explicit.
Dézippe le dans un dossier ou sur ton bureau (Clique droit puis Extraire Tout).
Selectionne le texte dans le cadre :
C:\WINNT\system32\bfubackups\
C:\WINNT\system32\smzwhyu.exe
C:\WINNT\UnInstallKey.exe
D:\MES LOGICIELS\STOPGAME\StopGame_Office_Edition_1.2.3.exe
D:\MES LOGICIELS\stopgame home edition 1.2.2 crack.zip
D:\MES LOGICIELS\stopgame1.3\StopGame_Home_Edition_1.3.exe
D:\MES LOGICIELS\TimeWatch\TimeWatch_-_Soho_430105.exe
D:\MES LOGICIELS\Win nanny\Win_Nanny_2.14.exe
D:\MES LOGICIELS\Win nanny 1.01\Win_Nanny_1.01.exe
---> Clique Droit puis Copier.
----------
-- Ouvre Killbox.exe
-- Choisis "Delete on reboot"
-- Clique sur :
- " File " -> " Paste from Clipboard "
- " All Files "
Pour terminer clique sur![[:angeldark:3]]( "[:angeldark:3]")
Une question te sera alors posée :
" File will be Removed on Reboot, Do you want to reboot now ? "
-- Répond par OUI, un compte à rebours s'enclenche, ton PC va redémarrer.
-- Après redémarrage, relance Killbox puis clique sur le menu : Files -> Logs -> Actions History Log, poste ce rapport ici.
NOTE: Si tu reçois le message "PendingFileRenameOperations Registry Data has been removed by external process!"
Redémarre ton PC manuellement.
AIDE : Tuto sur KillBox (Jesses)
Ah les cracks...
Télécharge KillBox d'Option^Explicit.
Dézippe le dans un dossier ou sur ton bureau (Clique droit puis Extraire Tout).
Selectionne le texte dans le cadre :
Citation :
C:\WINNT\system32\auycbkzir.exeC:\WINNT\system32\bfubackups\
C:\WINNT\system32\smzwhyu.exe
C:\WINNT\UnInstallKey.exe
D:\MES LOGICIELS\STOPGAME\StopGame_Office_Edition_1.2.3.exe
D:\MES LOGICIELS\stopgame home edition 1.2.2 crack.zip
D:\MES LOGICIELS\stopgame1.3\StopGame_Home_Edition_1.3.exe
D:\MES LOGICIELS\TimeWatch\TimeWatch_-_Soho_430105.exe
D:\MES LOGICIELS\Win nanny\Win_Nanny_2.14.exe
D:\MES LOGICIELS\Win nanny 1.01\Win_Nanny_1.01.exe
---> Clique Droit puis Copier.
----------
-- Ouvre Killbox.exe
-- Choisis "Delete on reboot"
-- Clique sur :
- " File " -> " Paste from Clipboard "
- " All Files "
Pour terminer clique sur
![[:angeldark:3]](http://m.bestofmedia.com/sfp/design/usr/fr/smilies/ff/f1/angeldark:3.gif "[:angeldark:3]")
Une question te sera alors posée :
" File will be Removed on Reboot, Do you want to reboot now ? "
-- Répond par OUI, un compte à rebours s'enclenche, ton PC va redémarrer.
-- Après redémarrage, relance Killbox puis clique sur le menu : Files -> Logs -> Actions History Log, poste ce rapport ici.
NOTE: Si tu reçois le message "PendingFileRenameOperations Registry Data has been removed by external process!"
Redémarre ton PC manuellement.
AIDE : Tuto sur KillBox (Jesses)
j'adore ce smileys...
voilà le rapport mon capitaine !
Pocket Killbox version 2.0.0.648
Running on Windows 2000 as Isa et Nico(Administrator)
was started @ vendredi, janvier 26, 2007, 9:44 PM
Killbox Closed(Exit) @ 9:45:24 PM
__________________________________________________
Pocket Killbox version 2.0.0.648
Running on Windows 2000 as Isa et Nico(Administrator)
was started @ vendredi, janvier 26, 2007, 9:45 PM
# 1 [Delete on Reboot]
Path = C:\WINNT\system32\auycbkzir.exe
# 2 [Delete on Reboot]
Path = C:\WINNT\system32\bfubackups
# 3 [Delete on Reboot]
Path = C:\WINNT\system32\smzwhyu.exe
# 4 [Delete on Reboot]
Path = C:\WINNT\UnInstallKey.exe
# 5 [Delete on Reboot]
Path = D:\MES LOGICIELS\stopgame home edition 1.2.2 crack.zip
I Rebooted @ 9:54:03 PM
Pocket Killbox version 2.0.0.648
Running on Windows 2000 as Isa et Nico(Administrator)
was started @ vendredi, janvier 26, 2007, 9:57 PM
voilà le rapport mon capitaine !
Pocket Killbox version 2.0.0.648
Running on Windows 2000 as Isa et Nico(Administrator)
was started @ vendredi, janvier 26, 2007, 9:44 PM
Killbox Closed(Exit) @ 9:45:24 PM
__________________________________________________
Pocket Killbox version 2.0.0.648
Running on Windows 2000 as Isa et Nico(Administrator)
was started @ vendredi, janvier 26, 2007, 9:45 PM
# 1 [Delete on Reboot]
Path = C:\WINNT\system32\auycbkzir.exe
# 2 [Delete on Reboot]
Path = C:\WINNT\system32\bfubackups
# 3 [Delete on Reboot]
Path = C:\WINNT\system32\smzwhyu.exe
# 4 [Delete on Reboot]
Path = C:\WINNT\UnInstallKey.exe
# 5 [Delete on Reboot]
Path = D:\MES LOGICIELS\stopgame home edition 1.2.2 crack.zip
I Rebooted @ 9:54:03 PM
Pocket Killbox version 2.0.0.648
Running on Windows 2000 as Isa et Nico(Administrator)
was started @ vendredi, janvier 26, 2007, 9:57 PM
le voici...
Incident Status Location
Adware:Adware/NaviPromo Not disinfected C:\!KillBox\auycbkzir.exe
Adware:Adware/NaviPromo Not disinfected C:\!KillBox\smzwhyu.exe
Adware:Adware/EShopper Not disinfected C:\!KillBox\UnInstallKey.exe
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Comclick Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[fl01.ct2.comclick.com/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.adtech.de/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[statse.webtrendslive.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.advertising.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.metriweb.be/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/HotLog Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.hotlog.ru/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.overture.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.com.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.yadro.ru/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.apmebf.com/]
Potentially unwanted tool:Application/Pskill.K Not disinfected C:\Documents and Settings\Administrateur\Bureau\NaviPromo 1\clean\pskill.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Administrateur\Bureau\NaviPromo 1\navilog1\Process.exe
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Administrateur\Cookies\isa et nico@2o7[2].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Administrateur\Cookies\isa et nico@bluestreak[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrateur\Cookies\isa et nico@doubleclick[1].txt
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Administrateur\Cookies\isa et nico@tradedoubler[1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Administrateur\Cookies\isa et nico@xiti[1].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\Cache\408E70EBd01[Process.exe]
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.as-eu.falkag.net/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.zedo.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/fe.lea.lycos Not disinfected C:\Documents and Settings\Vincent\Cookies\vincent@fe.lea.lycos[1].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Vincent\Cookies\vincent@searchportal.information[1].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Vincent\Cookies\vincent@winantivirus[1].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Vincent\Cookies\vincent@www.winantivirus[1].txt
Adware:Adware/NaviPromo Not disinfected C:\WINNT\system32\bfubackups\tghsvmnckw.exe
Incident Status Location
Adware:Adware/NaviPromo Not disinfected C:\!KillBox\auycbkzir.exe
Adware:Adware/NaviPromo Not disinfected C:\!KillBox\smzwhyu.exe
Adware:Adware/EShopper Not disinfected C:\!KillBox\UnInstallKey.exe
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Comclick Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[fl01.ct2.comclick.com/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.adtech.de/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[statse.webtrendslive.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.advertising.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.metriweb.be/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/HotLog Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.hotlog.ru/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.overture.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.com.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.yadro.ru/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\cookies.txt[.apmebf.com/]
Potentially unwanted tool:Application/Pskill.K Not disinfected C:\Documents and Settings\Administrateur\Bureau\NaviPromo 1\clean\pskill.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Administrateur\Bureau\NaviPromo 1\navilog1\Process.exe
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Administrateur\Cookies\isa et nico@2o7[2].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Administrateur\Cookies\isa et nico@bluestreak[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrateur\Cookies\isa et nico@doubleclick[1].txt
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Administrateur\Cookies\isa et nico@tradedoubler[1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Administrateur\Cookies\isa et nico@xiti[1].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\u2el1ai3.default\Cache\408E70EBd01[Process.exe]
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.as-eu.falkag.net/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.zedo.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Vincent\Application Data\Mozilla\Firefox\Profiles\e0exmbwh.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/fe.lea.lycos Not disinfected C:\Documents and Settings\Vincent\Cookies\vincent@fe.lea.lycos[1].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Vincent\Cookies\vincent@searchportal.information[1].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Vincent\Cookies\vincent@winantivirus[1].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Vincent\Cookies\vincent@www.winantivirus[1].txt
Adware:Adware/NaviPromo Not disinfected C:\WINNT\system32\bfubackups\tghsvmnckw.exe
suite à Ccleaner, je te post le scan de kaspersky et encore MERCI pour toute ton aide!
KASPERSKY ON-LINE SCANNER REPORT
Sunday, January 28, 2007 8:07:06 PM
Système d'exploitation : Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky On-line Scanner version : 5.0.83.0
Dernière mise à jour de la base antivirus Kaspersky : 28/01/2007
Enregistrements dans la base antivirus Kaspersky : 262677
Paramètres d'analyse
Analyser avec la base antivirus suivante étendue
Analyser les archives vrai
Analyser les bases de messagerie vrai
Cible de l'analyse Poste de travail
C:\
D:\
E:\
F:\
G:\
H:\
J:\
Statistiques de l'analyse
Total d'objets analysés 71162
Nombre de virus trouvés 2
Nombre d'objets infectés 3 / 0
Nombre d'objets suspects 0
Durée de l'analyse 01:00:40
Nom de l'objet infecté Nom du virus Dernière action
C:\Documents and Settings\Administrateur\Bureau\NaviPromo 1\clean\pskill.exe Infecté : not-a-virus:RiskTool.Win32.PsKill.k ignoré
C:\Documents and Settings\Administrateur\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\Local Settings\Historique\History.IE5\MSHist012007012820070129\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\Default User\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Default User\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Program Files\Blue Coat K9 Web Protection\cwmlog.txt L'objet est verrouillé ignoré
C:\Program Files\Blue Coat K9 Web Protection\urls.log L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\00000002.ps1 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\00000002.ps2 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\00010008.ci L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\cicat.fid L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\cicat.hsh L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiCL0001.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiP10000.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiP20000.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiPT0000.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiSL0001.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiSP0000.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiST0000.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiVP0000.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\INDEX.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\propstor.bk1 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\propstor.bk2 L'objet est verrouillé ignoré
C:\WINNT\CSC\00000001 L'objet est verrouillé ignoré
C:\WINNT\Debug\ipsecpa.log L'objet est verrouillé ignoré
C:\WINNT\Debug\oakley.log L'objet est verrouillé ignoré
C:\WINNT\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINNT\SchedLgU.Txt L'objet est verrouillé ignoré
C:\WINNT\SoftwareDistribution\EventCache\{C44AC82D-DC05-4F15-8D02-DFE43B5B6A06}.bin L'objet est verrouillé ignoré
C:\WINNT\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINNT\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINNT\system32\bfubackups\jfmzagpytb.exe Infecté : not-a-virus:AdWare.Win32.NaviPromo.l ignoré
C:\WINNT\system32\bfubackups\tghsvmnckw.exe Infecté : not-a-virus:AdWare.Win32.NaviPromo.l ignoré
C:\WINNT\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINNT\system32\config\default L'objet est verrouillé ignoré
C:\WINNT\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINNT\system32\config\SAM L'objet est verrouillé ignoré
C:\WINNT\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINNT\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINNT\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINNT\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINNT\system32\config\software L'objet est verrouillé ignoré
C:\WINNT\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINNT\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINNT\system32\config\system L'objet est verrouillé ignoré
C:\WINNT\system32\config\SYSTEM.ALT L'objet est verrouillé ignoré
C:\WINNT\system32\drivers\dtscsi.sys L'objet est verrouillé ignoré
C:\WINNT\system32\drivers\sptd.sys L'objet est verrouillé ignoré
C:\WINNT\system32\drivers\sptd8301.sys L'objet est verrouillé ignoré
C:\WINNT\system32\Perflib_Perfdata_404.dat L'objet est verrouillé ignoré
C:\WINNT\WindowsUpdate.log L'objet est verrouillé ignoré
Analyse terminée.
KASPERSKY ON-LINE SCANNER REPORT
Sunday, January 28, 2007 8:07:06 PM
Système d'exploitation : Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky On-line Scanner version : 5.0.83.0
Dernière mise à jour de la base antivirus Kaspersky : 28/01/2007
Enregistrements dans la base antivirus Kaspersky : 262677
Paramètres d'analyse
Analyser avec la base antivirus suivante étendue
Analyser les archives vrai
Analyser les bases de messagerie vrai
Cible de l'analyse Poste de travail
C:\
D:\
E:\
F:\
G:\
H:\
J:\
Statistiques de l'analyse
Total d'objets analysés 71162
Nombre de virus trouvés 2
Nombre d'objets infectés 3 / 0
Nombre d'objets suspects 0
Durée de l'analyse 01:00:40
Nom de l'objet infecté Nom du virus Dernière action
C:\Documents and Settings\Administrateur\Bureau\NaviPromo 1\clean\pskill.exe Infecté : not-a-virus:RiskTool.Win32.PsKill.k ignoré
C:\Documents and Settings\Administrateur\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\Local Settings\Historique\History.IE5\MSHist012007012820070129\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\Administrateur\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\Default User\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Default User\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Program Files\Blue Coat K9 Web Protection\cwmlog.txt L'objet est verrouillé ignoré
C:\Program Files\Blue Coat K9 Web Protection\urls.log L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\00000002.ps1 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\00000002.ps2 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\00010008.ci L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\cicat.fid L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\cicat.hsh L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiCL0001.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiP10000.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiP20000.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiPT0000.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiSL0001.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiSP0000.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiST0000.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\CiVP0000.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\INDEX.000 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\propstor.bk1 L'objet est verrouillé ignoré
C:\System Volume Information\catalog.wci\propstor.bk2 L'objet est verrouillé ignoré
C:\WINNT\CSC\00000001 L'objet est verrouillé ignoré
C:\WINNT\Debug\ipsecpa.log L'objet est verrouillé ignoré
C:\WINNT\Debug\oakley.log L'objet est verrouillé ignoré
C:\WINNT\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINNT\SchedLgU.Txt L'objet est verrouillé ignoré
C:\WINNT\SoftwareDistribution\EventCache\{C44AC82D-DC05-4F15-8D02-DFE43B5B6A06}.bin L'objet est verrouillé ignoré
C:\WINNT\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINNT\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINNT\system32\bfubackups\jfmzagpytb.exe Infecté : not-a-virus:AdWare.Win32.NaviPromo.l ignoré
C:\WINNT\system32\bfubackups\tghsvmnckw.exe Infecté : not-a-virus:AdWare.Win32.NaviPromo.l ignoré
C:\WINNT\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINNT\system32\config\default L'objet est verrouillé ignoré
C:\WINNT\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINNT\system32\config\SAM L'objet est verrouillé ignoré
C:\WINNT\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINNT\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINNT\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINNT\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINNT\system32\config\software L'objet est verrouillé ignoré
C:\WINNT\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINNT\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINNT\system32\config\system L'objet est verrouillé ignoré
C:\WINNT\system32\config\SYSTEM.ALT L'objet est verrouillé ignoré
C:\WINNT\system32\drivers\dtscsi.sys L'objet est verrouillé ignoré
C:\WINNT\system32\drivers\sptd.sys L'objet est verrouillé ignoré
C:\WINNT\system32\drivers\sptd8301.sys L'objet est verrouillé ignoré
C:\WINNT\system32\Perflib_Perfdata_404.dat L'objet est verrouillé ignoré
C:\WINNT\WindowsUpdate.log L'objet est verrouillé ignoré
Analyse terminée.
le voici....
Logfile of HijackThis v1.99.1
Scan saved at 22:40:42, on 29/01/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\cisvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINNT\system32\cidaemon.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Barre d'outils du menu Anti-fraude de Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINNT\system32\BhoECart.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Barre d'outils du menu Anti-fraude de Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKLM\..\Run: [eCarteBleue-LP-P1] "C:\Program Files\e-Carte Bleue\LA BANQUE POSTALE\CVD ADESIO\ECB.exe" /dontopenmycards
O4 - HKLM\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKLM\..\Run: [ParentalControl] C:\Program Files\Parental Control\ParentalControl.exe /SERVICE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Contro...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst....
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.pixdiscount.fr/clients/uploader_v2.1.0.53.ca...
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader/i...
O23 - Service: a-squared Anti-Spam Service (A2AntiSpamService) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Spam\A2AntiSpamSrv.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: Blue Coat K9 Web Protection (WebFilter) - Unknown owner - C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
Logfile of HijackThis v1.99.1
Scan saved at 22:40:42, on 29/01/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\cisvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINNT\system32\cidaemon.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Barre d'outils du menu Anti-fraude de Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINNT\system32\BhoECart.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Barre d'outils du menu Anti-fraude de Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKLM\..\Run: [eCarteBleue-LP-P1] "C:\Program Files\e-Carte Bleue\LA BANQUE POSTALE\CVD ADESIO\ECB.exe" /dontopenmycards
O4 - HKLM\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKLM\..\Run: [ParentalControl] C:\Program Files\Parental Control\ParentalControl.exe /SERVICE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Contro...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst....
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.pixdiscount.fr/clients/uploader_v2.1.0.53.ca...
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader/i...
O23 - Service: a-squared Anti-Spam Service (A2AntiSpamService) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Spam\A2AntiSpamSrv.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: Blue Coat K9 Web Protection (WebFilter) - Unknown owner - C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
Bonsoir,
Télécharge SpySweeper (de Webroot, version d'essai de 14 jours) :
-Clique sur "Télécharger la version test".
-Installe le programme en choississant "installation standard".
-Accepte le redémarrage
-L'option de le mettre à jour s'affichera, acceptes la mise à jour
-Lorsque les mises à jour seront installées, dans colonne de gauche clique sur l'onglet Options puis analyse.
-Sous Eléments à analyser et Autres options coche toutes les cases.
-Ferme SpySweeper
La suite étant faite en mode sans échec, imprime ou copie/colle dans un fichier texte les instructions suivantes
Redémarre en mode sans échec : au redémarrage, tapotes immédiatement la touche F8, tu verras un écran avec choix de démarrages apparaître. Utilisant les flèches du clavier, choisis "Mode Sans Échec" et valide avec "Entrée". Choisis ton compte usuel, et non Administrateur.
Si tu n’arrives vraiment pas à redémarrer en mode sans échec je te propose ce lien :
Redémarrer en mode sans échec
Démarre SpySweeper
-Clique Analyser sur la gauche puis sur Démarrer l'analyse.
-Quand le scan est terminé, clique sur Suivant.
-Assure-toi que tous les éléments trouvés sont tous cochés, puis clic sur Suivant.
-Tous les éléments cochés seront alors mis en quarantaine.
-Dans "Récapitulatif", sélectionne en bas Afficher le journal de session puis Enregistrer dans un fichier afin de sauvegarder le rapport.
Redémarre normalement
Désinstalle SpySweeper à partir de ajout/suppression de programme sauf si tu veux continuer l'évaluation pendant 15 jours.
Copie/colle le rapport de SpySweeper ici
-Clique sur "Télécharger la version test".
-Installe le programme en choississant "installation standard".
-Accepte le redémarrage
-L'option de le mettre à jour s'affichera, acceptes la mise à jour
-Lorsque les mises à jour seront installées, dans colonne de gauche clique sur l'onglet Options puis analyse.
-Sous Eléments à analyser et Autres options coche toutes les cases.
-Ferme SpySweeper
La suite étant faite en mode sans échec, imprime ou copie/colle dans un fichier texte les instructions suivantes
Si tu n’arrives vraiment pas à redémarrer en mode sans échec je te propose ce lien :
Redémarrer en mode sans échec
-Clique Analyser sur la gauche puis sur Démarrer l'analyse.
-Quand le scan est terminé, clique sur Suivant.
-Assure-toi que tous les éléments trouvés sont tous cochés, puis clic sur Suivant.
-Tous les éléments cochés seront alors mis en quarantaine.
-Dans "Récapitulatif", sélectionne en bas Afficher le journal de session puis Enregistrer dans un fichier afin de sauvegarder le rapport.
Aussi peux-tu me dire quels sont tes conseils pour éviter cela et si je peux ou dois utiliser régulièrement les programmes et utilitaires que tu m'a donné lors de tes réponses?
Les rapports Kaspersky et cclean sont bons?
J'en profite pr te poster 1 rapport clean:
Rapport clean par Malekal_morte - http://www.malekal.com
Option 1, executee le mar. 30/01/2007 a 8:50:05,10
*** Recherche de fichiers sur C:
*** Recherche des fichiers dans C:\WINNT\
*** Recherche des fichiers dans C:\WINNT\system32
*** Fin du rapport !
Et toujours plein de grands MERCIS à toi ...
Très bonne journée!
Les rapports Kaspersky et cclean sont bons?
J'en profite pr te poster 1 rapport clean:
Rapport clean par Malekal_morte - http://www.malekal.com
Option 1, executee le mar. 30/01/2007 a 8:50:05,10
*** Recherche de fichiers sur C:
*** Recherche des fichiers dans C:\WINNT\
*** Recherche des fichiers dans C:\WINNT\system32
*** Fin du rapport !
Et toujours plein de grands MERCIS à toi ...
Très bonne journée!
alors... me revoici avec le rapport de SpySweeper... et toujours cette fenêtre "ERROR" Unable to load function FT_Thunk (KERNEL 32.dll) !!
18:48: Removal process completed. Elapsed time 00:00:00
18:48: Quarantining All Traces: servlet cookie
18:48: Quarantining All Traces: fe.lea.lycos.com cookie
18:48: Removal process initiated
18:33: Traces Found: 2
18:33: Full Sweep has completed. Elapsed time 00:30:55
18:33: File Sweep Complete, Elapsed Time: 00:30:10
18:22: Warning: Stream read error
18:22: Warning: Failed to access drive J:
18:22: Warning: Failed to access drive H:
18:22: Warning: Failed to access drive G:
18:21: Warning: Failed to access drive E:
18:21: Warning: Failed to access drive E:
18:19: Warning: Failed to open file "c:\program files\maxis\les sims\userdata2\web pages\ulrih\scrapncv_prev_b.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}". Opération réussie
18:03: Starting File Sweep
18:03: Cookie Sweep Complete, Elapsed Time: 00:00:01
18:03: c:\documents and settings\vincent\cookies\vincent@servlet[2].txt (ID = 3345)
18:03: Found Spy Cookie: servlet cookie
18:03: c:\documents and settings\vincent\cookies\vincent@fe.lea.lycos[1].txt (ID = 2660)
18:03: Found Spy Cookie: fe.lea.lycos.com cookie
18:03: Starting Cookie Sweep
18:03: Registry Sweep Complete, Elapsed Time:00:00:09
18:03: Starting Registry Sweep
18:03: Memory Sweep Complete, Elapsed Time: 00:00:29
18:02: Starting Memory Sweep
18:02: Sweep initiated using definitions version 734
18:02: Spy Sweeper 5.0.7.1608 started
18:02: | Start of Session, jeudi 1 février 2007 |
********
18:02: | End of Session, jeudi 1 février 2007 |
Keylogger Shield: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
18:01: Shield States
18:01: Spyware Definitions: 734
18:01: Spy Sweeper 5.0.7.1608 started
Keylogger Shield: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
17:53: Shield States
17:53: Spyware Definitions: 734
17:53: Spy Sweeper 5.0.7.1608 started
17:53: Spy Sweeper 5.0.7.1608 started
17:53: | Start of Session, jeudi 1 février 2007 |
********
MERCI pour tout...
18:48: Removal process completed. Elapsed time 00:00:00
18:48: Quarantining All Traces: servlet cookie
18:48: Quarantining All Traces: fe.lea.lycos.com cookie
18:48: Removal process initiated
18:33: Traces Found: 2
18:33: Full Sweep has completed. Elapsed time 00:30:55
18:33: File Sweep Complete, Elapsed Time: 00:30:10
18:22: Warning: Stream read error
18:22: Warning: Failed to access drive J:
18:22: Warning: Failed to access drive H:
18:22: Warning: Failed to access drive G:
18:21: Warning: Failed to access drive E:
18:21: Warning: Failed to access drive E:
18:19: Warning: Failed to open file "c:\program files\maxis\les sims\userdata2\web pages\ulrih\scrapncv_prev_b.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}". Opération réussie
18:03: Starting File Sweep
18:03: Cookie Sweep Complete, Elapsed Time: 00:00:01
18:03: c:\documents and settings\vincent\cookies\vincent@servlet[2].txt (ID = 3345)
18:03: Found Spy Cookie: servlet cookie
18:03: c:\documents and settings\vincent\cookies\vincent@fe.lea.lycos[1].txt (ID = 2660)
18:03: Found Spy Cookie: fe.lea.lycos.com cookie
18:03: Starting Cookie Sweep
18:03: Registry Sweep Complete, Elapsed Time:00:00:09
18:03: Starting Registry Sweep
18:03: Memory Sweep Complete, Elapsed Time: 00:00:29
18:02: Starting Memory Sweep
18:02: Sweep initiated using definitions version 734
18:02: Spy Sweeper 5.0.7.1608 started
18:02: | Start of Session, jeudi 1 février 2007 |
********
18:02: | End of Session, jeudi 1 février 2007 |
Keylogger Shield: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
18:01: Shield States
18:01: Spyware Definitions: 734
18:01: Spy Sweeper 5.0.7.1608 started
Keylogger Shield: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
17:53: Shield States
17:53: Spyware Definitions: 734
17:53: Spy Sweeper 5.0.7.1608 started
17:53: Spy Sweeper 5.0.7.1608 started
17:53: | Start of Session, jeudi 1 février 2007 |
********
MERCI pour tout...
le voici...
Logfile of HijackThis v1.99.1
Scan saved at 21:33:54, on 01/02/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\cisvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINNT\system32\cidaemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Barre d'outils du menu Anti-fraude de Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINNT\system32\BhoECart.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Barre d'outils du menu Anti-fraude de Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] "mobsync.exe" /logon
O4 - HKLM\..\Run: [AudioDeck] "C:\Program Files\VIAudioi\SBADeck\ADeck.exe" 1
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKLM\..\Run: [eCarteBleue-LP-P1] "C:\Program Files\e-Carte Bleue\LA BANQUE POSTALE\CVD ADESIO\ECB.exe" /dontopenmycards
O4 - HKLM\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKLM\..\Run: [ParentalControl] C:\Program Files\Parental Control\ParentalControl.exe /SERVICE
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Contro...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst....
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.pixdiscount.fr/clients/uploader_v2.1.0.53.ca...
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader/i...
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O23 - Service: a-squared Anti-Spam Service (A2AntiSpamService) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Spam\A2AntiSpamSrv.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: Blue Coat K9 Web Protection (WebFilter) - Unknown owner - C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
ça ne va pas ??
Logfile of HijackThis v1.99.1
Scan saved at 21:33:54, on 01/02/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\cisvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINNT\system32\cidaemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Barre d'outils du menu Anti-fraude de Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINNT\system32\BhoECart.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Barre d'outils du menu Anti-fraude de Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~2\PccIeBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] "mobsync.exe" /logon
O4 - HKLM\..\Run: [AudioDeck] "C:\Program Files\VIAudioi\SBADeck\ADeck.exe" 1
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKLM\..\Run: [eCarteBleue-LP-P1] "C:\Program Files\e-Carte Bleue\LA BANQUE POSTALE\CVD ADESIO\ECB.exe" /dontopenmycards
O4 - HKLM\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKLM\..\Run: [ParentalControl] C:\Program Files\Parental Control\ParentalControl.exe /SERVICE
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [hldrrr] C:\WINNT\system32\hldrrr.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Contro...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst....
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.pixdiscount.fr/clients/uploader_v2.1.0.53.ca...
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader/i...
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O23 - Service: a-squared Anti-Spam Service (A2AntiSpamService) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Spam\A2AntiSpamSrv.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: Blue Coat K9 Web Protection (WebFilter) - Unknown owner - C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
ça ne va pas ??
Re,
Toujours la ligne.
Télécharge Gmer.
Dézippe le dans un dossier ou sur ton bureau.
Déconnecte toi d'Internet puis et ferme tous les programmes.
Double-clique sur Gmer.exe.
IMPORTANT: Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.
Clique sur l'onglet rootkit.
A droite, coche Files et Services.
Clique maintenant sur Scan.
Lorsque le scan est terminé, clique sur Copy.
Ouvre le Bloc-notes puis clique sur le Menu Edition / Coller.
Le rapport doit alors apparaître.
Enregistre le fichier sur ton bureau et copie/colle le contenu ici.
Toujours la ligne.
Télécharge Gmer.
Dézippe le dans un dossier ou sur ton bureau.
Déconnecte toi d'Internet puis et ferme tous les programmes.
Double-clique sur Gmer.exe.
IMPORTANT: Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.
Clique sur l'onglet rootkit.
A droite, coche Files et Services.
Clique maintenant sur Scan.
Lorsque le scan est terminé, clique sur Copy.
Ouvre le Bloc-notes puis clique sur le Menu Edition / Coller.
Le rapport doit alors apparaître.
Enregistre le fichier sur ton bureau et copie/colle le contenu ici.
Bonjour Angeldark..
Voici donc le rapport de GMER j'espère que c'est bien ça car tout ne c'est
pas passé comme voulu...
bonne lecture et j'espère que tu seras satisfait, que tout va rentrer dans l'ordre pour que je te laisse tranquille...
Quand ce sera fini, pourras-tu juste ma dire quels programmes je gardes (killbox,clean,BFU,Gmer ??) et comment je les utilises à l'avenir?
très bonne journée et MERCI...MERCI...
GMER 1.0.12.12011 - http://www.gmer.net
Rootkit scan 2007-02-02 10:03:13
Windows 5.0.2195 Service Pack 4
---- System - GMER 1.0.12 ----
SSDT 85E13A20 ZwAllocateVirtualMemory
SSDT 85E17160 ZwCreateKey
SSDT 85E13EA0 ZwCreateProcess
SSDT 85E13D20 ZwCreateThread
SSDT 85E14220 ZwDeleteKey
SSDT 85E13F20 ZwDeleteValueKey
SSDT sptd.sys ZwEnumerateKey
SSDT sptd.sys ZwEnumerateValueKey
SSDT sptd.sys ZwOpenKey
SSDT sptd.sys ZwQueryKey
SSDT sptd.sys ZwQueryValueKey
SSDT 85E13AA0 ZwQueueApcThread
SSDT 85E13920 ZwReadVirtualMemory
SSDT 85E13BA0 ZwSetContextThread
SSDT 85E141A0 ZwSetInformationKey
SSDT 85E13DA0 ZwSetInformationProcess
SSDT 85E13C20 ZwSetInformationThread
SSDT 85E13FA0 ZwSetValueKey
SSDT 85E13B20 ZwSuspendThread
SSDT 85E13E20 ZwTerminateProcess
SSDT 85E13CA0 ZwTerminateThread
SSDT 85E139A0 ZwWriteVirtualMemory
---- Kernel code sections - GMER 1.0.12 ----
.text ntoskrnl.exe!NtClose 8044EAF0 10 Bytes [ B8, 61, 70, F4, AC, FF, E0, ... ]
PAGE ntoskrnl.exe!IoCreateFile 8049F64C 7 Bytes [ B8, E0, 6E, F4, AC, FF, E0 ]
.text NTDLL.DLL!NtClose 784681F8 5 Bytes JMP 72033FAA
.text NTDLL.DLL!NtCreateProcess 78468308 5 Bytes JMP 72034135
.text NTDLL.DLL!NtCreateSection 78468328 5 Bytes JMP 72033FC8
---- User code sections - GMER 1.0.12 ----
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtCreateKey + 1 784682A9 1 Byte [ 22 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtCreateKey + 4 784682AC 7 Bytes [ C0, 90, 90, 90, 90, 90, 90 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtCreateProcess + 1 78468309 1 Byte [ 22 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtCreateProcess + 4 7846830C 7 Bytes [ C0, 90, 90, 90, 90, 90, 90 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtOpenFile + 1 784686AD 1 Byte [ 22 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtOpenFile + 4 784686B0 7 Bytes [ C0, 90, 90, 90, 90, 90, 90 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtOpenKey + 1 784686DD 1 Byte [ 22 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtOpenKey + 4 784686E0 7 Bytes [ C0, 90, 90, 90, 90, 90, 90 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] KERNEL32.dll!CreateFileA 77E8C213 5 Bytes JMP 00030444 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] KERNEL32.dll!VirtualAlloc 77E8E8AD 5 Bytes JMP 000305F4 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] KERNEL32.dll!VirtualFree 77E8E8C7 5 Bytes JMP 00030634 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] KERNEL32.dll!VirtualProtect 77E8E9BE 5 Bytes JMP 00030670 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] KERNEL32.dll!LoadLibraryExW 77E90565 5 Bytes JMP 00030444 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] KERNEL32.dll!FreeLibrary + 37 77E9089E 4 Bytes [ 9A, F7, 86, F9 ]
.text C:\WINNT\Explorer.EXE[804] ADVAPI32.DLL!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 1A, 5F ]
.text C:\WINNT\Explorer.EXE[804] ADVAPI32.DLL!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 1D, 5F ]
.text C:\WINNT\Explorer.EXE[804] KERNEL32.dll!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\WINNT\Explorer.EXE[804] KERNEL32.dll!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\WINNT\Explorer.EXE[804] KERNEL32.dll!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 23, 5F ]
.text C:\WINNT\Explorer.EXE[804] KERNEL32.dll!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\WINNT\Explorer.EXE[804] KERNEL32.dll!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 20, 5F ]
.text C:\WINNT\Explorer.EXE[804] SHELL32.dll!Shell_NotifyIconW 7CEA80E4 6 Bytes [ FF, 25, 1E, 00, 29, 5F ]
.text C:\WINNT\Explorer.EXE[804] SHELL32.dll!Shell_NotifyIcon 7CEA81E3 6 Bytes [ FF, 25, 1E, 00, 26, 5F ]
.text C:\WINNT\Explorer.EXE[804] WS2_32.DLL!connect 74FBC1B9 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\WINNT\Explorer.EXE[804] WS2_32.DLL!listen 74FBC556 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe[908] KERNEL32.dll!FreeLibrary + 37 77E9089E 4 Bytes [ 9A, F7, 86, F9 ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe[980] KERNEL32.dll!CreateThread + 18 77E9B864 4 Bytes [ 98, 35, 5B, 88 ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] KERNEL32.dll!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] KERNEL32.dll!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] KERNEL32.dll!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] KERNEL32.dll!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] KERNEL32.dll!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] ADVAPI32.dll!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 0E, 5F ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] ADVAPI32.dll!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 11, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] KERNEL32.dll!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] KERNEL32.dll!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] KERNEL32.dll!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 1D, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] KERNEL32.dll!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] KERNEL32.dll!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 1A, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] ADVAPI32.dll!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] ADVAPI32.dll!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] SHELL32.dll!Shell_NotifyIconW 7CEA80E4 6 Bytes [ FF, 25, 1E, 00, 23, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] SHELL32.dll!Shell_NotifyIcon 7CEA81E3 6 Bytes [ FF, 25, 1E, 00, 20, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] WS2_32.DLL!connect 74FBC1B9 6 Bytes [ FF, 25, 1E, 00, 0E, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] WS2_32.DLL!listen 74FBC556 6 Bytes [ FF, 25, 1E, 00, 11, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] KERNEL32.DLL!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] KERNEL32.DLL!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] KERNEL32.DLL!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 1D, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] KERNEL32.DLL!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] KERNEL32.DLL!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 1A, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] ADVAPI32.DLL!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] ADVAPI32.DLL!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] WS2_32.DLL!connect 74FBC1B9 6 Bytes [ FF, 25, 1E, 00, 0E, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] WS2_32.DLL!listen 74FBC556 6 Bytes [ FF, 25, 1E, 00, 11, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] SHELL32.DLL!Shell_NotifyIconW 7CEA80E4 6 Bytes [ FF, 25, 1E, 00, 23, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] SHELL32.DLL!Shell_NotifyIcon 7CEA81E3 6 Bytes [ FF, 25, 1E, 00, 20, 5F ]
.text C:\Program Files\a-squared Anti-Dialer\a2adguard.exe[1744] KERNEL32.dll!CreateThread + 18 77E9B864 4 Bytes [ 68, 0F, 3E, 88 ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] ADVAPI32.dll!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 1A, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] ADVAPI32.dll!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 1D, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] KERNEL32.dll!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] KERNEL32.dll!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] KERNEL32.dll!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 23, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] KERNEL32.dll!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] KERNEL32.dll!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 20, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] WS2_32.dll!connect 74FBC1B9 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] WS2_32.dll!listen 74FBC556 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] SHELL32.dll!Shell_NotifyIconW 7CEA80E4 6 Bytes [ FF, 25, 1E, 00, 29, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] SHELL32.dll!Shell_NotifyIcon 7CEA81E3 6 Bytes [ FF, 25, 1E, 00, 26, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!FreeLibrary + 37 77E9089E 4 Bytes [ 9A, F7, 86, F9 ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 1D, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 1A, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!CreateThread + 18 77E9B864 4 Bytes [ 54, 31, 5B, 88 ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] ADVAPI32.dll!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] ADVAPI32.dll!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] shell32.dll!Shell_NotifyIconW 7CEA80E4 6 Bytes [ FF, 25, 1E, 00, 23, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] shell32.dll!Shell_NotifyIcon 7CEA81E3 6 Bytes [ FF, 25, 1E, 00, 20, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] WS2_32.DLL!connect 74FBC1B9 6 Bytes [ FF, 25, 1E, 00, 0E, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] WS2_32.DLL!listen 74FBC556 6 Bytes [ FF, 25, 1E, 00, 11, 5F ]
.text C:\WINNT\system32\cidaemon.exe[1816] KERNEL32.dll!FreeLibrary + 37 77E9089E 4 Bytes [ 9A, F7, 86, F9 ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] KERNEL32.dll!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] KERNEL32.dll!FreeLibrary + 37 77E9089E 4 Bytes [ 9A, F7, 86, F9 ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] KERNEL32.dll!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] KERNEL32.dll!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] KERNEL32.dll!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] KERNEL32.dll!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] ADVAPI32.dll!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 0E, 5F ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] ADVAPI32.dll!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 11, 5F ]
---- Devices - GMER 1.0.12 ----
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 85EADEA8
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE 85A19A20
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_NAMED_PIPE 85A199A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE 85A19920
Device \Driver\Tcpip \Device\Ip IRP_MJ_READ 85A198A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_WRITE 85A19820
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_INFORMATION 85A197A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_INFORMATION 85A19720
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_EA 85A196A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_EA 85A19620
Device \Driver\Tcpip \Device\Ip IRP_MJ_FLUSH_BUFFERS 85A195A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_VOLUME_INFORMATION 85A19520
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_VOLUME_INFORMATION 85A194A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_DIRECTORY_CONTROL 85A19420
Device \Driver\Tcpip \Device\Ip IRP_MJ_FILE_SYSTEM_CONTROL 85A193A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL 85A19320
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL 85A192A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN 85A19220
Device \Driver\Tcpip \Device\Ip IRP_MJ_LOCK_CONTROL 85A191A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP 85A19120
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT 85A18020
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_SECURITY 85A18FA0
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_SECURITY 85A18F20
Device \Driver\Tcpip \Device\Ip IRP_MJ_POWER 85A18EA0
Device \Driver\Tcpip \Device\Ip IRP_MJ_SYSTEM_CONTROL 85A18E20
Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CHANGE 85A18DA0
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_QUOTA 85A18D20
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_QUOTA 85A18CA0
Device \Driver\Tcpip \Device\Ip IRP_MJ_PNP 85A18C20
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CLOSE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_READ 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_WRITE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_FLUSH_BUFFERS 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SHUTDOWN 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_POWER 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_PNP 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CLOSE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_READ 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_WRITE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_FLUSH_BUFFERS 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SHUTDOWN 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_POWER 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_PNP 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CREATE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CLOSE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_READ 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_WRITE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_FLUSH_BUFFERS 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SHUTDOWN 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_POWER 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_PNP 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CREATE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CLOSE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_READ 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_WRITE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_FLUSH_BUFFERS 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_SHUTDOWN 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_POWER 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_PNP 85E7DBE8
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE 85A19A20
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE 85A199A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE 85A19920
Device \Driver\Tcpip \Device\Tcp IRP_MJ_READ 85A198A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_WRITE 85A19820
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_INFORMATION 85A197A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION 85A19720
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_EA 85A196A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_EA 85A19620
Device \Driver\Tcpip \Device\Tcp IRP_MJ_FLUSH_BUFFERS 85A195A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION 85A19520
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION 85A194A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DIRECTORY_CONTROL 85A19420
Device \Driver\Tcpip \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL 85A193A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL 85A19320
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL 85A192A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN 85A19220
Device \Driver\Tcpip \Device\Tcp IRP_MJ_LOCK_CONTROL 85A191A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP 85A19120
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT 85A18020
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_SECURITY 85A18FA0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_SECURITY 85A18F20
Device \Driver\Tcpip \Device\Tcp IRP_MJ_POWER 85A18EA0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SYSTEM_CONTROL 85A18E20
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CHANGE 85A18DA0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_QUOTA 85A18D20
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_QUOTA 85A18CA0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_PNP 85A18C20
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_CREATE E1661388
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_CLOSE E1661388
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_DEVICE_CONTROL E1661388
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_READ 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_WRITE 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CLEANUP 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_POWER 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_PNP 85E7DEA8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 85CE90E8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_READ 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_WRITE 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_FLUSH_BUFFERS 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_DEVICE_CONTROL 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SHUTDOWN 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CLEANUP 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_POWER 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_PNP 85E7DEA8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_NAMED_PIPE 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLOSE 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_WRITE 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_INFORMATION 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_INFORMATION 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_EA 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_EA 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FLUSH_BUFFERS 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_VOLUME_INFORMATION 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_VOLUME_INFORMATION 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DIRECTORY_CONTROL 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FILE_SYSTEM_CONTROL 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CONTROL 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_INTERNAL_DEVICE_CONTROL 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SHUTDOWN 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_LOCK_CONTROL 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLEANUP 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_MAILSLOT 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_SECURITY 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_SECURITY 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_POWER 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SYSTEM_CONTROL 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CHANGE 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_QUOTA 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_QUOTA 858460E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 85CE90E8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CREATE 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_READ 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_WRITE 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_FLUSH_BUFFERS 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_DEVICE_CONTROL 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SHUTDOWN 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CLEANUP 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_POWER 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_PNP 85E7DEA8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-2 IRP_MJ_INTERNAL_DEVICE_CONTROL [EB50661D] prosync1.sys
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL [EB50661D] prosync1.sys
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL [EB50661D] prosync1.sys
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-a IRP_MJ_INTERNAL_DEVICE_CONTROL [EB50661D] prosync1.sys
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-1c IRP_MJ_INTERNAL_DEVICE_CONTROL [EB50661D] prosync1.sys
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-14 IRP_MJ_INTERNAL_DEVICE_CONTROL [EB50661D] prosync1.sys
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLOSE 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_READ 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_WRITE 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FLUSH_BUFFERS 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_INTERNAL_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SHUTDOWN 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_POWER 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SYSTEM_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_PNP 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CREATE 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CLOSE 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_READ 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_WRITE 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_FLUSH_BUFFERS 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_INTERNAL_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SHUTDOWN 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_POWER 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SYSTEM_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_PNP 85CE90E8
Device \Driver\prohlp02 \Device\ProHlp02 IRP_MJ_CREATE E14A82C8
Device \Driver\prohlp02 \Device\ProHlp02 IRP_MJ_CLOSE E14A82C8
Device \Driver\prohlp02 \Device\ProHlp02 IRP_MJ_DEVICE_CONTROL E14A82C8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE 859850E8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLOSE 859850E8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_DEVICE_CONTROL 859850E8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_INTERNAL_DEVICE_CONTROL 859850E8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLEANUP 859850E8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_SYSTEM_CONTROL 859850E8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_PNP 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CREATE 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLOSE 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_DEVICE_CONTROL 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_INTERNAL_DEVICE_CONTROL 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLEANUP 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_SYSTEM_CONTROL 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_PNP 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_CREATE 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_CLOSE 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_DEVICE_CONTROL 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_INTERNAL_DEVICE_CONTROL 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_CLEANUP 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_SYSTEM_CONTROL 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_PNP 859850E8
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE 85A19A20
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_NAMED_PIPE 85A199A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE 85A19920
Device \Driver\Tcpip \Device\Udp IRP_MJ_READ 85A198A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_WRITE 85A19820
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_INFORMATION 85A197A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_INFORMATION 85A19720
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_EA 85A196A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_EA 85A19620
Device \Driver\Tcpip \Device\Udp IRP_MJ_FLUSH_BUFFERS 85A195A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_VOLUME_INFORMATION 85A19520
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_VOLUME_INFORMATION 85A194A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_DIRECTORY_CONTROL 85A19420
Device \Driver\Tcpip \Device\Udp IRP_MJ_FILE_SYSTEM_CONTROL 85A193A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL 85A19320
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL 85A192A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_SHUTDOWN 85A19220
Device \Driver\Tcpip \Device\Udp IRP_MJ_LOCK_CONTROL 85A191A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP 85A19120
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_MAILSLOT 85A18020
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_SECURITY 85A18FA0
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_SECURITY 85A18F20
Device \Driver\Tcpip \Device\Udp IRP_MJ_POWER 85A18EA0
Device \Driver\Tcpip \Device\Udp IRP_MJ_SYSTEM_CONTROL 85A18E20
Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CHANGE 85A18DA0
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_QUOTA 85A18D20
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_QUOTA 85A18CA0
Device \Driver\Tcpip \Device\Udp IRP_MJ_PNP 85A18C20
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE 85A19A20
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_NAMED_PIPE 85A199A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE 85A19920
Device \Driver\Tcpip \Device\RawIp IRP_MJ_READ 85A198A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_WRITE 85A19820
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_INFORMATION 85A197A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_INFORMATION 85A19720
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_EA 85A196A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_EA 85A19620
Device \Driver\Tcpip \Device\RawIp IRP_MJ_FLUSH_BUFFERS 85A195A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_VOLUME_INFORMATION 85A19520
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_VOLUME_INFORMATION 85A194A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DIRECTORY_CONTROL 85A19420
Device \Driver\Tcpip \Device\RawIp IRP_MJ_FILE_SYSTEM_CONTROL 85A193A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL 85A19320
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL 85A192A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SHUTDOWN 85A19220
Device \Driver\Tcpip \Device\RawIp IRP_MJ_LOCK_CONTROL 85A191A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP 85A19120
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_MAILSLOT 85A18020
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_SECURITY 85A18FA0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_SECURITY 85A18F20
Device \Driver\Tcpip \Device\RawIp IRP_MJ_POWER 85A18EA0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SYSTEM_CONTROL 85A18E20
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CHANGE 85A18DA0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_QUOTA 85A18D20
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_QUOTA 85A18CA0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_PNP 85A18C20
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_CREATE 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_CLOSE 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_READ 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_WRITE 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_FLUSH_BUFFERS 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_DEVICE_CONTROL 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_INTERNAL_DEVICE_CONTROL 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_SHUTDOWN 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_POWER 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_SYSTEM_CONTROL 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_PNP 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_CREATE 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_CLOSE 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_READ 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_WRITE 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_FLUSH_BUFFERS 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_DEVICE_CONTROL 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_INTERNAL_DEVICE_CONTROL 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_SHUTDOWN 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_POWER 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_SYSTEM_CONTROL 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_PNP 85EAD0E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_NAMED_PIPE 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLOSE 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_READ 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_WRITE 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_INFORMATION 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_INFORMATION 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_EA 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_EA 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FLUSH_BUFFERS 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_VOLUME_INFORMATION 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_VOLUME_INFORMATION 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DIRECTORY_CONTROL 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FILE_SYSTEM_CONTROL 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CONTROL 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_INTERNAL_DEVICE_CONTROL 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SHUTDOWN 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_LOCK_CONTROL 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLEANUP 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_MAILSLOT 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_SECURITY 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_SECURITY 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_POWER 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SYSTEM_CONTROL 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CHANGE 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_QUOTA 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_QUOTA 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP 85841728
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE 85A19A20
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE_NAMED_PIPE 85A199A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSE 85A19920
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_READ 85A198A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_WRITE 85A19820
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_INFORMATION 85A197A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_INFORMATION 85A19720
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_EA 85A196A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_EA 85A19620
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_FLUSH_BUFFERS 85A195A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_VOLUME_INFORMATION 85A19520
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_VOLUME_INFORMATION 85A194A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DIRECTORY_CONTROL 85A19420
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_FILE_SYSTEM_CONTROL 85A193A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DEVICE_CONTROL 85A19320
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL 85A192A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SHUTDOWN 85A19220
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_LOCK_CONTROL 85A191A
Voici donc le rapport de GMER j'espère que c'est bien ça car tout ne c'est
pas passé comme voulu...
bonne lecture et j'espère que tu seras satisfait, que tout va rentrer dans l'ordre pour que je te laisse tranquille...
Quand ce sera fini, pourras-tu juste ma dire quels programmes je gardes (killbox,clean,BFU,Gmer ??) et comment je les utilises à l'avenir?
très bonne journée et MERCI...MERCI...
GMER 1.0.12.12011 - http://www.gmer.net
Rootkit scan 2007-02-02 10:03:13
Windows 5.0.2195 Service Pack 4
---- System - GMER 1.0.12 ----
SSDT 85E13A20 ZwAllocateVirtualMemory
SSDT 85E17160 ZwCreateKey
SSDT 85E13EA0 ZwCreateProcess
SSDT 85E13D20 ZwCreateThread
SSDT 85E14220 ZwDeleteKey
SSDT 85E13F20 ZwDeleteValueKey
SSDT sptd.sys ZwEnumerateKey
SSDT sptd.sys ZwEnumerateValueKey
SSDT sptd.sys ZwOpenKey
SSDT sptd.sys ZwQueryKey
SSDT sptd.sys ZwQueryValueKey
SSDT 85E13AA0 ZwQueueApcThread
SSDT 85E13920 ZwReadVirtualMemory
SSDT 85E13BA0 ZwSetContextThread
SSDT 85E141A0 ZwSetInformationKey
SSDT 85E13DA0 ZwSetInformationProcess
SSDT 85E13C20 ZwSetInformationThread
SSDT 85E13FA0 ZwSetValueKey
SSDT 85E13B20 ZwSuspendThread
SSDT 85E13E20 ZwTerminateProcess
SSDT 85E13CA0 ZwTerminateThread
SSDT 85E139A0 ZwWriteVirtualMemory
---- Kernel code sections - GMER 1.0.12 ----
.text ntoskrnl.exe!NtClose 8044EAF0 10 Bytes [ B8, 61, 70, F4, AC, FF, E0, ... ]
PAGE ntoskrnl.exe!IoCreateFile 8049F64C 7 Bytes [ B8, E0, 6E, F4, AC, FF, E0 ]
.text NTDLL.DLL!NtClose 784681F8 5 Bytes JMP 72033FAA
.text NTDLL.DLL!NtCreateProcess 78468308 5 Bytes JMP 72034135
.text NTDLL.DLL!NtCreateSection 78468328 5 Bytes JMP 72033FC8
---- User code sections - GMER 1.0.12 ----
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtCreateKey + 1 784682A9 1 Byte [ 22 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtCreateKey + 4 784682AC 7 Bytes [ C0, 90, 90, 90, 90, 90, 90 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtCreateProcess + 1 78468309 1 Byte [ 22 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtCreateProcess + 4 7846830C 7 Bytes [ C0, 90, 90, 90, 90, 90, 90 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtOpenFile + 1 784686AD 1 Byte [ 22 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtOpenFile + 4 784686B0 7 Bytes [ C0, 90, 90, 90, 90, 90, 90 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtOpenKey + 1 784686DD 1 Byte [ 22 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] ntdll.dll!NtOpenKey + 4 784686E0 7 Bytes [ C0, 90, 90, 90, 90, 90, 90 ]
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] KERNEL32.dll!CreateFileA 77E8C213 5 Bytes JMP 00030444 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] KERNEL32.dll!VirtualAlloc 77E8E8AD 5 Bytes JMP 000305F4 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] KERNEL32.dll!VirtualFree 77E8E8C7 5 Bytes JMP 00030634 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] KERNEL32.dll!VirtualProtect 77E8E9BE 5 Bytes JMP 00030670 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] KERNEL32.dll!LoadLibraryExW 77E90565 5 Bytes JMP 00030444 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[720] KERNEL32.dll!FreeLibrary + 37 77E9089E 4 Bytes [ 9A, F7, 86, F9 ]
.text C:\WINNT\Explorer.EXE[804] ADVAPI32.DLL!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 1A, 5F ]
.text C:\WINNT\Explorer.EXE[804] ADVAPI32.DLL!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 1D, 5F ]
.text C:\WINNT\Explorer.EXE[804] KERNEL32.dll!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\WINNT\Explorer.EXE[804] KERNEL32.dll!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\WINNT\Explorer.EXE[804] KERNEL32.dll!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 23, 5F ]
.text C:\WINNT\Explorer.EXE[804] KERNEL32.dll!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\WINNT\Explorer.EXE[804] KERNEL32.dll!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 20, 5F ]
.text C:\WINNT\Explorer.EXE[804] SHELL32.dll!Shell_NotifyIconW 7CEA80E4 6 Bytes [ FF, 25, 1E, 00, 29, 5F ]
.text C:\WINNT\Explorer.EXE[804] SHELL32.dll!Shell_NotifyIcon 7CEA81E3 6 Bytes [ FF, 25, 1E, 00, 26, 5F ]
.text C:\WINNT\Explorer.EXE[804] WS2_32.DLL!connect 74FBC1B9 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\WINNT\Explorer.EXE[804] WS2_32.DLL!listen 74FBC556 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe[908] KERNEL32.dll!FreeLibrary + 37 77E9089E 4 Bytes [ 9A, F7, 86, F9 ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe[980] KERNEL32.dll!CreateThread + 18 77E9B864 4 Bytes [ 98, 35, 5B, 88 ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] KERNEL32.dll!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] KERNEL32.dll!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] KERNEL32.dll!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] KERNEL32.dll!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] KERNEL32.dll!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] ADVAPI32.dll!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 0E, 5F ]
.text C:\WINNT\system32\Ati2evxx.exe[1416] ADVAPI32.dll!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 11, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] KERNEL32.dll!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] KERNEL32.dll!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] KERNEL32.dll!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 1D, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] KERNEL32.dll!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] KERNEL32.dll!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 1A, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] ADVAPI32.dll!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] ADVAPI32.dll!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] SHELL32.dll!Shell_NotifyIconW 7CEA80E4 6 Bytes [ FF, 25, 1E, 00, 23, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] SHELL32.dll!Shell_NotifyIcon 7CEA81E3 6 Bytes [ FF, 25, 1E, 00, 20, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] WS2_32.DLL!connect 74FBC1B9 6 Bytes [ FF, 25, 1E, 00, 0E, 5F ]
.text C:\Program Files\VIAudioi\SBADeck\ADeck.exe[1724] WS2_32.DLL!listen 74FBC556 6 Bytes [ FF, 25, 1E, 00, 11, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] KERNEL32.DLL!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] KERNEL32.DLL!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] KERNEL32.DLL!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 1D, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] KERNEL32.DLL!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] KERNEL32.DLL!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 1A, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] ADVAPI32.DLL!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] ADVAPI32.DLL!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] WS2_32.DLL!connect 74FBC1B9 6 Bytes [ FF, 25, 1E, 00, 0E, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] WS2_32.DLL!listen 74FBC556 6 Bytes [ FF, 25, 1E, 00, 11, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] SHELL32.DLL!Shell_NotifyIconW 7CEA80E4 6 Bytes [ FF, 25, 1E, 00, 23, 5F ]
.text C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe[1736] SHELL32.DLL!Shell_NotifyIcon 7CEA81E3 6 Bytes [ FF, 25, 1E, 00, 20, 5F ]
.text C:\Program Files\a-squared Anti-Dialer\a2adguard.exe[1744] KERNEL32.dll!CreateThread + 18 77E9B864 4 Bytes [ 68, 0F, 3E, 88 ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] ADVAPI32.dll!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 1A, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] ADVAPI32.dll!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 1D, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] KERNEL32.dll!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] KERNEL32.dll!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] KERNEL32.dll!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 23, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] KERNEL32.dll!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] KERNEL32.dll!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 20, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] WS2_32.dll!connect 74FBC1B9 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] WS2_32.dll!listen 74FBC556 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] SHELL32.dll!Shell_NotifyIconW 7CEA80E4 6 Bytes [ FF, 25, 1E, 00, 29, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[1780] SHELL32.dll!Shell_NotifyIcon 7CEA81E3 6 Bytes [ FF, 25, 1E, 00, 26, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!FreeLibrary + 37 77E9089E 4 Bytes [ 9A, F7, 86, F9 ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 1D, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 1A, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] KERNEL32.dll!CreateThread + 18 77E9B864 4 Bytes [ 54, 31, 5B, 88 ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] ADVAPI32.dll!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] ADVAPI32.dll!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] shell32.dll!Shell_NotifyIconW 7CEA80E4 6 Bytes [ FF, 25, 1E, 00, 23, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] shell32.dll!Shell_NotifyIcon 7CEA81E3 6 Bytes [ FF, 25, 1E, 00, 20, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] WS2_32.DLL!connect 74FBC1B9 6 Bytes [ FF, 25, 1E, 00, 0E, 5F ]
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[1796] WS2_32.DLL!listen 74FBC556 6 Bytes [ FF, 25, 1E, 00, 11, 5F ]
.text C:\WINNT\system32\cidaemon.exe[1816] KERNEL32.dll!FreeLibrary + 37 77E9089E 4 Bytes [ 9A, F7, 86, F9 ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] KERNEL32.dll!LoadLibraryExW 77E90565 6 Bytes [ FF, 25, 1E, 00, 08, 5F ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] KERNEL32.dll!FreeLibrary + 37 77E9089E 4 Bytes [ 9A, F7, 86, F9 ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] KERNEL32.dll!CreateProcessW 77E96951 6 Bytes [ FF, 25, 1E, 00, 0B, 5F ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] KERNEL32.dll!OpenProcess 77E9697D 6 Bytes [ FF, 25, 1E, 00, 17, 5F ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] KERNEL32.dll!WinExec 77E974FA 6 Bytes [ FF, 25, 1E, 00, 05, 5F ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] KERNEL32.dll!WriteProcessMemory 77E97960 6 Bytes [ FF, 25, 1E, 00, 14, 5F ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] ADVAPI32.dll!CreateServiceA 78F14B39 6 Bytes [ FF, 25, 1E, 00, 0E, 5F ]
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[2088] ADVAPI32.dll!CreateServiceW 78F14CF9 6 Bytes [ FF, 25, 1E, 00, 11, 5F ]
---- Devices - GMER 1.0.12 ----
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 85EADEA8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 85EADEA8
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE 85A19A20
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_NAMED_PIPE 85A199A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE 85A19920
Device \Driver\Tcpip \Device\Ip IRP_MJ_READ 85A198A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_WRITE 85A19820
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_INFORMATION 85A197A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_INFORMATION 85A19720
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_EA 85A196A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_EA 85A19620
Device \Driver\Tcpip \Device\Ip IRP_MJ_FLUSH_BUFFERS 85A195A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_VOLUME_INFORMATION 85A19520
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_VOLUME_INFORMATION 85A194A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_DIRECTORY_CONTROL 85A19420
Device \Driver\Tcpip \Device\Ip IRP_MJ_FILE_SYSTEM_CONTROL 85A193A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL 85A19320
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL 85A192A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN 85A19220
Device \Driver\Tcpip \Device\Ip IRP_MJ_LOCK_CONTROL 85A191A0
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP 85A19120
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT 85A18020
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_SECURITY 85A18FA0
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_SECURITY 85A18F20
Device \Driver\Tcpip \Device\Ip IRP_MJ_POWER 85A18EA0
Device \Driver\Tcpip \Device\Ip IRP_MJ_SYSTEM_CONTROL 85A18E20
Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CHANGE 85A18DA0
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_QUOTA 85A18D20
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_QUOTA 85A18CA0
Device \Driver\Tcpip \Device\Ip IRP_MJ_PNP 85A18C20
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CLOSE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_READ 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_WRITE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_FLUSH_BUFFERS 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SHUTDOWN 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_POWER 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_PNP 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CLOSE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_READ 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_WRITE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_FLUSH_BUFFERS 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SHUTDOWN 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_POWER 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_PNP 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CREATE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CLOSE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_READ 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_WRITE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_FLUSH_BUFFERS 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SHUTDOWN 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_POWER 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_PNP 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CREATE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CLOSE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_READ 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_WRITE 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_FLUSH_BUFFERS 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_SHUTDOWN 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_POWER 85E7DBE8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_PNP 85E7DBE8
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE 85A19A20
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE 85A199A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE 85A19920
Device \Driver\Tcpip \Device\Tcp IRP_MJ_READ 85A198A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_WRITE 85A19820
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_INFORMATION 85A197A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION 85A19720
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_EA 85A196A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_EA 85A19620
Device \Driver\Tcpip \Device\Tcp IRP_MJ_FLUSH_BUFFERS 85A195A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION 85A19520
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION 85A194A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DIRECTORY_CONTROL 85A19420
Device \Driver\Tcpip \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL 85A193A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL 85A19320
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL 85A192A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN 85A19220
Device \Driver\Tcpip \Device\Tcp IRP_MJ_LOCK_CONTROL 85A191A0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP 85A19120
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT 85A18020
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_SECURITY 85A18FA0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_SECURITY 85A18F20
Device \Driver\Tcpip \Device\Tcp IRP_MJ_POWER 85A18EA0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SYSTEM_CONTROL 85A18E20
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CHANGE 85A18DA0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_QUOTA 85A18D20
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_QUOTA 85A18CA0
Device \Driver\Tcpip \Device\Tcp IRP_MJ_PNP 85A18C20
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_CREATE E1661388
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_CLOSE E1661388
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_DEVICE_CONTROL E1661388
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_READ 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_WRITE 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CLEANUP 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_POWER 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_PNP 85E7DEA8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 85CE90E8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_READ 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_WRITE 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_FLUSH_BUFFERS 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_DEVICE_CONTROL 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SHUTDOWN 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CLEANUP 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_POWER 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_PNP 85E7DEA8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_NAMED_PIPE 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLOSE 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_WRITE 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_INFORMATION 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_INFORMATION 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_EA 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_EA 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FLUSH_BUFFERS 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_VOLUME_INFORMATION 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_VOLUME_INFORMATION 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DIRECTORY_CONTROL 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FILE_SYSTEM_CONTROL 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CONTROL 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_INTERNAL_DEVICE_CONTROL 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SHUTDOWN 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_LOCK_CONTROL 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLEANUP 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_MAILSLOT 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_SECURITY 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_SECURITY 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_POWER 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SYSTEM_CONTROL 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CHANGE 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_QUOTA 858460E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_QUOTA 858460E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 85CE90E8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CREATE 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_READ 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_WRITE 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_FLUSH_BUFFERS 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_DEVICE_CONTROL 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_INTERNAL_DEVICE_CONTROL 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SHUTDOWN 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CLEANUP 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_POWER 85E7DEA8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_PNP 85E7DEA8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-2 IRP_MJ_INTERNAL_DEVICE_CONTROL [EB50661D] prosync1.sys
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL [EB50661D] prosync1.sys
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL [EB50661D] prosync1.sys
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-a IRP_MJ_INTERNAL_DEVICE_CONTROL [EB50661D] prosync1.sys
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-1c IRP_MJ_INTERNAL_DEVICE_CONTROL [EB50661D] prosync1.sys
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-14 IRP_MJ_INTERNAL_DEVICE_CONTROL [EB50661D] prosync1.sys
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLOSE 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_READ 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_WRITE 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FLUSH_BUFFERS 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_INTERNAL_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SHUTDOWN 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_POWER 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SYSTEM_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_PNP 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CREATE 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CLOSE 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_READ 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_WRITE 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_FLUSH_BUFFERS 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_INTERNAL_DEVICE_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SHUTDOWN 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_POWER 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SYSTEM_CONTROL 85CE90E8
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_PNP 85CE90E8
Device \Driver\prohlp02 \Device\ProHlp02 IRP_MJ_CREATE E14A82C8
Device \Driver\prohlp02 \Device\ProHlp02 IRP_MJ_CLOSE E14A82C8
Device \Driver\prohlp02 \Device\ProHlp02 IRP_MJ_DEVICE_CONTROL E14A82C8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE 859850E8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLOSE 859850E8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_DEVICE_CONTROL 859850E8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_INTERNAL_DEVICE_CONTROL 859850E8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLEANUP 859850E8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_SYSTEM_CONTROL 859850E8
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_PNP 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CREATE 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLOSE 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_DEVICE_CONTROL 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_INTERNAL_DEVICE_CONTROL 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLEANUP 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_SYSTEM_CONTROL 859850E8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_PNP 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_CREATE 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_CLOSE 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_DEVICE_CONTROL 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_INTERNAL_DEVICE_CONTROL 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_CLEANUP 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_SYSTEM_CONTROL 859850E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3DF938DA-4612-41DA-ABA5-4C6AE36FED4E} IRP_MJ_PNP 859850E8
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE 85A19A20
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_NAMED_PIPE 85A199A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE 85A19920
Device \Driver\Tcpip \Device\Udp IRP_MJ_READ 85A198A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_WRITE 85A19820
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_INFORMATION 85A197A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_INFORMATION 85A19720
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_EA 85A196A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_EA 85A19620
Device \Driver\Tcpip \Device\Udp IRP_MJ_FLUSH_BUFFERS 85A195A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_VOLUME_INFORMATION 85A19520
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_VOLUME_INFORMATION 85A194A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_DIRECTORY_CONTROL 85A19420
Device \Driver\Tcpip \Device\Udp IRP_MJ_FILE_SYSTEM_CONTROL 85A193A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL 85A19320
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL 85A192A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_SHUTDOWN 85A19220
Device \Driver\Tcpip \Device\Udp IRP_MJ_LOCK_CONTROL 85A191A0
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP 85A19120
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_MAILSLOT 85A18020
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_SECURITY 85A18FA0
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_SECURITY 85A18F20
Device \Driver\Tcpip \Device\Udp IRP_MJ_POWER 85A18EA0
Device \Driver\Tcpip \Device\Udp IRP_MJ_SYSTEM_CONTROL 85A18E20
Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CHANGE 85A18DA0
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_QUOTA 85A18D20
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_QUOTA 85A18CA0
Device \Driver\Tcpip \Device\Udp IRP_MJ_PNP 85A18C20
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE 85A19A20
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_NAMED_PIPE 85A199A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE 85A19920
Device \Driver\Tcpip \Device\RawIp IRP_MJ_READ 85A198A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_WRITE 85A19820
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_INFORMATION 85A197A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_INFORMATION 85A19720
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_EA 85A196A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_EA 85A19620
Device \Driver\Tcpip \Device\RawIp IRP_MJ_FLUSH_BUFFERS 85A195A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_VOLUME_INFORMATION 85A19520
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_VOLUME_INFORMATION 85A194A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DIRECTORY_CONTROL 85A19420
Device \Driver\Tcpip \Device\RawIp IRP_MJ_FILE_SYSTEM_CONTROL 85A193A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL 85A19320
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL 85A192A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SHUTDOWN 85A19220
Device \Driver\Tcpip \Device\RawIp IRP_MJ_LOCK_CONTROL 85A191A0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP 85A19120
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_MAILSLOT 85A18020
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_SECURITY 85A18FA0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_SECURITY 85A18F20
Device \Driver\Tcpip \Device\RawIp IRP_MJ_POWER 85A18EA0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SYSTEM_CONTROL 85A18E20
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CHANGE 85A18DA0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_QUOTA 85A18D20
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_QUOTA 85A18CA0
Device \Driver\Tcpip \Device\RawIp IRP_MJ_PNP 85A18C20
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_CREATE 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_CLOSE 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_READ 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_WRITE 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_FLUSH_BUFFERS 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_DEVICE_CONTROL 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_INTERNAL_DEVICE_CONTROL 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_SHUTDOWN 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_POWER 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_SYSTEM_CONTROL 85EAD0E8
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_PNP 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_CREATE 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_CLOSE 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_READ 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_WRITE 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_FLUSH_BUFFERS 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_DEVICE_CONTROL 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_INTERNAL_DEVICE_CONTROL 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_SHUTDOWN 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_POWER 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_SYSTEM_CONTROL 85EAD0E8
Device \Driver\Disk \Device\Harddisk1\DR1 IRP_MJ_PNP 85EAD0E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_NAMED_PIPE 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLOSE 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_READ 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_WRITE 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_INFORMATION 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_INFORMATION 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_EA 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_EA 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FLUSH_BUFFERS 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_VOLUME_INFORMATION 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_VOLUME_INFORMATION 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DIRECTORY_CONTROL 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FILE_SYSTEM_CONTROL 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CONTROL 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_INTERNAL_DEVICE_CONTROL 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SHUTDOWN 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_LOCK_CONTROL 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLEANUP 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_MAILSLOT 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_SECURITY 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_SECURITY 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_POWER 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SYSTEM_CONTROL 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CHANGE 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_QUOTA 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_QUOTA 85841728
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP 85841728
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE 85A19A20
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE_NAMED_PIPE 85A199A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSE 85A19920
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_READ 85A198A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_WRITE 85A19820
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_INFORMATION 85A197A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_INFORMATION 85A19720
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_EA 85A196A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_EA 85A19620
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_FLUSH_BUFFERS 85A195A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_VOLUME_INFORMATION 85A19520
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_VOLUME_INFORMATION 85A194A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DIRECTORY_CONTROL 85A19420
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_FILE_SYSTEM_CONTROL 85A193A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DEVICE_CONTROL 85A19320
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL 85A192A0
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SHUTDOWN 85A19220
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_LOCK_CONTROL 85A191A
Lassé par la pub ? Créez un compte
