------------------------------[ Lop S&D 1.5 ]----------------------------
Version : Microsoft Windows XP [version 5.1.2600] [ OS : Windows_NT ]
Lancé depuis : "C:\Documents and Settings\manon le maguer\Bureau\LopSD\Lop S&D"
Rapport créé Le 16/11/2007 à 16:34:03,79 PC : PRESARIO
! Faire analyser le rapport par un Helper avant intervention !
-------------[ Listing des Dossiers dans Application Data ]-------------
C:\Documents and settings\Administrateur\Application Data\Identities
C:\Documents and settings\Administrateur\Application Data\Microsoft
C:\Documents and settings\Administrateur\Application Data\desktop.ini
C:\Documents and settings\All Users\Application Data\BitDefender
C:\Documents and settings\All Users\Application Data\Grisoft
C:\Documents and settings\All Users\Application Data\bits chin bind drive
C:\Documents and settings\All Users\Application Data\Ulead Systems
C:\Documents and settings\All Users\Application Data\SmartSound Software Inc
C:\Documents and settings\All Users\Application Data\Microsoft
C:\Documents and settings\All Users\Application Data\Yahoo! Companion
C:\Documents and settings\All Users\Application Data\Apple Computer
C:\Documents and settings\All Users\Application Data\Google
C:\Documents and settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and settings\All Users\Application Data\ThunkAmenDashChin
C:\Documents and settings\All Users\Application Data\Messenger Plus!
C:\Documents and settings\All Users\Application Data\SBSI
C:\Documents and settings\All Users\Application Data\HP
C:\Documents and settings\All Users\Application Data\CyberLink
C:\Documents and settings\All Users\Application Data\InstallShield
C:\Documents and settings\All Users\Application Data\hpzinstall.log
C:\Documents and settings\All Users\Application Data\Sonic
C:\Documents and settings\All Users\Application Data\Adobe
C:\Documents and settings\All Users\Application Data\desktop.ini
C:\Documents and settings\Default User\Application Data\Identities
C:\Documents and settings\Default User\Application Data\Microsoft
C:\Documents and settings\Default User\Application Data\desktop.ini
C:\Documents and settings\LocalService\Application Data\Microsoft
C:\Documents and settings\manon le maguer\Application Data\Bitdefender
C:\Documents and settings\manon le maguer\Application Data\Mozilla
C:\Documents and settings\manon le maguer\Application Data\Grisoft
C:\Documents and settings\manon le maguer\Application Data\IE7Pro
C:\Documents and settings\manon le maguer\Application Data\wklnhst.dat
C:\Documents and settings\manon le maguer\Application Data\Sun
C:\Documents and settings\manon le maguer\Application Data\Ulead Systems
C:\Documents and settings\manon le maguer\Application Data\Morpheus Software
C:\Documents and settings\manon le maguer\Application Data\Morpheus
C:\Documents and settings\manon le maguer\Application Data\Apple Computer
C:\Documents and settings\manon le maguer\Application Data\CyberLink
C:\Documents and settings\manon le maguer\Application Data\HP
C:\Documents and settings\manon le maguer\Application Data\Google
C:\Documents and settings\manon le maguer\Application Data\Microsoft
C:\Documents and settings\manon le maguer\Application Data\Template
C:\Documents and settings\manon le maguer\Application Data\Creative
C:\Documents and settings\manon le maguer\Application Data\Macromedia
C:\Documents and settings\manon le maguer\Application Data\Help
C:\Documents and settings\manon le maguer\Application Data\Identities
C:\Documents and settings\manon le maguer\Application Data\desktop.ini
C:\Documents and settings\megane le maguer\Application Data\BitDefender
C:\Documents and settings\megane le maguer\Application Data\IE7Pro
C:\Documents and settings\megane le maguer\Application Data\stopbat
C:\Documents and settings\megane le maguer\Application Data\Microsoft
C:\Documents and settings\megane le maguer\Application Data\wklnhst.dat
C:\Documents and settings\megane le maguer\Application Data\Ulead Systems
C:\Documents and settings\megane le maguer\Application Data\AVSMedia
C:\Documents and settings\megane le maguer\Application Data\Apple Computer
C:\Documents and settings\megane le maguer\Application Data\CyberLink
C:\Documents and settings\megane le maguer\Application Data\HP
C:\Documents and settings\megane le maguer\Application Data\ArcSoft
C:\Documents and settings\megane le maguer\Application Data\Morpheus
C:\Documents and settings\megane le maguer\Application Data\Morpheus Software
C:\Documents and settings\megane le maguer\Application Data\Sun
C:\Documents and settings\megane le maguer\Application Data\Google
C:\Documents and settings\megane le maguer\Application Data\Jasc
C:\Documents and settings\megane le maguer\Application Data\AdobeUM
C:\Documents and settings\megane le maguer\Application Data\Adobe
C:\Documents and settings\megane le maguer\Application Data\Creative
C:\Documents and settings\megane le maguer\Application Data\Help
C:\Documents and settings\megane le maguer\Application Data\Sonic
C:\Documents and settings\megane le maguer\Application Data\Leadertech
C:\Documents and settings\megane le maguer\Application Data\Macromedia
C:\Documents and settings\megane le maguer\Application Data\Template
C:\Documents and settings\megane le maguer\Application Data\Identities
C:\Documents and settings\megane le maguer\Application Data\Symantec
C:\Documents and settings\megane le maguer\Application Data\desktop.ini
C:\Documents and settings\NetworkService\Application Data\Microsoft
C:\Documents and settings\Sabine\Application Data\BitDefender
C:\Documents and settings\Sabine\Application Data\IE7Pro
C:\Documents and settings\Sabine\Application Data\Microsoft
C:\Documents and settings\Sabine\Application Data\Ulead Systems
C:\Documents and settings\Sabine\Application Data\wklnhst.dat
C:\Documents and settings\Sabine\Application Data\Template
C:\Documents and settings\Sabine\Application Data\AdobeUM
C:\Documents and settings\Sabine\Application Data\Adobe
C:\Documents and settings\Sabine\Application Data\Sun
C:\Documents and settings\Sabine\Application Data\Macromedia
C:\Documents and settings\Sabine\Application Data\Google
C:\Documents and settings\Sabine\Application Data\Creative
C:\Documents and settings\Sabine\Application Data\Identities
C:\Documents and settings\Sabine\Application Data\desktop.ini
C:\Documents and settings\Test\Application Data\Google
C:\Documents and settings\Test\Application Data\Microsoft
C:\Documents and settings\Test\Application Data\Creative
C:\Documents and settings\Test\Application Data\Identities
C:\Documents and settings\Test\Application Data\desktop.ini
----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\SA.DAT
C:\WINDOWS\tasks\desktop.ini
---------------[ Listing des dossiers dans Program Files ]--------------
C:\Program Files\Active GIF Creator 2.23
C:\Program Files\Adobe
C:\Program Files\Alwil Software
C:\Program Files\AMD
C:\Program Files\Apple Software Update
C:\Program Files\ATI Technologies
C:\Program Files\AVSMedia
C:\Program Files\BitDefender
C:\Program Files\Chevalmag
C:\Program Files\ComPlus Applications
C:\Program Files\CONEXANT
C:\Program Files\Creative
C:\Program Files\eMule
C:\Program Files\Fichiers communs
C:\Program Files\Google
C:\Program Files\Grisoft
C:\Program Files\Hewlett-Packard
C:\Program Files\HP
C:\Program Files\HPQ
C:\Program Files\IE7Pro
C:\Program Files\Internet Explorer
C:\Program Files\Inventel
C:\Program Files\iPod
C:\Program Files\iTunes
C:\Program Files\Jasc Software Inc
C:\Program Files\Java
C:\Program Files\Kodak
C:\Program Files\Logiciel Photo Orange
C:\Program Files\Messenger
C:\Program Files\Messenger Plus! Live
C:\Program Files\MessengerPlus! 3
C:\Program Files\microsoft frontpage
C:\Program Files\Microsoft Office
C:\Program Files\Microsoft Works
C:\Program Files\MioNet
C:\Program Files\Morpheus
C:\Program Files\Morpheus Photo Animation Suite
C:\Program Files\MorpheusBar
C:\Program Files\Movie Maker
C:\Program Files\MSN
C:\Program Files\MSN Gaming Zone
C:\Program Files\MSN Messenger
C:\Program Files\MSXML 4.0
C:\Program Files\Navilog1
C:\Program Files\NetMeeting
C:\Program Files\Outlook Express
C:\Program Files\Philips
C:\Program Files\PhotoFiltre
C:\Program Files\Picasa2
C:\Program Files\QuickTime
C:\Program Files\SAGEM
C:\Program Files\Securitoo
C:\Program Files\Services en ligne
C:\Program Files\SM
C:\Program Files\SmartSound Software
C:\Program Files\Sonic
C:\Program Files\stopbat
C:\Program Files\Synaptics
C:\Program Files\Ulead Systems
C:\Program Files\Wanadoo
C:\Program Files\Windows Live
C:\Program Files\Windows Media Components
C:\Program Files\Windows Media Connect 2
C:\Program Files\Windows Media Player
C:\Program Files\Windows NT
C:\Program Files\xerox
C:\Program Files\Yahoo!
------[ Listing des dossiers dans Program Files\Fichiers Communs ]------
C:\program files\fichiers communs\Adobe
C:\program files\fichiers communs\AOL
C:\program files\fichiers communs\ArcSoft
C:\program files\fichiers communs\AVSMedia
C:\program files\fichiers communs\BitDefender
C:\program files\fichiers communs\FDEUnInstaller.exe
C:\program files\fichiers communs\HP
C:\program files\fichiers communs\InstallShield
C:\program files\fichiers communs\Java
C:\program files\fichiers communs\LightScribe
C:\program files\fichiers communs\Microsoft Shared
C:\program files\fichiers communs\MSSoap
C:\program files\fichiers communs\ODBC
C:\program files\fichiers communs\Services
C:\program files\fichiers communs\Sonic Shared
C:\program files\fichiers communs\SPC500NC
C:\program files\fichiers communs\SpeechEngines
C:\program files\fichiers communs\SureThing Shared
C:\program files\fichiers communs\Symantec Shared
C:\program files\fichiers communs\System
C:\program files\fichiers communs\TiVo Shared
C:\program files\fichiers communs\Ulead Systems
----------------------[ Recherche dans le Registre ]----------------------
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
-----------------[ Recherche de Fichiers - Dossiers Lop ]-----------------
Aucun dossier Lop trouvé !
--------------------[ Vérification du fichier Hosts ]---------------------
Fichier Hosts : MODIFIE
127.0.0.1 localhost
EDIT : suppression des adresses sensibles.
Synthexe
--------------[ Recherche de fichiers cachés avec Catchme ]---------------
catchme 0.3.1066 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-16 16:34:20
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden services & system hive ...
scanning hidden files ...
scan completed successfully
hidden files: 0
--------------------[ Recherche d'autres infections ]---------------------
D:\Autorun.inf
F:\Autorun.inf
--------------------[ Fin du rapport à 16:35:41,01 ]----------------------
DiagHelp version v1.4 - http://www.malekal.com
excute le 16/11/2007 à 16:38:36,92
Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->16/11/2007 16:38:31
C:\WINDOWS\prefetch\IMAPI.EXE-0BF740A4.pf -->16/11/2007 16:35:53
C:\WINDOWS\prefetch\NOTEPAD.EXE-336351A9.pf -->16/11/2007 16:35:51
C:\WINDOWS\prefetch\VERCLSID.EXE-3667BD89.pf -->16/11/2007 16:35:42
C:\WINDOWS\prefetch\FINDSTR.EXE-0CA6274B.pf -->16/11/2007 16:35:40
C:\WINDOWS\prefetch\WUAUCLT.EXE-399A8E72.pf -->16/11/2007 16:29:35
C:\WINDOWS\prefetch\WMIPRVSE.EXE-28F301A9.pf -->16/11/2007 16:29:35
C:\WINDOWS\prefetch\RUNDLL32.EXE-451FC2C0.pf -->16/11/2007 16:29:35
C:\WINDOWS\prefetch\NTOSBOOT-B00DFAAD.pf -->16/11/2007 16:29:35
C:\WINDOWS\prefetch\MSNMSGR.EXE-366A1A81.pf -->16/11/2007 16:29:35
C:\WINDOWS\System32\drivers\bdfndisf.sys -->19/10/2007 13:17:08
C:\WINDOWS\System32\drivers\ultradfg.sys -->08/10/2007 10:54:36
C:\WINDOWS\System32\drivers\bdfsfltr.sys -->02/08/2007 16:03:44
C:\WINDOWS\System32\drivers\ntfs.sys -->09/02/2007 12:10:35
C:\WINDOWS\System32\drivers\wpdusb.sys -->18/10/2006 20:00:00
C:\WINDOWS\System32\drivers\cdralw2k.sys -->05/10/2006 03:42:42
C:\WINDOWS\System32\drivers\cdr4_xp.sys -->05/10/2006 03:42:42
C:\WINDOWS\System32\CONFIG.NT -->16/11/2007 15:05:39
C:\WINDOWS\System32\tmp.txt -->16/11/2007 00:09:37
C:\WINDOWS\System32\tmp.reg -->16/11/2007 00:09:37
C:\WINDOWS\System32\jupdate-1.6.0_03-b05.log -->15/11/2007 21:20:25
C:\WINDOWS\System32\wpa.dbl -->15/11/2007 18:59:54
C:\WINDOWS\System32\pgdfgsvc.exe -->15/11/2007 18:32:54
C:\WINDOWS\System32\perfh00C.dat -->04/11/2007 00:03:51
C:\WINDOWS\System32\perfh009.dat -->04/11/2007 00:03:51
C:\WINDOWS\System32\perfc00C.dat -->04/11/2007 00:03:51
C:\WINDOWS\System32\PerfStringBackup.INI -->04/11/2007 00:03:50
C:\WINDOWS\System32\perfc009.dat -->04/11/2007 00:03:50
C:\WINDOWS\System32\MRT.exe -->02/11/2007 08:12:57
C:\WINDOWS\System32\xpsp3res.dll -->29/10/2007 16:07:16
C:\WINDOWS\System32\shell32.dll -->25/10/2007 17:43:25
C:\WINDOWS\System32\javaws.exe -->24/09/2007 23:31:42
C:\WINDOWS\System32\javacpl.cpl -->24/09/2007 23:31:42
C:\WINDOWS\System32\javaw.exe -->24/09/2007 22:30:30
C:\WINDOWS\System32\java.exe -->24/09/2007 22:30:28
C:\WINDOWS\System32\TZLog.log -->29/08/2007 21:35:54
C:\WINDOWS\System32\inetcomm.dll -->21/08/2007 07:17:23
C:\WINDOWS\System32\wininet.dll -->20/08/2007 10:59:31
C:\WINDOWS\System32\webcheck.dll -->20/08/2007 10:59:31
C:\WINDOWS\System32\urlmon.dll -->20/08/2007 10:59:31
C:\WINDOWS\System32\url.dll -->20/08/2007 10:59:31
C:\WINDOWS\System32\occache.dll -->20/08/2007 10:59:31
C:\WINDOWS\0.log -->16/11/2007 16:28:13
C:\WINDOWS\WindowsUpdate.log -->16/11/2007 16:28:00
C:\WINDOWS\wiadebug.log -->16/11/2007 16:28:00
C:\WINDOWS\wiaservc.log -->16/11/2007 16:27:57
C:\WINDOWS\bootstat.dat -->16/11/2007 16:27:52
C:\WINDOWS\bdagent.INI -->16/11/2007 15:54:17
C:\WINDOWS\SchedLgU.Txt -->16/11/2007 15:37:24
C:\WINDOWS\win.ini -->16/11/2007 14:45:14
C:\WINDOWS\system.ini -->16/11/2007 14:45:14
C:\WINDOWS\Sti_Trace.log -->16/11/2007 12:12:53
C:\WINDOWS\msnfix.txt -->16/11/2007 00:08:51
C:\WINDOWS\NirCmd.exe -->17/06/2007 00:11:58
C:\WINDOWS\explorer.exe -->13/06/2007 14:22:28
C:\WINDOWS\MSDraw.ini -->05/01/2007 20:28:43
C:\WINDOWS\WORDPAD.INI -->31/12/2006 17:08:37
winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed
ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com
------------------------------------------------------------------------------
explorer.exe pid: 2288
Command line: explorer.exe
Base Size Version Path
0x44080000 0xcf000 7.00.6000.16544 C:\WINDOWS\system32\WININET.dll
0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x43e00000 0x45000 7.00.6000.16544 C:\WINDOWS\system32\iertutil.dll
0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll
0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
0x10000000 0xe000 1.00.0001.0000 C:\Program Files\Creative\Shared Files\CTHook.dll
0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll
0x44360000 0x5cb000 7.00.6000.16544 C:\WINDOWS\system32\ieframe.dll
0x44160000 0x124000 7.00.6000.16544 C:\WINDOWS\system32\urlmon.dll
0x442b0000 0x3c000 7.00.6000.16544 C:\WINDOWS\system32\webcheck.dll
0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\WPDShServiceObj.dll
0x748f0000 0x113000 8.90.1101.0000 C:\WINDOWS\system32\msxml3.dll
0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceTypes.dll
0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\PortableDeviceApi.dll
0x02670000 0x27000 11.00.0000.0013 C:\Program Files\BitDefender\BitDefender 2008\bdshelxt.dll
0x026a0000 0x13000 11.00.0000.0010 C:\Program Files\BitDefender\BitDefender 2008\bdutils.dll
0x7c420000 0x87000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCP80.dll
0x78130000 0x9b000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
0x026c0000 0x16000 11.00.0000.0001 C:\Program Files\BitDefender\BitDefender 2008\txmlx.dll
0x02230000 0xd000 C:\Program Files\Morpheus\MorphShellExt.dll
0x7c3a0000 0x7b000 7.10.3077.0000 C:\WINDOWS\system32\MSVCP71.dll
0x7c340000 0x56000 7.10.3052.0004 C:\WINDOWS\system32\MSVCR71.dll
0x029b0000 0x45000 5.20.0006.0002 C:\Program Files\HPQ\Quick Launch Buttons\CPQINFO.DLL
ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com
------------------------------------------------------------------------------
winlogon.exe pid: 1288
Command line: winlogon.exe
Base Size Version Path
0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe
0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll
0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x10000000 0x11000 6.14.0010.4123 C:\WINDOWS\system32\Ati2evxx.dll
0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 33C5-1859
Répertoire de C:\WINDOWS\system32
05/08/2004 09:00 6 144 csrss.exe
1 fichier(s) 6 144 octets
0 Rép(s) 49 487 859 712 octets libres
Contenu de Downloaded Program Files
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 33C5-1859
Répertoire de C:\WINDOWS\Downloaded Program Files
15/11/2007 19:15 <REP> .
15/11/2007 19:15 <REP> ..
17/08/2004 10:16 65 desktop.ini
25/07/2002 18:13 24 576 dwusplay.dll
25/07/2002 18:13 196 608 dwusplay.exe
07/06/2006 10:09 1 249 erma.inf
22/11/2006 23:22 372 736 GAME_UNO1.dll
22/11/2006 20:50 316 GAME_UNO1.INF
27/07/2004 16:48 323 584 isusweb.dll
29/05/2003 14:00 160 864 messengerstatsclient.dll
29/05/2003 14:00 77 408 msgrchkr.dll
11/06/2007 11:21 5 021 swflash.inf
10 fichier(s) 1 162 427 octets
Total des fichiers listés :
10 fichier(s) 1 162 427 octets
2 Rép(s) 49 487 859 712 octets libres
Recherche de rootkit! (Merci S!Ri)
Recherche d'infections connues
Export des clefs sensibles..
Liste des fichiers en exception sur le pare-feu XP SP2
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL France"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Morpheus\\Morpheus.exe"="C:\\Program Files\\Morpheus\\Morpheus.exe:*:Enabled:M5Shell"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\WINDOWS\\system32\\rtcshare.exe"="C:\\WINDOWS\\system32\\rtcshare.exe:*
isabled
artage de l'application RTC"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
Export de la clef SharedTaskScheduler
[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
exports des policies
REGEDIT4
[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-16 16:39:20
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden services & system hive ...
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000210
scanning hidden files ...
scan completed successfully
hidden services: 0
hidden files: 0
KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)
Process list by traversal of KiWaitListHead
4 - System
228 - ctfmon.exe
320 - spoolsv.exe
508 - MioNetManager.e
512 - hpqimzone.exe
584 - PAStiSvc.exe
596 - svchost.exe
616 - MioNet.exe
712 - xcommsvr.exe
728 - HP Wireless Ass
752 - VPro500.exe
784 - vsserv.exe
912 - eabservr.exe
928 - SynTPEnh.exe
956 - hpqwmiex.exe
1040 - livesrv.exe
1108 - PicasaMediaDete
1128 - iTunesHelper.ex
1260 - csrss.exe
1288 - winlogon.exe
1332 - services.exe
1372 - lsass.exe
1500 - ati2evxx.exe
1512 - svchost.exe
1608 - svchost.exe
1644 - svchost.exe
1704 - svchost.exe
1760 - msnmsgr.exe
1772 - ati2evxx.exe
1816 - svchost.exe
1908 - atiptaxx.exe
1980 - bdagent.exe
2208 - iPodService.exe
2248 - alg.exe
2288 - explorer.exe
2600 - HPQTOA~1.EXE
3260 - svchost.exe
3308 - svchost.exe
3532 - firefox.exe
4024 - cmd.exe
Total number of processes = 40
NOTE: Under WinXP, this will not show all processes.
KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)
Driver/Module list by traversal of PsLoadedModuleList
804D7000 - \WINDOWS\system32\ntkrnlpa.exe
806CF000 - \WINDOWS\system32\hal.dll
F7B12000 - \WINDOWS\system32\KDCOM.DLL
F7A22000 - \WINDOWS\system32\BOOTVID.dll
F74E2000 - ACPI.sys
F7B14000 - \WINDOWS\system32\DRIVERS\WMILIB.SYS
F74D1000 - pci.sys
F7612000 - isapnp.sys
F7622000 - ohci1394.sys
F7632000 - \WINDOWS\system32\DRIVERS\1394BUS.SYS
F7A26000 - compbatt.sys
F7A2A000 - \WINDOWS\system32\DRIVERS\BATTC.SYS
F7BDA000 - pciide.sys
F7892000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
F7B16000 - intelide.sys
F7B18000 - viaide.sys
F7B1A000 - aliide.sys
F74B3000 - pcmcia.sys
F7642000 - MountMgr.sys
F7494000 - ftdisk.sys
F7A2E000 - ACPIEC.sys
F7BDB000 - \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
F789A000 - PartMgr.sys
F7652000 - VolSnap.sys
F747C000 - atapi.sys
F7662000 - disk.sys
F7672000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
F745C000 - fltMgr.sys
F744A000 - sr.sys
F7682000 - PxHelp20.sys
F7433000 - KSecDD.sys
F73A6000 - Ntfs.sys
F7379000 - NDIS.sys
F7368000 - serial.sys
F734D000 - Mup.sys
F7A32000 - NDISRD.sys
F76D2000 - \SystemRoot\system32\DRIVERS\AmdK8.sys
F7B0A000 - \SystemRoot\system32\DRIVERS\wmiacpi.sys
F6BE7000 - \SystemRoot\system32\DRIVERS\ati2mtag.sys
F6BD3000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
F7962000 - \SystemRoot\system32\DRIVERS\usbohci.sys
F6BB0000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
F796A000 - \SystemRoot\system32\DRIVERS\usbehci.sys
F76E2000 - \SystemRoot\system32\DRIVERS\imapi.sys
F76F2000 - \SystemRoot\system32\DRIVERS\cdrom.sys
F7702000 - \SystemRoot\system32\DRIVERS\redbook.sys
F6B8D000 - \SystemRoot\system32\DRIVERS\ks.sys
F7972000 - \SystemRoot\System32\Drivers\GEARAspiWDM.sys
F7712000 - \SystemRoot\system32\DRIVERS\i8042prt.sys
F797A000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
F6B5E000 - \SystemRoot\system32\DRIVERS\SynTP.sys
F7B3E000 - \SystemRoot\system32\DRIVERS\USBD.SYS
F7982000 - \SystemRoot\system32\DRIVERS\mouclass.sys
F7318000 - \SystemRoot\system32\DRIVERS\CmBatt.sys
F6AF6000 - \SystemRoot\system32\DRIVERS\bcmwl5.sys
F7722000 - \SystemRoot\system32\DRIVERS\nic1394.sys
F6ACE000 - \SystemRoot\system32\drivers\tifm21.sys
F6ABD000 - \SystemRoot\system32\DRIVERS\sdbus.sys
F6AA9000 - \SystemRoot\system32\DRIVERS\Rtnicxp.sys
F6A53000 - \SystemRoot\system32\drivers\camc6hal.sys
F7732000 - \SystemRoot\system32\drivers\camc6aud.sys
F6A2F000 - \SystemRoot\system32\drivers\portcls.sys
F7742000 - \SystemRoot\system32\drivers\drmk.sys
F69F6000 - \SystemRoot\system32\DRIVERS\HSFHWATI.sys
F68F9000 - \SystemRoot\system32\DRIVERS\HSF_DP.sys
F6849000 - \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
F798A000 - \SystemRoot\System32\Drivers\Modem.SYS
F7CD4000 - \SystemRoot\system32\DRIVERS\audstub.sys
F7752000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
F7314000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
F6832000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
F7762000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
F7772000 - \SystemRoot\system32\DRIVERS\raspptp.sys
F7992000 - \SystemRoot\system32\DRIVERS\TDI.SYS
F6821000 - \SystemRoot\system32\DRIVERS\psched.sys
F7782000 - \SystemRoot\system32\DRIVERS\msgpc.sys
F799A000 - \SystemRoot\system32\DRIVERS\ptilink.sys
F79A2000 - \SystemRoot\system32\DRIVERS\raspti.sys
F7792000 - \SystemRoot\system32\DRIVERS\termdd.sys
F676D000 - \SystemRoot\system32\DRIVERS\bdfndisf.sys
F7B40000 - \SystemRoot\system32\DRIVERS\swenum.sys
F6739000 - \SystemRoot\system32\DRIVERS\update.sys
F7304000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
F77A2000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F77D2000 - \SystemRoot\system32\DRIVERS\usbhub.sys
F7B48000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F7CA4000 - \SystemRoot\System32\Drivers\Null.SYS
F7B4A000 - \SystemRoot\System32\Drivers\Beep.SYS
F79C2000 - \SystemRoot\System32\drivers\vga.sys
F7B4C000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F7B4E000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F79CA000 - \SystemRoot\System32\Drivers\Msfs.SYS
F79D2000 - \SystemRoot\System32\Drivers\Npfs.SYS
F6D54000 - \SystemRoot\system32\DRIVERS\rasacd.sys
EE6BE000 - \SystemRoot\system32\DRIVERS\ipsec.sys
EE666000 - \SystemRoot\system32\DRIVERS\tcpip.sys
EE619000 - \??\C:\Program Files\Fichiers communs\BitDefender\BitDefender Firewall\bdftdif.sys
EE5F8000 - \SystemRoot\system32\DRIVERS\ipnat.sys
F7802000 - \SystemRoot\system32\DRIVERS\wanarp.sys
F7ACE000 - \SystemRoot\system32\DRIVERS\hidusb.sys
F7812000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
F79E2000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
EE5D0000 - \SystemRoot\system32\DRIVERS\netbt.sys
EE5AE000 - \SystemRoot\System32\drivers\afd.sys
F7822000 - \SystemRoot\system32\DRIVERS\netbios.sys
EE4E3000 - \SystemRoot\system32\DRIVERS\rdbss.sys
EE474000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys
F7842000 - \SystemRoot\System32\Drivers\Fips.SYS
F7852000 - \SystemRoot\system32\DRIVERS\arp1394.sys
F7B52000 - \??\C:\WINDOWS\system32\drivers\EABFiltr.sys
F7AE2000 - \SystemRoot\system32\DRIVERS\mouhid.sys
EE451000 - \SystemRoot\System32\Drivers\Fastfat.SYS
EE439000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F7B58000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F7B06000 - \SystemRoot\System32\drivers\Dxapi.sys
F7A0A000 - \SystemRoot\System32\watchdog.sys
BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
F7C01000 - \SystemRoot\System32\drivers\dxgthk.sys
BF9D5000 - \SystemRoot\System32\ati2dvag.dll
BFA15000 - \SystemRoot\System32\ati2cqag.dll
BFA4F000 - \SystemRoot\System32\atikvmag.dll
BFA85000 - \SystemRoot\System32\ati3duag.dll
BFCE6000 - \SystemRoot\System32\ativvaxx.dll
EC225000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
EBF9C000 - \SystemRoot\system32\DRIVERS\mrxdav.sys
EBEFA000 - \SystemRoot\system32\DRIVERS\srv.sys
EC0A9000 - \SystemRoot\system32\DRIVERS\mdmxsdk.sys
EBC15000 - \SystemRoot\system32\drivers\wdmaud.sys
EC101000 - \SystemRoot\system32\drivers\sysaudio.sys
EB8EF000 - \SystemRoot\System32\Drivers\Cdfs.SYS
EB6CE000 - \SystemRoot\System32\Drivers\HTTP.sys
EB56E000 - \??\C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys
F7922000 - \SystemRoot\system32\DRIVERS\USBSTOR.SYS
EB216000 - \SystemRoot\system32\DRIVERS\bdfsfltr.sys
EB033000 - \SystemRoot\system32\drivers\kmixer.sys
F7D51000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys
Total number of drivers = 137
Liste des programmes installes
802.11 USB Wireless LAN Adapter
Active GIF Creator 2.23
Adobe Flash Player Plugin
Adobe Reader 6.0.1 - Français
Amélioration de nos services
Amélioration de nos services
Apple Software Update
Athlon 64 Processor Driver
ATI Display Driver
BitDefender Internet Security 2008
BufferChm
Conexant AC-Link Audio
CP_AtenaShokunin1Config
CP_CalendarTemplates1
cp_LightScribeConfig
cp_OnlineProjectsConfig
CP_Package_Basic1
CP_Package_Variety1
CP_Package_Variety2
CP_Package_Variety3
CP_Panorama1Config
cp_PosterPrintConfig
cp_UpdateProjectsConfig
Creative PC-CAM Center Lite
Creative WebCam Monitor
Creative WebCam NX Driver (1.02.01.0827)
CueTour
Destinations
DeviceManagementQFolder
eMule
FullDPAppQFolder
Google Toolbar for Internet Explorer
HijackThis 2.0.0
HP DVD Play 2.0
HP Help and Support
HP Imaging Device Functions 6.0
HP Photosmart Premier Software 6.0
HP Software Update
HP User Guides--System Recovery
HP User Guides 0025
HP Wireless Assistant 2.00 C1
HpSdpAppCoreApp
IE7Pro
InstantShareDevices
iTunes
J2SE Runtime Environment 5.0 Update 6
Jasc Animation Shop 3
Java(TM) 6 Update 3
Java(TM) SE Runtime Environment 6 Update 1
Lecteur Windows Media 11
LightScribe 1.4.56.1
Logiciel Photo Orange
Manuel d'utilisation de Creative WebCam NX (Français)
Messenger Plus! 3 & Sponsor
Messenger Plus! Live
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 French Language Pack
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works
MioNet
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)
Morpheus 5.3 (remove only)
Morpheus Photo Animation Suite v3.00
MSN
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
Navilog1 3.3.6
OptionalContentQFolder
Panneau de contrôle ATI
Philips SPC500NC Webcam
Philips VLounge
PhotoFiltre
PhotoGallery
Picasa 2
Quick Launch Buttons 5.20 F2
QuickTime
RandMap
SAGEM USB-Serial Mobile Communication Device
SkinsHP1
SmartSound Quicktracks Plugin
SmartSound Quicktracks Plugin
Soft Data Fax Modem with SmartCP
Sonic Audio Module
Sonic Copy Module
Sonic Data Module
Sonic Express Labeler
Sonic MyDVD Plus
Sonic Update Manager
Sonic_PrimoSDK
Synaptics Pointing Device Driver
Texas Instruments PCIxx21/x515/xx12 drivers.
TIPCI
Ulead VideoStudio 10
Unload
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Yahoo! Toolbar
Yahoo! Toolbar
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 33C5-1859
Répertoire de C:\Program Files
16/11/2007 15:31 <REP> .
16/11/2007 15:31 <REP> ..
29/07/2006 12:26 <REP> Active GIF Creator 2.23
20/02/2006 05:25 <REP> Adobe
27/10/2006 17:25 <REP> Alwil Software
20/02/2006 05:26 <REP> AMD
11/04/2007 12:29 <REP> Apple Software Update
20/02/2006 05:15 <REP> ATI Technologies
13/04/2007 22:38 <REP> AVSMedia
16/11/2007 15:31 <REP> BitDefender
26/09/2006 18:02 <REP> Chevalmag
20/02/2006 14:03 <REP> ComPlus Applications
20/02/2006 05:07 <REP> CONEXANT
28/06/2006 18:33 <REP> Creative
26/08/2007 13:33 <REP> eMule
16/11/2007 15:30 <REP> Fichiers communs
30/01/2007 20:25 <REP> Google
16/11/2007 09:47 <REP> Grisoft
20/02/2006 05:50 <REP> Hewlett-Packard
20/02/2006 05:49 <REP> HP
06/06/2006 17:57 <REP> HPQ
15/11/2007 23:52 <REP> IE7Pro
12/10/2007 19:59 <REP> Internet Explorer
27/10/2006 09:17 <REP> Inventel
24/04/2007 21:00 <REP> iPod
24/04/2007 21:00 <REP> iTunes
29/07/2006 17:23 <REP> Jasc Software Inc
15/11/2007 21:20 <REP> Java
18/08/2006 17:55 <REP> Kodak
16/05/2007 10:10 <REP> Logiciel Photo Orange
20/02/2006 05:15 <REP> Messenger
02/07/2007 20:39 <REP> Messenger Plus! Live
27/09/2006 19:45 <REP> MessengerPlus! 3
20/02/2006 14:03 <REP> microsoft frontpage
20/02/2006 05:29 <REP> Microsoft Office
20/02/2006 05:29 <REP> Microsoft Works
13/07/2007 22:35 <REP> MioNet
16/11/2007 15:48 <REP> Morpheus
01/11/2006 14:18 <REP> Morpheus Photo Animation Suite
16/11/2007 08:59 <REP> MorpheusBar
20/02/2006 14:03 <REP> Movie Maker
14/06/2006 11:45 <REP> MSN
20/02/2006 14:03 <REP> MSN Gaming Zone
02/07/2007 20:39 <REP> MSN Messenger
15/11/2006 13:36 <REP> MSXML 4.0
16/11/2007 14:55 <REP> Navilog1
20/02/2006 14:03 <REP> NetMeeting
13/06/2007 21:35 <REP> Outlook Express
26/12/2006 11:18 <REP> Philips
22/06/2006 19:49 <REP> PhotoFiltre
20/08/2007 12:21 <REP> Picasa2
11/04/2007 12:32 <REP> QuickTime
18/06/2006 12:35 <REP> SAGEM
27/10/2006 09:16 <REP> Securitoo
20/02/2006 05:47 <REP> Services en ligne
09/01/2007 21:51 <REP> SM
21/06/2007 19:08 <REP> SmartSound Software
20/02/2006 05:35 <REP> Sonic
02/07/2007 20:39 <REP> stopbat
20/02/2006 05:37 <REP> Synaptics
21/06/2007 19:04 <REP> Ulead Systems
27/10/2006 09:09 <REP> Wanadoo
02/07/2007 20:32 <REP> Windows Live
21/06/2007 19:06 <REP> Windows Media Components
04/03/2007 18:09 <REP> Windows Media Connect 2
04/03/2007 18:09 <REP> Windows Media Player
20/02/2006 14:03 <REP> Windows NT
20/02/2006 14:03 <REP> xerox
27/01/2007 23:13 <REP> Yahoo!
0 fichier(s) 0 octets
69 Rép(s) 49 487 548 416 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 33C5-1859
Répertoire de C:\Program Files\fichiers communs
16/11/2007 15:30 <REP> .
16/11/2007 15:30 <REP> ..
04/07/2006 17:03 <REP> Adobe
14/06/2006 11:49 <REP> AOL
26/12/2006 11:19 <REP> ArcSoft
13/04/2007 22:39 <REP> AVSMedia
16/11/2007 15:32 <REP> BitDefender
27/10/2006 09:17 278 528 FDEUnInstaller.exe
20/02/2006 05:26 <REP> HP
20/02/2006 05:36 <REP> InstallShield
20/02/2006 05:17 <REP> Java
20/02/2006 05:50 <REP> LightScribe
16/03/2007 21:36 <REP> Microsoft Shared
20/02/2006 14:03 <REP> MSSoap
20/02/2006 14:03 <REP> ODBC
20/02/2006 14:03 <REP> Services
20/02/2006 05:35 <REP> Sonic Shared
26/12/2006 11:18 <REP> SPC500NC
20/02/2006 14:03 <REP> SpeechEngines
20/02/2006 05:35 <REP> SureThing Shared
15/11/2007 23:40 <REP> Symantec Shared
13/06/2007 21:35 <REP> System
20/02/2006 05:36 <REP> TiVo Shared
21/06/2007 19:04 <REP> Ulead Systems
1 fichier(s) 278 528 octets
23 Rép(s) 49 487 548 416 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 33C5-1859
Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders
20/02/2006 14:03 <REP> .
20/02/2006 14:03 <REP> ..
18/05/2001 09:57 561 209 MSONSEXT.DLL
03/06/1999 06:09 122 937 MSOWS409.DLL
07/03/2001 01:00 127 033 MSOWS40c.DLL
3 fichier(s) 811 179 octets
2 Rép(s) 49 487 548 416 octets libres
c:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.1.1.5\iTunesSetupAdmin.exe
c:\Documents and Settings\manon le maguer\Bureau\BitDefender Internet Security_2008.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\catchme.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\diff.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\dumphive.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\FilesInfoCmd.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\find2.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\Fport.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\grep.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\gzip.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\KProcCheck.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\LFiles.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\LISTDLLS.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\md5sums.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\pslist.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\sigcheck.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\streams.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\swreg.exe
c:\Documents and Settings\manon le maguer\Bureau\DiagHelp\DiagHelp\tar.exe
c:\Documents and Settings\manon le maguer\Bureau\LopSD\Lop S&D\catchme.exe
c:\Documents and Settings\manon le maguer\Bureau\LopSD\Lop S&D\Process.exe
c:\Documents and Settings\megane le maguer\Application Data\Microsoft\Installer\{174D5678-D941-433C-BD23-58A5C7B0D36D}\Anim3TryAndBuy.exe
c:\Documents and Settings\megane le maguer\Application Data\Microsoft\Installer\{174D5678-D941-433C-BD23-58A5C7B0D36D}\ARPPRODUCTICON.exe
c:\Documents and Settings\megane le maguer\Mes documents\Convers Msn\uvs10_tbyb_(f).exe
c:\Documents and Settings\megane le maguer\Mes documents\Mes fichiers reçus\virus fo.exe
c:\Documents and Settings\megane le maguer\Mes documents\Morpheus Shared\Downloads\avsvideoeditor.exe
c:\Documents and Settings\megane le maguer\Mes documents\Morpheus Shared\Downloads\iTunesSetup.exe
c:\Documents and Settings\Sabine\Local Settings\Temp\dfrg.exe
c:\Documents and Settings\Sabine\Local Settings\Temp\udefrag.exe
c:\Documents and Settings\Test\Local Settings\Temporary Internet Files\Content.IE5\ALZ7UF36\EP-CDB-FRA[1].exe
c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
c:\Documents and Settings\manon le maguer\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
c:\Documents and Settings\megane le maguer\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
c:\Documents and Settings\megane le maguer\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll
c:\Documents and Settings\Sabine\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
****** Fin du rapport DiagHelp
Veuillez svp envoyer le fichier Ci_PRESARIO.tar.gz a l'adresse http://upload.malekal.
-------------------------------------------------------------------------------------------:\upload_mo
Message édité par synthexe le 17-11-2007 à 16:59:50
bfuscated-BPP [Trj], Mis en quarantaine
