Bonjour à tous.

Probleme rencontré:

Impossible de se connecter depuis quelques jours aux pages HTTPS avec Firefox, IE6 et 7, Opéra, mais pas Mozilla...

Lenteur d'utilisation de Firefox avec certaines pages quelconques, et obligation de rafraichir avant d'afficher leur contenu. Pas avec Mozilla.

Sous IE, j'ai des fenêtres de pub qui se lancent de temps en temps.
Pas sous les autres navigateurs.
Exemple: http://www.web-mediaplayer.com/ful [...] &tag_id=28


Ce qui est encore plus étrange, c'est que chez moi j'arrive à me connecter aux sites HTTPS, mais rencontre quamd même des problemes de lenteur avec certaines pages (rafraichir...). Idem pour les fenêtre intempestives IE.

Au boulot j'ai tout les problèmes, et ai besoin de me connecter à yahoo ou gmail entre autre... (Mozilla pas optimisé pour)


Configuration:

Firefox: 2.0.0.6 <-> 2.0.0.12
IE: 6 <-> 7
Opéra: 9.24
Mozilla: 1.7.10

Windows XP Pro, SP2
Virus Scan Entreprise 8.5.0i (mis à jour régulièrement)



Un grand merci d'avance pour votre aide.

Hello ,

Bizarre ..

Télécharge HiJackThis < ici

lance le programme , clique sur [ do a system scan and save a logfile ]
copie / colle le rapport généré

>> Tuto HiJackThis v2.0.2 <<

Salut.

Merci de ta réponse rapide.

J'ai aussi lancé Spybot, et il m'a trouvé quelques éléments:

AdRevolver
DoubleClick
FastClick
HitBox
MediaPlexx
Right Media
Statcounter
Virtumonde

Voici mon log HiJackThis:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:44:42, on 14/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NetScreen\NetScreen-Remote\IPSecMon.exe
C:\Program Files\NetScreen\NetScreen-Remote\IreIKE.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\QuickSet.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Program Files\NetScreen\NetScreen-Remote\SafeCfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\Drivers\trcboot.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireSvc.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\PROGRA~1\NowSMS\SMSGWNT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NowSMS\SMSGWS.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\StacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by EDS COE
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://autoconf.eu.alcatel.com/proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=internetemea.eds.com:81;https=internetemea.eds.com:81;ftp=internetemea.eds.com:81;gopher=internetemea.eds.com:81
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.eds.com;<local>
O1 - Hosts: 213.186.47.145 www.kraland.org
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [EMFINV] C:\Program Files\Eds\EmfInv\emfinv.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [McAfeeFireTray] C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\Firetray.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [1433497b] rundll32.exe "C:\WINDOWS\system32\ruiwcmly.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKUS\S-1-5-19\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'Default user')
O4 - Global Startup: NetScreen-Remote.lnk = C:\Program Files\NetScreen\NetScreen-Remote\SafeCfg.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=www.infocentre.fr.eds.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ad2.ansf.alcatel.fr
O17 - HKLM\Software\..\Telephony: DomainName = ad2.ansf.alcatel.fr
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ad2.ansf.alcatel.fr
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = ad2.ad.alcatel.com,snr.ansf.alcatel.fr,netfr.alcatel.fr
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ad2.ad.alcatel.com,snr.ansf.alcatel.fr,netfr.alcatel.fr
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: McAfee Desktop Firewall Service (FireSvc) - Networks Associates Technology, Inc. - C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireSvc.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\NetScreen\NetScreen-Remote\IPSecMon.exe
O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Program Files\NetScreen\NetScreen-Remote\IreIKE.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NowSMS - Unknown owner - C:\PROGRA~1\NowSMS\SMSGWNT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: IBM Trace Facility (TrcBoot) - IBM Corporation - C:\WINDOWS\system32\Drivers\trcboot.exe

--
End of file - 9318 bytes

Bonsoir.

Partant bientôt à l'étranger en mission (demain ^^'), je me permet de relancer mon post.

Mon log HiJackThis vous parle t il?

Merci

Re ,

désolé du retard , le boulot ...

Désactive tes protections résidentes ( Antivirus , ... ) tu les réactivera après le scan

Télécharge ComboFix < ici

Enregistre le sur ton Bureau et pas ailleurs !
Double clique combofix.exe ( le .exe peut ne pas apparaitre )
Pour démarrer , tape [1] puis valide , attend la fin du scan
il peut y avoir un Redémarrage du PC !

Copie / Colle le rapport généré ( C:\Combofix.txt )

Pas de soucis, on a tous sa vie. ^^
Merci de m'aider.

Par contre, le soucis c'est que j'utilise MacAfee Virus scan entreprise 8.5.0i, (pc du travail) et que je ne sais pas comment l'arréter...

C'est un imératif?
Si oui, peut être qu'avec la base de registre...?
Ou en redémarrant en mode sans échec?

Re ,

Pas grave on va le lancer autrement

Ne double clique pas dessus , mais Menu Démarrer / Executer , colle ceci et valide :

Je dois avouer que le coup du 1/100 des PC plantes toussa m'a un peu mis la pression ^^ , mais voici mon log:


ComboFix 08-03-14.2 - cdamien 2008-03-14 20:25:14.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1033.18.1541 [GMT 1:00]
Running from: D:\Documents and Settings\cdamien.AD2\Desktop\Combofix.exe
Command switches used :: /KillAll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM17007ae7.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\clgymeeg.dll
C:\WINDOWS\system32\efbxsceu.dll
C:\WINDOWS\system32\ffgrkxww.dll
C:\WINDOWS\system32\fvnovovx.ini
C:\WINDOWS\system32\ingcnkyb.dll
C:\WINDOWS\system32\japmfxuq.dll
C:\WINDOWS\system32\kjkkrluu.dll
C:\WINDOWS\system32\loqrcrlo.ini
C:\WINDOWS\system32\mljhebx.dll
C:\WINDOWS\system32\nnedonbq.dll
C:\WINDOWS\system32\olrcrqol.dll
C:\WINDOWS\system32\omyqoxtg.dll
C:\WINDOWS\system32\pekdgfcw.dll
C:\WINDOWS\system32\pskill.exe
C:\WINDOWS\system32\qttss.ini
C:\WINDOWS\system32\qttss.ini2
C:\WINDOWS\system32\ssttq.dll
C:\WINDOWS\system32\sxqhucuh.dll
C:\WINDOWS\system32\tkdpanve.dll
C:\WINDOWS\system32\uexvaumj.dll
C:\WINDOWS\system32\xvovonvf.dll
C:\WINDOWS\system32\yaseemgc.dll
C:\WINDOWS\system32\yayraror.dll
C:\WINDOWS\system32\yuywrywy.dll
D:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
D:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Possible infected sites -----

hxxp://FRVELSSMS32
hxxp://139.54.202.227
hxxp://FRRENSSMS03.AD2.AD.ALCATEL.COM
hxxp://FRRENSSMSõj
.
((((((((((((((((((((((((( Files Created from 2008-02-14 to 2008-03-14 )))))))))))))))))))))))))))))))
.

2008-03-14 17:34 . 2008-03-14 17:34 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-03-14 15:53 . 2008-03-14 17:34 <DIR> d-------- C:\VundoFix Backups
2008-03-14 12:33 . 2008-03-14 17:39 1,351,995 ---hs---- C:\WINDOWS\system32\ylmcwiur.ini
2008-03-14 11:50 . 2008-03-14 11:51 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-14 11:36 . 2008-03-14 11:41 1,351,069 ---hs---- C:\WINDOWS\system32\gboqpbxo.ini
2008-03-13 18:18 . 2007-08-09 15:50 188,222 --a------ C:\WINDOWS\mcagview.exe
2008-03-13 17:41 . 2007-10-09 19:34 110,644 --a------ C:\WINDOWS\mctgui.exe
2008-03-13 17:39 . 2008-03-13 18:17 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\McAfee
2008-03-13 17:37 . 2007-10-16 20:50 171,272 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-03-13 17:37 . 2007-10-16 20:50 72,680 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-03-13 17:37 . 2007-10-16 20:50 64,168 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
2008-03-13 17:37 . 2007-10-16 20:50 51,944 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
2008-03-13 17:37 . 2007-10-16 20:50 33,960 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-03-13 17:36 . 2008-03-13 18:17 <DIR> d-------- C:\Program Files\McAfee
2008-03-13 17:36 . 2008-03-13 17:36 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-03-13 17:35 . 2008-03-13 17:35 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Network Associates
2008-03-13 17:34 . 2008-03-13 17:35 <DIR> d-------- C:\Program Files\Network Associates
2008-03-13 17:33 . 2008-03-13 17:33 <DIR> d-------- C:\Program Files\VPNLOGINSCRIPT
2008-03-13 17:33 . 2005-08-15 08:27 536,634 --------- C:\WINDOWS\system32\drivers\Crypto.sys
2008-03-13 17:32 . 2008-03-13 17:32 <DIR> d-------- C:\Program Files\Common Files\Deterministic Networks
2008-03-13 17:31 . 2008-03-13 17:31 <DIR> d-------- C:\Program Files\NetScreen
2008-03-13 17:31 . 2005-11-30 18:18 348,212 --a------ C:\WINDOWS\system32\IreMgmt.dll
2008-03-13 17:31 . 2001-11-07 10:48 143,360 --a------ C:\WINDOWS\system32\nsldap32v50.dll
2008-03-13 17:31 . 2002-12-06 14:42 78,848 -ra------ C:\WINDOWS\system32\soedber.dll
2008-03-13 17:31 . 2002-12-06 14:42 46,080 -ra------ C:\WINDOWS\system32\soedapi.dll
2008-03-13 17:31 . 2002-12-06 14:42 28,160 -ra------ C:\WINDOWS\system32\cstrain.dll
2008-03-13 17:31 . 2002-12-06 14:42 23,552 -ra------ C:\WINDOWS\system32\ossapi.dll
2008-03-13 17:31 . 2002-12-06 14:42 16,896 -ra------ C:\WINDOWS\system32\ossdmem.dll
2008-03-13 17:31 . 2002-12-06 14:42 11,264 -ra------ C:\WINDOWS\system32\soedoid.dll
2008-03-13 17:30 . 2008-03-13 17:30 <DIR> d-------- C:\WINDOWS\ms
2008-03-13 11:22 . 2008-03-13 11:22 <DIR> d-------- D:\Documents and Settings\jeanmian\Application Data\Dell
2008-03-13 11:21 . 2008-03-13 11:21 <DIR> d-------- D:\Documents and Settings\jeanmian\Application Data\Network Associates
2008-03-12 23:49 . 2008-03-12 23:49 <DIR> d-------- C:\Program Files\Alwil Software
2008-03-12 19:47 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\atosmrwlaxmm.sys
2008-03-12 18:55 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\rgsexruaxuli.sys
2008-03-12 18:41 . 2008-03-12 18:41 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-12 18:41 . 2008-03-12 18:41 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-03-12 18:25 . 2008-03-12 18:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-12 16:10 . 2008-03-12 16:10 <DIR> d-------- C:\Program Files\CCleaner
2008-03-12 11:54 . 2008-03-13 10:32 <DIR> d-------- C:\LangoScript
2008-03-12 11:35 . 2008-03-14 11:35 1,351,009 ---hs---- C:\WINDOWS\system32\vwlgbsnb.ini
2008-03-12 09:41 . 2008-03-12 09:41 <DIR> d-------- C:\WINDOWS\system32\ModelDat
2008-03-10 19:49 . 2008-03-14 11:50 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-10 11:30 . 2008-03-11 09:47 1,318,163 ---hs---- C:\WINDOWS\system32\jsmkquil.ini
2008-03-09 11:29 . 2008-03-10 11:29 1,317,923 ---hs---- C:\WINDOWS\system32\rrpxmpqf.ini
2008-03-08 20:02 . 2008-03-08 20:02 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-03-03 18:31 . 2008-03-03 18:31 <DIR> d-------- C:\Program Files\WinAVI MP4 Converter
2008-03-02 23:32 . 2008-03-14 20:31 <DIR> d-------- C:\MDT
2008-03-02 22:05 . 2008-03-02 22:05 <DIR> d-------- D:\Documents and Settings\cdamien.AD2\Application Data\CyberLink
2008-03-02 22:05 . 2008-03-02 22:05 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-22 20:32 . 2008-02-22 20:32 <DIR> d-------- C:\Program Files\AliveMedia
2008-02-22 18:36 . 2008-03-14 20:31 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-22 18:36 . 2008-02-22 18:36 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-22 18:34 . 2008-03-12 20:11 <DIR> d-------- C:\Program Files\iTunes
2008-02-22 18:34 . 2008-02-22 18:34 <DIR> d-------- C:\Program Files\iPod
2008-02-22 18:33 . 2008-02-22 18:34 <DIR> d-------- C:\Program Files\QuickTime
2008-02-22 18:32 . 2008-02-22 18:32 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Apple
2008-02-22 18:32 . 2008-02-22 18:32 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-02-22 18:32 . 2008-02-22 18:32 <DIR> d-------- C:\Program Files\Apple Software Update
2008-02-22 18:32 . 2008-02-18 11:16 30,464 --a------ C:\WINDOWS\system32\drivers\usbaapl.sys
2008-02-22 13:13 . 2008-03-14 20:31 <DIR> d-------- D:\Documents and Settings\cdamien.AD2\.rainlendar2
2008-02-22 13:12 . 2008-03-12 20:17 <DIR> d-------- C:\Program Files\Rainlendar2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-14 19:33 --------- d-----w C:\Program Files\NowSMS
2008-03-14 08:52 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-03-13 15:50 --------- d-----w C:\Program Files\Common Files\Network Associates
2008-03-13 15:28 --------- d-----w D:\Documents and Settings\cdamien.AD2\Application Data\FileZilla
2008-03-13 09:32 --------- d-----w C:\Program Files\Wolfenstein - Enemy Territory
2008-03-13 09:25 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-12 19:08 --------- d-----w C:\Program Files\FileZilla Client
2008-03-12 19:06 --------- d-----w C:\Program Files\Apoint
2008-03-12 16:13 --------- d-----w C:\Program Files\Common Files\Logishrd
2008-03-12 08:52 --------- d-----w C:\Program Files\Common Files\Logitech
2008-03-12 08:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-12 08:42 --------- d-----w C:\Program Files\Logitech
2008-03-11 22:29 --------- d-----w C:\Program Files\Azureus
2008-03-11 21:40 --------- d-----w C:\Program Files\Yahoo!
2008-02-22 17:34 --------- d-----w D:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-22 12:09 --------- d-----w C:\Program Files\DivX
2008-02-14 13:49 --------- d-----w D:\Documents and Settings\cdamien.AD2\Application Data\Wireshark
2008-02-06 05:02 --------- d-----w C:\Program Files\Google
2008-02-06 05:01 --------- d-----w C:\Program Files\Skype
2008-02-04 07:42 --------- d-----w D:\Documents and Settings\cdamien.AD2\Application Data\ACD Systems
2008-02-04 07:41 --------- d-----w D:\Documents and Settings\All Users\Application Data\ACD Systems
2008-02-04 07:41 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-02-04 07:41 --------- d-----w C:\Program Files\ACD Systems
2008-02-01 16:14 0 ----a-w C:\WINDOWS\system32\drivers\lvuvc.hs
2008-02-01 11:37 --------- d-----w C:\Program Files\mst software
2008-01-23 19:37 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-01-21 08:55 --------- d-----w C:\Program Files\SMS Packages
2008-01-16 20:48 --------- d-----w C:\Program Files\Torrent Search
2008-01-15 10:07 --------- d-----w C:\Program Files\Microsoft Office Communicator
2007-12-26 19:28 32 ----a-w D:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-12-24 12:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2007-12-19 19:30 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-12-17 16:41 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-12-05 20:08 22,328 ----a-w D:\Documents and Settings\cdamien.AD2\Application Data\PnkBstrK.sys
2006-12-29 15:15 626,688 ----a-w C:\Program Files\Common Files\sapconsaccess.dll
2006-12-29 15:15 40,960 ----a-w C:\Program Files\Common Files\DigitalSignature.ocx
2006-12-29 15:15 3,100,672 ----a-w C:\Program Files\Common Files\sapxlhelper.dll
2006-12-29 15:15 192,512 ----a-w C:\Program Files\Common Files\sapconsr3.dll
2006-12-07 10:26 1,129,984 ----a-w C:\Program Files\Common Files\SAPActiveXL.xlt
2006-12-07 10:26 1,124,864 ----a-w C:\Program Files\Common Files\SAPActiveXL_nosig.xlt
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Rasmpc]
@={9D1F87E7-4D72-41AB-9D57-D101A08F20E5}

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-07-24 08:12 1298432]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 13:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 13:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 13:00 455168]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-05-06 17:52 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-05-06 17:48 118784]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 13:00 59392]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-29 04:05 8429568]
"nwiz"="nwiz.exe" [2007-04-29 04:05 1626112 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2007-04-29 04:05 67584 C:\WINDOWS\system32\nvhotkey.dll]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-29 04:05 81920]
"SigmatelSysTrayApp"="stsystra.exe" [2007-02-19 23:26 303104 C:\WINDOWS\stsystra.exe]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 04:43 176128]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\QuickSet.exe" [2007-02-20 12:29 1191936]
"PDVDDXSrv"="C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 17:23 118784]
"EMFINV"="C:\Program Files\Eds\EmfInv\emfinv.exe" [2006-11-02 17:32 143360]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 C:\WINDOWS\KHALMNPR.Exe]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 22:22 3739648]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2007-10-25 15:06 136512]
"Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [2004-02-19 13:07 147514]
"McAfeeFireTray"="C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\Firetray.exe" [2005-04-12 18:40 655420]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2007-10-16 20:50 111952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Communicator"="C:\Program Files\Microsoft Office Communicator\Communicator.exe" [2007-06-19 19:13 3901288]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]

D:\Documents and Settings\lztt9h\Start Menu\Programs\Startup\
New PC Important Information and Additional Applications.mht.lnk - C:\WINDOWS\COE\NewPC\New PC Important Information and Additional Applications.mht [2007-07-31 12:49:55 46917]

D:\Documents and Settings\sturbet\Start Menu\Programs\Startup\
New PC Important Information and Additional Applications.mht.lnk - C:\WINDOWS\COE\NewPC\New PC Important Information and Additional Applications.mht [2007-07-31 12:49:55 46917]

D:\Documents and Settings\tzbh1Y\Start Menu\Programs\Startup\
New PC Important Information and Additional Applications.mht.lnk - C:\WINDOWS\COE\NewPC\New PC Important Information and Additional Applications.mht [2007-07-31 12:49:55 46917]

D:\Documents and Settings\cdamien\Start Menu\Programs\Startup\
montage.bat [2008-01-25 16:35:39 459]
New PC Important Information and Additional Applications.mht.lnk - C:\WINDOWS\COE\NewPC\New PC Important Information and Additional Applications.mht [2007-07-31 12:49:55 46917]

D:\Documents and Settings\erwanq\Start Menu\Programs\Startup\
New PC Important Information and Additional Applications.mht.lnk - C:\WINDOWS\COE\NewPC\New PC Important Information and Additional Applications.mht [2007-07-31 12:49:55 46917]

D:\Documents and Settings\jeanmian\Start Menu\Programs\Startup\
New PC Important Information and Additional Applications.mht.lnk - C:\WINDOWS\COE\NewPC\New PC Important Information and Additional Applications.mht [2007-07-31 12:49:55 46917]

D:\Documents and Settings\jz60bx\Start Menu\Programs\Startup\
New PC Important Information and Additional Applications.mht.lnk - C:\WINDOWS\COE\NewPC\New PC Important Information and Additional Applications.mht [2007-07-31 12:49:55 46917]

D:\Documents and Settings\All Users\Start Menu\Programs\Startup\
NetScreen-Remote.lnk - C:\Program Files\NetScreen\NetScreen-Remote\SafeCfg.exe [2008-03-13 17:31:46 73780]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoMSAppLogo5ChannelNotify"= 1 (0x1)
"NoToolbarCustomize"= 0 (0x0)
"NoBandCustomize"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
"Btn_Back"= 0 (0x0)
"Btn_Forward"= 0 (0x0)
"Btn_Stop"= 0 (0x0)
"Btn_Refresh"= 0 (0x0)
"Btn_Home"= 0 (0x0)
"Btn_Search"= 0 (0x0)
"Btn_History"= 0 (0x0)
"Btn_Favorites"= 0 (0x0)
"Btn_Media"= 0 (0x0)
"Btn_Folders"= 0 (0x0)
"Btn_Fullscreen"= 0 (0x0)
"Btn_Tools"= 0 (0x0)
"Btn_MailNews"= 0 (0x0)
"Btn_Size"= 0 (0x0)
"Btn_Print"= 0 (0x0)
"Btn_Edit"= 0 (0x0)
"Btn_Discussions"= 0 (0x0)
"Btn_Cut"= 0 (0x0)
"Btn_Copy"= 0 (0x0)
"Btn_Paste"= 0 (0x0)
"Btn_Encoding"= 0 (0x0)
"Btn_PrintPreview"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoLogoff"= 0 (0x0)
"EnforceShellExtensionSecurity"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]
"NoAutoUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pcsinst]
pcsinst.dll 2006-07-31 18:24 49152 C:\WINDOWS\system32\pcsinst.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1547161642-879983540-682003330-142676\Scripts\Logon\0\0]
"Script"=etrustcfg.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1547161642-879983540-682003330-264140\Scripts\Logon\0\0]
"Script"=etrustcfg.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1547161642-879983540-682003330-39221\Scripts\Logon\0\0]
"Script"=etrustcfg.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\CA\\eTrust Antivirus\\InoNmSrv.exe"=
"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\NetScreen\\NetScreen-Remote\\IreIKE.exe"=
"C:\Program Files\NetScreen\NetScreen-Remote\ViewLog.exe"= C:\Program Files\NetScreen\NetScreen-Remote\ViewLog.exe:127.0.0.1/255.255.255.255:Enabled:ViewLog
"C:\Program Files\NetScreen\NetScreen-Remote\CmonApp.exe"= C:\Program Files\NetScreen\NetScreen-Remote\CmonApp.exe:127.0.0.1/255.255.255.255:Enabled:CMonApp
"C:\Program Files\NetScreen\NetScreen-Remote\vpn.exe"= C:\Program Files\NetScreen\NetScreen-Remote\vpn.exe:127.0.0.1/255.255.255.255:Enabled:VPN Connection Manager

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 IPSECDRV;SafeNet IPSec Plugin;C:\WINDOWS\system32\Drivers\IPSECDRV.sys [2005-11-30 17:32]
R2 CcmExec;SMS Agent Host;C:\WINDOWS\system32\CCM\CcmExec.exe [2007-04-13 02:50]
R2 Crypto;Crypto;C:\WINDOWS\system32\Drivers\Crypto.sys [2005-08-15 08:27]
R2 NowSMS;NowSMS;C:\PROGRA~1\NowSMS\SMSGWNT.EXE [2004-08-18 14:20]
R2 NsTrcNT;NsTrcNT;C:\WINDOWS\system32\drivers\nstrcnt.sys [2006-08-11 12:09]
R3 DniVap;SafeNet WAN Miniport (VA);C:\WINDOWS\system32\DRIVERS\vap.sys [2001-12-14 15:26]
R3 KLOGNT;KLOGNT;C:\WINDOWS\system32\drivers\klognt.sys [2006-08-11 12:09]
R3 prepdrvr;SMS Process Event Driver;C:\WINDOWS\system32\CCM\prepdrv.sys [2007-04-13 02:50]
S4 a320raid;a320raid;C:\WINDOWS\system32\DRIVERS\a320raid.sys [2004-07-29 21:34]
S4 aarich;aarich;C:\WINDOWS\system32\DRIVERS\aarich.sys [2005-05-18 04:12]
S4 megasas;megasas;C:\WINDOWS\system32\DRIVERS\megasas.sys [2006-08-25 20:29]

*Newly Created Service* - ALG

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>>ZZZZZZZZ_ScreenSaver]
C:\WINDOWS\System32\REG ADD "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d C:\WINDOWS\FIRE_8~1.SCR /F

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\BuildUtil]
C:\WINDOWS\COE\Build\Utils\BuildUtil.exe /regserver

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\EandL]
C:\WINDOWS\COE\Build\0001-BLD-Execute and Leave.wsf

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\GEO_Nation]
C:\WINDOWS\System32\REG ADD "HKCU\Control Panel\International\Geo" /v Nation /t REG_SZ /d 84 /F

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\LanguageBar]
C:\WINDOWS\System32\REG ADD "HKCU\Software\Microsoft\CTF\LangBar" /v ShowStatus /t REG_DWORD /d 00000004 /F

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Netmeeting]
C:\WINDOWS\System32\REG ADD "HKCU\Software\Microsoft\User Location Service\Client" /v Server Name /t REG_SZ /d ils1.ti.eds.com /F

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\NetscreenVPNClient_1071b10_menu]
regedit -s "C:\Program Files\NetScreen\NetScreen-Remote\menu_order.reg"

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Netscreen_1071b10]
regedit -s "C:\Program Files\NetScreen\NetScreen-Remote\safenet_proxy.reg"

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Outlook_PRF]
C:\WINDOWS\System32\REG ADD "HKCU\Software\Microsoft\Office\11.0\Outlook\Setup" /v ImportPRF /t REG_SZ /d C:\WINDOWS\COE\outlook.prf /F

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EEBF9CA6-567B-41cd-B5F6-EF2C7FEF37B5}]
rundll32.exe advpack.dll,LaunchINFSectionEx C:\WINDOWS\INF\wmactedp.inf,PerUserStub,,4
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-14 20:31:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\NetScreen\NetScreen-Remote\IPSecMon.exe
C:\Program Files\NetScreen\NetScreen-Remote\IreIKE.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\Drivers\trcboot.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireSvc.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NowSMS\SMSGWS.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\StacSV.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\msiexec.exe
.
**************************************************************************
.
Completion time: 2008-03-14 20:34:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-14 19:34:43
.
2007-11-27 12:29:43 --- E O F ---

Re ,

Séléctionne l'encadré ci dessous en entier , puis clique droit , choisis Copier

Colle le dans le Bloc-Notes
Enregistre le sur ton Bureau et nomme le CFScript ( type fichier texte )
Fait glisser le fichier CFScript sur le fichier ComboFix.exe comme ceci :



Un menu va apparaitre , tape 1 puis valide
Laisse faire le scan et poste le rapport généré ( C:\ComboFix.txt )

J'ai bien fait glisser le script sur l'icone de ComboFix, mais je n'ai pas eu à choisir 1 dans un menu.
Cependant j'ai bien vu dans la console qu'il supprimais les fichiers présent dans le script.

Voici le log:
ComboFix 08-03-14.2 - cdamien 2008-03-14 21:16:50.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1033.18.1557 [GMT 1:00]
Running from: D:\Documents and Settings\cdamien.AD2\Desktop\ComboFix.exe
Command switches used :: D:\Documents and Settings\cdamien.AD2\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\gboqpbxo.ini
C:\WINDOWS\system32\jsmkquil.ini
C:\WINDOWS\system32\rrpxmpqf.ini
C:\WINDOWS\system32\vwlgbsnb.ini
C:\WINDOWS\system32\ylmcwiur.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\VundoFix Backups\qttss.ini.bad
C:\VundoFix Backups\qttss.ini2.bad
C:\VundoFix Backups\ssttq.dll.bad
C:\WINDOWS\system32\gboqpbxo.ini
C:\WINDOWS\system32\jsmkquil.ini
C:\WINDOWS\system32\rrpxmpqf.ini
C:\WINDOWS\system32\vwlgbsnb.ini
C:\WINDOWS\system32\ylmcwiur.ini

.
((((((((((((((((((((((((( Files Created from 2008-02-14 to 2008-03-14 )))))))))))))))))))))))))))))))
.

2008-03-14 17:34 . 2008-03-14 17:34 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-03-14 11:50 . 2008-03-14 11:51 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-13 18:18 . 2007-08-09 15:50 188,222 --a------ C:\WINDOWS\mcagview.exe
2008-03-13 17:41 . 2007-10-09 19:34 110,644 --a------ C:\WINDOWS\mctgui.exe
2008-03-13 17:39 . 2008-03-13 18:17 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\McAfee
2008-03-13 17:37 . 2007-10-16 20:50 171,272 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-03-13 17:37 . 2007-10-16 20:50 72,680 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-03-13 17:37 . 2007-10-16 20:50 64,168 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
2008-03-13 17:37 . 2007-10-16 20:50 51,944 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
2008-03-13 17:37 . 2007-10-16 20:50 33,960 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-03-13 17:36 . 2008-03-13 18:17 <DIR> d-------- C:\Program Files\McAfee
2008-03-13 17:36 . 2008-03-13 17:36 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-03-13 17:35 . 2008-03-13 17:35 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Network Associates
2008-03-13 17:34 . 2008-03-13 17:35 <DIR> d-------- C:\Program Files\Network Associates
2008-03-13 17:33 . 2008-03-13 17:33 <DIR> d-------- C:\Program Files\VPNLOGINSCRIPT
2008-03-13 17:33 . 2005-08-15 08:27 536,634 --------- C:\WINDOWS\system32\drivers\Crypto.sys
2008-03-13 17:32 . 2008-03-13 17:32 <DIR> d-------- C:\Program Files\Common Files\Deterministic Networks
2008-03-13 17:31 . 2008-03-13 17:31 <DIR> d-------- C:\Program Files\NetScreen
2008-03-13 17:31 . 2005-11-30 18:18 348,212 --a------ C:\WINDOWS\system32\IreMgmt.dll
2008-03-13 17:31 . 2001-11-07 10:48 143,360 --a------ C:\WINDOWS\system32\nsldap32v50.dll
2008-03-13 17:31 . 2002-12-06 14:42 78,848 -ra------ C:\WINDOWS\system32\soedber.dll
2008-03-13 17:31 . 2002-12-06 14:42 46,080 -ra------ C:\WINDOWS\system32\soedapi.dll
2008-03-13 17:31 . 2002-12-06 14:42 28,160 -ra------ C:\WINDOWS\system32\cstrain.dll
2008-03-13 17:31 . 2002-12-06 14:42 23,552 -ra------ C:\WINDOWS\system32\ossapi.dll
2008-03-13 17:31 . 2002-12-06 14:42 16,896 -ra------ C:\WINDOWS\system32\ossdmem.dll
2008-03-13 17:31 . 2002-12-06 14:42 11,264 -ra------ C:\WINDOWS\system32\soedoid.dll
2008-03-13 17:30 . 2008-03-13 17:30 <DIR> d-------- C:\WINDOWS\ms
2008-03-13 11:22 . 2008-03-13 11:22 <DIR> d-------- D:\Documents and Settings\jeanmian\Application Data\Dell
2008-03-13 11:21 . 2008-03-13 11:21 <DIR> d-------- D:\Documents and Settings\jeanmian\Application Data\Network Associates
2008-03-12 23:49 . 2008-03-12 23:49 <DIR> d-------- C:\Program Files\Alwil Software
2008-03-12 19:47 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\atosmrwlaxmm.sys
2008-03-12 18:55 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\rgsexruaxuli.sys
2008-03-12 18:41 . 2008-03-12 18:41 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-12 18:41 . 2008-03-12 18:41 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-03-12 18:25 . 2008-03-12 18:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-12 16:10 . 2008-03-12 16:10 <DIR> d-------- C:\Program Files\CCleaner
2008-03-12 11:54 . 2008-03-13 10:32 <DIR> d-------- C:\LangoScript
2008-03-12 09:41 . 2008-03-12 09:41 <DIR> d-------- C:\WINDOWS\system32\ModelDat
2008-03-10 19:49 . 2008-03-14 11:50 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-08 20:02 . 2008-03-08 20:02 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-03-03 18:31 . 2008-03-03 18:31 <DIR> d-------- C:\Program Files\WinAVI MP4 Converter
2008-03-02 23:32 . 2008-03-14 21:19 <DIR> d-------- C:\MDT
2008-03-02 22:05 . 2008-03-02 22:05 <DIR> d-------- D:\Documents and Settings\cdamien.AD2\Application Data\CyberLink
2008-03-02 22:05 . 2008-03-02 22:05 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-22 20:32 . 2008-02-22 20:32 <DIR> d-------- C:\Program Files\AliveMedia
2008-02-22 18:36 . 2008-03-1