[LOGICIEL] [Centralisation] .:::: Hijackthis ::::.

snooky · le 22 septembre 2006

Ha oui , lol ... m'a gourré là ... :pleure:

Avast détecte sans doute un faut positif , rien de grave ...

Tu pourrais d'ailleurs nous indiquer le chemin de cet Win 32 : Adaware-gen ... vise le rapport Avast .

Rien d'infectieux dans ton rapport Hijackthis .

Vista bloque peut être le fichier Hosts ... ou HJT qui ne détecte plus les bons chemins sur un pc équipé de Vista !

Tu ne peux fixer aucune ligne , sans que ce message apparaisse ?

Si oui , plus de corrections possibles :eeek2: ( fixer les lignes )

legains · le 23 septembre 2006

Salut,

= fichier E:\system volume information\ _restore {E93C6812-647F-405C-9374-E3349 1B23BA9}\rp25\A0005050.exe est infecté par Win32

E:\ est un hdd externe de stockage.

Les messages apparaissent dès que j'ouvre HJT.

Mais j'ai essayé de fixer une ligne, et c'est bon, apparement on peut fixer des lignes :smack:

Le patch HOSTS ne s'applique pas automatiquement sur Vista :arrow:

Pour le faire manuellement, je peux renomer le hosts ( de Driver/ect ) en.old et apporter le HOSTS du patch manuellement??

PegHorse · le 23 septembre 2006

Salut,
= fichier E:\system volume information\ _restore {E93C6812-647F-405C-9374-E3349 1B23BA9}\rp25\A0005050.exe est infecté par Win32

E:\ est un hdd externe de stockage.

Les messages apparaissent dès que j'ouvre HJT.

Mais j'ai essayé de fixer une ligne, et c'est bon, apparement on peut fixer des lignes

Le patch HOSTS ne s'applique pas automatiquement sur Vista

Pour le faire manuellement, je peux renomer le hosts ( de Driver/ect ) en.old et apporter le HOSTS du patch manuellement??

Salut.

Pour commencer rebranche ton disque dur externe si tu l'as retiré et tu vas devoir Désactiver la restauration système, ceci supprimera alors ton virus caché mais enlèvera également tes sauvegardes de restaurations systèmes.

Pour désactiver la restauration système :

Touche Windows + Pause, Restauration système, "Désactiver la restauration système", Appliquer et ensuite tu peux décocher la case "Désactiver..." pour pouvoir réutiliser la restauration système.

Si tu as Windows Vista, HJT ne fonctionne pas correctement.

Il est possible également que la manipulation que je viens de te citer soit fausse, je ne sais pas car je n'utilise pas Vista, mais dans tous les cas cherche pour désactiver la restauration système.

Quelle idée de mettre Vista aussi

Pour ton fichier Hosts, ouvre le et colle nous son contenu stp que je vois ce que t'as dedans, il est facile de le désinfecter :)

legains · le 23 septembre 2006

Salut,

Pour ton fichier Hosts, ouvre le et colle nous son contenu stp que je vois ce que t'as dedans, il est facile de le désinfecter :)

Quel hosts veux tu que je mette, celui du patch que je veux appliquer, ou celui de Win32/drivers/ect?

Pour la restauration system, ça m'ennuis un peu de la désactiver maintenant comme je teste Vista un peu dans tous les sens, elle pourait m'être bien utile.

Mais je n'est pas compris tu veux que je la désactive, puis la réactive?

KilMi · le 23 septembre 2006

Suite à mon problème avec Firefox, je post mon rapport hijackthis :

Logfile of HijackThis v1.99.1

Scan saved at 14:54:39, on 23/09/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Saitek\Software\Profiler.exe

C:\Program Files\Saitek\Software\SaiSmart.exe

C:\Program Files\Saitek\Software\SaiMfd.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\WINDOWS\system32\ctfmon.exe

C:\FRAPS\FRAPS.EXE

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Creative\Shared Files\CamTray.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe

C:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe

C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Kilik\Mes documents\Logiciels\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [Launch Ai Booster] "C:\Program Files\ASUS\Ai Booster\OverClk.exe"

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe

O4 - HKLM\..\Run: [saiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe

O4 - HKLM\..\Run: [saiMfd] C:\Program Files\Saitek\Software\SaiMfd.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe

O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe

O4 - Startup: Y'z Toolbar.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

O4 - Global Startup: hpoddt01.exe.lnk = ?

O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...arch.jhtml?p=ZZ

O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {68253470-5D4F-4CDF-8D9C-353C14A2F013} (SVPorsche Control) - http://img.yahoo.co.kr/multi/2005/tool/pla...9/SVPorsche.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{0C68A222-9D99-4670-8954-C2B1864384DC}: NameServer = 85.255.116.151,85.255.112.20

O17 - HKLM\System\CCS\Services\Tcpip\..\{9CF11236-B47A-43B1-9047-68B9F998ED9E}: NameServer = 85.255.116.151,85.255.112.20

O17 - HKLM\System\CCS\Services\Tcpip\..\{DB76F30F-0C8D-4A89-9325-BBCF583896EB}: NameServer = 85.255.116.151,85.255.112.20

O17 - HKLM\System\CCS\Services\Tcpip\..\{F375CBAF-3EC6-4370-83C6-7193D7EF0E9D}: NameServer = 85.255.116.151,85.255.112.20

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.151 85.255.112.20

O17 - HKLM\System\CS2\Services\Tcpip\..\{0C68A222-9D99-4670-8954-C2B1864384DC}: NameServer = 85.255.116.151,85.255.112.20

O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.116.151 85.255.112.20

O17 - HKLM\System\CS3\Services\Tcpip\..\{0C68A222-9D99-4670-8954-C2B1864384DC}: NameServer = 85.255.116.151,85.255.112.20

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.151 85.255.112.20

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Sinon voici le problème dont j'ai fait part en centralisation firefox :

Bonsoir ,
voilà depuis quelques jours j'ai quelques problèmes sur firefox, en fait depuis sa dernière mise à jour (ce doit être la 1.5.0.7).

En fait à chaque chargement de page, d'abord il m'affiche le fameux message "le navigateur a effectué une opération illégale, nous vous conseillons de redémarrer Firefox" blah blah, bon je lui demande de ne plus m'afficher ce message sur la session (ce qui n'empêche pas le message de revenir à chaque nouvelle fenêtre ouverte).

Et quelques minutes plus tard, il rencontre un problème et ferme. Je ne peux plus aller sur des sites qui contiennent des lecteur en flash (comme par exemple IGN, ou Youtube), ce qui provoque la fermeture de firefox, ou bien le freezing de la page au choix.

Enfin certaines fois en plein surf sur des pages "ordinaires", firefox ne répond plus, j'entends par là que le navigateur reste ouvert, mais que je ne peux plus cliquer sur quoique ce soit sur aucune des pages, et que même si je ferme le navigateur, je suis contraint de terminer le processus.

Voilà depuis peu je suis repassé à IE, mais j'aime Firefox moi , ça me manque et j'aimerais savoir si vous aviez quelques propositions (je vais de mon côté faire quelques analyses).

EDIT : je crois en fait que le problème va plus loin , je ne peux plus faire d'analyse anti-spyware, Ad-aware et Spybot freezent à chaque analyse ...

Merci

snooky · le 23 septembre 2006

@ legains :

Pour le faire manuellement, je peux renomer le hosts ( de Driver/ect ) en.old et apporter le HOSTS du patch manuellement??

Oui , tout à fait :francais:

Laisse la restauration système activée .

Passe Avast en mode sans échec .

Passe Ewido .

snooky · le 23 septembre 2006

@ KilMi :

Quelle version de Firefox ?

KilMi · le 23 septembre 2006

@ KilMi :

Quelle version de Firefox ?

Je l'ai écrit, c'est la 1.5.0.7 ^^

snooky · le 23 septembre 2006

Réinstalle " par dessus " pour voir .

KilMi · le 23 septembre 2006

Réinstalle " par dessus " pour voir .

Je l'ai déjà fait, ça n'a rien changé ...

HustleR · le 23 septembre 2006

Snooky je t en supplie il faut que tu m aide tu est ma derniere chance :francais:

voila mon rapport dit moi ce qu'il se passe je t en serai reconnaissant :troll:

rapport:

Logfile of HijackThis v1.99.1

Scan saved at 17:30:36, on 23/09/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe

C:\WINDOWS\system32\slserv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Media-Codec\pmsngr.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe

C:\Program Files\McAfee.com\VSO\mcvsshld.exe

C:\Program Files\Media-Codec\pmmon.exe

c:\progra~1\mcafee.com\vso\mcvsescn.exe

C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe

C:\windows\hffext\hffsrv.exe

C:\nwnmff_e12.exe

C:\kybrdff_e12.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\Spyware Doctor\swdoctor.exe

C:\WINDOWS\system32\wuauclt.exe

c:\progra~1\mcafee.com\vso\mcvsftsn.exe

C:\Program Files\Messenger\msmsgs.exe

c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe

c:\PROGRA~1\mcafee.com\vso\mcshield.exe

c:\PROGRA~1\mcafee.com\vso\OasClnt.exe

C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll

O3 - Toolbar: Protection Bar - {479fd0cf-5be9-4c63-8cda-b6d371c67bd5} - C:\Program Files\Media-Codec\iesplugin.dll

O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll (file missing)

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe

O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe

O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe

O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask

O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe

O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"

O4 - HKLM\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Automation

O4 - HKLM\..\Run: [hffsrv] c:\windows\hffext\hffsrv.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [newname] C:\\nwnmff_e12.exe

O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e12.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll

O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1157299887953

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - AppInit_DLLs: MsgPlusLoader.dll

O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\gp8ml3l11.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Tk9N\command.exe (file missing)

O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe

O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe

O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)

O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

snooky · le 23 septembre 2006

Réinstallation propre alors . ( sauvegarde tes marques-pages avant )

KilMi · le 23 septembre 2006

Réinstallation propre alors . ( sauvegarde tes marques-pages avant )

Aussi :francais: un j'ai désinstallé firefox complètement, et réinstallé, pas de changement (mais bizarrement j'ai gardé mes paramètres et mes marques-pages)

snooky · le 23 septembre 2006

@ Hustler :

Désactive la restauration système .

Désinstalle :

UCmore

Websearch

Supprime ces fichers :

nwnmff

kybrdff

netmon.exe

Fixe ces lignes :

R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)

O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll (file missing)

O4 - HKLM\..\Run: [newname] C:\\nwnmff_e12.exe

O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e12.exe

O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)

Désinstalle Spyware Doctor.

Passe Ewido.

____________________________________________

@KilMi

Quand tu dis complètement , tu veux dire quoi exactement ?

As-tu pensé à supprimer ce dossier , en plus de la désinstallation ?

C:\Documents and Settings\AtYourRisk\Application Data\Mozilla

HustleR · le 23 septembre 2006

impossible de supprimé ces deux la snooky :

O4 - HKLM\..\Run: [newname] C:\\nwnmff_e12.exe

O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e12.exe

que faire ??? Je passe ewido anti-malware ??

snooky · le 23 septembre 2006

Oui pour Ewido .

Supprime les fichiers avec Unlocker ( une fois installé , Unlocker apparait dans le clic droit )

FaTaL1Ty · le 23 septembre 2006

HARDWARE Information:

---------------------

Processor:

AMD Athlon 64 X2 Dual Core Processor 3800+ 2009 MHz

Processors number:

2

BIOS:

Nvidia - 42302e31 )Phoenix - Award WorkstationBIOS v6.00PG oC(Phoenix - Award WorkstationBIOS v6.00PG BIOS Date: 06/23/05

Total physical memory:

1022,424 Mb

Total virtual memory:

2047,896 Mb

Available physical memory:

1022,424 Mb

Available virtual memory:

2012,400 Mb

Hard drives:

SAMSUNG HD080HJ

HDT722525DLA380

Logical disks structure:

a:\ REMOVABLE Full size - 0 Mb, Free size - 0 Mb, File system -

c:\ FIXED SYSTEM Full size - 76308 Mb, Free size - 34924 Mb, File system - NTFS

d:\ CDROM Full size - 165 Mb, Free size - 0 Mb, File system - CDFS

e:\ FIXED Full size - 99998 Mb, Free size - 66355 Mb, File system - NTFS

f:\ FIXED Full size - 138466 Mb, Free size - 137763 Mb, File system - NTFS

Video adapters:

NetWork adapters:

Generic Marvell Yukon Chipset based Ethernet Controller

DRIVER - C:\WINDOWS\system32\DRIVERS\yk51x86.sys

File version = 8.57.2.3 built by: WinDDK, File size = 249856, File modification date = 25/08/2006 06:57

File description = NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller

Product Name = Marvell Yukon Ethernet Controller, Product version = 8.57.2.3

Carte réseau 1394

DRIVER - C:\WINDOWS\system32\DRIVERS\nic1394.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 61824, File modification date = 20/06/2006 22:22

File description = IEEE1394 Ndis Miniport and Call Manager

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

Modems:

Multimedia:

Printers:

Removable devices:

Lecteur de disquettes

DRIVER - C:\WINDOWS\system32\DRIVERS\flpydisk.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 20480, File modification date = 03/08/2004 22:59

File description = Floppy Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

_NEC DVD_RW ND-4550A

DRIVER - C:\WINDOWS\system32\DRIVERS\cdrom.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 49536, File modification date = 03/08/2004 22:59

File description = SCSI CD-ROM Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

_NEC DVD_RW ND-4550A

DRIVER - C:\WINDOWS\system32\DRIVERS\cdrom.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 49536, File modification date = 03/08/2004 22:59

File description = SCSI CD-ROM Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

SOFTWARE Information:

---------------------

Operation system:

Microsoft Windows XP Professional Edition, 5.1.2600 Service Pack 2

Environment variables:

ALLUSERSPROFILE=C:\Documents and Settings\All Users

APPDATA=C:\Documents and Settings\Guillaume\Application Data

BitRock=1

CommonProgramFiles=C:\Program Files\Fichiers communs

COMPUTERNAME=SALL-3LZFQ64L1J

ComSpec=C:\WINDOWS\system32\cmd.exe

FP_NO_HOST_CHECK=NO

HOMEDRIVE=C:

HOMEPATH=\Documents and Settings\Guillaume

LOGONSERVER=\\SALL-3LZFQ64L1J

NUMBER_OF_PROCESSORS=2

OS=Windows_NT

Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Diskeeper Corporation\Diskeeper\

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

PROCESSOR_ARCHITECTURE=x86

PROCESSOR_IDENTIFIER=x86 Family 15 Model 43 Stepping 1, AuthenticAMD

PROCESSOR_LEVEL=15

PROCESSOR_REVISION=2b01

ProgramFiles=C:\Program Files

SESSIONNAME=Console

SystemDrive=C:

SystemRoot=C:\WINDOWS

TEMP=C:\DOCUME~1\GUILLA~1\LOCALS~1\Temp

TMP=C:\DOCUME~1\GUILLA~1\LOCALS~1\Temp

USERDOMAIN=SALL-3LZFQ64L1J

USERNAME=Guillaume

USERPROFILE=C:\Documents and Settings\Guillaume

windir=C:\WINDOWS

Installed network protocols:

MSAFD Irda [irDA]

MSAFD Tcpip [TCP/IP]

MSAFD Tcpip [uDP/IP]

MSAFD Tcpip [RAW/IP]

RSVP UDP Service Provider

RSVP TCP Service Provider

MSAFD NetBIOS [\Device\NetBT_Tcpip_{826882F9-D193-4245-8F6A-0D94ABD956A7}] SEQPACKET 4

MSAFD NetBIOS [\Device\NetBT_Tcpip_{826882F9-D193-4245-8F6A-0D94ABD956A7}] DATAGRAM 4

MSAFD NetBIOS [\Device\NetBT_Tcpip_{8824F8FD-7C24-432C-B407-540E69B231E8}] SEQPACKET 3

MSAFD NetBIOS [\Device\NetBT_Tcpip_{8824F8FD-7C24-432C-B407-540E69B231E8}] DATAGRAM 3

MSAFD NetBIOS [\Device\NetBT_Tcpip_{867C2C2D-B8B2-4E4B-ADA6-131E8B0FD266}] SEQPACKET 0

MSAFD NetBIOS [\Device\NetBT_Tcpip_{867C2C2D-B8B2-4E4B-ADA6-131E8B0FD266}] DATAGRAM 0

MSAFD NetBIOS [\Device\NetBT_Tcpip_{E17E76D3-DDE7-4118-9337-F1FF29ADCDBB}] SEQPACKET 1

MSAFD NetBIOS [\Device\NetBT_Tcpip_{E17E76D3-DDE7-4118-9337-F1FF29ADCDBB}] DATAGRAM 1

MSAFD NetBIOS [\Device\NetBT_Tcpip_{2C356905-7546-4D6F-A8EB-6E53C62E8FAB}] SEQPACKET 2

MSAFD NetBIOS [\Device\NetBT_Tcpip_{2C356905-7546-4D6F-A8EB-6E53C62E8FAB}] DATAGRAM 2

Installed applications/hotfixes:

Adobe Download Manager 2.0 (Supprimer uniquement)

AudioConvert

Call of Duty Game of the Year Edition

CCleaner (remove only)

DVD Shrink 3.2

eMule

Gadwin PrintScreen

Hijackthis Version Française

Kaspersky Anti-Hacker 1.5

Rome - Total War

Call of Duty - United Offensive

IZArc 3.5 beta 3

Kaspersky Anti-Virus Personal

Correctif Windows XP - KB867282

Correctif Windows XP - KB884020

Correctif Windows XP - KB885894

Windows Media Player 10 Hotfix - KB888656

Hotfix for Windows Media Format SDK (KB902344)

Mise à jour de sécurité pour Lecteur Windows Media 10 (KB911565)

Mise à jour de sécurité pour Windows XP (KB913433)

Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)

Mise à jour de sécurité pour Windows XP (KB917953)

Labtec Media Keyboard V5.0

LimeWire 4.12.6

Microsoft .NET Framework 1.1 Hotfix (KB886903)

Macromedia Shockwave Player

Microsoft .NET Framework 1.1

Microsoft .NET Framework 2.0

Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA

MozBackup 1.4.4

Mozilla ActiveX Control v1.7.7

Mozilla Firefox (1.5.0.7)

NVIDIA Drivers

QuickTime Alternative 1.70

SafeClean Utilities 3.0

Macromedia Flash Player 8

Smart Guardian

iolo technologies' System Mechanic 6

Unlocker 1.8.4

VideoLAN VLC media player 0.8.5

Winamp (remove only)

Codeur Windows Media Série 9

Windows Media Format Runtime

Lecteur Windows Media 10

Microsoft Windows Media Video 9 VCM

HardwareDetection

J2SE Runtime Environment 5.0 Update 7

Lyra Jukebox Applications

WebFldrs XP

Rome - Total War

Visionneuse Journal Windows Microsoft

Adobe® Photoshop® Album Edition Découverte 3.0

Photorécit 3 pour Windows

Kerio Personal Firewall 2.1.5

Nero 7 Demo

Microsoft .NET Framework 2.0

Kaspersky Anti-Hacker

Macromedia Shockwave Player

Microsoft Office PowerPoint Viewer 2003

Microsoft .NET Framework 1.1 French Language Pack

Rome Total War - patch 1.3

Rome - Total War

Call of Duty - United Offensive

Adobe Reader 7.0.8 - Français

MSN Messenger 7.5

Athlon 64 Processor Driver

Marvell Miniport Driver

Microsoft .NET Framework 1.1

ImageShack QuickLoad

Mise à jour de logiciel pour les Dossiers Web

Diskeeper Professional Edition

Razer

Codeur Windows Media Série 9

Macromedia Flash Player 8 Plugin

Microsoft .NET Framework 2.0 Language Pack - FRA

Run drivers:

C:\WINDOWS\system32\ntkrnlpa.exe

File version = 5.1.2600.2622 (xpsp.050301-1521), File size = 2017280, File modification date = 20/06/2006 22:22

File description = Noyau et système NT

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2622

C:\WINDOWS\system32\hal.dll

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 134400, File modification date = 03/08/2004 22:59

File description = Hardware Abstraction Layer DLL

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\KDCOM.DLL

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 7040, File modification date = 28/08/2001 14:00

File description = Kernel Debugger HW Extension DLL

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\BOOTVID.dll

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 12288, File modification date = 28/08/2001 14:00

File description = VGA Boot Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\drivers\sptd.sys

File size = 642560, File modification date = 01/07/2006 10:04

C:\WINDOWS\System32\Drivers\WMILIB.SYS

File version = 5.1.2600.0 (XPClient.010817-1148), File size = 4352, File modification date = 28/08/2001 14:00

File description = WMILIB WMI support library Dll

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\System32\Drivers\SPTD1389.SYS

File size = 96256, File modification date = 01/07/2006 10:04

C:\WINDOWS\system32\drivers\ACPI.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 188672, File modification date = 19/08/2004 15:51

File description = Pilote ACPI pour NT

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\pci.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 68608, File modification date = 19/08/2004 13:52

File description = Énumérateur Plug-and-Play PCI pour NT

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\isapnp.sys

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 36224, File modification date = 28/08/2001 14:00

File description = Pilote de bus PNP ISA

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.0

C:\WINDOWS\system32\drivers\ohci1394.sys

File version = 5.1.2600.2738 (xpsp.050812-1541), File size = 61312, File modification date = 03/08/2004 23:10

File description = 1394 OpenHCI Port Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2738

C:\WINDOWS\system32\DRIVERS\1394BUS.SYS

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 53248, File modification date = 03/08/2004 23:10

File description = 1394 Bus Device Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\pciide.sys

File version = 5.1.2600.0 (XPClient.010817-1148), File size = 3328, File modification date = 28/08/2001 14:00

File description = Pilote de bus générique PCI IDE

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.0

C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 25088, File modification date = 03/08/2004 22:59

File description = PCI IDE Bus Driver Extension

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\MountMgr.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 42240, File modification date = 03/08/2004 22:58

File description = Mount Manager

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\ftdisk.sys

File version = 5.1.2600.0 (XPClient.010817-1148), File size = 126080, File modification date = 28/08/2001 14:00

File description = Pilote de disque à FT

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.0

C:\WINDOWS\system32\drivers\dmload.sys

File version = 2600.0.503.0, File size = 5888, File modification date = 28/08/2001 14:00

File description = NT Disk Manager Startup Driver

Product Name = Logical Disk Manager for Windows NT, Product version = 1.0

C:\WINDOWS\system32\drivers\dmio.sys

File version = 2600.2180.503.0, File size = 154496, File modification date = 19/08/2004 16:01

File description = Pilote E/S du Gestionnaire de disques NT

Product Name = Gestionnaire de disques NT VERITAS®, Product version = 1.0

C:\WINDOWS\system32\drivers\PartMgr.sys

File version = 5.1.2600.0 (XPClient.010817-1148), File size = 18688, File modification date = 28/08/2001 14:00

File description = Partition Manager

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\drivers\VolSnap.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 53376, File modification date = 19/08/2004 15:59

File description = Pilote de cliché instantané du volume

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\atapi.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 95360, File modification date = 03/08/2004 22:59

File description = IDE/ATAPI Port Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\nvatabus.sys

File version = 5.10.2600.0479 built by: WinDDK, File size = 87936, File modification date = 11/01/2005 23:32

File description = NVIDIA® nForce IDE Performance Driver

Product Name = NVIDIA nForce IDE Driver, Product version = 5.10.2600.0479

C:\WINDOWS\system32\drivers\disk.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 36352, File modification date = 03/08/2004 22:59

File description = PnP Disk Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 49664, File modification date = 03/08/2004 23:14

File description = SCSI Class System Dll

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\fltmgr.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 124800, File modification date = 03/08/2004 23:01

File description = Microsoft Filesystem Filter Manager

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\sr.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 73600, File modification date = 19/08/2004 16:04

File description = Pilote de filtre de système de fichiers pour la restauration du système

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\PxHelp20.sys

File version = 3.00.11B, File size = 46080, File modification date = 16/05/2006 20:23

File description = Px Engine Device Driver for Windows 2000/XP

Product Name = PxHelp20, Product version = (null)

C:\WINDOWS\system32\drivers\KSecDD.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 92032, File modification date = 03/08/2004 22:59

File description = Kernel Security Support Provider Interface

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\Ntfs.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 574592, File modification date = 03/08/2004 23:15

File description = NT File System Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\NDIS.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 182912, File modification date = 03/08/2004 23:14

File description = NDIS 5.1 wrapper driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\sfhlp02.sys

File version = 2.3, File size = 6656, File modification date = 16/05/2005 13:20

File description = StarForce Protection Helper Driver

Product Name = StarForce Protection System, Product version = 3.4

C:\WINDOWS\system32\drivers\sfdrv01.sys

File version = 1.37, File size = 50688, File modification date = 10/08/2005 12:44

File description = StarForce Protection Environment Driver

Product Name = StarForce Protection System, Product version = 3.4

C:\WINDOWS\system32\drivers\nvcchflt.sys

File version = 5.10.2600.0518 built by: WinDDK, File size = 16640, File modification date = 11/02/2005 16:11

File description = NVIDIA® nForce Cache Filter Driver

Product Name = NVIDIA nForce Cache Filter Driver, Product version = 5.10.2600.0518

C:\WINDOWS\system32\drivers\Mup.sys

File version = 5.1.2600.2756 (xpsp.050908-1543), File size = 104704, File modification date = 20/06/2006 22:12

File description = Multiple UNC Provider driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2756

C:\WINDOWS\system32\drivers\klpid.sys

File version = 2, 0, 0, 8, File size = 33046, File modification date = 03/09/2004 10:50

File description = klpid

Product Name = KL klpid, Product version = 1, 0, 0, 1

C:\WINDOWS\system32\drivers\Klpf.sys

File version = 2, 0, 0, 8, File size = 28723, File modification date = 03/09/2004 10:50

File description = klpf

Product Name = Kaspersky Anti-Hacker, Product version = 1, 0, 0, 1

C:\WINDOWS\System32\Drivers\TDI.SYS

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 18560, File modification date = 03/08/2004 23:07

File description = TDI Wrapper

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\nic1394.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 61824, File modification date = 20/06/2006 22:22

File description = IEEE1394 Ndis Miniport and Call Manager

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\AmdK8.sys

File version = 1.1.0 built by: dnsrv(wmbla), File size = 38912, File modification date = 08/05/2004 08:22

File description = Pilote de périphérique processeur

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 1.1.0

C:\WINDOWS\system32\DRIVERS\usbohci.sys

File version = 5.1.2600.2891 (xpsp.060419-0254), File size = 17152, File modification date = 20/06/2006 22:14

File description = OHCI USB Miniport Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2891

C:\WINDOWS\system32\DRIVERS\USBPORT.SYS

File version = 5.1.2600.2891 (xpsp.060419-0254), File size = 143360, File modification date = 20/06/2006 22:14

File description = USB 1.1 & 2.0 Port Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2891

C:\WINDOWS\System32\Drivers\ousbehci.sys

File version = 2.2.2.0, File size = 44928, File modification date = 01/08/2004 06:09

File description = USB 2.0 Enhanced Host Controller Driver

Product Name = USB 2.0 Enhanced Host Controller Driver, Product version = 2.2.2

C:\WINDOWS\system32\DRIVERS\imapi.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 41856, File modification date = 03/08/2004 23:00

File description = IMAPI Kernel Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\cdrom.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 49536, File modification date = 03/08/2004 22:59

File description = SCSI CD-ROM Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\redbook.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 58496, File modification date = 19/08/2004 15:54

File description = Pilote de filtre audio Livre rouge

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\ks.sys

File version = 5.3.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 140928, File modification date = 03/08/2004 21:15

File description = Kernel CSA Library

Product Name = Microsoft® Windows® Operating System, Product version = 5.3.2600.2180

C:\WINDOWS\system32\drivers\P17.sys

File version = 5.12.01.512, File size = 1389056, File modification date = 07/07/2005 14:14

File description = WDM Audio Miniport

Product Name = , Product version = 5.12.01.512

C:\WINDOWS\system32\drivers\portcls.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 145792, File modification date = 03/08/2004 21:15

File description = Port Class (Class Driver for Port/Miniport Devices)

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\drmk.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 60288, File modification date = 03/08/2004 21:08

File description = Microsoft Kernel DRM Descrambler Filter

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\ctoss2k.sys

File version = 5.12.01.1081-2.04.0050, File size = 106496, File modification date = 10/01/2005 16:15

File description = Creative OS Services Driver (WDM)

Product Name = Creative Audio Product, Product version = 2.04.0050

C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys

File version = 5.12.01.1081-2.04.0050, File size = 138752, File modification date = 10/01/2005 16:15

File description = SoundFont® Manager (WDM)

Product Name = Creative Audio Product, Product version = 2.04.0050

C:\WINDOWS\system32\DRIVERS\yk51x86.sys

File version = 8.57.2.3 built by: WinDDK, File size = 249856, File modification date = 25/08/2006 06:57

File description = NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller

Product Name = Marvell Yukon Ethernet Controller, Product version = 8.57.2.3

C:\WINDOWS\system32\DRIVERS\nvnetbus.sys

File version = 1.00.00.0466, File size = 12928, File modification date = 11/01/2005 23:32

File description = NVIDIA Networking Bus Driver.

Product Name = NVNETBUS, Product version = 1.00.00.0466

C:\WINDOWS\system32\DRIVERS\NVNRM.SYS

File version = 1.00.00.0466, File size = 275584, File modification date = 11/01/2005 23:32

File description = NVIDIA Network Resource Manager.

Product Name = NVNRM, Product version = 1.00.00.0466

C:\WINDOWS\system32\DRIVERS\NVSNPU.SYS

File version = 1.00.00.0466, File size = 208256, File modification date = 11/01/2005 23:32

File description = NVIDIA Networking Soft-NPU Driver.

Product Name = NVSNPU, Product version = 1.00.00.0466

C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

File version = 6.14.10.9131, File size = 3925920, File modification date = 01/06/2006 15:22

File description = NVIDIA Compatible Windows 2000 Miniport Driver, Version 91.31

Product Name = NVIDIA Compatible Windows 2000 Miniport Driver, Version 91.31 , Product version = 6.14.10.9131

C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 79744, File modification date = 03/08/2004 23:07

File description = Video Port Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\fdc.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 27392, File modification date = 03/08/2004 22:59

File description = Floppy Disk Controller Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\serial.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 66560, File modification date = 19/08/2004 15:56

File description = Pilote de périphérique série

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\serenum.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 15488, File modification date = 03/08/2004 22:59

File description = Serial Port Enumerator

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\irsir.sys

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 18688, File modification date = 17/08/2001 21:51

File description = Serial Infrared Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\DRIVERS\irenum.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 11264, File modification date = 03/08/2004 23:00

File description = Infra-Red Bus Enumerator

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\audstub.sys

File version = 5.1.2600.0 (XPClient.010817-1148), File size = 3072, File modification date = 17/08/2001 21:59

File description = AudStub Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\DRIVERS\rasirda.sys

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 19584, File modification date = 17/08/2001 21:51

File description = IrDA WAN Miniport Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 51328, File modification date = 03/08/2004 23:14

File description = RAS L2TP mini-port/call-manager driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\ndistapi.sys

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 9600, File modification date = 28/08/2001 14:00

File description = NDIS 3.0 connection wrapper driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\DRIVERS\ndiswan.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 91776, File modification date = 03/08/2004 23:14

File description = MS PPP Framing Driver (Strong Encryption)

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\raspppoe.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 41472, File modification date = 03/08/2004 23:05

File description = RAS PPPoE mini-port/call-manager driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\raspptp.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 48384, File modification date = 03/08/2004 23:14

File description = Peer-to-Peer Tunneling Protocol

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\psched.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 69120, File modification date = 03/08/2004 23:04

File description = MS QoS Packet Scheduler

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\msgpc.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 35072, File modification date = 03/08/2004 23:04

File description = MS General Packet Classifier

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\ptilink.sys

File version = 1.10 (XPClient.010817-1148), File size = 17792, File modification date = 28/08/2001 14:00

File description = Parallel Technologies DirectParallel IO Library

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\DRIVERS\raspti.sys

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 16512, File modification date = 28/08/2001 14:00

File description = PTI DirectParallel® mini-port/call-manager driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\DRIVERS\rdpdr.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 196864, File modification date = 03/08/2004 21:01

File description = Microsoft RDP Device redirector

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\termdd.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 40840, File modification date = 19/08/2004 14:10

File description = Terminal Server Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\kbdclass.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 25216, File modification date = 19/08/2004 16:00

File description = Pilote de la classe Clavier

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\mouclass.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 23680, File modification date = 20/06/2006 22:22

File description = Pilote de la classe Souris

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\swenum.sys

File version = 5.3.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 4352, File modification date = 20/06/2006 22:22

File description = Plug and Play Software Device Enumerator

Product Name = Microsoft® Windows® Operating System, Product version = 5.3.2600.2180

C:\WINDOWS\system32\DRIVERS\update.sys

File version = 5.1.2600.2508 (xpsp.040806-1825), File size = 209280, File modification date = 20/06/2006 22:02

File description = Update Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2508

C:\WINDOWS\system32\DRIVERS\mssmbios.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 15488, File modification date = 20/06/2006 22:22

File description = System Management BIOS Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\usbhub.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 57600, File modification date = 03/08/2004 23:08

File description = Default Hub Driver for USB

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\USBD.SYS

File version = 5.1.2600.0 (XPClient.010817-1148), File size = 4736, File modification date = 28/08/2001 14:00

File description = Universal Serial Bus Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\System32\Drivers\NDProxy.SYS

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 38016, File modification date = 28/08/2001 14:00

File description = NDIS Proxy

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\DRIVERS\ousb2hub.sys

File version = 2.2.2.0, File size = 55936, File modification date = 01/08/2004 06:09

File description = USB 2.0 Hub Driver

Product Name = USB 2.0 Hub Driver, Product version = 2.2.2

C:\WINDOWS\system32\DRIVERS\flpydisk.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 20480, File modification date = 03/08/2004 22:59

File description = Floppy Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\System32\Drivers\Fs_Rec.SYS

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 7936, File modification date = 28/08/2001 14:00

File description = File System Recognizer Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\System32\Drivers\Null.SYS

File version = 5.1.2600.0 (XPClient.010817-1148), File size = 2944, File modification date = 28/08/2001 14:00

File description = NULL Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\System32\Drivers\Beep.SYS

File version = 5.1.2600.0 (XPClient.010817-1148), File size = 4224, File modification date = 28/08/2001 14:00

File description = BEEP Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 24960, File modification date = 03/08/2004 21:08

File description = Hid Parsing Library

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\System32\drivers\vga.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 20992, File modification date = 03/08/2004 23:07

File description = VGA/Super VGA Video Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\System32\Drivers\mnmdd.SYS

File version = 5.1.2600.0 (XPClient.010817-1148), File size = 4224, File modification date = 28/08/2001 14:00

File description = Frame buffer simulator

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\System32\DRIVERS\RDPCDD.sys

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 4224, File modification date = 28/08/2001 14:00

File description = RDP Miniport

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\Drivers\fwdrv.sys

File size = 102912, File modification date = 15/04/2002 10:28

C:\WINDOWS\System32\Drivers\Msfs.SYS

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 19072, File modification date = 03/08/2004 23:00

File description = Mailslot driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\System32\Drivers\Npfs.SYS

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 30848, File modification date = 03/08/2004 23:00

File description = NPFS Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\rasacd.sys

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 8832, File modification date = 28/08/2001 14:00

File description = RAS Automatic Connection Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\DRIVERS\ipsec.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 74752, File modification date = 03/08/2004 23:14

File description = IPSec Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\tcpip.sys

File version = 5.1.2600.2892 (xpsp_sp2_gdr.060420-0254), File size = 359808, File modification date = 22/09/2006 18:08

File description = TCP/IP Protocol Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2892

C:\WINDOWS\system32\DRIVERS\ipnat.sys

File version = 5.1.2600.2524 (xpsp.040919-1030), File size = 134912, File modification date = 20/06/2006 22:03

File description = IP Network Address Translator

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2524

C:\WINDOWS\system32\DRIVERS\netbt.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 162816, File modification date = 03/08/2004 23:14

File description = MBT Transport driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\System32\drivers\afd.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 138496, File modification date = 03/08/2004 23:14

File description = Ancillary Function Driver for WinSock

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\wanarp.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 34560, File modification date = 03/08/2004 23:04

File description = MS Remote Access and Routing ARP Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\netbios.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 34560, File modification date = 03/08/2004 23:03

File description = NetBIOS interface driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\rdbss.sys

File version = 5.1.2600.2902 (xpsp.060505-0047), File size = 174592, File modification date = 20/06/2006 22:14

File description = Redirected Drive Buffering SubSystem Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2902

C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

File version = 5.1.2600.2902 (xpsp.060505-0047), File size = 454400, File modification date = 20/06/2006 22:14

File description = Windows NT SMB Minirdr

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2902

C:\WINDOWS\system32\DRIVERS\arp1394.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 60800, File modification date = 20/06/2006 22:22

File description = IP/1394 Arp Client

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\System32\drivers\klmc.sys

File version = 5.0.146.1, File size = 9939, File modification date = 11/08/2004 09:31

File description = Kaspersky Anti-Virus Mail Checker Proxy

Product Name = Kaspersky Anti-Virus Personal, Product version = 5.0.0.0

C:\WINDOWS\system32\drivers\klif.sys

File version = 6.12.10.226, File size = 170256, File modification date = 30/06/2006 07:46

File description = spuper-ptor

Product Name = Kaspersky Anti-Virus, Product version = 6.0.1.335

C:\WINDOWS\System32\Drivers\Fips.SYS

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 35072, File modification date = 28/08/2001 14:00

File description = Pilote de cryptographie FIPS

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.0

C:\WINDOWS\system32\DRIVERS\hidusb.sys

File version = 5.1.2600.0 (XPClient.010817-1148), File size = 9600, File modification date = 17/08/2001 20:02

File description = USB Miniport Driver for Input Devices

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 36224, File modification date = 03/08/2004 21:08

File description = Hid Class Library

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\System32\Drivers\Cdfs.SYS

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 63744, File modification date = 03/08/2004 23:14

File description = CD-ROM File System Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\System32\Drivers\Fastfat.SYS

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 143360, File modification date = 03/08/2004 23:14

File description = Fast FAT File System Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\System32\win32k.sys

File version = 5.1.2600.2770 (xpsp.051005-1515), File size = 1839616, File modification date = 20/06/2006 22:12

File description = Pilote Win32 multi-utilisateurs

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2770

C:\WINDOWS\System32\drivers\Dxapi.sys

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 10496, File modification date = 28/08/2001 14:00

File description = DirectX API Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\System32\watchdog.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 17664, File modification date = 03/08/2004 23:07

File description = Watchdog Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\System32\drivers\dxg.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 71040, File modification date = 03/08/2004 23:00

File description = DirectX Graphics Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\System32\drivers\dxgthk.sys

File version = 5.1.2600.0 (xpclient.010817-1148), File size = 3328, File modification date = 28/08/2001 14:00

File description = DirectX Graphics Driver Thunk

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.0

C:\WINDOWS\System32\nv4_disp.dll

File version = 6.14.10.9131, File size = 4529408, File modification date = 01/06/2006 15:22

File description = NVIDIA Compatible Windows 2000 Display driver, Version 91.31

Product Name = NVIDIA Compatible Windows 2000 Display driver, Version 91.31 , Product version = 6.14.10.9131

C:\WINDOWS\system32\DRIVERS\irda.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 87424, File modification date = 03/08/2004 23:00

File description = IRDA Protocol Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\ndisuio.sys

File version = 5.1.2600.2658 (xpsp.050419-1524), File size = 14592, File modification date = 03/08/2004 21:03

File description = NDIS User mode I/O Driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2658

C:\WINDOWS\system32\drivers\wdmaud.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 82944, File modification date = 03/08/2004 21:15

File description = MMSYSTEM Wave/Midi API mapper

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\sysaudio.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 60800, File modification date = 03/08/2004 21:15

File description = System Audio WDM Filter

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\drivers\kmixer.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 171776, File modification date = 03/08/2004 21:07

File description = Kernel Mode Audio Mixer

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\mrxdav.sys

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 181248, File modification date = 03/08/2004 23:00

File description = Windows NT WebDav Minirdr

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

C:\WINDOWS\system32\DRIVERS\srv.sys

File version = 5.1.2600.2673 (xpsp.050509-1532), File size = 332544, File modification date = 20/06/2006 22:10

File description = Server driver

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2673

C:\WINDOWS\system32\DRIVERS\secdrv.sys

File version = 4.00.060, File size = 163644, File modification date = 24/08/2006 11:44

File description = Macrovision SECURITY Driver

Product Name = Macrovision SECURITY Driver, Product version = SECURITY Driver 4.00.060 2004/08/31

C:\WINDOWS\system32\drivers\iteio.sys

File size = 3680, File modification date = 30/08/1999 17:49

C:\WINDOWS\System32\Drivers\HTTP.sys

File version = 5.1.2600.2525 (xpsp.040919-1030), File size = 262272, File modification date = 20/06/2006 22:03

File description = HTTP Protocol Stack

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2525

C:\WINDOWS\system32\DRIVERS\mouhid.sys

File version = 5.1.2600.0 (XPClient.010817-1148), File size = 12288, File modification date = 20/06/2006 22:21

File description = Pilote de filtre souris HID

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.0

C:\WINDOWS\system32\ntdll.dll

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 733184, File modification date = 19/08/2004 16:09

File description = DLL Couche NT

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

Run processes/modules:

PROCESS System, PID = 4

PROCESS smss, PID = 772

MODULE C:\WINDOWS\System32\smss.exe, MID = 48580000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 50688, File modification date = 19/08/2004 16:10

File description = Gestionnaire de session Windows NT

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\ntdll.dll, MID = 7c910000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 733184, File modification date = 19/08/2004 16:09

File description = DLL Couche NT

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

PROCESS csrss, PID = 1508

MODULE C:\WINDOWS\system32\csrss.exe, MID = 4a680000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 6144, File modification date = 19/08/2004 16:09

File description = Client Server Runtime Process

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\ntdll.dll, MID = 7c910000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 733184, File modification date = 19/08/2004 16:09

File description = DLL Couche NT

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\CSRSRV.dll, MID = 75ad0000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 32768, File modification date = 19/08/2004 16:09

File description = Client Server Runtime Process

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\basesrv.dll, MID = 75ae0000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 52736, File modification date = 19/08/2004 16:09

File description = Windows NT BASE API Server DLL

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\winsrv.dll, MID = 75af0000

File version = 5.1.2600.2751 (xpsp.050831-1531), File size = 292352, File modification date = 20/06/2006 22:11

File description = DLL serveur de Windows

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2751

MODULE C:\WINDOWS\system32\GDI32.dll, MID = 77ef0000

File version = 5.1.2600.2818 (xpsp.051228-1450), File size = 280064, File modification date = 20/06/2006 22:13

File description = GDI Client DLL

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2818

MODULE C:\WINDOWS\system32\KERNEL32.dll, MID = 7c800000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 1048576, File modification date = 19/08/2004 16:09

File description = DLL du client API BASE Windows NT

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\USER32.dll, MID = 77d10000

File version = 5.1.2600.2622 (xpsp.050301-1521), File size = 578048, File modification date = 20/06/2006 22:05

File description = DLL client de l'API Utilisateur de Windows XP

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2622

MODULE C:\WINDOWS\system32\sxs.dll, MID = 77210000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 716800, File modification date = 19/08/2004 16:09

File description = Fusion 2.5

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\ADVAPI32.dll, MID = 77da0000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 685056, File modification date = 19/08/2004 16:09

File description = API avancées Windows 32

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\RPCRT4.dll, MID = 77e50000

File version = 5.1.2600.2794 (xpsp.051110-1543), File size = 582144, File modification date = 20/06/2006 22:12

File description = Remote Procedure Call Runtime

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2794

PROCESS winlogon, PID = 1580

MODULE C:\WINDOWS\system32\winlogon.exe, MID = 1000000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 506368, File modification date = 19/08/2004 16:10

File description = Application d'ouverture de session Windows NT

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\ntdll.dll, MID = 7c910000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 733184, File modification date = 19/08/2004 16:09

File description = DLL Couche NT

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\kernel32.dll, MID = 7c800000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 1048576, File modification date = 19/08/2004 16:09

File description = DLL du client API BASE Windows NT

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\ADVAPI32.dll, MID = 77da0000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 685056, File modification date = 19/08/2004 16:09

File description = API avancées Windows 32

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\RPCRT4.dll, MID = 77e50000

File version = 5.1.2600.2794 (xpsp.051110-1543), File size = 582144, File modification date = 20/06/2006 22:12

File description = Remote Procedure Call Runtime

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2794

MODULE C:\WINDOWS\system32\AUTHZ.dll, MID = 77680000

File version = 5.1.2600.2622 (xpsp.050301-1521), File size = 62464, File modification date = 20/06/2006 22:04

File description = Authorization Framework

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2622

MODULE C:\WINDOWS\system32\msvcrt.dll, MID = 77be0000

File version = 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 343040, File modification date = 19/08/2004 16:09

File description = Windows NT CRT DLL

Product Name = Microsoft® Windows® Operating System, Product version = 7.0.2600.2180

MODULE C:\WINDOWS\system32\CRYPT32.dll, MID = 779e0000

File version = 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 604672, File modification date = 19/08/2004 16:09

File description = Crypto API32

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.131.2600.2180

MODULE C:\WINDOWS\system32\USER32.dll, MID = 77d10000

File version = 5.1.2600.2622 (xpsp.050301-1521), File size = 578048, File modification date = 20/06/2006 22:05

File description = DLL client de l'API Utilisateur de Windows XP

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2622

MODULE C:\WINDOWS\system32\GDI32.dll, MID = 77ef0000

File version = 5.1.2600.2818 (xpsp.051228-1450), File size = 280064, File modification date = 20/06/2006 22:13

File description = GDI Client DLL

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2818

MODULE C:\WINDOWS\system32\MSASN1.dll, MID = 77a80000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 57344, File modification date = 19/08/2004 16:09

File description = ASN.1 Runtime APIs

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\NDdeApi.dll, MID = 758d0000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 18432, File modification date = 19/08/2004 16:09

File description = APIs de gestion du partage DDE réseau

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\PROFMAP.dll, MID = 758c0000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 27648, File modification date = 19/08/2004 16:09

File description = Userenv

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\NETAPI32.dll, MID = 6fee0000

File version = 5.1.2600.2756 (xpsp.050908-1544), File size = 336896, File modification date = 20/06/2006 22:12

File description = Net Win32 API DLL

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2756

MODULE C:\WINDOWS\system32\USERENV.dll, MID = 76960000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 731136, File modification date = 19/08/2004 16:09

File description = Userenv

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\PSAPI.DLL, MID = 76ba0000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 23040, File modification date = 19/08/2004 16:09

File description = Process Status Helper

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\REGAPI.dll, MID = 76b60000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 49664, File modification date = 19/08/2004 16:09

File description = Registry Configuration APIs

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\Secur32.dll, MID = 77fc0000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 55808, File modification date = 19/08/2004 16:09

File description = Security Support Provider Interface

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\SETUPAPI.dll, MID = 778e0000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 1003520, File modification date = 19/08/2004 16:09

File description = Installation de L'API Windows

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\VERSION.dll, MID = 77bd0000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 18944, File modification date = 19/08/2004 16:09

File description = Version Checking and File Installation Libraries

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\WINSTA.dll, MID = 762f0000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 53760, File modification date = 19/08/2004 16:09

File description = Winstation Library

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\WINTRUST.dll, MID = 76be0000

File version = 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 176640, File modification date = 19/08/2004 16:09

File description = API Microsoft de vérification de la confiance

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.131.2600.2180

MODULE C:\WINDOWS\system32\IMAGEHLP.dll, MID = 76c40000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 144384, File modification date = 19/08/2004 16:09

File description = Windows NT Image Helper

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\WS2_32.dll, MID = 719f0000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 82944, File modification date = 19/08/2004 16:09

File description = Windows Socket 2.0 32-Bit DLL

Product Name = Microsoft® Windows® Operating System, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\WS2HELP.dll, MID = 719e0000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 19968, File modification date = 19/08/2004 16:09

File description = Application d'assistance de Windows Socket 2.0 pour Windows NT

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\MSGINA.dll, MID = 75900000

File version = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), File size = 1004032, File modification date = 19/08/2004 16:09

File description = Ouverture de session Windows NT GINA DLL

Product Name = Système d'exploitation Microsoft® Windows®, Product version = 5.1.2600.2180

MODULE C:\WINDOWS\system32\SH

KilMi · le 23 septembre 2006

@KilMi

Quand tu dis complètement , tu veux dire quoi exactement ?

As-tu pensé à supprimer ce dossier , en plus de la désinstallation ?

C:\Documents and Settings\AtYourRisk\Application Data\Mozilla

J'ai bien recommencé en désinstallant tout, rien n'y change :zarb: .

legains · le 24 septembre 2006

Salut,

quelques nouvelles...

Après des modifications de drivers, HJT fonctionne parfaitement.

Par contre Ewido NADA !!! :francais: pas compatible :yes:

Le scan d'Avast en mode sans échec :

Je ne pense pas que ce soit très important,

cependand Avast n'a pas pu agir dessu, je le ferai manuellement si tu me le conseils.

Voilà un nouveau rapport HJT :

Logfile of HijackThis v1.99.1

Scan saved at 07:13:30, on 24/09/2006

Platform: Unknown Windows (WinNT 6.00.1504)

MSIE: Internet Explorer v7.00 (7.00.5600.16384)

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Windows\soundman.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=552...cid={SUB_CLCID}

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O13 - Gopher Prefix:

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Merci,

Bon Dimanche.

KilMi · le 24 septembre 2006

Mais pour ma part je pense que c'est plus un problème de spyware, dont j'arrive pas à me débarasser puisque les anti-spywares que j'ai plantent en cours d'analyse.

snooky · le 24 septembre 2006

Désinstalle Firefox .

Passe Ewido .

Ambassadeur Kosh · le 24 septembre 2006

Pourriez vous me dire s'il y a des problème d'après le log ? Merçi à vous car je ne pourrais le dire ceux qui est bien ou pas.

Logfile of HijackThis v1.99.1

Scan saved at 16:38:55, on 24/09/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll

O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Télécharger avec FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm

O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1142451961896

O17 - HKLM\System\CCS\Services\Tcpip\..\{FA042631-C135-483A-9851-F1BFA3925C3A}: NameServer = 80.10.246.5 80.10.246.136

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Kaspersky Anti-Virus Service (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

snooky · le 24 septembre 2006

Spybot est de trop . :)

Tu peux passer à la version 6 de kasperky :

ftp://ftp.kaspersky.com/products/release/...6.0.0.303fr.msi

parlie · le 24 septembre 2006

je crois que j'ai été oublié alors revoila mon rapport et mon probleme

merci d'avance

voila mon rapport

mon probleme se situe avec le logiciel vnc qui ne fonctionne plus chez moi

en fait je lance le viewer je mets l'ip +entrée et le tout disparait.....je ne sais ou....

en tout cas pas dans le gestionnaire de taches ....

merci d'avance

Logfile of HijackThis v1.99.1

Scan saved at 21:21:05, on 11/09/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\DeltTray.exe

C:\Program Files\Eset\nod32kui.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\3M\PSNotes\psn.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\PROGRA~1\3M\PSNotes\PSNGive.exe

C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe

C:\WINDOWS\BricoPacks\Vista Inspirat\UberIcon\UberIcon Manager.exe

C:\WINDOWS\BricoPacks\Vista Inspirat\YzShadow\YzShadow.exe

C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe

C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\WINDOWS\System32\GEARSec.exe

C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe

C:\Program Files\Eset\nod32krn.exe

C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe

C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\oodag.exe

C:\WINDOWS\system32\pctspk.exe

C:\Program Files\Microsoft Private Folder 1.0\PrfldSvc.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE

C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

C:\Program Files\eMule\emule.exe

C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll

O4 - HKLM\..\Run: [DeltTray] DeltTray.exe

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - Startup: freeinfo.lnk = C:\Program Files\Free-info\freeinfo.exe

O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe

O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\UberIcon\UberIcon Manager.exe

O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzShadow\YzShadow.exe

O4 - Startup: Y'z ToolBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe

O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe

O4 - Global Startup: Post-it® Software Notes.lnk = C:\Program Files\3M\PSNotes\psn.exe

O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe

O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Ouvrir le fichier PDF dans Word - res://C:\Program Files\ScanSoft\OmniPagePro14.0\PdfCnv\IEShellExt.dll /300