Bonjour à toutes et à tous.

Je viens de passer d'Avast 4. 7 + ZoneAlarme à Bitdefender...

Résultat du Virus+SpywareScan Bitdefender :

Adware.Virtumonde.WQ : désinfection impossible
Adware.Virtumonde.GFH : désinfection impossible
Trojan.Agent.ABD : désinfection impossible
Trojan.Downloader.Small.AHR : désinfection impossible
Trojan.Proxy.Dlena.CL : désinfection impossible
Trojan.Clicker.CM : désinfection impossible
Trojan.Patch.G : désinfection impossible
Adware.Cometsys.l : désinfection impossible
Adware.Admoke.DE : désinfection impossible

Bitderfender parle de 11 virus détectés, alors que je n'en compte que 9 dans son rapport.
La bonne nouvelle étant que je n'ai pas de spyware...

En 2 mots comme en 100 : AU SECOURS !!!
Y-a-t-il un Docteur ès virologie dans la salle ?

Merci à l'avance de vos généreuses lumières.

Bonjour


Télécharge HijackThis v1.99.1
http://pchelpbordeaux.free.fr/logiciels.html
Tutorial
http://pchelpbordeaux.free.fr/tuto.html
Démo en image
http://perso.orange.fr/rginformati [...] hijack.htm

Fais un scan et poste l'analyse ici.

Bonjour Chercheur, et merci pour ta réponse ultrarapide.
Demain samedi fin d'après-midi, je posterai l'analyse
( madame, les enfants... ) si je m'en sors.
Mais je vois : le tuto, la démo... ça devrait aller.
Merci et A+, Modpas

Bonjour Chercheur

Ci-dessous l'analyse.
Voici en préambule quelques symptomes que le profane que je suis peux te décrire :
Microsoft Visual C++ : buffer overrun detected - UC toujours à 100% !
Le bureau disparaît parfois, mes icones en tous cas - Certaines pages Internet se ferment seules - Widmr1.exe tente toujours de se connecter à Internet et de modifier le registre - erreur explorer.exe il n'y a pas de disque dans le lecteur A veuillez introduire un disque dans le lecteur A ( à chaque démarrage, et parfois en cours de travail ) - lenteur extrême lors de certaines ouvertures de programme - certains programmes ne s'ouvrent pas.
Voilà ce à quoi je pense maintenant, la liste n'étant pas exhaustive. Merci déjà et encore pour ton aide.
-----------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 02:51:36, on 14/07/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NetLimiter 2 Pro\NLClient.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\widmr1.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9DF2B4BE-BAA9-4AE5-86D9-42D6B9E81AAA} - C:\WINDOWS\System32\qomjk.dll
O2 - BHO: (no name) - {DC192567-65F9-4AB6-ADB7-E13575F81726} - C:\WINDOWS\System32\khfdccc.dll
O3 - Toolbar: &Kangaroo - {663C7429-E454-11D3-B9AE-0000B4C32B4D} - C:\IDC\WEBKA.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [DVD43] C:\PROGRA~1\DVDREG~1\DVDRegionFree.exe /hidden
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SvcManager] c:\windows\system32\widmr1.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SvcManager] widmr1.exe
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Reduire avec Alice's Biscuit - C:\Program Files\kayenko\alice's biscuit\alice.htm
O9 - Extra button: Kangaroo - {06A18DC1-FE86-11d3-B9AF-0000B4C32B4D} - http://knowledge-assistant.com/webka/toolbar/tbie.asp (file missing)
O12 - Plugin for .mts: C:\Program Files\MetaCreations\MetaStream\npmetastream.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/ [...] NPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537 [...] scan53.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: khfdccc - C:\WINDOWS\SYSTEM32\khfdccc.dll
O20 - Winlogon Notify: qomjk - C:\WINDOWS\System32\qomjk.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDExchange - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDExchange.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Bonjour


Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4

* Double-clique VundoFix.exe afin de le lancer.
* Lorsque l'outil se lance à nouveau, clique sur le bouton Scan for Vundo
* Clique sur le bouton Scan for Vundo.
* Lorsque le scan est complété, clique sur le bouton Remove Vundo.
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
* Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown" ); clique OK
* Démarre ton PC à nouveau.

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".


Télécharge Combofix.exe (par sUBs) sur ton Bureau
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Double clique combofix.exe et suis les invites.
Lorsque le scan sera complété, un rapport apparaîtra.

Copie/colle ce rapport dans ta prochaine réponse avec un nouveau HijackThis et le contenu du rapport situé dans C:\vundofix.txt

Bonjour Chercheur.
Tu dois avant tout savoir qu'au cours de Combofix, des aletres Bitdefender m'ont demandé de permettre ou non une modification au registre ( dans le but de démarrer en même temps que Windows ) par 2 ou 3 programmes autres que Bitdefender. ne sachant que faire, je n'ai ni permis ni défendu, et les fenêtres ont disparu toutes seules. Par contre, j'ai autorisé ces accès pour ce qui concerne Bitdefender. Je t'informe de cela afin de nous faire perdre de temps, quitte à recommencer la procédure en sachant désormais que faire. Merci à toi.

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\SYSTEM32\kjmoq.ini
C:\WINDOWS\SYSTEM32\kjmoq.bak1
C:\WINDOWS\SYSTEM32\kjmoq.ini
C:\WINDOWS\SYSTEM32\kjmoq.bak1
C:\WINDOWS\system32\qomjk.dll
C:\WINDOWS\system32\khfdccc.dll
C:\WINDOWS\system32\khfdccc.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\JEAN-M~1\APPLIC~1.\macromedia\Flash Player\#SharedObjects\RTHJ9E5X\iforex.com
C:\DOCUME~1\JEAN-M~1\APPLIC~1.\macromedia\Flash Player\#SharedObjects\RTHJ9E5X\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\DOCUME~1\JEAN-M~1\APPLIC~1.\macromedia\Flash Player\macromedia.com\SUPPORT\flashplayer\SYS\#iforex.com
C:\DOCUME~1\JEAN-M~1\APPLIC~1.\macromedia\Flash Player\macromedia.com\SUPPORT\flashplayer\SYS\#iforex.com\settings.sol
C:\DOCUME~1\JEAN-M~1\Bureau\internet.lnk
C:\Program Files\Fichiers communs\microsoft shared\web folders\ibm00001.dll
C:\Program Files\Fichiers communs\microsoft shared\web folders\ibm00002.dll
C:\Program Files\Fichiers communs\Yazzle1730OinUninstaller.exe
C:\WINDOWS\hosts
C:\WINDOWS\start.exe


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_ASC3550U
-------\LEGACY_IPRIP
-------\LEGACY_NTMLSVC
-------\asc3550u
-------\Iprip
-------\NtmlSvc


((((((((((((((((((((((((( Files Created from 2007-06-14 to 2007-07-14 )))))))))))))))))))))))))))))))


2007-07-14 14:56 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-14 14:02 <REP> d-------- C:\VundoFix Backups
2007-07-14 02:50 <REP> d-------- C:\Program Files\Hijackthis Version Fran‡aise
2007-07-12 23:07 54,936 --a------ C:\WINDOWS\SYSTEM32\vsutil_loc040c.dll
2007-07-12 23:07 42,648 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2007-07-12 23:07 22,168 --a------ C:\WINDOWS\SYSTEM32\imsinstall_loc040c.dll
2007-07-12 23:07 18,072 --a------ C:\WINDOWS\SYSTEM32\imslsp_install_loc040c.dll
2007-07-12 23:06 75,512 --a------ C:\WINDOWS\zllsputility.exe
2007-07-12 23:05 1,087,216 --a------ C:\WINDOWS\SYSTEM32\zpeng24.dll
2007-07-12 23:04 <REP> d-------- C:\WINDOWS\SYSTEM32\ZoneLabs
2007-07-12 21:53 <REP> d-------- C:\DOCUME~1\JEAN-M~1\APPLIC~1\Bitdefender
2007-07-12 19:27 50,176 --a------ C:\WINDOWS\SYSTEM32\inetres.dll
2007-07-12 19:26 593,920 --a------ C:\WINDOWS\SYSTEM32\inetcomm.dll
2007-07-11 20:41 23,416 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswRdr.sys
2007-07-11 20:40 745,600 --a------ C:\WINDOWS\SYSTEM32\aswBoot.exe
2007-07-11 16:20 81,984 --a------ C:\WINDOWS\SYSTEM32\bdod.bin
2007-07-11 16:08 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
2007-07-11 14:33 <REP> d-------- C:\Program Files\bitdefender
2007-07-10 19:17 <REP> dr------- C:\WINDOWS\Favoris
2007-07-10 18:42 <REP> d--hs---- C:\FOUND.001
2007-07-10 14:28 446,464 --a------ C:\WINDOWS\SYSTEM32\vp31vfw.dll
2007-07-10 14:28 <REP> d-------- C:\Program Files\On2 Technologies
2007-07-10 13:50 <REP> d-------- C:\Program Files\Combined Community Codec Pack
2007-07-10 12:51 <REP> d--hs---- C:\FOUND.000
2007-07-10 00:29 <REP> d-------- C:\WINDOWS\AU_Temp
2007-07-09 21:55 61,440 --a------ C:\WINDOWS\Scanusd.dll
2007-07-09 21:55 40,960 --a------ C:\WINDOWS\Stiaspi.dll
2007-07-09 21:55 147,456 --a------ C:\WINDOWS\CHECKING.DLL
2007-07-09 21:55 <REP> d-------- C:\WINDOWS\usbbin
2007-07-09 12:04 <REP> d-------- C:\WINDOWS\PreviewSoft
2007-07-09 12:03 49,152 --a------ C:\WINDOWS\SYSTEM32\INETWH32.dll
2007-07-09 12:03 <REP> d-------- C:\Program Files\Ulead Systems
2007-07-09 12:02 <REP> d-------- C:\WINDOWS\Noslip
2007-07-09 11:59 <REP> d-------- C:\Program Files\gif
2007-07-07 17:12 <REP> d-------- C:\Program Files\Innovative Solutions
2007-07-06 18:37 <REP> d-------- C:\Program Files\Vstplugins
2007-07-06 17:19 43,338 --a------ C:\WINDOWS\SYSTEM32\widmr1.exe
2007-07-06 14:58 <REP> d-------- C:\Program Files\Microsoft SQL Server
2007-07-06 14:40 73,728 --a------ C:\WINDOWS\SYSTEM32\cliconfg.dll
2007-07-06 14:40 73,728 --------- C:\WINDOWS\SYSTEM32\dbnetlib.dll
2007-07-06 14:40 401,408 --------- C:\WINDOWS\SYSTEM32\sqlsrv32.dll
2007-07-06 14:40 28,672 --a------ C:\WINDOWS\SYSTEM32\dbnmpntw.dll
2007-07-06 14:40 28,672 --a------ C:\WINDOWS\SYSTEM32\dbmsgnet.dll
2007-07-06 14:40 24,576 --a------ C:\WINDOWS\SYSTEM32\dbmsvinn.dll
2007-07-06 14:40 24,576 --a------ C:\WINDOWS\SYSTEM32\dbmsrpcn.dll
2007-07-06 14:40 24,576 --a------ C:\WINDOWS\SYSTEM32\dbmsadsn.dll
2007-07-06 14:40 24,576 --------- C:\WINDOWS\SYSTEM32\odbcbcp.dll
2007-07-06 14:40 20,480 --a------ C:\WINDOWS\SYSTEM32\cliconfg.exe
2007-07-06 14:40 180,800 --------- C:\WINDOWS\SYSTEM32\sqlunirl.dll
2007-07-06 14:39 44,032 --a------ C:\WINDOWS\SYSTEM32\msxml3r.dll
2007-07-06 14:39 4,656 --a------ C:\WINDOWS\SYSTEM32\ds16gt.dll
2007-07-06 14:39 36,864 --a------ C:\WINDOWS\SYSTEM32\mscpxl32.dll
2007-07-06 14:39 26,224 --a------ C:\WINDOWS\SYSTEM32\odbc16gt.dll
2007-07-06 14:39 20,480 --a------ C:\WINDOWS\SYSTEM32\msorc32r.dll
2007-07-06 14:39 139,264 --a------ C:\WINDOWS\SYSTEM32\msorcl32.dll
2007-07-06 14:39 1,129,472 --a------ C:\WINDOWS\SYSTEM32\msxml3.dll
2007-07-06 14:38 94,208 --a------ C:\WINDOWS\SYSTEM32\odbcint.dll
2007-07-06 14:38 61,440 --a------ C:\WINDOWS\SYSTEM32\odbccu32.dll
2007-07-06 14:38 61,440 --a------ C:\WINDOWS\SYSTEM32\odbccr32.dll
2007-07-06 14:38 32,768 --a------ C:\WINDOWS\SYSTEM32\odbcad32.exe
2007-07-06 14:38 221,184 --a------ C:\WINDOWS\SYSTEM32\odbc32.dll
2007-07-06 14:38 16,384 --a------ C:\WINDOWS\SYSTEM32\odbc32gt.dll
2007-07-06 14:38 16,384 --a------ C:\WINDOWS\SYSTEM32\ds32gt.dll
2007-07-06 14:38 147,456 --a------ C:\WINDOWS\SYSTEM32\odbctrac.dll
2007-07-06 14:38 143,360 --a------ C:\WINDOWS\SYSTEM32\msdart.dll
2007-07-06 14:38 102,400 --a------ C:\WINDOWS\SYSTEM32\odbccp32.dll
2007-07-06 14:30 <REP> d-------- C:\Program Files\Sony
2007-07-04 12:14 626,688 --a------ C:\WINDOWS\SYSTEM32\msvcr80.dll
2007-07-04 09:28 <REP> d-------- C:\WINDOWS\pss
2007-07-04 08:56 977,920 --a------ C:\WINDOWS\SYSTEM32\msdtctm.dll
2007-07-04 08:56 97,280 --a------ C:\WINDOWS\SYSTEM32\txflog.dll
2007-07-04 08:56 82,432 --a------ C:\WINDOWS\SYSTEM32\mtxoci.dll
2007-07-04 08:56 64,512 --a------ C:\WINDOWS\SYSTEM32\mtxclu.dll
2007-07-04 08:56 64,512 --a------ C:\WINDOWS\SYSTEM32\colbact.dll
2007-07-04 08:56 596,480 --a------ C:\WINDOWS\SYSTEM32\catsrvut.dll
2007-07-04 08:56 499,200 --a------ C:\WINDOWS\SYSTEM32\comuid.dll
2007-07-04 08:56 442,880 --a------ C:\WINDOWS\SYSTEM32\rpcrt4.dll
2007-07-04 08:56 365,568 --a------ C:\WINDOWS\SYSTEM32\msdtcprx.dll
2007-07-04 08:56 226,816 --a------ C:\WINDOWS\SYSTEM32\es.dll
2007-07-04 08:56 225,280 --a------ C:\WINDOWS\SYSTEM32\catsrv.dll
2007-07-04 08:56 214,528 --a------ C:\WINDOWS\SYSTEM32\rpcss.dll
2007-07-04 08:56 150,528 --a------ C:\WINDOWS\SYSTEM32\msdtcuiu.dll
2007-07-04 08:56 110,080 --a------ C:\WINDOWS\SYSTEM32\clbcatex.dll
2007-07-04 08:56 1,177,088 --a------ C:\WINDOWS\SYSTEM32\comsvcs.dll
2007-07-04 08:56 1,105,408 --a------ C:\WINDOWS\SYSTEM32\ole32.dll
2007-07-04 08:52 593,408 --a------ C:\WINDOWS\SYSTEM32\h323msp.dll
2007-07-04 08:52 554,496 --a------ C:\WINDOWS\SYSTEM32\rtcdll.dll
2007-07-04 08:52 48,640 --a------ C:\WINDOWS\SYSTEM32\browser.dll
2007-07-04 08:52 456,192 --a------ C:\WINDOWS\SYSTEM32\ipnathlp.dll
2007-07-04 08:52 36,864 --a------ C:\WINDOWS\SYSTEM32\mf3216.dll
2007-07-03 22:50 221,184 --a------ C:\WINDOWS\SYSTEM32\srrstr.dll
2007-07-03 21:51 17,408 --a------ C:\WINDOWS\SYSTEM32\qmgrprxy.dll
2007-07-03 21:45 <REP> d-------- C:\WINDOWS\SYSTEM32\SoftwareDistribution
2007-06-20 12:34 4,608 --a------ C:\WINDOWS\SYSTEM32\w95inf32.dll
2007-06-20 12:34 2,272 --a------ C:\WINDOWS\SYSTEM32\w95inf16.dll
2007-06-20 11:18 <REP> d-------- C:\Program Files\Fichiers communs\Knowledge Adventure
2007-06-20 11:18 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Knowledge Adventure
2007-06-20 09:45 <REP> d-------- C:\Program Files\Alcohol Soft
2007-06-19 17:36 <REP> d-------- C:\Program Files\rares
2007-06-19 15:02 <REP> d-------- C:\Program Files\bbcclone


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-14 13:26:28 35,296 ----a-w C:\WINDOWS\system32\drivers\Dvd43.sys
2007-07-14 00:51:00 -------- d-----w C:\Program Files\Hijackthis Version Française
2007-07-12 21:12:46 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat
2007-07-10 16:13:04 69,608 ----a-w C:\DOCUME~1\JEAN-M~1\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-07-10 13:24:56 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat
2007-07-09 22:31:52 267,845 ----a-w C:\WINDOWS\tsc.exe
2007-07-09 22:31:46 71,749 ----a-w C:\WINDOWS\hcextoutput.dll
2007-07-09 22:31:44 1,163,344 ----a-w C:\WINDOWS\vsapi32.dll
2007-07-09 22:31:36 86,094 ----a-w C:\WINDOWS\BPMNT.dll
2007-07-09 22:28:02 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL
2007-07-09 22:28:00 69,689 ----a-w C:\WINDOWS\UNZIP.DLL
2007-07-09 22:27:58 286,720 ----a-w C:\WINDOWS\PATCH.EXE
2007-07-07 13:47:22 230,432 ----a-w C:\StiImg.dat
2007-07-06 13:04:18 567,714 ----a-w C:\WINDOWS\system32\perfh00C.dat
2007-07-06 13:04:18 113,872 ----a-w C:\WINDOWS\system32\perfc00C.dat
2007-06-20 07:45:14 223,128 ----a-w C:\WINDOWS\system32\drivers\vaxscsi.sys
2007-06-18 18:53:54 1,712 ----a-w C:\Program Files\DFX for WMP.lnk
2007-06-18 15:06:14 29 ----a-w C:\Program Files\Serial.MiCROSOFT.OFFiCE.ULTiMATE.2007.FRENCH.iSO-ENGiNE.txt
2007-05-28 19:10:38 3,590 ----a-w C:\WINDOWS\system32\SpoonUninstall-dBpoweramp m4a Codec.dat
2007-05-28 19:09:48 1,057,656 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe
2007-05-28 18:35:50 13,015 ----a-w C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2007-05-26 21:19:10 -------- d-----w C:\Program Files\nandub
2007-05-25 19:48:42 -------- d-----w C:\Program Files\AviSynth 2.5
2007-05-25 19:46:48 616 ----a-w C:\Program Files\Ripp-it_AM.lnk
2007-05-25 19:45:14 -------- d-----w C:\Program Files\Ripp-it_AM
2007-05-24 16:05:14 611,064 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-05-24 05:40:42 227,856 ----a-w C:\WINDOWS\system32\PDBoot.exe
2007-05-16 16:53:44 1,530 ----a-w C:\Program Files\NetLimiter 2 Pro.lnk
2007-05-16 16:53:24 -------- d-----w C:\Program Files\NetLimiter 2 Pro
2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-03-28 08:30:32 1,697 ----a-w C:\Program Files\FlashPaper 2.lnk
2007-03-23 10:05:16 1,431 ----a-w C:\Program Files\DivX Movies.lnk
2007-03-23 10:05:14 705 ----a-w C:\Program Files\DivX Player.lnk
2007-03-23 09:52:00 14,797,568 ----a-w C:\Program Files\DivXPlay.exe
2007-03-08 14:19:04 1,514 ----a-w C:\Program Files\QuickTime.lnk
2007-03-05 14:59:48 35,246,592 ----a-w C:\Program Files\directx_9c_oct05sdk_redist.exe
2007-03-05 14:52:36 7,462,674 ----a-w C:\Program Files\Combined-Community-Codec-Pack-2007-02-22.exe
2007-02-01 14:50:04 1,619 ----a-w C:\Program Files\Antivirus.lnk
2006-12-11 13:08:34 1,650 ----a-w C:\Program Files\Adobe 6.lnk
2006-11-26 09:12:34 127 ----a-w C:\DOCUME~1\JEAN-M~1\APPLIC~1\fusioncache.dat
2006-10-12 23:37:36 271 --sh--w C:\Program Files\desktop.ini
2006-10-12 23:37:36 23,506 ---h--w C:\Program Files\folder.htt


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 14:17 54248 --a------ C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsmqIntCert"="regsvr32 /s mqrt.dll" []
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-07-12 22:12]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 15:49]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 15:47]
"DVD43"="C:\PROGRA~1\DVDREG~1\DVDRegionFree.exe" [2005-03-29 04:36]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05]
"SvcManager"="widmr1.exe" [2007-07-06 17:19 C:\WINDOWS\SYSTEM32\widmr1.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-28 12:00]
"SvcManager"="widmr1.exe" [2007-07-06 17:19 C:\WINDOWS\SYSTEM32\widmr1.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"="C:\PROGRA~1\DVDREG~1\DVDShell.dll" [2004-10-09 15:18]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"reminder.exe"=C:\Program Files\BackWeb\tuner\reminder.exe
"LoadQM"=loadqm.exe
"Symantec Core LC"=C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe start
"SETUP98"=C:\WINDOWS\98SETUP.EXE
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
"Symantec NetDriver Monitor"=C:\PROGRA~1\SYMNET~1\SNDMON.EXE /Consumer
"OEMCleanup"=C:\WINDOWS\OPTIONS\OEMRESET.EXE /O
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme


HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APPE /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APPE /CALLER:IE50 /user /install

HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install

HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}
rundll32 iesetup.dll,IEAccessUserInst

HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CA0A4247-44BE-11d1-A005-00805F8ABE06}
RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf

Contents of the 'Scheduled Tasks' folder
2007-07-07 17:00:02 C:\WINDOWS\tasks\Démarrage du programme de réglages.job
2007-07-14 13:26:58 C:\WINDOWS\tasks\Planificateur pour la collecte de données PCHealth.job
2007-07-10 18:15:02 C:\WINDOWS\tasks\Maintenance en 1 clic.job
2007-07-08 13:09:04 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-14 15:25:04
Windows 5.1.2600 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet009\Services\{F1082F44-3F0E-4F7A-9083-30B2D0DBCEC9}]
"ServiceDll"="%SystemRoot%\System32\6to4svc.dll"
"ImagePath"="system32\drivers\ac97intc.sys"
"ImagePath"="System32\DRIVERS\ACPI.sys"
"ImagePath"="system32\drivers\aec.sys"
"ImagePath"="System32\drivers\AEC6710D.sys"
"ImagePath"="\SystemRoot\System32\drivers\afd.sys"
"ServiceDll"="%SystemRoot%\system32\alrsvc.dll"
"ImagePath"="%SystemRoot%\System32\alg.exe"
"ServiceDll"="%SystemRoot%\System32\appmgmts.dll"
"ImagePath"="%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe"
"ImagePath"="System32\DRIVERS\asyncmac.sys"
"ImagePath"="System32\DRIVERS\atapi.sys"
"ImagePath"="System32\DRIVERS\atmarpc.sys"
"ServiceDll"="%SystemRoot%\System32\audiosrv.dll"
"ImagePath"="System32\DRIVERS\audstub.sys"
"MofImagePath"="System32\Drivers\battc.sys"
"ImagePath"="\??\C:\Program Files\Softwin\BitDefender10\bdfdll.sys"
"ImagePath"="\??\C:\Program Files\Softwin\BitDefender10\bdfsdrv.sys"
"ImagePath"="\??\C:\Program Files\Softwin\BitDefender10\bdpredir.sys"
"ImagePath"="\??\C:\Program Files\Softwin\BitDefender10\bdrsdrv.sys"
"ImagePath"="\"C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe\" /service"
"ServiceDll"="C:\WINDOWS\system32\qmgr.dll"
"ServiceDll"="%SystemRoot%\System32\browser.dll"
"ImagePath"="system32\DRIVERS\CCDECODE.sys"
"ImagePath"="System32\DRIVERS\cdrom.sys"
"ImagePath"="%SystemRoot%\system32\cisvc.exe"
"ImagePath"="%SystemRoot%\system32\clipsrv.exe"
"ImagePath"="C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"
"ImagePath"="C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
"ServiceDll"="%SystemRoot%\System32\cryptsvc.dll"
"ServiceDll"="%SystemRoot%\system32\rpcss.dll"
"ServiceDll"="%SystemRoot%\System32\dhcpcsvc.dll"
"ImagePath"="System32\DRIVERS\disk.sys"
"ImagePath"="%SystemRoot%\System32\dmadmin.exe /com"
"ImagePath"="System32\drivers\dmboot.sys"
"ImagePath"="System32\DRIVERS\dmio.sys"
"ServiceDll"="%SystemRoot%\System32\dmserver.dll"
"ImagePath"="system32\drivers\DMusic.sys"
"ServiceDll"="%SystemRoot%\System32\dnsrslvr.dll"
"ImagePath"="system32\drivers\drmkaud.sys"
"ImagePath"="System32\DRIVERS\Dvd43.sys"
"ImagePath"="System32\Drivers\ElbyCDFL.sys"
"ImagePath"="System32\Drivers\ElbyCDIO.sys"
"ImagePath"="System32\Drivers\ElbyDelay.sys"
"ImagePath"="\SystemRoot\System32\drivers\EPPSCSI.SYS"
"ServiceDll"="%SystemRoot%\System32\ersvc.dll"
"ImagePath"="%SystemRoot%\system32\services.exe"
"ServiceDll"="C:\WINDOWS\System32\es.dll"
"ServiceDll"="%SystemRoot%\System32\shsvcs.dll"
"ImagePath"="%systemroot%\system32\fxssvc.exe"
"ImagePath"="system32\DRIVERS\fdc.sys"
"ImagePath"="System32\DRIVERS\flpydisk.sys"
"ImagePath"="system32\drivers\fltmgr.sys"
"ImagePath"="System32\DRIVERS\ftdisk.sys"
"ImagePath"="System32\Drivers\GEARAspiWDM.sys"
"ImagePath"="System32\DRIVERS\msgpc.sys"
"ServiceDll"="%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll"
"ServiceDll"="%SystemRoot%\System32\hidserv.dll"
"ImagePath"="System32\DRIVERS\hidusb.sys"
"ImagePath"="System32\Drivers\HTTP.sys"
"ServiceDll"="%SystemRoot%\System32\w3ssl.dll"
"ImagePath"="System32\DRIVERS\i8042prt.sys"
"ImagePath"="System32\DRIVERS\i81xnt5.sys"
"ImagePath"="System32\DRIVERS\wADV01nt.sys"
"ImagePath"="System32\DRIVERS\wADV02NT.sys"
"ImagePath"="System32\DRIVERS\wADV05NT.sys"
"ImagePath"="System32\DRIVERS\wSiINTxx.sys"
"ImagePath"="System32\DRIVERS\wVchNTxx.sys"
"ImagePath"="system32\DRIVERS\wADV07nt.sys"
"ImagePath"="system32\DRIVERS\wADV08nt.sys"
"ImagePath"="system32\DRIVERS\wADV09nt.sys"
"ImagePath"="System32\DRIVERS\wATV01nt.sys"
"ImagePath"="System32\DRIVERS\wATV02NT.sys"
"ImagePath"="System32\DRIVERS\wATV03nt.sys"
"ImagePath"="System32\DRIVERS\wATV04nt.sys"
"ImagePath"="System32\DRIVERS\wCh7xxNT.sys"
"ImagePath"="system32\DRIVERS\wATV10nt.sys"
"ImagePath"="system32\DRIVERS\wATV06nt.sys"
"ImagePath"="C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe"
"ImagePath"="C:\WINDOWS\System32\inetsrv\inetinfo.exe"
"ImagePath"="system32\DRIVERS\imapi.sys"
"ImagePath"="C:\WINDOWS\System32\imapi.exe"
"ImagePath"="System32\DRIVERS\intelide.sys"
"ImagePath"="system32\drivers\ip6fw.sys"
"ImagePath"="System32\DRIVERS\ipfltdrv.sys"
"ImagePath"="System32\DRIVERS\ipinip.sys"
"ImagePath"="System32\DRIVERS\ipnat.sys"
"ImagePath"="\"C:\Program Files\iPod\bin\iPodService.exe\""
"ImagePath"="System32\DRIVERS\ipsec.sys"
"ImagePath"="System32\DRIVERS\irenum.sys"
"ImagePath"="System32\DRIVERS\isapnp.sys"
"ImagePath"="System32\DRIVERS\kbdclass.sys"
"ImagePath"="system32\drivers\kmixer.sys"
"ServiceDll"="%SystemRoot%\System32\srvsvc.dll"
"ServiceDll"="%SystemRoot%\System32\wkssvc.dll"
"ImagePath"="\"C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe\""
"ImagePath"="\"C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe\" /service"
"ServiceDll"="%SystemRoot%\System32\lmhsvc.dll"
"ImagePath"="\"C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe\""
"ServiceDll"="%SystemRoot%\System32\msgsvc.dll"
"ImagePath"="C:\WINDOWS\System32\mnmsrvc.exe"
"ImagePath"="System32\DRIVERS\mouclass.sys"
"ImagePath"="System32\DRIVERS\mouhid.sys"
"ImagePath"="\??\C:\WINDOWS\system32\drivers\mqac.sys"
"ImagePath"="System32\DRIVERS\mrxdav.sys"
"ImagePath"="System32\DRIVERS\mrxsmb.sys"
"ImagePath"="C:\WINDOWS\System32\msdtc.exe"
"ImagePath"="C:\WINDOWS\System32\msiexec.exe /V"
"ImagePath"="system32\drivers\MSKSSRV.sys"
"ImagePath"="C:\WINDOWS\system32\mqsvc.exe"
"ImagePath"="C:\WINDOWS\system32\mqtgsvc.exe"
"ImagePath"="system32\drivers\MSPCLOCK.sys"
"ImagePath"="system32\drivers\MSPQM.sys"
"ImagePath"="System32\DRIVERS\mssmbios.sys"
"ImagePath"="C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR"
"ImagePath"="C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe"
"ImagePath"="system32\drivers\MSTEE.sys"
"ImagePath"="system32\DRIVERS\NABTSFEC.sys"
"ImagePath"="system32\DRIVERS\NdisIP.sys"
"ImagePath"="System32\DRIVERS\ndistapi.sys"
"ImagePath"="System32\DRIVERS\ndisuio.sys"
"ImagePath"="System32\DRIVERS\ndiswan.sys"
"ImagePath"="System32\DRIVERS\netbios.sys"
"ImagePath"="System32\DRIVERS\netbt.sys"
"ImagePath"="%SystemRoot%\system32\netdde.exe"
"ImagePath"="%SystemRoot%\system32\netdde.exe"
"ImagePath"="%SystemRoot%\System32\lsass.exe"
"ServiceDll"="%SystemRoot%\System32\netman.dll"
"ServiceDll"="%SystemRoot%\System32\mswsock.dll"
"ImagePath"="\"C:\Program Files\NetLimiter 2 Pro\nlsvc.exe\""
"ImagePath"="\??\C:\WINDOWS\System32\drivers\nltdi.sys"
"ImagePath"="%SystemRoot%\System32\lsass.exe"
"ServiceDll"="%SystemRoot%\system32\ntmssvc.dll"
"ServiceDll"="%SystemRoot%\System32\nwwks.dll"
"ImagePath"="System32\DRIVERS\nwlnkflt.sys"
"ImagePath"="System32\DRIVERS\nwlnkfwd.sys"
"ImagePath"="system32\DRIVERS\nwlnkipx.sys"
"ImagePath"="system32\DRIVERS\nwlnknb.sys"
"ImagePath"="system32\DRIVERS\nwlnkspx.sys"
"ImagePath"="system32\DRIVERS\nwrdr.sys"
"ImagePath"="System32\DRIVERS\p3.sys"
"ImagePath"="system32\DRIVERS\pfc027.sys"
"ImagePath"="System32\DRIVERS\parport.sys"
"ImagePath"="System32\DRIVERS\pci.sys"
"ImagePath"="\"C:\Program Files\Raxco\PerfectDisk\PDAgent.exe\""
"ImagePath"="\"C:\Program Files\Raxco\PerfectDisk\PDEngine.exe\""
"ImagePath"="\"C:\Program Files\Raxco\PerfectDisk\PDExchange.exe\""
"ImagePath"="%SystemRoot%\system32\services.exe"
"ImagePath"="%SystemRoot%\System32\lsass.exe"
"ImagePath"="System32\DRIVERS\raspptp.sys"
"ImagePath"="\??\C:\Program Files\Softwin\BitDefender10\profos.sys"
"ImagePath"="%SystemRoot%\system32\lsass.exe"
"ImagePath"="System32\DRIVERS\ptilink.sys"
"ImagePath"="System32\Drivers\PxHelp20.sys"
"ImagePath"="System32\DRIVERS\rasacd.sys"
"ServiceDll"="%SystemRoot%\System32\rasauto.dll"
"ImagePath"="System32\DRIVERS\rasl2tp.sys"
"ServiceDll"="%SystemRoot%\System32\rasmans.dll"
"ImagePath"="System32\DRIVERS\raspppoe.sys"
"ImagePath"="System32\DRIVERS\raspti.sys"
"ImagePath"="System32\DRIVERS\rdbss.sys"
"ImagePath"="System32\DRIVERS\RDPCDD.sys"
"ImagePath"="System32\DRIVERS\rdpdr.sys"
"ImagePath"="C:\WINDOWS\system32\sessmgr.exe"
"ImagePath"="System32\DRIVERS\redbook.sys"
"ServiceDll"="%SystemRoot%\System32\mprdim.dll"
"ServiceDll"="%SystemRoot%\system32\regsvc.dll"
"ImagePath"="\??\C:\WINDOWS\system32\drivers\RMCast.sys"
"ImagePath"="System32\Drivers\RootMdm.sys"
"ImagePath"="%SystemRoot%\System32\locator.exe"
"ServiceDll"="%SystemRoot%\System32\rpcss.dll"
"ImagePath"="%SystemRoot%\system32\rsvp.exe"
"ImagePath"="System32\DRIVERS\RTL8139.SYS"
"ImagePath"="%SystemRoot%\system32\lsass.exe"
"ImagePath"="%SystemRoot%\System32\SCardSvr.exe"
"ImagePath"="%SystemRoot%\System32\SCardSvr.exe"
"ServiceDll"="%SystemRoot%\system32\schedsvc.dll"
"ImagePath"="%SystemRoot%\system32\drivers\scsiport.sys"
"ImagePath"="System32\DRIVERS\secdrv.sys"
"ServiceDll"="%SystemRoot%\System32\seclogon.dll"
"ServiceDll"="%SystemRoot%\system32\sens.dll"
"ImagePath"="system32\DRIVERS\serenum.sys"
"ImagePath"="system32\DRIVERS\serial.sys"
"ServiceDll"="%SystemRoot%\System32\ipnathlp.dll"
"ServiceDll"="%SystemRoot%\System32\shsvcs.dll"
"ImagePath"="%SystemRoot%\system32\tcpsvcs.exe"
"ImagePath"="system32\DRIVERS\SLIP.sys"
"ImagePath"="C:\WINDOWS\system32\inetsrv\inetinfo.exe"
"ImagePath"="%SystemRoot%\System32\snmp.exe"
"ImagePath"="%SystemRoot%\System32\snmptrap.exe"
"ImagePath"="system32\drivers\splitter.sys"
"ImagePath"="%SystemRoot%\system32\spoolsv.exe"
"ImagePath"="System32\Drivers\sptd.sys"
"ImagePath"="C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR"
"ImagePath"="system32\DRIVERS\sr.sys"
"ImagePath"="System32\ZoneLabs\srescan.sys"
"ServiceDll"="C:\WINDOWS\system32\srsvc.dll"
"ImagePath"="System32\DRIVERS\srv.sys"
"ServiceDll"="%SystemRoot%\System32\ssdpsrv.dll"
"ImagePath"="C:\WINDOWS\System32\PAStiSvc.exe"
"ServiceDll"="%SystemRoot%\system32\wiaservc.dll"
"ImagePath"="system32\DRIVERS\StreamIP.sys"
"ImagePath"="System32\DRIVERS\swenum.sys"
"ImagePath"="system32\drivers\swmidi.sys"
"ImagePath"="C:\WINDOWS\System32\dllhost.exe /Processid:{0162749F-D98A-4032-926D-101C9F2C6E64}"
"ImagePath"="\"C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe\""
"ImagePath"="system32\drivers\sysaudio.sys"
"ImagePath"="%SystemRoot%\system32\smlogsvc.exe"
"ServiceDll"="%SystemRoot%\System32\tapisrv.dll"
"ImagePath"="System32\DRIVERS\tcpip.sys"
"ImagePath"="system32\DRIVERS\tcpip6.sys"
"ImagePath"="System32\DRIVERS\termdd.sys"
"ServiceDll"="%SystemRoot%\System32\termsrv.dll"
"ServiceDll"="%SystemRoot%\System32\shsvcs.dll"
"ImagePath"="C:\WINDOWS\System32\tlntsvr.exe"
"ServiceDll"="%SystemRoot%\system32\trkwks.dll"
"ImagePath"="\??\C:\Program Files\Softwin\BitDefender10\trufos.sys"
"ImagePath"="system32\DRIVERS\tunmp.sys"
"ImagePath"="C:\WINDOWS\System32\wdfmgr.exe"
"ImagePath"="System32\DRIVERS\update.sys"
"ServiceDll"="%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll"
"ServiceDll"="%SystemRoot%\System32\upnphost.dll"
"ImagePath"="%SystemRoot%\System32\ups.exe"
"ImagePath"="System32\DRIVERS\usbhub.sys"
"ImagePath"="system32\DRIVERS\USBSTOR.SYS"
"ImagePath"="System32\DRIVERS\usbuhci.sys"
"ImagePath"="\"C:\Program Files\MSN Messenger\usnsvc.exe\""
"ImagePath"="\SystemRoot\System32\Drivers\vaxscsi.sys"
"ImagePath"="\SystemRoot\System32\drivers\vga.sys"
"ImagePath"="System32\vsdatant.sys"
"ImagePath"="C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe -service"
"ImagePath"="%SystemRoot%\System32\vssvc.exe"
"ImagePath"="\"C:\Program Files\Softwin\BitDefender10\vsserv.exe\" /service"
"ServiceDll"="C:\WINDOWS\System32\w32time.dll"
"ImagePath"="%SystemRoot%\System32\inetsrv\inetinfo.exe"
"ImagePath"="System32\DRIVERS\wanarp.sys"
"ImagePath"="system32\drivers\wdmaud.sys"
"ServiceDll"="%SystemRoot%\System32\webclnt.dll"
"ServiceDll"="%SystemRoot%\system32\wbem\WMIsvc.dll"
"ServiceDll"="C:\WINDOWS\System32\MsPMSNSv.dll"
"ServiceDll"="%SystemRoot%\System32\advapi32.dll"
"ImagePath"="C:\WINDOWS\System32\wbem\wmiapsrv.exe"
"ServiceDll"="%SYSTEMROOT%\system32\wscsvc.dll"
"ImagePath"="system32\DRIVERS\WSTCODEC.SYS"
"ServiceDll"="C:\WINDOWS\System32\wuauserv.dll"
"ServiceDll"="%SystemRoot%\System32\wzcsvc.dll"
"ImagePath"="\"C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe\" /service"
"ServiceDll"="%SystemRoot%\System32\xmlprov.dll"

Completion time: 2007-07-14 15:28:50 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-14 15:28

--- E O F ---
------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 15:40:53, on 14/07/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\NetLimiter 2 Pro\NLClient.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\widmr1.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: &Kangaroo - {663C7429-E454-11D3-B9AE-0000B4C32B4D} - C:\IDC\WEBKA.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [DVD43] C:\PROGRA~1\DVDREG~1\DVDRegionFree.exe /hidden
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SvcManager] widmr1.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SvcManager] widmr1.exe
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Reduire avec Alice's Biscuit - C:\Program Files\kayenko\alice's biscuit\alice.htm
O9 - Extra button: Kangaroo - {06A18DC1-FE86-11d3-B9AF-0000B4C32B4D} - http://knowledge-assistant.com/webka/toolbar/tbie.asp (file missing)
O12 - Plugin for .mts: C:\Program Files\MetaCreations\MetaStream\npmetastream.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/ [...] NPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537 [...] scan53.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDExchange - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDExchange.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

----------------------------


VundoFix V6.5.4

Checking Java version...

Sun Java not detected
Scan started at 14:02:00 14/07/2007

Listing files found while scanning....

C:\WINDOWS\System32\khfdccc.dll
C:\WINDOWS\System32\kjmoq.bak2
C:\WINDOWS\System32\kjmoq.ini
C:\WINDOWS\System32\qomjk.dll

Beginning removal...

Attempting to delete C:\WINDOWS\System32\kjmoq.bak2
C:\WINDOWS\System32\kjmoq.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\System32\kjmoq.ini
C:\WINDOWS\System32\kjmoq.ini Has been deleted!

Performing Repairs to the registry.
Done!