Bonjour à toutes et à tous,

Je sais que ce sujet existe dejà en pas mal d'exemplaire mais apparemment pour la clareté de la chose c'est mieux d'en créer un nouveau.
Voilà, je suis moi-même également touché par WIN32:TratBHO... .
Ma config :
Windows XP
Antivirus : Avast
Firewall : Windows

Est-ce qu'une ame charitable serait prete a me venir en aide SVP?
Merci d'avance.

Up...

Personne pour me venir en aide??
Svp...

Bonjour,
Télécharge puis installe Hijackthis (Trend Micro).
Poste ensuite un rapport dans ta prochaine réponse.
AIDE : Comment utiliser Hijackthis v2.0.2

Salut !

Et voici le rapport Hijackthis :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:17:29, on 26/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
E:\Programmes\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
E:\Programmes\FlashGet\flashget.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Programmes\SuperCopier 2\SuperCopier2.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
E:\Programmes\Opera\Opera.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Del Nero\Bureau\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favoris
O2 - BHO: BHO Class - {06358080-33BE-452b-9B31-E54E112ADCCA} - C:\WINDOWS\system32\MSIEMPlayer.DLL
O2 - BHO: (no name) - {0DD81058-BEF5-48F4-8620-F1B58475E0AB} - C:\WINDOWS\system32\jkkll.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\Programmes\FlashGet\jccatch.dll
O2 - BHO: (no name) - {4778E9D2-DB64-4D0E-A1AC-E45891EFB291} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {53F6DDEF-4DDB-451A-A090-9ECD40F86311} - (no file)
O2 - BHO: (no name) - {55CFB5A0-252A-41A1-8CEF-D45364F24875} - (no file)
O2 - BHO: (no name) - {6C6746F3-4859-434F-814F-3E48CDAE90E7} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {7FC0E081-F9A7-4D83-A692-D6A37E9FB401} - (no file)
O2 - BHO: (no name) - {89CCC4BC-E9E6-49BF-AD5D-9454BD9404A5} - (no file)
O2 - BHO: (no name) - {A1B07E69-581F-42ED-9FF3-DCA541B20D2C} - (no file)
O2 - BHO: (no name) - {A55C2B77-C0E3-4A9C-B08E-7D021A997329} - (no file)
O2 - BHO: (no name) - {A764D985-3D40-4080-AC14-9FEC3029FEF0} - (no file)
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - E:\Programmes\FlashGet\getflash.dll
O2 - BHO: (no name) - {F196DF99-3FA0-4ECA-B7F4-7C9171D784D5} - (no file)
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Flashget] E:\Programmes\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "E:\Programmes\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [SuperCopier2.exe] E:\Programmes\SuperCopier 2\SuperCopier2.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetupo.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetupo.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetupo.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetupo.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O8 - Extra context menu item: &Tout télécharger avec FlashGet - E:\Programmes\FlashGet\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - E:\Programmes\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Programmes\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Programmes\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driv [...] eqlab2.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\Programmes\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 7329 bytes




Donc j'utilise Antivir après avoir utilisé AVAST, Avast ne me detectait plus rien et Antivir m'a trouvé ça : TR/Vundo.Gen. Bien sur impossible de faire quoi que ce soit, Quarantaine, Delete, Ignore, etc, le message revient sans cesse.
Voici le Printscreen correspondant :



Merci de ton attention en tout cas.

Re,

Désactive tes protections résidentes (antivirus, Spybot...) !

• Télécharge Combofix (sUBs) sur ton Bureau.
• Double clique sur combofix.exe afin de le lancer.
• Tape sur la touche 1 (Yes) pour démarrer le scan.
• Lorsque le scan sera complété, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

Re, voici mon rapport ComboFix :

ComboFix 08-01-23.1C - Del Nero 2008-01-26 18:42:38.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1594 [GMT 1:00]
Endroit: C:\Documents and Settings\Del Nero\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\dsjsjtlj.dll
C:\WINDOWS\system32\jkkll.dll
C:\WINDOWS\system32\jltjsjsd.ini
C:\WINDOWS\system32\llkkj.ini
C:\WINDOWS\system32\llkkj.ini2
C:\WINDOWS\system32\mcrh.tmp

.
((((((((((((((((((((((((((((( Fichiers créés 2007-12-26 to 2008-01-26 ))))))))))))))))))))))))))))))))))))
.

2008-01-26 18:40 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-26 15:05 . 2008-01-26 15:05 2,381 --a------ C:\WINDOWS\Opera.INI
2008-01-26 14:15 . 2008-01-26 14:15 15 --a------ C:\WINDOWS\system32\58d30e72
2008-01-26 13:55 . 2008-01-26 13:55 <REP> d-------- C:\VundoFix Backups
2008-01-26 13:16 . 2008-01-26 13:16 <REP> d-------- C:\Program Files\Avira
2008-01-23 23:35 . 2008-01-23 23:35 268 --ah----- C:\sqmdata01.sqm
2008-01-23 23:35 . 2008-01-23 23:35 244 --ah----- C:\sqmnoopt01.sqm
2008-01-22 22:49 . 2008-01-22 22:49 268 --ah----- C:\sqmdata00.sqm
2008-01-22 22:49 . 2008-01-22 22:49 244 --ah----- C:\sqmnoopt00.sqm
2008-01-22 15:39 . 2008-01-23 15:40 474 ---hs---- C:\WINDOWS\system32\jwifuhhi.ini
2008-01-21 15:41 . 2008-01-22 07:28 354 ---hs---- C:\WINDOWS\system32\lkmpperl.ini
2008-01-20 15:38 . 2008-01-21 15:39 354 ---hs---- C:\WINDOWS\system32\dvwfeavf.ini
2008-01-19 15:39 . 2008-01-20 11:07 354 ---hs---- C:\WINDOWS\system32\unnhkiwo.ini
2008-01-18 15:37 . 2008-01-19 09:17 1,194 ---hs---- C:\WINDOWS\system32\uyatrbvu.ini
2008-01-16 19:29 . 2008-01-16 19:29 9,728 --a------ C:\WINDOWS\system32\MSIEMPlayer.DLL
2008-01-16 15:41 . 2008-01-18 07:29 1,074 ---hs---- C:\WINDOWS\system32\bnjoklmw.ini
2008-01-15 15:38 . 2008-01-16 15:38 894 ---hs---- C:\WINDOWS\system32\ohahfeph.ini
2008-01-14 15:35 . 2008-01-15 07:29 774 ---hs---- C:\WINDOWS\system32\tprfsxmv.ini
2008-01-13 18:37 . 2008-01-13 18:37 38 --a------ C:\WINDOWS\avisplitter.INI
2008-01-13 15:37 . 2008-01-14 07:29 654 ---hs---- C:\WINDOWS\system32\xeotwfgv.ini
2008-01-11 19:28 . 2008-01-13 15:34 534 ---hs---- C:\WINDOWS\system32\vavfbnur.ini
2008-01-10 19:31 . 2008-01-11 07:28 354 ---hs---- C:\WINDOWS\system32\ntfkfngt.ini
2008-01-09 20:17 . 2008-01-09 20:25 4,607 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-01-08 22:55 . 2008-01-08 22:55 <REP> d-------- C:\WINDOWS\system32\GroupPolicy
2008-01-08 22:55 . 2008-01-08 22:55 <REP> d-------- C:\WINDOWS\SparkleXP
2008-01-07 18:04 . 2008-01-09 20:25 3,932,214 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
2008-01-07 18:04 . 2008-01-09 20:25 59,964 --a------ C:\WINDOWS\BricoPackUninst.cmd
2008-01-07 17:57 . 2008-01-09 20:17 <REP> d-------- C:\WINDOWS\BricoPacks
2008-01-07 17:49 . 2008-01-07 17:49 <REP> d-------- C:\Program Files\Windows Media Connect 2
2008-01-07 17:46 . 2008-01-07 17:46 <REP> d-------- C:\WINDOWS\system32\drivers\umdf
2008-01-07 17:41 . 2008-01-07 17:41 <REP> d-------- C:\Program Files\Microsoft Works
2008-01-07 17:40 . 2008-01-07 17:40 <REP> d-------- C:\Program Files\MSBuild
2008-01-07 17:33 . 2008-01-07 17:39 <REP> d-------- C:\WINDOWS\SHELLNEW
2008-01-07 17:31 . 2008-01-07 17:31 <REP> dr-h----- C:\MSOCache
2008-01-03 13:08 . 2004-08-19 15:09 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-01-01 23:39 . 2008-01-14 20:56 <REP> d-------- C:\Program Files\Everest Poker
2008-01-01 23:08 . 2008-01-01 23:08 94 --a------ C:\WINDOWS\wininit.ini
2007-12-30 17:58 . 2007-05-31 19:30 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2007-12-30 17:58 . 2007-05-31 19:29 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2007-12-30 17:57 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-12-30 17:57 . 2006-09-28 16:05 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2007-12-30 17:57 . 2007-04-04 18:55 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2007-12-30 17:57 . 2007-01-24 15:27 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2007-12-30 17:57 . 2006-12-08 12:02 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll
2007-12-27 18:30 . 2007-12-27 18:30 0 --a------ C:\WINDOWS\nsreg.dat
2007-12-26 11:43 . 2007-12-26 11:45 1,823 --a------ C:\WINDOWS\SubCreator.INI

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-07 17:04 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-12-22 15:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-22 15:45 --------- d-----w C:\Program Files\Alcohol Soft
2007-12-22 15:33 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-12-15 19:55 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-12-11 17:26 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-12-11 06:54 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2007-12-09 20:55 --------- d-----w C:\Program Files\AvRack
2007-12-09 19:33 --------- d-----w C:\Program Files\Realtek Sound Manager
2007-12-09 19:33 --------- d-----w C:\Program Files\Realtek AC97
2007-12-09 19:24 --------- d-----w C:\Program Files\MSN Messenger
2007-12-09 19:14 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-12-09 19:14 --------- d-----w C:\Program Files\Fichiers communs\ODBC
2007-12-09 19:07 --------- d-----w C:\Program Files\Java
2007-12-09 19:07 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-12-09 18:39 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-12-09 18:37 --------- d-----w C:\Program Files\SystemRequirementsLab
2007-12-09 18:32 --------- d--h--w C:\Program Files\Uninstall Information
2007-12-09 18:27 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-09 18:23 --------- d-----w C:\Program Files\Services en ligne
2007-12-09 18:23 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-12-05 01:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-05 00:41 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-12-05 00:41 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-12-05 00:41 8,523,776 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-12-05 00:41 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-12-05 00:41 7,435,392 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-12-05 00:41 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-12-05 00:41 6,549,504 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-12-05 00:41 5,773,568 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-12-05 00:41 5,611,520 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-12-05 00:41 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-12-05 00:41 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-12-05 00:41 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-12-05 00:41 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-12-05 00:41 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-12-05 00:41 385,024 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-12-05 00:41 356,352 ----a-w C:\WINDOWS\system32\nvudisp.exe
2007-12-05 00:41 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-12-05 00:41 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-12-05 00:41 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-12-05 00:41 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-12-05 00:41 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-12-05 00:41 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-12-05 00:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-12-05 00:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-12-05 00:41 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-12-05 00:41 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-12-05 00:41 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-12-05 00:41 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-12-05 00:41 3,715,072 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-12-05 00:41 3,710,976 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-12-05 00:41 3,420,160 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-12-05 00:41 3,334,144 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-12-05 00:41 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-12-05 00:41 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-12-05 00:41 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-12-05 00:41 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2007-12-05 00:41 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll
2007-12-05 00:41 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll
2007-12-05 00:41 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll
2007-12-05 00:41 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll
2007-12-05 00:41 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll
2007-12-05 00:41 270,336 ----a-w C:\WINDOWS\system32\nvrsru.dll
2007-12-05 00:41 266,240 ----a-w C:\WINDOWS\system32\nvrsptb.dll
2007-12-05 00:41 266,240 ----a-w C:\WINDOWS\system32\nvrsja.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrstr.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrssl.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrssk.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrshu.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrsth.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrssv.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrspl.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrsno.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrsda.dll
2007-12-05 00:41 249,856 ----a-w C:\WINDOWS\system32\nvrsfi.dll
2007-12-05 00:41 249,856 ----a-w C:\WINDOWS\system32\nvrscs.dll
2007-12-05 00:41 245,760 ----a-w C:\WINDOWS\system32\nvrseng.dll
2007-12-05 00:41 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-12-05 00:41 225,280 ----a-w C:\WINDOWS\system32\nvrszhc.dll
2007-12-05 00:41 212,992 ----a-w C:\WINDOWS\system32\nvwrsja.dll
2007-12-05 00:41 2,854,912 ----a-w C:\WINDOWS\system32\nvmoblsr.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06358080-33BE-452b-9B31-E54E112ADCCA}]
2008-01-16 19:29 9728 --a------ C:\WINDOWS\system32\MSIEMPlayer.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360]
"AlcoholAutomount"="E:\Programmes\Alcohol 120\axcmd.exe" [2007-12-25 02:35 4608]
"SuperCopier2.exe"="E:\Programmes\SuperCopier 2\SuperCopier2.exe" [2006-07-07 17:45 1052672]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 15:10 110592 C:\WINDOWS\system32\bthprops.cpl]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SoundMan"="SOUNDMAN.EXE" [2005-10-24 14:45 90112 C:\WINDOWS\soundman.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"Flashget"="E:\Programmes\FlashGet\flashget.exe" [2007-09-25 09:10 2007088]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-26 13:31 249896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="cmd.exe" [2004-08-19 15:09 428032 C:\WINDOWS\system32\cmd.exe]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 14:52 44544]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoChooseProgramsPage"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoChooseProgramsPage"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoChooseProgramsPage"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\jkkll.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-220523388-1580436667-1801674531-1004\Scripts\Logoff\0\0]
"Script"=scriptoff.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-220523388-1580436667-1801674531-1004\Scripts\Logon\0\0]
"Script"=scripton.exe

[HKLM\~\startupfolder\C:^Documents and Settings^Del Nero^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
path=C:\Documents and Settings\Del Nero\Menu Démarrer\Programmes\Démarrage\TransBar.lnk
backup=C:\WINDOWS\pss\TransBar.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Del Nero^Menu Démarrer^Programmes^Démarrage^UberIcon.lnk]
path=C:\Documents and Settings\Del Nero\Menu Démarrer\Programmes\Démarrage\UberIcon.lnk
backup=C:\WINDOWS\pss\UberIcon.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Del Nero^Menu Démarrer^Programmes^Démarrage^Y'z Shadow.lnk]
path=C:\Documents and Settings\Del Nero\Menu Démarrer\Programmes\Démarrage\Y'z Shadow.lnk
backup=C:\WINDOWS\pss\Y'z Shadow.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:55 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2007-08-31 16:46 1460560 E:\Programmes\Spybot - Search & Destroy\TeaTimer.exe


*Newly Created Service* - WUAUSERV
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-26 18:50:12
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-01-26 18:51:35 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-26 17:51:26

Que dois-je faire ensuite?

Re,

Désactive tes protections résidentes (antivirus...) !
Copie (Ctrl+C) le texte se situant dans le cadre ci-dessous :

Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précedemment copié.
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :


Cela va relancer Combofix, tape sur 1 puis valide. Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
NOTE : S'il n'y a pas de rédémarrage, poste quand même les rapports demandés.

Re

Voici le rapport ComboFix :

ComboFix 08-01-23.1C - Del Nero 2008-01-27 23:21:35.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1626 [GMT 1:00]
Endroit: C:\Documents and Settings\Del Nero\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Del Nero\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]

FILE
C:\WINDOWS\system32\bnjoklmw.ini
C:\WINDOWS\system32\dvwfeavf.ini
C:\WINDOWS\system32\jwifuhhi.ini
C:\WINDOWS\system32\lkmpperl.ini
C:\WINDOWS\system32\ntfkfngt.ini
C:\WINDOWS\system32\ohahfeph.ini
C:\WINDOWS\system32\tprfsxmv.ini
C:\WINDOWS\system32\unnhkiwo.ini
C:\WINDOWS\system32\uyatrbvu.ini
C:\WINDOWS\system32\vavfbnur.ini
C:\WINDOWS\system32\xeotwfgv.ini
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\bnjoklmw.ini
C:\WINDOWS\system32\dvwfeavf.ini
C:\WINDOWS\system32\jwifuhhi.ini
C:\WINDOWS\system32\lkmpperl.ini
C:\WINDOWS\system32\ntfkfngt.ini
C:\WINDOWS\system32\ohahfeph.ini
C:\WINDOWS\system32\tprfsxmv.ini
C:\WINDOWS\system32\unnhkiwo.ini
C:\WINDOWS\system32\uyatrbvu.ini
C:\WINDOWS\system32\vavfbnur.ini
C:\WINDOWS\system32\xeotwfgv.ini

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-27 to 2008-01-27 ))))))))))))))))))))))))))))))))))))
.

2008-01-26 18:40 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-26 15:05 . 2008-01-26 15:05 2,381 --a------ C:\WINDOWS\Opera.INI
2008-01-26 14:15 . 2008-01-26 14:15 15 --a------ C:\WINDOWS\system32\58d30e72
2008-01-26 13:55 . 2008-01-26 13:55 <REP> d-------- C:\VundoFix Backups
2008-01-26 13:16 . 2008-01-26 13:16 <REP> d-------- C:\Program Files\Avira
2008-01-23 23:35 . 2008-01-23 23:35 268 --ah----- C:\sqmdata01.sqm
2008-01-23 23:35 . 2008-01-23 23:35 244 --ah----- C:\sqmnoopt01.sqm
2008-01-22 22:49 . 2008-01-22 22:49 268 --ah----- C:\sqmdata00.sqm
2008-01-22 22:49 . 2008-01-22 22:49 244 --ah----- C:\sqmnoopt00.sqm
2008-01-16 19:29 . 2008-01-16 19:29 9,728 --a------ C:\WINDOWS\system32\MSIEMPlayer.DLL
2008-01-13 18:37 . 2008-01-13 18:37 38 --a------ C:\WINDOWS\avisplitter.INI
2008-01-09 20:17 . 2008-01-09 20:25 4,607 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-01-08 22:55 . 2008-01-08 22:55 <REP> d-------- C:\WINDOWS\system32\GroupPolicy
2008-01-08 22:55 . 2008-01-08 22:55 <REP> d-------- C:\WINDOWS\SparkleXP
2008-01-07 18:04 . 2008-01-09 20:25 3,932,214 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
2008-01-07 18:04 . 2008-01-09 20:25 59,964 --a------ C:\WINDOWS\BricoPackUninst.cmd
2008-01-07 17:57 . 2008-01-09 20:17 <REP> d-------- C:\WINDOWS\BricoPacks
2008-01-07 17:49 . 2008-01-07 17:49 <REP> d-------- C:\Program Files\Windows Media Connect 2
2008-01-07 17:46 . 2008-01-07 17:46 <REP> d-------- C:\WINDOWS\system32\drivers\umdf
2008-01-07 17:41 . 2008-01-07 17:41 <REP> d-------- C:\Program Files\Microsoft Works
2008-01-07 17:40 . 2008-01-07 17:40 <REP> d-------- C:\Program Files\MSBuild
2008-01-07 17:33 . 2008-01-07 17:39 <REP> d-------- C:\WINDOWS\SHELLNEW
2008-01-07 17:31 . 2008-01-07 17:31 <REP> dr-h----- C:\MSOCache
2008-01-03 13:08 . 2004-08-19 15:09 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-01-01 23:39 . 2008-01-14 20:56 <REP> d-------- C:\Program Files\Everest Poker
2008-01-01 23:08 . 2008-01-01 23:08 94 --a------ C:\WINDOWS\wininit.ini
2007-12-30 17:58 . 2007-05-31 19:30 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2007-12-30 17:58 . 2007-05-31 19:29 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2007-12-30 17:57 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-12-30 17:57 . 2006-09-28 16:05 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2007-12-30 17:57 . 2007-04-04 18:55 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2007-12-30 17:57 . 2007-01-24 15:27 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2007-12-30 17:57 . 2006-12-08 12:02 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll
2007-12-27 18:30 . 2007-12-27 18:30 0 --a------ C:\WINDOWS\nsreg.dat

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-07 17:04 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-12-22 15:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-22 15:45 --------- d-----w C:\Program Files\Alcohol Soft
2007-12-22 15:33 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-12-15 19:55 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-12-11 17:26 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-12-11 06:54 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2007-12-09 20:55 --------- d-----w C:\Program Files\AvRack
2007-12-09 19:33 --------- d-----w C:\Program Files\Realtek Sound Manager
2007-12-09 19:33 --------- d-----w C:\Program Files\Realtek AC97
2007-12-09 19:24 --------- d-----w C:\Program Files\MSN Messenger
2007-12-09 19:14 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-12-09 19:14 --------- d-----w C:\Program Files\Fichiers communs\ODBC
2007-12-09 19:07 --------- d-----w C:\Program Files\Java
2007-12-09 19:07 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-12-09 18:39 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-12-09 18:37 --------- d-----w C:\Program Files\SystemRequirementsLab
2007-12-09 18:32 --------- d--h--w C:\Program Files\Uninstall Information
2007-12-09 18:27 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-09 18:23 --------- d-----w C:\Program Files\Services en ligne
2007-12-09 18:23 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-12-05 01:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-05 00:41 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-12-05 00:41 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-12-05 00:41 8,523,776 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-12-05 00:41 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-12-05 00:41 7,435,392 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-12-05 00:41 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-12-05 00:41 6,549,504 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-12-05 00:41 5,773,568 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-12-05 00:41 5,611,520 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-12-05 00:41 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-12-05 00:41 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-12-05 00:41 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-12-05 00:41 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-12-05 00:41 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-12-05 00:41 385,024 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-12-05 00:41 356,352 ----a-w C:\WINDOWS\system32\nvudisp.exe
2007-12-05 00:41 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-12-05 00:41 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-12-05 00:41 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-12-05 00:41 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-12-05 00:41 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-12-05 00:41 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-12-05 00:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-12-05 00:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-12-05 00:41 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-12-05 00:41 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-12-05 00:41 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-12-05 00:41 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-12-05 00:41 3,715,072 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-12-05 00:41 3,710,976 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-12-05 00:41 3,420,160 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-12-05 00:41 3,334,144 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-12-05 00:41 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-12-05 00:41 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-12-05 00:41 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\s