Aller au contenu

pitixouxou

Membres
 Afficher le profil  Afficher son activité

  • Compteur de contenus

    13

  • Inscription

  • Dernière visite

pitixouxou's Achievements

Junior Member

Junior Member (3/12)

0

Réputation sur la communauté

  1. pitixouxou
    Personne ne sait? C'est un problème si complexe que ça?? Même en bidouillant, rien à faire, la PS3 ne détecte pas les ordinateurs connectés à la livebox, n'y a-t-il vraiment aucun moyen d'y remédier?
  2. pitixouxou
    Bien le bonsoir, Je fais appel à vous, car je n'arrive pas à configurer mes adaptateurs Devolo comme je le voudrais. Je vous expose la situation. J'ai une livebox 2 mini qui se trouve dans le bureau, et j'aurais voulu pouvoir me connecter à Internet (avec mon ordinateur portable, les consoles, etc...) par wifi dans le salon. Le signal étant trop faible, j'ai acheté un Devolo Wireless Extender Starter Kit (avec donc un adaptateur ethernet et un adaptateur avec antenne). J'ai connecté le premier adaptateur à la livebox, et ai branché celui avec l'antenne dans le salon. Jusque là, tout va bien. J'aurais donc voulu que l'adaptateur avec l'antenne "remplace" en quelque sorte la livebox au salon, qu'il serve juste de relai pour augmenter la portée du signal. Seulement, je ne sais pas si l'adaptateur diffuse le "même" réseau que celui de la livebox. En effet, j'ai bien Internet au salon, mais lorsque je veux lire avec ma PS3 des musiques qui se trouvent sur l'ordinateur relié à la livebox, c'est impossible, il n'y a pas de connexion entre les deux. Alors que si j'essaye lorsque l'ordinateur est relié à l'adaptateur devolo wifi du salon, aucun problème. Via le programme fourni avec les adaptateurs, je suis allé voir la configuration. L'adaptateur wifi est en mode "Point d'accès". Ne faudrait-il pas qu'il soit en mode "Client WLAN" pour servir de "relai", comme je le souhaite? J'ai essayé, en mettant le même SSID et la même clé que la livebox, mais à ce moment là je ne reçois même plus de signal de l'adaptateur, et suis obligé de tout remettre comme avant. Je ne suis peut-être pas très clair, mais ce n'est pas simple à expliquer :s Si vous avez besoin de nouvelles explications, n'hésitez pas à me demander. Merci d'avance pour vos réponses.
  3. pitixouxou
    Non c'est bon, Combofix n'est plus là. J'ai installé Secunia Personal Software Inspector, je le trouve très bien fait et très utile. Je mets le sujet en Résolu. Encore merci Gof!
  4. pitixouxou
    Bonjour Gof, Voilà, j'ai suivi tes instructions et ai tout supprimé. Juste une chose à signaler: quelques difficultés avec le "combofix /u" dans Executer: j'ai eu un message disant que Combofix était périmé, et qui me demandait de cliquer sur oui pour... Je sais plus ce qu'il disait Est-ce que j'ai bien fait de continuer? J'ai également fait les mises à jour, et je pense utiliser Secunia Personal Software Inspector pour mettre à jour le reste. Je te remercie grandement de l'aide que tu m'as apportée. Tu es rapide et efficace, ça fait plaisir
  5. pitixouxou
    Le résultat du scan BitDefender: Fichier journal de BitDefender Produit : BitDefender Total Security 2008 Version : BitDefender UIScanner V.11 Date du journal : 18:32:03 20/12/2009 Chemin du journal : C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Profiles\Logs\full_scan\1261330323_1_01.xml Analyse des chemins :Chemin0000: C:\ Options d’analyse :Analyse contre les virus : Oui Détecter les adwares : Oui Analyse contre les spywares : Oui Analyse des applications : Oui Détecter les numéroteurs : Oui Analyse contre les Rootkits : Oui Options de sélection de cible :Analyse les clés du registre : Oui Analyse des cookies : Oui Analyser le secteur de boot : Oui Analyse des processus mémoire : Oui Analyser les archives : Non Analyser les fichiers enpaquetés : Oui Analyser les emails : Oui Analyser tous les fichiers : Oui Analyse heuristique : Oui Extensions analysées : Extensions exclues : Traitement cibleAction par défaut pour les objets infectés : Désinfecter Action par défaut pour les objets suspects : Aucun Action par défaut pour les objets camouflés : Aucun Résumé de l'analyseNombre de signatures de virus : 4753802 Plugins archives : 44 Plug-ins messagerie : 6 Plugins d'analyse : 13 Plugins archives : 44 Plug-ins système : 5 Plug-ins décompression : 8 Résumé de l'analyse généraleEléments analysés : 49971 Eléments infectés : 1 Eléments suspects : 0 Eléments résolus : 1 Virus individuels trouvés : 1 Répertoires analysés : 3814 Secteur de boot analysés : 2 Archives analysés : 3613 Erreurs I/O : 0 Temps d'analyse : 00:00:38:40 Fichiers par seconde : 21 Résumé des processus analysésAnalysé(s) : 31 Infecté(s) : 0 Résumé des clés de registre analyséesAnalysé(s) : 818 Infecté(s) : 0 Résumé des cookies analysésAnalysé(s) : 152 Infecté(s) : 1 Problèmes non résolus :Nom de l'objet Nom de la menace Etat final Problèmes résolusNom de l'objet Nom de la menace Etat final [system]=]C:\Documents and Settings\Fujitsu\Cookies\[email protected][1].txt Cookie.BS.Serving-Sys Effacé Objets non scannés :Nom de l'objet Raison Etat final Voili voilou
  6. pitixouxou
    Voilà le rapport Look.bat: REGEDIT4 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi] "ErrorControl"=dword:00000001 "Group"="SCSI miniport" "Start"=dword:00000000 "Tag"=dword:00000019 "Type"=dword:00000001 "DisplayName"="Contrôleur de disque dur IDE/ESDI standard" "ImagePath"=hex(2):73,79,73,74,65,6d,33,32,5c,44,52,49,56,45,52,53,5c,61,74,61,\ 70,69,2e,73,79,73,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi\Parameters] "LegacyDetection"=dword:00000001 "GhostSlave"=hex(7):53,75,6e,44,69,73,6b,20,00,00 "UseCheckPowerForFlush"=hex(7):53,41,4d,53,55,4e,47,20,57,4e,52,2d,33,31,36,30,\ 31,41,20,28,31,36,30,30,4d,42,29,20,20,20,20,20,20,20,20,20,20,20,20,20,00,\ 53,41,4d,53,55,4e,47,20,57,4e,52,2d,33,31,36,30,31,41,20,28,31,2e,36,47,42,\ 29,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,49,42,4d,2d,44,54,43,41,2d,\ 32,34,30,39,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,54,43,36,4f,41,41,32,41,00,49,42,4d,2d,44,54,43,41,2d,32,\ 34,30,39,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,54,43,36,49,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,35,\ 31,32,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,50,4c,38,4f,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,35,31,\ 32,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,50,4c,38,49,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,35,31,32,\ 30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,50,4c,38,49,41,41,34,41,00,49,42,4d,2d,44,54,43,41,2d,32,33,32,34,30,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,54,43,35,4f,41,41,32,41,00,49,42,4d,2d,44,54,43,41,2d,32,33,32,34,30,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 54,43,35,49,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,34,34,38,30,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,50,\ 4c,37,4f,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,34,34,38,30,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,50,4c,\ 37,49,41,41,32,41,00,00 "NoFlushDevice"=hex(7):51,55,41,4e,54,55,4d,5f,4c,50,53,35,32,35,41,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,53,43,\ 52,2d,37,33,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,00,00 "PioOnlyDevice"=hex(7):20,20,20,20,43,6f,6e,6e,65,72,20,50,65,72,69,70,68,65,\ 72,61,6c,73,20,34,32,35,4d,42,20,2d,20,43,46,53,34,32,35,41,20,20,00,4d,41,\ 54,53,48,49,54,41,20,43,52,2d,35,38,31,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,00,46,58,36,30,30,53,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,00,43,44,2d,34,34,45,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,51,55,41,4e,\ 54,55,4d,20,54,52,42,38,35,30,41,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,00,51,55,41,4e,54,55,4d,20,4d,41,52,56,45,\ 52,49,43,4b,20,35,34,30,41,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,00,20,4d,41,58,54,4f,52,20,4d,58,54,2d,35,34,30,20,20,41,54,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,\ 20,37,31,32,36,30,20,41,54,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,38,35,30,20,41,56,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 00,4d,61,78,74,6f,72,20,37,35,34,30,20,41,56,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,\ 32,31,33,20,41,54,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,33,34,35,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,\ 61,78,74,6f,72,20,37,32,34,35,20,41,54,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,32,34,\ 35,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,32,31,31,41,55,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,61,78,\ 74,6f,72,20,37,31,37,31,20,41,54,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,00,43,44,2d,33,31,36,45,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,00,53,41,4d,53,55,4e,47,5f,53,43,52,2d,32,34,33,30,00,43,52,2d,32,\ 38,30,31,54,45,00,00 "NonRemovableMedia"=hex(7):4b,69,6e,67,73,74,6f,6e,20,54,65,63,68,6e,6f,6c,6f,\ 67,79,20,44,61,74,61,50,61,6b,20,33,34,30,20,20,20,20,20,20,20,20,20,00,53,\ 75,6e,44,69,73,6b,20,53,44,50,35,41,2d,31,30,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,53,75,6e,44,69,73,6b,20,53,44,\ 43,46,42,2d,31,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,00,53,75,6e,44,69,73,6b,20,53,44,50,33,42,2d,32,30,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,53,75,6e,\ 44,69,73,6b,20,53,44,50,33,42,2d,31,37,35,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,00,53,75,6e,44,69,73,6b,20,53,44,50,35,\ 2d,32,2e,35,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,00,43,61,6c,6c,75,6e,61,20,54,65,63,68,6e,6f,6c,6f,67,79,20,43,54,\ 32,36,30,4d,43,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,42,4e,2d,53,30,\ 30,34,41,43,2d,53,20,31,2e,30,30,00,43,61,6c,6c,75,6e,61,20,54,65,63,68,6e,\ 6f,6c,6f,67,79,20,43,54,35,32,30,52,4d,00,48,69,74,61,63,68,69,20,43,56,20,\ 35,2e,31,2e,31,00,20,20,20,20,20,20,41,54,41,5f,46,4c,41,53,48,20,00,4d,69,\ 74,73,75,62,69,73,68,69,20,41,54,41,20,43,61,72,64,20,00,4c,45,58,41,52,20,\ 41,54,41,5f,46,4c,41,53,48,00,4d,69,63,72,6f,6e,20,4d,54,43,46,30,30,34,41,\ 00,4d,69,63,72,6f,6e,20,4d,54,43,46,30,30,38,41,00,53,75,6e,44,69,73,6b,20,\ 53,44,50,33,42,2d,31,31,30,00,53,75,6e,44,69,73,6b,20,53,44,43,46,42,2d,34,\ 00,42,4e,2d,43,41,42,2d,54,00,4d,45,4d,4f,52,59,53,54,49,43,4b,00,4d,45,4d,\ 4f,52,59,53,54,49,43,4b,20,20,20,38,4d,20,20,38,4b,00,00 "NoPowerDownDevice"=hex(7):52,44,2d,44,52,43,30,30,31,2d,4d,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,43,\ 53,2d,52,33,37,20,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,00 "AutoEjectZipDevice"=hex(7):49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,\ 20,20,20,20,20,41,54,41,50,49,20,20,20,20,20,20,20,20,20,20,20,20,20,32,33,\ 2e,44,20,20,20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,\ 20,20,20,20,41,54,41,50,49,20,20,20,20,20,20,20,20,20,20,20,20,20,32,31,2e,\ 44,20,20,20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,20,\ 20,20,20,41,54,41,50,49,20,20,20,20,20,20,20,20,20,20,20,20,20,32,30,2e,44,\ 20,20,20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,20,20,\ 20,20,41,54,41,50,49,20,20,20,20,20,20,20,20,20,20,20,20,20,39,31,2e,44,20,\ 20,20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,42,2e,32,39,20,20,\ 20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,42,2e,32,32,20,20,20,\ 20,00,00 "NeedIdentDevice"=hex(7):51,55,41,4e,54,55,4d,20,46,49,52,45,42,41,4c,4c,00,00 "DefaultPioAtapiDevice"=hex(7):54,4f,52,69,53,41,4e,20,44,56,44,2d,52,4f,4d,20,\ 44,52,44,2d,4e,32,31,36,00,49,44,45,2d,43,44,20,52,2f,52,57,20,32,78,32,78,\ 32,34,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi\Enum] "0"="PCIIDE\\IDEChannel\\4&33751483&0&0" "Count"=dword:00000002 "NextInstance"=dword:00000002 "1"="PCIIDE\\IDEChannel\\4&33751483&0&1" Je lance l'analyse avec BitDefender tout de suite, et te posterai le rapport dès que ce sera terminé. Ensuite, TU pourras filer (c'est toi qui te casses la tête pour m'aider, pas l'inverse )
  7. pitixouxou
    C'est bon, PC redémarré, aucun problème à signaler. Juste une question: j'ai maintenant de temps en temps un "veuillez patienter" qui apparait au démarrage que je n'avais pas avant. A quoi cela est dû? Ce n'est pas bien grave, ça dure une dizaine de secondes, mais je veux juste m'assurer que c'est bien normal. Je suis prêt pour la suite
  8. pitixouxou
    C'est fait, j'ai supprimé atapi.sys.vir Voilà le rapport du Look.bat: REGEDIT4 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi] "ErrorControl"=dword:00000001 "Group"="SCSI miniport" "Start"=dword:00000000 "Tag"=dword:00000019 "Type"=dword:00000001 "DisplayName"="Contrôleur de disque dur IDE/ESDI standard" "ImagePath"=hex(2):73,79,73,74,65,6d,33,32,5c,44,52,49,56,45,52,53,5c,61,74,61,\ 70,69,2e,73,79,73,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi\Parameters] "LegacyDetection"=dword:00000001 "GhostSlave"=hex(7):53,75,6e,44,69,73,6b,20,00,00 "UseCheckPowerForFlush"=hex(7):53,41,4d,53,55,4e,47,20,57,4e,52,2d,33,31,36,30,\ 31,41,20,28,31,36,30,30,4d,42,29,20,20,20,20,20,20,20,20,20,20,20,20,20,00,\ 53,41,4d,53,55,4e,47,20,57,4e,52,2d,33,31,36,30,31,41,20,28,31,2e,36,47,42,\ 29,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,49,42,4d,2d,44,54,43,41,2d,\ 32,34,30,39,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,54,43,36,4f,41,41,32,41,00,49,42,4d,2d,44,54,43,41,2d,32,\ 34,30,39,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,54,43,36,49,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,35,\ 31,32,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,50,4c,38,4f,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,35,31,\ 32,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,50,4c,38,49,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,35,31,32,\ 30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,50,4c,38,49,41,41,34,41,00,49,42,4d,2d,44,54,43,41,2d,32,33,32,34,30,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,54,43,35,4f,41,41,32,41,00,49,42,4d,2d,44,54,43,41,2d,32,33,32,34,30,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 54,43,35,49,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,34,34,38,30,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,50,\ 4c,37,4f,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,34,34,38,30,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,50,4c,\ 37,49,41,41,32,41,00,00 "NoFlushDevice"=hex(7):51,55,41,4e,54,55,4d,5f,4c,50,53,35,32,35,41,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,53,43,\ 52,2d,37,33,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,00,00 "PioOnlyDevice"=hex(7):20,20,20,20,43,6f,6e,6e,65,72,20,50,65,72,69,70,68,65,\ 72,61,6c,73,20,34,32,35,4d,42,20,2d,20,43,46,53,34,32,35,41,20,20,00,4d,41,\ 54,53,48,49,54,41,20,43,52,2d,35,38,31,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,00,46,58,36,30,30,53,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,00,43,44,2d,34,34,45,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,51,55,41,4e,\ 54,55,4d,20,54,52,42,38,35,30,41,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,00,51,55,41,4e,54,55,4d,20,4d,41,52,56,45,\ 52,49,43,4b,20,35,34,30,41,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,00,20,4d,41,58,54,4f,52,20,4d,58,54,2d,35,34,30,20,20,41,54,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,\ 20,37,31,32,36,30,20,41,54,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,38,35,30,20,41,56,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 00,4d,61,78,74,6f,72,20,37,35,34,30,20,41,56,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,\ 32,31,33,20,41,54,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,33,34,35,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,\ 61,78,74,6f,72,20,37,32,34,35,20,41,54,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,32,34,\ 35,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,32,31,31,41,55,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,61,78,\ 74,6f,72,20,37,31,37,31,20,41,54,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,00,43,44,2d,33,31,36,45,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,00,53,41,4d,53,55,4e,47,5f,53,43,52,2d,32,34,33,30,00,43,52,2d,32,\ 38,30,31,54,45,00,00 "NonRemovableMedia"=hex(7):4b,69,6e,67,73,74,6f,6e,20,54,65,63,68,6e,6f,6c,6f,\ 67,79,20,44,61,74,61,50,61,6b,20,33,34,30,20,20,20,20,20,20,20,20,20,00,53,\ 75,6e,44,69,73,6b,20,53,44,50,35,41,2d,31,30,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,53,75,6e,44,69,73,6b,20,53,44,\ 43,46,42,2d,31,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,00,53,75,6e,44,69,73,6b,20,53,44,50,33,42,2d,32,30,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,53,75,6e,\ 44,69,73,6b,20,53,44,50,33,42,2d,31,37,35,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,00,53,75,6e,44,69,73,6b,20,53,44,50,35,\ 2d,32,2e,35,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,00,43,61,6c,6c,75,6e,61,20,54,65,63,68,6e,6f,6c,6f,67,79,20,43,54,\ 32,36,30,4d,43,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,42,4e,2d,53,30,\ 30,34,41,43,2d,53,20,31,2e,30,30,00,43,61,6c,6c,75,6e,61,20,54,65,63,68,6e,\ 6f,6c,6f,67,79,20,43,54,35,32,30,52,4d,00,48,69,74,61,63,68,69,20,43,56,20,\ 35,2e,31,2e,31,00,20,20,20,20,20,20,41,54,41,5f,46,4c,41,53,48,20,00,4d,69,\ 74,73,75,62,69,73,68,69,20,41,54,41,20,43,61,72,64,20,00,4c,45,58,41,52,20,\ 41,54,41,5f,46,4c,41,53,48,00,4d,69,63,72,6f,6e,20,4d,54,43,46,30,30,34,41,\ 00,4d,69,63,72,6f,6e,20,4d,54,43,46,30,30,38,41,00,53,75,6e,44,69,73,6b,20,\ 53,44,50,33,42,2d,31,31,30,00,53,75,6e,44,69,73,6b,20,53,44,43,46,42,2d,34,\ 00,42,4e,2d,43,41,42,2d,54,00,4d,45,4d,4f,52,59,53,54,49,43,4b,00,4d,45,4d,\ 4f,52,59,53,54,49,43,4b,20,20,20,38,4d,20,20,38,4b,00,00 "NoPowerDownDevice"=hex(7):52,44,2d,44,52,43,30,30,31,2d,4d,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,43,\ 53,2d,52,33,37,20,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,00 "AutoEjectZipDevice"=hex(7):49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,\ 20,20,20,20,20,41,54,41,50,49,20,20,20,20,20,20,20,20,20,20,20,20,20,32,33,\ 2e,44,20,20,20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,\ 20,20,20,20,41,54,41,50,49,20,20,20,20,20,20,20,20,20,20,20,20,20,32,31,2e,\ 44,20,20,20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,20,\ 20,20,20,41,54,41,50,49,20,20,20,20,20,20,20,20,20,20,20,20,20,32,30,2e,44,\ 20,20,20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,20,20,\ 20,20,41,54,41,50,49,20,20,20,20,20,20,20,20,20,20,20,20,20,39,31,2e,44,20,\ 20,20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,42,2e,32,39,20,20,\ 20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,42,2e,32,32,20,20,20,\ 20,00,00 "NeedIdentDevice"=hex(7):51,55,41,4e,54,55,4d,20,46,49,52,45,42,41,4c,4c,00,00 "DefaultPioAtapiDevice"=hex(7):54,4f,52,69,53,41,4e,20,44,56,44,2d,52,4f,4d,20,\ 44,52,44,2d,4e,32,31,36,00,49,44,45,2d,43,44,20,52,2f,52,57,20,32,78,32,78,\ 32,34,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi\Enum] "0"="PCIIDE\\IDEChannel\\4&33751483&0&0" "Count"=dword:00000002 "NextInstance"=dword:00000002 "1"="PCIIDE\\IDEChannel\\4&33751483&0&1"
  9. pitixouxou
    Bonjour Gof Je voulais justement te parler des symptômes: ils ont disparus. Je n'ai plus ni alerte de la part de mon anti-virus, ni redirection de page web. Serait-ce la fin de ce fichu malware? Voilà les rapports: Celui de Combofix avec CFScript: ComboFix 09-12-18.03 - Fujitsu 20/12/2009 11:32:06.2.1 - x86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1023.691 [GMT 1:00] Lancé depuis: c:\documents and settings\Fujitsu\Bureau\KittyFix.exe Commutateurs utilisés :: c:\documents and settings\Fujitsu\Bureau\CFScript.txt AV: Bitdefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB} FW: Bitdefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . --------------- FCopy --------------- c:\windows\system32\drivers\atapi.sys --> c:\windows\atapi.sys.vir c:\windows\ServicePackFiles\i386\atapi.sys --> c:\windows\system32\drivers\atapi.sys . ((((((((((((((((((((((((((((( Fichiers créés du 2009-11-20 au 2009-12-20 )))))))))))))))))))))))))))))))))))) . 2009-12-20 10:32 . 2009-12-19 15:11 96512 ----a-w- c:\windows\atapi.sys.vir 2009-12-19 17:35 . 2009-12-19 17:54 -------- d-----w- c:\program files\ma-config.com 2009-12-19 17:35 . 2009-12-19 17:54 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com 2009-12-19 15:08 . 2009-12-19 15:08 96512 ----a-w- c:\windows\system32\drivers\tsk_atapi.sys 2009-12-19 15:08 . 2009-12-19 15:08 16904 ----a-w- c:\windows\system32\drivers\KLMD.sys 2009-12-19 15:08 . 2009-12-19 15:08 -------- d-----w- C:\tdsskiller 2009-12-19 14:01 . 2009-12-19 14:01 -------- d-----w- c:\program files\WOT 2009-12-19 13:29 . 2009-12-19 13:30 -------- d-----w- c:\program files\trend micro 2009-12-19 13:29 . 2009-12-19 13:30 -------- d-----w- C:\rsit 2009-12-19 08:58 . 2009-12-19 08:58 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help 2009-12-18 10:57 . 2009-12-20 10:39 81984 ----a-w- c:\windows\system32\bdod.bin 2009-12-18 10:45 . 2009-12-18 10:45 -------- d-----w- c:\documents and settings\LocalService\Menu Démarrer 2009-12-18 10:22 . 2009-12-18 10:22 -------- d-----w- c:\documents and settings\Fujitsu\Application Data\BitDefender 2009-12-18 10:20 . 2009-12-18 10:20 -------- d-----w- c:\program files\BitDefender 2009-12-18 10:20 . 2009-12-20 09:32 -------- d-----w- c:\program files\BitDefender 2008 2009-12-18 10:20 . 2009-12-18 10:43 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender 2009-12-18 10:16 . 2009-12-18 10:20 -------- d-----w- c:\program files\Fichiers communs\BitDefender 2009-12-18 09:47 . 2006-10-26 18:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll 2009-12-18 09:47 . 2006-10-26 18:56 32592 ----a-w- c:\windows\system32\msonpmon.dll 2009-12-18 09:46 . 2009-12-18 09:46 -------- d-----w- c:\program files\Microsoft Works 2009-12-18 09:44 . 2009-12-18 09:44 -------- d-----w- c:\program files\Microsoft.NET 2009-12-18 09:39 . 2009-12-18 09:40 -------- d-----w- c:\windows\SHELLNEW 2009-12-18 09:39 . 2009-12-18 09:39 -------- d-----w- c:\documents and settings\Fujitsu\Local Settings\Application Data\Microsoft Help 2009-12-18 09:38 . 2009-12-19 19:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-12-18 09:38 . 2009-12-18 09:38 -------- d-----r- C:\MSOCache 2009-12-18 09:17 . 2001-08-23 16:47 5632 ----a-w- c:\windows\system32\ptpusb.dll 2009-12-18 09:17 . 2008-04-13 18:45 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys 2009-12-18 09:17 . 2008-04-13 18:45 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys 2009-12-18 09:17 . 2008-04-14 02:33 159232 ----a-w- c:\windows\system32\ptpusd.dll 2009-12-17 21:51 . 2009-12-17 21:51 -------- d-----w- c:\documents and settings\All Users\Application Data\F-Secure 2009-12-17 17:37 . 2009-12-17 17:37 -------- d-----w- c:\windows\Sun 2009-12-16 21:36 . 2009-12-16 21:36 -------- d-sh--w- c:\windows\system32\config\systemprofile\IECompatCache 2009-12-16 21:34 . 2009-12-16 21:34 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-12-19 14:27 . 2009-09-28 15:59 -------- d-----w- c:\program files\CCleaner 2009-12-18 10:39 . 2007-11-12 15:27 86792 ----a-w- c:\windows\system32\drivers\bdfndisf.sys 2009-12-18 10:04 . 2009-11-03 15:00 -------- d-----w- c:\documents and settings\Fujitsu\Application Data\Skype 2009-12-18 10:01 . 2009-11-03 14:59 -------- d-----r- c:\program files\Skype 2009-12-18 10:00 . 2009-09-28 15:45 28272 ----a-w- c:\documents and settings\Fujitsu\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-12-18 10:00 . 2009-10-28 10:39 -------- d-----w- c:\program files\SlySoft 2009-12-10 18:34 . 2009-09-28 08:39 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2009-12-10 02:22 . 2004-08-05 12:00 64052 ----a-w- c:\windows\system32\perfc00C.dat 2009-12-10 02:22 . 2004-08-05 12:00 445672 ----a-w- c:\windows\system32\perfh00C.dat 2009-11-21 15:59 . 2009-12-19 19:10 1206508 ----a-w- c:\windows\AppPatch\SET67E.tmp 2009-11-03 15:04 . 2009-11-03 15:04 48 ---ha-w- c:\windows\system32\ezsidmv.dat 2009-11-03 15:04 . 2009-11-03 15:04 -------- d-----w- c:\documents and settings\Fujitsu\Application Data\skypePM 2009-11-03 14:59 . 2009-11-03 14:59 -------- d-----w- c:\program files\Fichiers communs\Skype 2009-11-03 14:59 . 2009-11-03 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2009-11-02 11:51 . 2009-10-01 17:56 -------- d-----w- c:\program files\Fichiers communs\Adobe 2009-10-29 07:42 . 2004-08-05 12:00 916480 ------w- c:\windows\system32\wininet.dll 2009-10-27 10:00 . 2009-10-27 10:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira 2009-10-21 05:39 . 2004-08-05 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll 2009-10-21 05:39 . 2004-08-05 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll 2009-10-20 16:20 . 2004-08-05 12:00 265728 ----a-w- c:\windows\system32\drivers\http.sys 2009-10-13 10:33 . 2004-08-05 12:00 271360 ----a-w- c:\windows\system32\oakley.dll 2009-10-12 13:39 . 2004-08-05 12:00 79872 ----a-w- c:\windows\system32\raschap.dll 2009-10-12 13:39 . 2004-08-05 12:00 150528 ----a-w- c:\windows\system32\rastls.dll 2009-09-29 20:29 . 2009-09-29 20:29 1961720 ----a-w- c:\documents and settings\Fujitsu\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe 2009-09-28 07:50 . 2009-09-28 07:50 21892 ----a-w- c:\windows\system32\emptyregdb.dat . ((((((((((((((((((((((((((((( SnapShot@2009-12-19_15.38.09 ))))))))))))))))))))))))))))))))))))))))) . + 2007-08-22 23:18 . 2007-08-22 23:18 96256 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll + 2004-08-05 12:00 . 2008-04-13 18:40 96512 c:\windows\system32\dllcache\atapi.sys - 2009-12-18 09:47 . 2009-12-19 08:59 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe + 2009-12-18 09:47 . 2009-12-19 19:15 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe + 2009-12-18 09:47 . 2009-12-19 19:15 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe - 2009-12-18 09:47 . 2009-12-19 08:59 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe + 2009-12-18 09:47 . 2009-12-19 19:15 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe - 2009-12-18 09:47 . 2009-12-19 08:59 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe + 2006-10-26 13:04 . 2006-10-26 13:04 76624 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\TWSTRUCT.DLL + 2006-10-26 13:04 . 2006-10-26 13:04 19784 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\TWRECS.DLL + 2006-10-26 13:04 . 2006-10-26 13:04 51008 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\TWRECE.DLL + 2006-10-26 13:04 . 2006-10-26 13:04 27456 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\TWORIENT.DLL + 2006-10-26 13:04 . 2006-10-26 13:04 58168 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\TWLAY32.DLL + 2006-10-26 13:05 . 2006-10-26 13:05 86840 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\TWCUTLIN.DLL + 2006-10-26 13:04 . 2006-10-26 13:04 29976 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\THOCRAPI.DLL + 2006-10-26 13:04 . 2006-10-26 13:04 19784 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\REVERSE.DLL + 2006-10-26 20:13 . 2006-10-26 20:13 38168 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\REFEDIT.DLL + 2006-10-26 13:05 . 2006-10-26 13:05 77144 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\PSOM.DLL + 2006-10-26 19:12 . 2006-10-26 19:12 65824 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\NAME.DLL + 2006-10-26 20:13 . 2006-10-26 20:13 26936 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSOEURO.DLL + 2006-10-26 18:48 . 2006-10-26 18:48 14664 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSOCFU.DLL + 2006-10-26 13:04 . 2006-10-26 13:04 75576 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\FORM.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 56120 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACERCLR.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 15160 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEODTXT.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 15160 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEODPDX.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 15160 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEODEXL.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 15160 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEODDBS.DLL + 2006-10-27 14:00 . 2006-10-27 14:00 47976 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEERR.DLL + 2007-10-14 22:44 . 2007-10-14 22:44 324608 c:\windows\Installer\b81134.msp + 2007-10-14 22:46 . 2007-10-14 22:46 324608 c:\windows\Installer\b8112e.msp + 2007-10-12 18:51 . 2007-10-12 18:51 965632 c:\windows\Installer\b81120.msp + 2009-12-18 09:47 . 2009-12-19 19:15 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe - 2009-12-18 09:47 . 2009-12-19 08:59 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe - 2009-12-18 09:47 . 2009-12-19 08:59 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe + 2009-12-18 09:47 . 2009-12-19 19:15 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe - 2009-12-18 09:47 . 2009-12-19 08:59 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe + 2009-12-18 09:47 . 2009-12-19 19:15 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe + 2009-12-18 09:47 . 2009-12-19 19:15 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe - 2009-12-18 09:47 . 2009-12-19 08:59 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe - 2009-12-18 09:39 . 2009-12-18 09:39 217864 c:\windows\Installer\{90120000-006E-040C-0000-0000000FF1CE}\misc.exe + 2009-12-19 19:17 . 2009-12-19 19:17 217864 c:\windows\Installer\{90120000-006E-040C-0000-0000000FF1CE}\misc.exe + 2006-10-26 13:05 . 2006-10-26 13:05 530760 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\XPAGE3C.DLL + 2009-12-18 09:45 . 2009-12-18 09:45 781104 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\WORDPIA.DLL + 2006-10-26 13:05 . 2006-10-26 13:05 126784 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\TWCUTCHR.DLL + 2006-10-26 19:06 . 2006-10-26 19:06 439600 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\SETUP.EXE + 2006-10-26 19:13 . 2006-10-26 19:13 503624 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\SELFCERT.EXE + 2006-10-26 20:30 . 2006-10-26 20:30 482088 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\PORTCONN.DLL + 2006-07-26 17:53 . 2006-07-26 17:53 459080 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\OUTLFLTR.DLL + 2006-10-26 19:23 . 2006-10-26 19:23 782720 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ONSYNCPC.DLL + 2006-10-27 14:39 . 2006-10-27 14:39 687432 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ONBTTNOL.DLL + 2006-10-26 19:00 . 2006-10-26 19:00 285008 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\OISGRAPH.DLL + 2006-10-26 19:00 . 2006-10-26 19:00 998208 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\OISAPP.DLL + 2006-10-26 19:00 . 2006-10-26 19:00 274744 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\OIS.EXE + 2006-10-26 19:06 . 2006-10-26 19:06 232816 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ODEPLOY.EXE + 2006-10-26 18:55 . 2006-10-26 18:55 538904 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSTORES.DLL + 2006-10-26 18:55 . 2006-10-26 18:55 832800 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSTORDB.EXE + 2006-10-26 12:56 . 2006-10-26 12:56 505136 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSSOAP30.DLL + 2006-10-26 18:50 . 2006-10-26 18:50 672024 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSQRY32.EXE + 2006-10-26 12:56 . 2006-10-26 12:56 436520 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSORUN.DLL + 2006-10-26 19:12 . 2006-10-26 19:12 428816 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSODCW.DLL + 2006-10-27 13:59 . 2006-10-27 13:59 161080 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSOCF.DLL + 2006-10-26 12:58 . 2006-10-26 12:58 117552 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSCONV97.DLL + 2006-10-26 18:55 . 2006-10-26 18:55 828704 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MEDCAT.DLL + 2006-10-26 19:12 . 2006-10-26 19:12 173328 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\IEAWSDC.DLL + 2006-10-27 14:09 . 2006-10-27 14:09 983376 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\FPWEC.DLL + 2006-10-26 17:48 . 2006-10-26 17:48 439568 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\DWDCW20.DLL + 2006-10-26 19:12 . 2006-10-26 19:12 189760 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\CONTACTPICKER.DLL + 2006-10-26 18:59 . 2006-10-26 18:59 205616 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\CLVIEW.EXE + 2006-10-27 14:41 . 2006-10-27 14:41 399640 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\CDLMSO.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 371568 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEXBE.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 224104 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACETXT.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 551800 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEREP.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 289648 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACER3X.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 260976 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACER2X.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 392048 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEPDE.DLL + 2006-10-27 14:00 . 2006-10-27 14:00 387960 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEOLEDB.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 279352 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEODBC.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 207736 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACELTS.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 629616 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEEXCL.DLL + 2006-10-26 19:13 . 2006-10-26 19:13 338800 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEEXCH.DLL + 2006-10-27 14:00 . 2006-10-27 14:00 191360 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEES.DLL + 2006-10-27 14:00 . 2006-10-27 14:00 576376 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACEDAO.DLL + 2006-10-26 18:49 . 2006-10-26 18:49 970528 c:\windows\Installer\$PatchCache$\Managed\000021090100C0400000000000F01FEC\12.0.4518\MSONSEXT.DLL + 2009-12-19 19:14 . 2009-12-19 19:14 783744 c:\windows\assembly\GAC\Microsoft.Office.Interop.Word\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Word.dll + 2007-08-23 00:03 . 2007-08-23 00:03 1195888 c:\windows\system32\FM20.DLL + 2007-10-12 18:49 . 2007-10-12 18:49 4116480 c:\windows\Installer\b8113d.msp + 2007-10-14 22:46 . 2007-10-14 22:46 6205440 c:\windows\Installer\b81128.msp + 2007-10-14 22:43 . 2007-10-14 22:43 5749760 c:\windows\Installer\b810f9.msp - 2009-12-18 09:47 . 2009-12-19 08:59 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe + 2009-12-18 09:47 . 2009-12-19 19:15 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe + 2006-10-26 13:05 . 2006-10-26 13:05 1181520 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\XIMAGE3B.DLL + 2006-10-26 21:58 . 2006-10-26 21:58 3732792 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\VVIEWER.DLL + 2006-10-26 22:00 . 2006-10-26 22:00 1841984 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\VVIEWDWG.DLL + 2006-09-29 23:42 . 2006-09-29 23:42 2583344 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\VBE6.DLL + 2006-10-27 13:57 . 2006-10-27 13:57 2330968 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\STSLIST.DLL + 2006-10-26 18:52 . 2006-10-26 18:52 2012480 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\PPTVIEW.EXE + 2006-10-26 19:07 . 2006-10-26 19:07 6536992 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\OSETUP.DLL + 2006-10-26 19:14 . 2006-10-26 19:14 7033152 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\OFFOWC.DLL + 2006-10-26 19:00 . 2006-10-26 19:00 6635320 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSORES.DLL + 2006-10-27 14:10 . 2006-10-27 14:10 5281592 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\IPEDITOR.DLL + 2006-10-26 19:02 . 2006-10-26 19:02 2526520 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\GRAPH.EXE + 2006-10-26 18:21 . 2006-10-26 18:21 1682232 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\FPSRVUTL.DLL + 2006-10-26 13:10 . 2006-10-26 13:10 1190688 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\FM20.DLL + 2006-10-27 14:00 . 2006-10-27 14:00 1751904 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACECORE.DLL + 2006-10-26 18:49 . 2006-10-26 18:49 1011488 c:\windows\Installer\$PatchCache$\Managed\000021090100C0400000000000F01FEC\12.0.4518\MSDAIPP.DLL + 2007-10-14 22:54 . 2007-10-14 22:54 12280320 c:\windows\Installer\b8114f.msp + 2007-10-14 22:44 . 2007-10-14 22:44 22625792 c:\windows\Installer\b81100.msp + 2006-10-27 14:14 . 2006-10-27 14:14 14151456 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\OART.DLL + 2007-10-14 22:43 . 2007-10-14 22:43 229852160 c:\windows\Installer\b810f1.msp . -- Instantané actualisé -- . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_05\bin\jusched.exe" [2009-09-28 32881] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-10 339968] "ORAHSSSessionManager"="c:\program files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696] "Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288] "BitDefender Antiphishing Helper"="c:\program files\BitDefender 2008\IEShow.exe" [2007-10-09 61440] "BDAgent"="c:\program files\BitDefender 2008\bdagent.exe" [2009-12-18 368640] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] 2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\UrbanTerror\\ioUrbanTerror.exe"= "c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [12/11/2007 16:27 86792] R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [28/09/2009 13:43 191092] R3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [28/09/2009 13:43 6100] S3 P1171VID;Creative WebCam Notebook #2;c:\windows\system32\drivers\P1171Vid.sys [17/10/2009 21:56 91392] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bdx REG_MULTI_SZ scan . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000 Trusted Zone: mappy.com Trusted Zone: orange.fr Trusted Zone: voila.fr\rw.search.ke Trusted Zone: weborama.fr\orange . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-12-20 11:41 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bdfsfltr] "ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\ [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bdfsfltr] "ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\ . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6a,53,fd,81,a8,b4,71,42,aa,b6,cd,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6a,53,fd,81,a8,b4,71,42,aa,b6,cd,\ . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(1096) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(3284) c:\progra~1\WINDOW~2\wmpband.dll c:\windows\system32\eappprxy.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe c:\windows\system32\wscntfy.exe c:\program files\OrangeHSS\Launcher\Launcher.exe c:\windows\system32\ssstars.scr . ************************************************************************** . Heure de fin: 2009-12-20 11:47:47 - La machine a redémarré ComboFix-quarantined-files.txt 2009-12-20 10:47 ComboFix2.txt 2009-12-19 15:42 Avant-CF: 49 727 877 120 octets libres Après-CF: 49 844 613 120 octets libres - - End Of File - - FCEE8DB5DF395FDBDCBCF64C3E0BA3B2 Celui de Virus Total: Fichier atapi.sys.vir reçu le 2009.12.20 11:01:55 (UTC)Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.43 2009.12.20 - AhnLab-V3 5.0.0.2 2009.12.19 - AntiVir 7.9.1.114 2009.12.18 - Antiy-AVL 2.0.3.7 2009.12.18 - Authentium 5.2.0.5 2009.12.02 - Avast 4.8.1351.0 2009.12.20 - AVG 8.5.0.427 2009.12.20 - BitDefender 7.2 2009.12.20 - CAT-QuickHeal 10.00 2009.12.19 - ClamAV 0.94.1 2009.12.20 - Comodo 3307 2009.12.20 - DrWeb 5.0.0.12182 2009.12.20 - eSafe 7.0.17.0 2009.12.16 - eTrust-Vet 35.1.7185 2009.12.19 - F-Prot 4.5.1.85 2009.12.19 - Fortinet 4.0.14.0 2009.12.20 - GData 19 2009.12.20 - Ikarus T3.1.1.79.0 2009.12.20 - K7AntiVirus 7.10.923 2009.12.17 - Kaspersky 7.0.0.125 2009.12.20 - McAfee 5837 2009.12.19 - McAfee+Artemis 5837 2009.12.19 - McAfee-GW-Edition 6.8.5 2009.12.20 - Microsoft 1.5302 2009.12.20 - NOD32 4702 2009.12.19 - Norman 6.04.03 2009.12.20 - nProtect 2009.1.8.0 2009.12.18 - Panda 10.0.2.2 2009.12.15 - PCTools 7.0.3.5 2009.12.20 - Prevx 3.0 2009.12.20 - Rising 22.26.06.04 2009.12.20 - Sophos 4.49.0 2009.12.20 - Sunbelt 3.2.1858.2 2009.12.19 - Symantec 1.4.4.12 2009.12.20 - TheHacker 6.5.0.2.100 2009.12.20 - TrendMicro 9.100.0.1001 2009.12.20 - VBA32 3.12.12.0 2009.12.19 - ViRobot 2009.12.18.2097 2009.12.18 - VirusBuster 5.0.21.0 2009.12.19 - Information additionnelle File size: 96512 bytes MD5...: 0b42f25da0ed67ac9425eed66d330259 SHA1..: 32776dd0dabfbe722be8ff80ce2e7fbef2f1b7f8 SHA256: eb8184e01e0d82ff93eb59fa685e78cadbb317ecc30ff72bc2a6a9705177e2c1 ssdeep: 1536:hwXpkfV74F1D7yNEZIHRRJMohmus27G1j/XBoDQi7oaRMJfYHFktprll1Kb<BR>DD0us:hQ+N74vkEZIxMohjsimBoDTRMBwFktZ+<BR> PEiD..: - PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x159f7<BR>timedatestamp.....: 0x4802539d (Sun Apr 13 18:40:29 2008)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 9 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x380 0x97ba 0x9800 6.45 0d7d81391f33c6450a81be1e3ac8c7b7<BR>NONPAGE 0x9b80 0x18e8 0x1900 6.48 c74a833abd81cc5d037de168e055ad29<BR>.rdata 0xb480 0xa64 0xa80 4.31 8523651899e28819a14bf9415af25708<BR>.data 0xbf00 0xd94 0xe00 0.45 3575b51634ae7a56f55f1ee0a6213834<BR>PAGESCAN 0xcd00 0x157f 0x1580 6.20 dc4c309c4db9576daa752fdd125fccf9<BR>PAGE 0xe280 0x61da 0x6200 6.46 40b83d4d552384e58a03517a98eb4863<BR>INIT 0x14480 0x22be 0x2300 6.47 906462abc478368424ea462d5868d2e3<BR>.rsrc 0x16780 0x3e0 0x400 0.91 3bc4ad6bcafc5bf3753cdda7967abd52<BR>.reloc 0x16b80 0xd20 0xd80 6.39 ce2b0898cc0e40b618e5df9099f6be45<BR><BR>( 3 imports ) <BR>> ntoskrnl.exe: RtlInitUnicodeString, swprintf, KeSetEvent, IoCreateSymbolicLink, IoGetConfigurationInformation, IoDeleteSymbolicLink, MmFreeMappingAddress, IoFreeErrorLogEntry, IoDisconnectInterrupt, MmUnmapIoSpace, ObReferenceObjectByPointer, IofCompleteRequest, RtlCompareUnicodeString, IofCallDriver, MmAllocateMappingAddress, IoAllocateErrorLogEntry, IoConnectInterrupt, IoDetachDevice, KeWaitForSingleObject, KeInitializeEvent, KeCancelTimer, RtlAnsiStringToUnicodeString, RtlInitAnsiString, IoBuildDeviceIoControlRequest, IoQueueWorkItem, MmMapIoSpace, IoInvalidateDeviceRelations, IoReportDetectedDevice, IoReportResourceForDetection, RtlxAnsiStringToUnicodeSize, NlsMbCodePageTag, PoRequestPowerIrp, KeInsertByKeyDeviceQueue, PoRegisterDeviceForIdleDetection, sprintf, MmMapLockedPagesSpecifyCache, ObfDereferenceObject, IoGetAttachedDeviceReference, IoInvalidateDeviceState, ZwClose, ObReferenceObjectByHandle, ZwCreateDirectoryObject, IoBuildSynchronousFsdRequest, PoStartNextPowerIrp, IoCreateDevice, RtlCopyUnicodeString, IoAllocateDriverObjectExtension, RtlQueryRegistryValues, ZwOpenKey, RtlFreeUnicodeString, IoStartTimer, KeInitializeTimer, IoInitializeTimer, KeInitializeDpc, KeInitializeSpinLock, IoInitializeIrp, ZwCreateKey, RtlAppendUnicodeStringToString, RtlIntegerToUnicodeString, ZwSetValueKey, KeInsertQueueDpc, KefAcquireSpinLockAtDpcLevel, IoStartPacket, KefReleaseSpinLockFromDpcLevel, IoBuildAsynchronousFsdRequest, IoFreeMdl, MmUnlockPages, IoWriteErrorLogEntry, KeRemoveByKeyDeviceQueue, MmMapLockedPagesWithReservedMapping, MmUnmapReservedMapping, KeSynchronizeExecution, IoStartNextPacket, KeBugCheckEx, KeRemoveDeviceQueue, KeSetTimer, _allmul, MmProbeAndLockPages, _except_handler3, PoSetPowerState, IoOpenDeviceRegistryKey, RtlWriteRegistryValue, RtlDeleteRegistryValue, _aulldiv, strstr, _strupr, KeQuerySystemTime, IoWMIRegistrationControl, KeTickCount, IoAttachDeviceToDeviceStack, IoDeleteDevice, ExAllocatePoolWithTag, IoAllocateWorkItem, IoAllocateIrp, IoAllocateMdl, MmBuildMdlForNonPagedPool, MmLockPagableDataSection, IoGetDriverObjectExtension, MmUnlockPagableImageSection, ExFreePoolWithTag, IoFreeIrp, IoFreeWorkItem, InitSafeBootMode, RtlCompareMemory, PoCallDriver, memmove, MmHighestUserAddress<BR>> HAL.dll: KfAcquireSpinLock, READ_PORT_UCHAR, KeGetCurrentIrql, KfRaiseIrql, KfLowerIrql, HalGetInterruptVector, HalTranslateBusAddress, KeStallExecutionProcessor, KfReleaseSpinLock, READ_PORT_BUFFER_USHORT, READ_PORT_USHORT, WRITE_PORT_BUFFER_USHORT, WRITE_PORT_UCHAR<BR>> WMILIB.SYS: WmiSystemControl, WmiCompleteRequest<BR><BR>( 0 exports ) <BR> RDS...: NSRL Reference Data Set<BR>- pdfid.: - sigcheck:<BR>publisher....: n/a<BR>copyright....: n/a<BR>product......: n/a<BR>description..: n/a<BR>original name: n/a<BR>internal name: n/a<BR>file version.: n/a<BR>comments.....: n/a<BR>signers......: -<BR>signing date.: -<BR>verified.....: Unsigned<BR> trid..: Win32 Executable Generic (68.0%)<BR>Generic Win/DOS Executable (15.9%)<BR>DOS Executable Generic (15.9%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) packers (Kaspersky): PE_Patch Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.43 2009.12.20 - AhnLab-V3 5.0.0.2 2009.12.19 - AntiVir 7.9.1.114 2009.12.18 - Antiy-AVL 2.0.3.7 2009.12.18 - Authentium 5.2.0.5 2009.12.02 - Avast 4.8.1351.0 2009.12.20 - AVG 8.5.0.427 2009.12.20 - BitDefender 7.2 2009.12.20 - CAT-QuickHeal 10.00 2009.12.19 - ClamAV 0.94.1 2009.12.20 - Comodo 3307 2009.12.20 - DrWeb 5.0.0.12182 2009.12.20 - eSafe 7.0.17.0 2009.12.16 - eTrust-Vet 35.1.7185 2009.12.19 - F-Prot 4.5.1.85 2009.12.19 - Fortinet 4.0.14.0 2009.12.20 - GData 19 2009.12.20 - Ikarus T3.1.1.79.0 2009.12.20 - K7AntiVirus 7.10.923 2009.12.17 - Kaspersky 7.0.0.125 2009.12.20 - McAfee 5837 2009.12.19 - McAfee+Artemis 5837 2009.12.19 - McAfee-GW-Edition 6.8.5 2009.12.20 - Microsoft 1.5302 2009.12.20 - NOD32 4702 2009.12.19 - Norman 6.04.03 2009.12.20 - nProtect 2009.1.8.0 2009.12.18 - Panda 10.0.2.2 2009.12.15 - PCTools 7.0.3.5 2009.12.20 - Prevx 3.0 2009.12.20 - Rising 22.26.06.04 2009.12.20 - Sophos 4.49.0 2009.12.20 - Sunbelt 3.2.1858.2 2009.12.19 - Symantec 1.4.4.12 2009.12.20 - TheHacker 6.5.0.2.100 2009.12.20 - TrendMicro 9.100.0.1001 2009.12.20 - VBA32 3.12.12.0 2009.12.19 - ViRobot 2009.12.18.2097 2009.12.18 - VirusBuster 5.0.21.0 2009.12.19 - Information additionnelle File size: 96512 bytes MD5...: 0b42f25da0ed67ac9425eed66d330259 SHA1..: 32776dd0dabfbe722be8ff80ce2e7fbef2f1b7f8 SHA256: eb8184e01e0d82ff93eb59fa685e78cadbb317ecc30ff72bc2a6a9705177e2c1 ssdeep: 1536:hwXpkfV74F1D7yNEZIHRRJMohmus27G1j/XBoDQi7oaRMJfYHFktprll1Kb<BR>DD0us:hQ+N74vkEZIxMohjsimBoDTRMBwFktZ+<BR> PEiD..: - PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x159f7<BR>timedatestamp.....: 0x4802539d (Sun Apr 13 18:40:29 2008)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 9 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x380 0x97ba 0x9800 6.45 0d7d81391f33c6450a81be1e3ac8c7b7<BR>NONPAGE 0x9b80 0x18e8 0x1900 6.48 c74a833abd81cc5d037de168e055ad29<BR>.rdata 0xb480 0xa64 0xa80 4.31 8523651899e28819a14bf9415af25708<BR>.data 0xbf00 0xd94 0xe00 0.45 3575b51634ae7a56f55f1ee0a6213834<BR>PAGESCAN 0xcd00 0x157f 0x1580 6.20 dc4c309c4db9576daa752fdd125fccf9<BR>PAGE 0xe280 0x61da 0x6200 6.46 40b83d4d552384e58a03517a98eb4863<BR>INIT 0x14480 0x22be 0x2300 6.47 906462abc478368424ea462d5868d2e3<BR>.rsrc 0x16780 0x3e0 0x400 0.91 3bc4ad6bcafc5bf3753cdda7967abd52<BR>.reloc 0x16b80 0xd20 0xd80 6.39 ce2b0898cc0e40b618e5df9099f6be45<BR><BR>( 3 imports ) <BR>> ntoskrnl.exe: RtlInitUnicodeString, swprintf, KeSetEvent, IoCreateSymbolicLink, IoGetConfigurationInformation, IoDeleteSymbolicLink, MmFreeMappingAddress, IoFreeErrorLogEntry, IoDisconnectInterrupt, MmUnmapIoSpace, ObReferenceObjectByPointer, IofCompleteRequest, RtlCompareUnicodeString, IofCallDriver, MmAllocateMappingAddress, IoAllocateErrorLogEntry, IoConnectInterrupt, IoDetachDevice, KeWaitForSingleObject, KeInitializeEvent, KeCancelTimer, RtlAnsiStringToUnicodeString, RtlInitAnsiString, IoBuildDeviceIoControlRequest, IoQueueWorkItem, MmMapIoSpace, IoInvalidateDeviceRelations, IoReportDetectedDevice, IoReportResourceForDetection, RtlxAnsiStringToUnicodeSize, NlsMbCodePageTag, PoRequestPowerIrp, KeInsertByKeyDeviceQueue, PoRegisterDeviceForIdleDetection, sprintf, MmMapLockedPagesSpecifyCache, ObfDereferenceObject, IoGetAttachedDeviceReference, IoInvalidateDeviceState, ZwClose, ObReferenceObjectByHandle, ZwCreateDirectoryObject, IoBuildSynchronousFsdRequest, PoStartNextPowerIrp, IoCreateDevice, RtlCopyUnicodeString, IoAllocateDriverObjectExtension, RtlQueryRegistryValues, ZwOpenKey, RtlFreeUnicodeString, IoStartTimer, KeInitializeTimer, IoInitializeTimer, KeInitializeDpc, KeInitializeSpinLock, IoInitializeIrp, ZwCreateKey, RtlAppendUnicodeStringToString, RtlIntegerToUnicodeString, ZwSetValueKey, KeInsertQueueDpc, KefAcquireSpinLockAtDpcLevel, IoStartPacket, KefReleaseSpinLockFromDpcLevel, IoBuildAsynchronousFsdRequest, IoFreeMdl, MmUnlockPages, IoWriteErrorLogEntry, KeRemoveByKeyDeviceQueue, MmMapLockedPagesWithReservedMapping, MmUnmapReservedMapping, KeSynchronizeExecution, IoStartNextPacket, KeBugCheckEx, KeRemoveDeviceQueue, KeSetTimer, _allmul, MmProbeAndLockPages, _except_handler3, PoSetPowerState, IoOpenDeviceRegistryKey, RtlWriteRegistryValue, RtlDeleteRegistryValue, _aulldiv, strstr, _strupr, KeQuerySystemTime, IoWMIRegistrationControl, KeTickCount, IoAttachDeviceToDeviceStack, IoDeleteDevice, ExAllocatePoolWithTag, IoAllocateWorkItem, IoAllocateIrp, IoAllocateMdl, MmBuildMdlForNonPagedPool, MmLockPagableDataSection, IoGetDriverObjectExtension, MmUnlockPagableImageSection, ExFreePoolWithTag, IoFreeIrp, IoFreeWorkItem, InitSafeBootMode, RtlCompareMemory, PoCallDriver, memmove, MmHighestUserAddress<BR>> HAL.dll: KfAcquireSpinLock, READ_PORT_UCHAR, KeGetCurrentIrql, KfRaiseIrql, KfLowerIrql, HalGetInterruptVector, HalTranslateBusAddress, KeStallExecutionProcessor, KfReleaseSpinLock, READ_PORT_BUFFER_USHORT, READ_PORT_USHORT, WRITE_PORT_BUFFER_USHORT, WRITE_PORT_UCHAR<BR>> WMILIB.SYS: WmiSystemControl, WmiCompleteRequest<BR><BR>( 0 exports ) <BR> RDS...: NSRL Reference Data Set<BR>- pdfid.: - sigcheck:<BR>publisher....: n/a<BR>copyright....: n/a<BR>product......: n/a<BR>description..: n/a<BR>original name: n/a<BR>internal name: n/a<BR>file version.: n/a<BR>comments.....: n/a<BR>signers......: -<BR>signing date.: -<BR>verified.....: Unsigned<BR> trid..: Win32 Executable Generic (68.0%)<BR>Generic Win/DOS Executable (15.9%)<BR>DOS Executable Generic (15.9%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) packers (Kaspersky): PE_Patch Celui de MBAM (aucun malware détecté): Malwarebytes' Anti-Malware 1.42 Version de la base de données: 3396 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 20/12/2009 12:52:17 mbam-log-2009-12-20 (12-52-17).txt Type de recherche: Examen complet (C:\|E:\|F:\|G:\|) Eléments examinés: 148676 Temps écoulé: 33 minute(s), 30 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 0 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): (Aucun élément nuisible détecté) Celui de look.bat: REGEDIT4 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi] "ErrorControl"=dword:00000001 "Group"="SCSI miniport" "Start"=dword:00000000 "Tag"=dword:00000019 "Type"=dword:00000001 "DisplayName"="Contrôleur de disque dur IDE/ESDI standard" "ImagePath"=hex(2):73,79,73,74,65,6d,33,32,5c,44,72,69,76,65,72,73,5c,74,73,6b,\ 5f,61,74,61,70,69,2e,73,79,73,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi\Parameters] "LegacyDetection"=dword:00000001 "GhostSlave"=hex(7):53,75,6e,44,69,73,6b,20,00,00 "UseCheckPowerForFlush"=hex(7):53,41,4d,53,55,4e,47,20,57,4e,52,2d,33,31,36,30,\ 31,41,20,28,31,36,30,30,4d,42,29,20,20,20,20,20,20,20,20,20,20,20,20,20,00,\ 53,41,4d,53,55,4e,47,20,57,4e,52,2d,33,31,36,30,31,41,20,28,31,2e,36,47,42,\ 29,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,49,42,4d,2d,44,54,43,41,2d,\ 32,34,30,39,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,54,43,36,4f,41,41,32,41,00,49,42,4d,2d,44,54,43,41,2d,32,\ 34,30,39,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,54,43,36,49,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,35,\ 31,32,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,50,4c,38,4f,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,35,31,\ 32,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,50,4c,38,49,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,35,31,32,\ 30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,50,4c,38,49,41,41,34,41,00,49,42,4d,2d,44,54,43,41,2d,32,33,32,34,30,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,54,43,35,4f,41,41,32,41,00,49,42,4d,2d,44,54,43,41,2d,32,33,32,34,30,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 54,43,35,49,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,34,34,38,30,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,50,\ 4c,37,4f,41,41,32,41,00,49,42,4d,2d,44,50,4c,41,2d,32,34,34,38,30,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,50,4c,\ 37,49,41,41,32,41,00,00 "NoFlushDevice"=hex(7):51,55,41,4e,54,55,4d,5f,4c,50,53,35,32,35,41,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,53,43,\ 52,2d,37,33,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,00,00 "PioOnlyDevice"=hex(7):20,20,20,20,43,6f,6e,6e,65,72,20,50,65,72,69,70,68,65,\ 72,61,6c,73,20,34,32,35,4d,42,20,2d,20,43,46,53,34,32,35,41,20,20,00,4d,41,\ 54,53,48,49,54,41,20,43,52,2d,35,38,31,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,00,46,58,36,30,30,53,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,00,43,44,2d,34,34,45,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,51,55,41,4e,\ 54,55,4d,20,54,52,42,38,35,30,41,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,00,51,55,41,4e,54,55,4d,20,4d,41,52,56,45,\ 52,49,43,4b,20,35,34,30,41,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,00,20,4d,41,58,54,4f,52,20,4d,58,54,2d,35,34,30,20,20,41,54,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,\ 20,37,31,32,36,30,20,41,54,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,38,35,30,20,41,56,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 00,4d,61,78,74,6f,72,20,37,35,34,30,20,41,56,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,\ 32,31,33,20,41,54,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,33,34,35,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,\ 61,78,74,6f,72,20,37,32,34,35,20,41,54,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,32,34,\ 35,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,00,4d,61,78,74,6f,72,20,37,32,31,31,41,55,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,4d,61,78,\ 74,6f,72,20,37,31,37,31,20,41,54,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,00,43,44,2d,33,31,36,45,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,00,53,41,4d,53,55,4e,47,5f,53,43,52,2d,32,34,33,30,00,43,52,2d,32,\ 38,30,31,54,45,00,00 "NonRemovableMedia"=hex(7):4b,69,6e,67,73,74,6f,6e,20,54,65,63,68,6e,6f,6c,6f,\ 67,79,20,44,61,74,61,50,61,6b,20,33,34,30,20,20,20,20,20,20,20,20,20,00,53,\ 75,6e,44,69,73,6b,20,53,44,50,35,41,2d,31,30,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,53,75,6e,44,69,73,6b,20,53,44,\ 43,46,42,2d,31,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,00,53,75,6e,44,69,73,6b,20,53,44,50,33,42,2d,32,30,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,53,75,6e,\ 44,69,73,6b,20,53,44,50,33,42,2d,31,37,35,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,00,53,75,6e,44,69,73,6b,20,53,44,50,35,\ 2d,32,2e,35,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,00,43,61,6c,6c,75,6e,61,20,54,65,63,68,6e,6f,6c,6f,67,79,20,43,54,\ 32,36,30,4d,43,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,42,4e,2d,53,30,\ 30,34,41,43,2d,53,20,31,2e,30,30,00,43,61,6c,6c,75,6e,61,20,54,65,63,68,6e,\ 6f,6c,6f,67,79,20,43,54,35,32,30,52,4d,00,48,69,74,61,63,68,69,20,43,56,20,\ 35,2e,31,2e,31,00,20,20,20,20,20,20,41,54,41,5f,46,4c,41,53,48,20,00,4d,69,\ 74,73,75,62,69,73,68,69,20,41,54,41,20,43,61,72,64,20,00,4c,45,58,41,52,20,\ 41,54,41,5f,46,4c,41,53,48,00,4d,69,63,72,6f,6e,20,4d,54,43,46,30,30,34,41,\ 00,4d,69,63,72,6f,6e,20,4d,54,43,46,30,30,38,41,00,53,75,6e,44,69,73,6b,20,\ 53,44,50,33,42,2d,31,31,30,00,53,75,6e,44,69,73,6b,20,53,44,43,46,42,2d,34,\ 00,42,4e,2d,43,41,42,2d,54,00,4d,45,4d,4f,52,59,53,54,49,43,4b,00,4d,45,4d,\ 4f,52,59,53,54,49,43,4b,20,20,20,38,4d,20,20,38,4b,00,00 "NoPowerDownDevice"=hex(7):52,44,2d,44,52,43,30,30,31,2d,4d,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,43,\ 53,2d,52,33,37,20,30,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,00,00 "AutoEjectZipDevice"=hex(7):49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,\ 20,20,20,20,20,41,54,41,50,49,20,20,20,20,20,20,20,20,20,20,20,20,20,32,33,\ 2e,44,20,20,20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,\ 20,20,20,20,41,54,41,50,49,20,20,20,20,20,20,20,20,20,20,20,20,20,32,31,2e,\ 44,20,20,20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,20,\ 20,20,20,41,54,41,50,49,20,20,20,20,20,20,20,20,20,20,20,20,20,32,30,2e,44,\ 20,20,20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,20,20,\ 20,20,41,54,41,50,49,20,20,20,20,20,20,20,20,20,20,20,20,20,39,31,2e,44,20,\ 20,20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,42,2e,32,39,20,20,\ 20,20,00,49,4f,4d,45,47,41,20,20,5a,49,50,20,31,30,30,20,20,20,20,20,20,20,\ 20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,20,42,2e,32,32,20,20,20,\ 20,00,00 "NeedIdentDevice"=hex(7):51,55,41,4e,54,55,4d,20,46,49,52,45,42,41,4c,4c,00,00 "DefaultPioAtapiDevice"=hex(7):54,4f,52,69,53,41,4e,20,44,56,44,2d,52,4f,4d,20,\ 44,52,44,2d,4e,32,31,36,00,49,44,45,2d,43,44,20,52,2f,52,57,20,32,78,32,78,\ 32,34,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi\Enum] "0"="PCIIDE\\IDEChannel\\4&33751483&0&0" "Count"=dword:00000002 "NextInstance"=dword:00000002 "1"="PCIIDE\\IDEChannel\\4&33751483&0&1" Encore merci de te pencher sur mon cas.
  10. pitixouxou
    Re, Après avoir suivi tes instructions, voici les deux rapports demandés: Celui de Tdsskiller: 16:8:44:556 2088 ForceUnloadDriver: NtUnloadDriver error 2 16:8:44:566 2088 ForceUnloadDriver: NtUnloadDriver error 2 16:8:44:566 2088 ForceUnloadDriver: NtUnloadDriver error 2 16:8:44:586 2088 main: Driver KLMD successfully dropped 16:8:44:776 2088 main: Driver KLMD successfully loaded 16:8:44:776 2088 Scanning Registry ... 16:8:44:776 2088 ScanServices: Searching service UACd.sys 16:8:44:776 2088 ScanServices: Open/Create key error 2 16:8:44:776 2088 ScanServices: Searching service TDSSserv.sys 16:8:44:776 2088 ScanServices: Open/Create key error 2 16:8:44:776 2088 ScanServices: Searching service gaopdxserv.sys 16:8:44:776 2088 ScanServices: Open/Create key error 2 16:8:44:776 2088 ScanServices: Searching service gxvxcserv.sys 16:8:44:776 2088 ScanServices: Open/Create key error 2 16:8:44:776 2088 ScanServices: Searching service MSIVXserv.sys 16:8:44:776 2088 ScanServices: Open/Create key error 2 16:8:44:786 2088 UnhookRegistry: Kernel module file name: C:\windows\system32\ntoskrnl.exe, base addr: 804D7000 16:8:44:816 2088 UnhookRegistry: Kernel local addr: E60000 16:8:44:836 2088 UnhookRegistry: KeServiceDescriptorTable addr: EE3220 16:8:44:926 2088 UnhookRegistry: KiServiceTable addr: E6B6A8 16:8:44:926 2088 UnhookRegistry: NtEnumerateKey service number (local): 47 16:8:44:926 2088 UnhookRegistry: NtEnumerateKey local addr: EFC5A4 16:8:44:946 2088 KLMD_OpenDevice: Trying to open KLMD device 16:8:44:946 2088 KLMD_GetSystemRoutineAddressA: Trying to get system routine address ZwEnumerateKey 16:8:44:946 2088 KLMD_GetSystemRoutineAddressW: Trying to get system routine address ZwEnumerateKey 16:8:44:946 2088 KLMD_ReadMem: Trying to ReadMemory 0x804DCC49[0x4] 16:8:44:946 2088 UnhookRegistry: NtEnumerateKey service number (kernel): 47 16:8:44:946 2088 KLMD_ReadMem: Trying to ReadMemory 0x804E27C4[0x4] 16:8:44:946 2088 UnhookRegistry: NtEnumerateKey real addr: 805735A4 16:8:44:946 2088 UnhookRegistry: NtEnumerateKey calc addr: 805735A4 16:8:44:946 2088 UnhookRegistry: No SDT hooks found on NtEnumerateKey 16:8:44:946 2088 KLMD_ReadMem: Trying to ReadMemory 0x805735A4[0xA] 16:8:44:946 2088 UnhookRegistry: No splicing found on NtEnumerateKey 16:8:44:946 2088 Scanning Kernel memory ... 16:8:44:946 2088 KLMD_OpenDevice: Trying to open KLMD device 16:8:44:946 2088 KLMD_GetSystemObjectAddressByNameA: Trying to get system object address by name \Driver\Disk 16:8:44:946 2088 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk 16:8:44:946 2088 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 8677FA08 16:8:44:946 2088 DetectCureTDL3: KLMD_GetDeviceObjectList returned 2 DevObjects 16:8:44:946 2088 DetectCureTDL3: 0 Curr stack PDEVICE_OBJECT: 8677DC68 16:8:44:946 2088 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8677DC68 16:8:44:956 2088 KLMD_ReadMem: Trying to ReadMemory 0x8677DC68[0x38] 16:8:44:956 2088 DetectCureTDL3: DRIVER_OBJECT addr: 8677FA08 16:8:44:956 2088 KLMD_ReadMem: Trying to ReadMemory 0x8677FA08[0xA8] 16:8:44:956 2088 KLMD_ReadMem: Trying to ReadMemory 0xE1011968[0x208] 16:8:44:956 2088 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 16:8:44:956 2088 DetectCureTDL3: IrpHandler (0) addr: F7894BB0 16:8:44:956 2088 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (2) addr: F7894BB0 16:8:44:956 2088 DetectCureTDL3: IrpHandler (3) addr: F788ED1F 16:8:44:956 2088 DetectCureTDL3: IrpHandler (4) addr: F788ED1F 16:8:44:956 2088 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (8 ) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (9) addr: F788F2E2 16:8:44:956 2088 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (14) addr: F788F3BB 16:8:44:956 2088 DetectCureTDL3: IrpHandler (15) addr: F7892F28 16:8:44:956 2088 DetectCureTDL3: IrpHandler (16) addr: F788F2E2 16:8:44:956 2088 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (22) addr: F7890C82 16:8:44:956 2088 DetectCureTDL3: IrpHandler (23) addr: F789599E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 16:8:44:956 2088 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 16:8:44:956 2088 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400] 16:8:44:956 2088 KLMD_ReadMem: DeviceIoControl error 1 16:8:44:956 2088 TDL3_StartIoHookDetect: Unable to get StartIo handler code 16:8:44:956 2088 TDL3_FileDetect: Processing driver: Disk 16:8:44:956 2088 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\tsk_disk.sys, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\tsk_disk.sys 16:8:44:956 2088 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys 16:8:44:956 2088 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys 16:8:44:996 2088 DetectCureTDL3: 1 Curr stack PDEVICE_OBJECT: 8677EAB8 16:8:44:996 2088 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8677EAB8 16:8:44:996 2088 DetectCureTDL3: 1 Curr stack PDEVICE_OBJECT: 8676B9E8 16:8:44:996 2088 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8676B9E8 16:8:44:996 2088 DetectCureTDL3: 1 Curr stack PDEVICE_OBJECT: 8676C940 16:8:44:996 2088 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8676C940 16:8:44:996 2088 KLMD_ReadMem: Trying to ReadMemory 0x8676C940[0x38] 16:8:45:6 2088 DetectCureTDL3: DRIVER_OBJECT addr: 867E3F38 16:8:45:6 2088 KLMD_ReadMem: Trying to ReadMemory 0x867E3F38[0xA8] 16:8:45:6 2088 KLMD_ReadMem: Trying to ReadMemory 0xE101D2E0[0x208] 16:8:45:6 2088 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi 16:8:45:6 2088 DetectCureTDL3: IrpHandler (0) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (1) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (2) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (3) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (4) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (5) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (6) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (7) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (8 ) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (9) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (10) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (11) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (12) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (13) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (14) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (15) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (16) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (17) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (18) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (19) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (20) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (21) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (22) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (23) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (24) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (25) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: IrpHandler (26) addr: F7781B3A 16:8:45:6 2088 DetectCureTDL3: All IRP handlers pointed to one addr: F7781B3A 16:8:45:6 2088 KLMD_ReadMem: Trying to ReadMemory 0xF7781B3A[0x400] 16:8:45:6 2088 TDL3_IrpHookDetect: TDL3 Stub signature found, trying to get hook true addr 16:8:45:6 2088 KLMD_ReadMem: Trying to ReadMemory 0xFFDF0308[0x4] 16:8:45:6 2088 KLMD_ReadMem: Trying to ReadMemory 0x867E390C[0x4] 16:8:45:6 2088 TDL3_IrpHookDetect: New IrpHandler addr: 86737F61 16:8:45:6 2088 KLMD_ReadMem: Trying to ReadMemory 0x86737F61[0x400] 16:8:45:6 2088 TDL3_IrpHookDetect: CheckParameters: 10, FFDF0308, 505, 134, 3, 120 16:8:45:6 2088 Driver "atapi" Irp handler infected by TDSS rootkit ... 16:8:45:6 2088 KLMD_WriteMem: Trying to WriteMemory 0x86737FE7[0xD] 16:8:45:6 2088 cured 16:8:45:6 2088 KLMD_ReadMem: Trying to ReadMemory 0xF777F864[0x400] 16:8:45:6 2088 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 316, 0 16:8:45:6 2088 TDL3_FileDetect: Processing driver: atapi 16:8:45:6 2088 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\atapi.sys, C:\WINDOWS\system32\Drivers\tsk_atapi.sys, SYSTEM\CurrentControlSet\Services\atapi, system32\Drivers\tsk_atapi.sys 16:8:45:6 2088 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\atapi.sys 16:8:45:6 2088 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\atapi.sys 16:8:45:36 2088 File C:\WINDOWS\system32\drivers\atapi.sys infected by TDSS rootkit ... 16:8:45:36 2088 TDL3_FileCure: Processing driver file: C:\WINDOWS\system32\drivers\atapi.sys 16:8:45:36 2088 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\atapi.sys 16:8:45:66 2088 TDL3_FileCure: Dumping cured buffer to file C:\WINDOWS\system32\Drivers\tsk_atapi.sys 16:8:45:127 2088 TDL3_FileCure: Image path (system32\Drivers\tsk_atapi.sys) was set for service (SYSTEM\CurrentControlSet\Services\atapi) 16:8:45:127 2088 TDL3_FileCure: KLMD_PendCopyFileW (C:\WINDOWS\system32\Drivers\tsk_atapi.sys, C:\WINDOWS\system32\drivers\atapi.sys) success 16:8:45:127 2088 will be cured on next reboot 16:8:45:127 2088 Completed Results: 16:8:45:127 2088 Infected objects in memory: 1 16:8:45:127 2088 Cured objects in memory: 1 16:8:45:127 2088 Infected objects on disk: 1 16:8:45:147 2088 Objects on disk cured on reboot: 1 16:8:45:147 2088 Objects on disk deleted on reboot: 0 16:8:45:147 2088 Registry nodes deleted on reboot: 0 16:8:45:147 2088 Celui de Combofix: ComboFix 09-12-18.03 - Fujitsu 19/12/2009 16:28:26.1.1 - x86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1023.572 [GMT 1:00] Lancé depuis: c:\documents and settings\Fujitsu\Bureau\KittyFix.exe AV: Bitdefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB} FW: Bitdefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242} . ADS - WINDOWS: deleted 24 bytes in 1 streams. (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\documents and settings\Fujitsu\Application Data\Desktopicon c:\documents and settings\Fujitsu\autorun.inf c:\windows\system32\qtplugin.exe c:\windows\system32\sshnas.dll c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job ----- BITS: Il y a peut-être des sites infectés ----- hxxp://premium.virginmega.fr . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SSHNAS -------\Service_SSHNAS ((((((((((((((((((((((((((((( Fichiers créés du 2009-11-19 au 2009-12-19 )))))))))))))))))))))))))))))))))))) . 2009-12-19 15:08 . 2009-12-19 15:08 96512 ----a-w- c:\windows\system32\drivers\tsk_atapi.sys 2009-12-19 15:08 . 2009-12-19 15:08 16904 ----a-w- c:\windows\system32\drivers\KLMD.sys 2009-12-19 15:08 . 2009-12-19 15:08 -------- d-----w- C:\tdsskiller 2009-12-19 14:01 . 2009-12-19 14:01 -------- d-----w- c:\program files\WOT 2009-12-19 13:29 . 2009-12-19 13:30 -------- d-----w- c:\program files\trend micro 2009-12-19 13:29 . 2009-12-19 13:30 -------- d-----w- C:\rsit 2009-12-19 08:58 . 2009-12-19 08:58 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help 2009-12-18 10:57 . 2009-12-19 15:36 81984 ----a-w- c:\windows\system32\bdod.bin 2009-12-18 10:45 . 2009-12-18 10:45 -------- d-----w- c:\documents and settings\LocalService\Menu Démarrer 2009-12-18 10:22 . 2009-12-18 10:22 -------- d-----w- c:\documents and settings\Fujitsu\Application Data\BitDefender 2009-12-18 10:20 . 2009-12-18 10:20 -------- d-----w- c:\program files\BitDefender 2009-12-18 10:20 . 2009-12-19 15:38 -------- d-----w- c:\program files\BitDefender 2008 2009-12-18 10:20 . 2009-12-18 10:43 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender 2009-12-18 10:16 . 2009-12-18 10:20 -------- d-----w- c:\program files\Fichiers communs\BitDefender 2009-12-18 09:47 . 2006-10-26 18:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll 2009-12-18 09:47 . 2006-10-26 18:56 32592 ----a-w- c:\windows\system32\msonpmon.dll 2009-12-18 09:46 . 2009-12-18 09:46 -------- d-----w- c:\program files\Microsoft Works 2009-12-18 09:44 . 2009-12-18 09:44 -------- d-----w- c:\program files\Microsoft.NET 2009-12-18 09:39 . 2009-12-18 09:40 -------- d-----w- c:\windows\SHELLNEW 2009-12-18 09:39 . 2009-12-18 09:39 -------- d-----w- c:\documents and settings\Fujitsu\Local Settings\Application Data\Microsoft Help 2009-12-18 09:38 . 2009-12-19 08:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-12-18 09:38 . 2009-12-18 09:38 -------- d-----r- C:\MSOCache 2009-12-18 09:17 . 2001-08-23 16:47 5632 ----a-w- c:\windows\system32\ptpusb.dll 2009-12-18 09:17 . 2008-04-13 18:45 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys 2009-12-18 09:17 . 2008-04-13 18:45 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys 2009-12-18 09:17 . 2008-04-14 02:33 159232 ----a-w- c:\windows\system32\ptpusd.dll 2009-12-17 21:51 . 2009-12-17 21:51 -------- d-----w- c:\documents and settings\All Users\Application Data\F-Secure 2009-12-17 17:37 . 2009-12-17 17:37 -------- d-----w- c:\windows\Sun 2009-12-16 21:36 . 2009-12-16 21:36 -------- d-sh--w- c:\windows\system32\config\systemprofile\IECompatCache 2009-12-16 21:34 . 2009-12-16 21:34 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-12-19 15:11 . 2004-08-05 12:00 96512 ----a-w- c:\windows\system32\drivers\atapi.sys 2009-12-19 14:27 . 2009-09-28 15:59 -------- d-----w- c:\program files\CCleaner 2009-12-18 10:39 . 2007-11-12 15:27 86792 ----a-w- c:\windows\system32\drivers\bdfndisf.sys 2009-12-18 10:04 . 2009-11-03 15:00 -------- d-----w- c:\documents and settings\Fujitsu\Application Data\Skype 2009-12-18 10:01 . 2009-11-03 14:59 -------- d-----r- c:\program files\Skype 2009-12-18 10:00 . 2009-09-28 15:45 28272 ----a-w- c:\documents and settings\Fujitsu\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-12-18 10:00 . 2009-10-28 10:39 -------- d-----w- c:\program files\SlySoft 2009-12-10 18:34 . 2009-09-28 08:39 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2009-12-10 02:22 . 2004-08-05 12:00 64052 ----a-w- c:\windows\system32\perfc00C.dat 2009-12-10 02:22 . 2004-08-05 12:00 445672 ----a-w- c:\windows\system32\perfh00C.dat 2009-11-03 15:04 . 2009-11-03 15:04 48 ---ha-w- c:\windows\system32\ezsidmv.dat 2009-11-03 15:04 . 2009-11-03 15:04 -------- d-----w- c:\documents and settings\Fujitsu\Application Data\skypePM 2009-11-03 14:59 . 2009-11-03 14:59 -------- d-----w- c:\program files\Fichiers communs\Skype 2009-11-03 14:59 . 2009-11-03 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2009-11-02 11:51 . 2009-10-01 17:56 -------- d-----w- c:\program files\Fichiers communs\Adobe 2009-10-29 07:42 . 2004-08-05 12:00 916480 ----a-w- c:\windows\system32\wininet.dll 2009-10-27 10:00 . 2009-10-27 10:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira 2009-10-21 05:39 . 2004-08-05 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll 2009-10-21 05:39 . 2004-08-05 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll 2009-10-20 16:20 . 2004-08-05 12:00 265728 ----a-w- c:\windows\system32\drivers\http.sys 2009-10-13 10:33 . 2004-08-05 12:00 271360 ----a-w- c:\windows\system32\oakley.dll 2009-10-12 13:39 . 2004-08-05 12:00 79872 ----a-w- c:\windows\system32\raschap.dll 2009-10-12 13:39 . 2004-08-05 12:00 150528 ----a-w- c:\windows\system32\rastls.dll 2009-09-29 20:29 . 2009-09-29 20:29 1961720 ----a-w- c:\documents and settings\Fujitsu\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe 2009-09-28 07:50 . 2009-09-28 07:50 21892 ----a-w- c:\windows\system32\emptyregdb.dat . ------- Sigcheck ------- [-] 2009-12-19 15:11 . 0B42F25DA0ED67AC9425EED66D330259 . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys [7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys [7] 2004-08-05 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys [7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_05\bin\jusched.exe" [2009-09-28 32881] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-10 339968] "ORAHSSSessionManager"="c:\program files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696] "Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288] "BitDefender Antiphishing Helper"="c:\program files\BitDefender 2008\IEShow.exe" [2007-10-09 61440] "BDAgent"="c:\program files\BitDefender 2008\bdagent.exe" [2009-12-18 368640] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] 2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\UrbanTerror\\ioUrbanTerror.exe"= "c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [12/11/2007 16:27 86792] R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [28/09/2009 13:43 191092] R3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [28/09/2009 13:43 6100] S3 P1171VID;Creative WebCam Notebook #2;c:\windows\system32\drivers\P1171Vid.sys [17/10/2009 21:56 91392] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bdx REG_MULTI_SZ scan . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000 Trusted Zone: mappy.com Trusted Zone: orange.fr Trusted Zone: voila.fr\rw.search.ke Trusted Zone: weborama.fr\orange . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-RegistryMonitor1 - c:\windows\system32\qtplugin.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-12-19 16:37 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bdfsfltr] "ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\ [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bdfsfltr] "ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\ . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6a,53,fd,81,a8,b4,71,42,aa,b6,cd,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6a,53,fd,81,a8,b4,71,42,aa,b6,cd,\ . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(1088) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(3140) c:\progra~1\WINDOW~2\wmpband.dll c:\windows\system32\eappprxy.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe c:\windows\system32\wscntfy.exe c:\program files\OrangeHSS\Launcher\Launcher.exe . ************************************************************************** . Heure de fin: 2009-12-19 16:42:31 - La machine a redémarré ComboFix-quarantined-files.txt 2009-12-19 15:42 Avant-CF: 48 334 151 680 octets libres Après-CF: 48 741 859 328 octets libres WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect - - End Of File - - E2872FADD6DF3972DCF79A8DEC2CAE67 Dans le premier rapport, les espaces entre les 8 et les ) viennent de moi (sinon les émoticones apparaissent). Voili voilou
  11. pitixouxou
    Bonjour Gof, Merci pour cet accueil. J'ai pris connaissance des différentes informations que tu m'as transmises. J'ai scanné avec RSIT, voilà les résultats: log.txt: Logfile of random's system information tool 1.06 (written by random/random) Run by Fujitsu at 2009-12-19 14:29:49 Microsoft Windows XP Édition familiale Service Pack 3 System drive C: has 46 GB (60%) free of 76 GB Total RAM: 1023 MB (56% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:30:37, on 19/12/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe C:\Program Files\BitDefender 2008\vsserv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\BitDefender 2008\bdagent.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\OrangeHSS\Launcher\Launcher.exe C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe C:\Program Files\OrangeHSS\systray\systrayapp.exe C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe C:\WINDOWS\TEMP\mpvu.tmp C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Fujitsu\Bureau\RSIT.exe C:\Program Files\trend micro\Fujitsu.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.ke.voila.fr/S/voila?kw= R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file) O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender 2008\IEToolbar.dll O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [RegistryMonitor1] C:\WINDOWS\system32\qtplugin.exe O4 - HKLM\..\Run: [bitDefender Antiphishing Helper] "C:\Program Files\BitDefender 2008\IEShow.exe" O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\BitDefender 2008\bdagent.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [RegistryMonitor1] "C:\WINDOWS\system32\qtplugin.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://*.mappy.com O15 - Trusted Zone: http://*.orange.fr O15 - Trusted Zone: http://rw.search.ke.voila.fr O15 - Trusted Zone: http://orange.weborama.fr O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1254169968380 O16 - DPF: {6EBC6744-5383-4213-AD5E-66434ECA1812} (F-Secure Online Scanner Launcher) - http://download.sp.f-secure.com/ols/nordne.../fslauncher.cab O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0...oUploader55.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender 2008\vsserv.exe O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe -- End of file - 7382 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job C:\WINDOWS\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender 2008\IEToolbar.dll [2009-12-18 86016] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"=C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe [2009-09-28 32881] "ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-06-10 339968] "ORAHSSSessionManager"=C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe [2007-12-12 107248] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696] "Adobe ARM"=C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288] "RegistryMonitor1"=C:\WINDOWS\system32\qtplugin.exe [2009-12-15 489984] "BitDefender Antiphishing Helper"=C:\Program Files\BitDefender 2008\IEShow.exe [2007-10-09 61440] "BDAgent"=C:\Program Files\BitDefender 2008\bdagent.exe [2009-12-18 368640] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] "RegistryMonitor1"=C:\WINDOWS\system32\qtplugin.exe [2009-12-15 489984] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] C:\WINDOWS\system32\Ati2evxx.dll [2004-06-09 86016] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "HonorAutoRunSetting"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe"="C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Program Files\UrbanTerror\ioUrbanTerror.exe"="C:\Program Files\UrbanTerror\ioUrbanTerror.exe:*:Enabled:ioUrbanTerror" "C:\Program Files\Microsoft Games\Age of Empires III\age3.exe"="C:\Program Files\Microsoft Games\Age of Empires III\age3.exe:*:Enabled:Age of Empires III" "C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager" "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f87b405-ac05-11de-ab34-00030d1e9034}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RIUoM.eXE ======List of files/folders created in the last 1 months====== 2009-12-19 14:29:52 ----D---- C:\Program Files\trend micro 2009-12-19 14:29:49 ----D---- C:\rsit 2009-12-18 11:25:38 ----A---- C:\WINDOWS\bdagent.INI 2009-12-18 11:22:26 ----D---- C:\Documents and Settings\Fujitsu\Application Data\BitDefender 2009-12-18 11:20:40 ----D---- C:\Program Files\BitDefender 2009-12-18 11:20:19 ----D---- C:\Program Files\BitDefender 2008 2009-12-18 11:20:19 ----D---- C:\Documents and Settings\All Users\Application Data\BitDefender 2009-12-18 11:16:58 ----D---- C:\Program Files\Fichiers communs\BitDefender 2009-12-18 10:47:22 ----A---- C:\WINDOWS\system32\msonpmon.dll 2009-12-18 10:46:11 ----D---- C:\Program Files\Microsoft Works 2009-12-18 10:45:24 ----D---- C:\Program Files\Fichiers communs\DESIGNER 2009-12-18 10:44:26 ----D---- C:\Program Files\Microsoft.NET 2009-12-18 10:39:40 ----D---- C:\WINDOWS\SHELLNEW 2009-12-18 10:39:00 ----D---- C:\Program Files\Microsoft Office 2009-12-18 10:38:59 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2009-12-18 10:38:22 ----RHD---- C:\MSOCache 2009-12-18 10:17:50 ----A---- C:\WINDOWS\system32\ptpusb.dll 2009-12-18 10:17:46 ----A---- C:\WINDOWS\system32\ptpusd.dll 2009-12-17 22:51:15 ----D---- C:\Documents and Settings\All Users\Application Data\F-Secure 2009-12-17 18:37:53 ----D---- C:\WINDOWS\Sun 2009-12-16 22:04:25 ----N---- C:\WINDOWS\system32\sshnas.dll 2009-12-15 00:54:21 ----A---- C:\WINDOWS\system32\qtplugin.exe 2009-12-10 03:04:30 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$ 2009-12-10 03:04:18 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$ 2009-12-10 03:03:30 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$ 2009-12-10 03:03:21 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$ 2009-12-10 03:03:09 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$ 2009-11-24 23:07:20 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$ 2009-11-24 23:07:09 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$ ======List of files/folders modified in the last 1 months====== 2009-12-19 14:29:57 ----D---- C:\WINDOWS\Temp 2009-12-19 14:29:55 ----D---- C:\WINDOWS\Prefetch 2009-12-19 14:29:52 ----RD---- C:\Program Files 2009-12-19 14:29:03 ----SD---- C:\Documents and Settings\Fujitsu\Application Data\Microsoft 2009-12-19 13:49:42 ----D---- C:\WINDOWS\system32 2009-12-19 09:59:49 ----SHD---- C:\WINDOWS\Installer 2009-12-19 09:56:22 ----AD---- C:\WINDOWS 2009-12-18 14:06:35 ----A---- C:\WINDOWS\ModemLog_Smart Link 56K Modem.txt 2009-12-18 14:03:42 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-12-18 14:03:40 ----D---- C:\WINDOWS\system32\CatRoot2 2009-12-18 11:54:15 ----D---- C:\WINDOWS\system32\drivers 2009-12-18 11:21:49 ----HD---- C:\WINDOWS\inf 2009-12-18 11:20:52 ----D---- C:\WINDOWS\WinSxS 2009-12-18 11:16:58 ----D---- C:\Program Files\Fichiers communs 2009-12-18 11:04:45 ----D---- C:\Documents and Settings\Fujitsu\Application Data\Skype 2009-12-18 11:01:48 ----RD---- C:\Program Files\Skype 2009-12-18 11:00:31 ----D---- C:\Program Files\SlySoft 2009-12-18 10:46:54 ----D---- C:\WINDOWS\system32\config 2009-12-18 10:46:05 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared 2009-12-18 10:44:53 ----RSD---- C:\WINDOWS\Fonts 2009-12-18 10:44:26 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft 2009-12-18 10:18:00 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-12-17 22:39:51 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-12-16 23:28:26 ----SD---- C:\WINDOWS\Tasks 2009-12-10 22:50:02 ----D---- C:\WINDOWS\Debug 2009-12-10 03:22:22 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-12-10 03:04:04 ----D---- C:\Program Files\Internet Explorer 2009-12-10 03:03:41 ----HD---- C:\WINDOWS\$hf_mig$ 2009-12-01 21:06:19 ----A---- C:\WINDOWS\system32\MRT.exe ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 bdftdif;bdftdif; \??\C:\Program Files\Fichiers communs\BitDefender\BitDefender Firewall\bdftdif.sys [] R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576] R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800] R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2004-06-09 746496] R3 Bdfndisf;BitDefender Firewall NDIS Filter Service; C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2009-12-18 86792] R3 bdfsfltr;bdfsfltr; 730079007300740065006D00330032005C0044005200490056004500520053005C00620064006600 730066006C00740072002E007300790073000000 [] R3 BDSelfPr;BDSelfPr; \??\C:\Program Files\BitDefender 2008\bdselfpr.sys [] R3 CmBatt;Pilote d'adaptateur secteur Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952] R3 CONAN;CONAN; C:\WINDOWS\system32\drivers\o2mmb.sys [2004-02-12 191092] R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] R3 MbxStby;MbxStby; C:\WINDOWS\system32\drivers\MbxStby.sys [2004-01-27 6100] R3 MODEMCSA;Périphérique de filtrage de flux Unimodem; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128] R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288] R3 Mtlmnt5;Mtlmnt5; C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys [2004-04-18 230656] R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824] R3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS [] R3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992] R3 Slntamr;SmartLink AMR_PCI Driver; C:\WINDOWS\system32\DRIVERS\slntamr.sys [2004-04-18 635152] R3 SlWdmSup;SlWdmSup; C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys [2004-04-18 13312] R3 Trufos;Trufos; \??\C:\Program Files\Fichiers communs\BitDefender\BitDefender Threat Scanner\trufos.sys [] R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608] R3 VIAudio;Vinyl AC'97 Audio Controller (WDM); C:\WINDOWS\system32\drivers\vinyl97.sys [2004-07-23 159488] R3 w29n51;Pilote de carte de connexion réseau Intel® PRO/Wireless 2200BG pour Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2005-09-11 3298432] S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720] S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-07-09 16384] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2002-12-11 5504] S3 Mtlstrm;Mtlstrm; C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys [2004-04-18 1301488] S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-07-09 83968] S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-07-09 10112] S3 NtMtlFax;NtMtlFax; C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys [2004-04-18 180664] S3 P1171VID;Creative WebCam Notebook #2; C:\WINDOWS\system32\DRIVERS\P1171Vid.sys [2004-03-19 91392] S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCAMPR5.SYS [] S3 Profos;Profos; \??\C:\Program Files\Fichiers communs\BitDefender\BitDefender Threat Scanner\profos.sys [] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-07-09 10880] S3 SlNtHal;SlNtHal; C:\WINDOWS\system32\DRIVERS\Slnthal.sys [2004-04-18 95760] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-07-09 14976] S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104] S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528] S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-07-09 18688] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2004-06-09 376832] R2 FTRTSVC;France Telecom Routing Table Service; C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [2007-12-11 65536] R2 LIVESRV;BitDefender Desktop Update Service; C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe [2009-12-18 1179648] R2 SLService;SmartLinkService; C:\WINDOWS\system32\slserv.exe [2004-04-18 45056] R2 SSHNAS;SSHNAS; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] R2 VSSERV;BitDefender Virus Shield; C:\Program Files\BitDefender 2008\vsserv.exe [2009-12-18 1261568] R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] R2 XCOMM;BitDefender Communicator; C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe [2007-11-27 86016] R3 scan;BitDefender Threat Scanner; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336] S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136] S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016] -----------------EOF----------------- info.txt: info.txt logfile of random's system information tool 1.06 2009-12-19 14:30:44 ======Uninstall list====== -->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CA9EC1C6-3B51-11D6-B1A9-BCD2747AA951}\setup.exe" -l0x40c -->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D43F13A1-1E39-4BD4-9682-DF889FE75421}\setup.exe" -l0x40c -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Reader 9.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A92000000001} Age of Empires III-->C:\Program Files\InstallShield Installation Information\{70F8B183-99EB-4304-BA35-080E2DFFD2A3}\install.exe -runfromtemp -l0x040c ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe ATI Control Panel-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe" ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe" Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE BitDefender Total Security 2008-->MsiExec.exe /I{C33A19F0-A3D8-45B4-B067-251D2DBABB1A} CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe" Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe" Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe" Correctif pour Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe" Correctif pour Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe" Creative PC-CAM Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D43F13A1-1E39-4BD4-9682-DF889FE75421}\setup.exe" -l0x40c /remove Creative WebCam Monitor-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CA9EC1C6-3B51-11D6-B1A9-BCD2747AA951}\setup.exe" -l0x40c /remove Creative WebCam Notebook Driver (1.04.01.0322)-->C:\WINDOWS\CtDrvIns.exe -uninstall -script Pd1171.uns -unsext NT -plugin P1171Pin.dll -pluginres P1171Pin.crl HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" Indiana Jones and the Emperors Tomb-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0DBF3265-57F1-4D8A-87EA-332B2A669BDE}\Setup.exe" -l0x40c Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31} Java 2 Runtime Environment, SE v1.4.2_05-->MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142050} K-Lite Codec Pack 3.9.0 Full-->"C:\Program Files\K-Lite Codec Pack\unins000.exe" Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall Manuel d'utilisation de Creative WebCam Notebook (Français)-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Creative WebCam Notebook\Manuel d'utilisation de Creative WebCam Notebook\French\CTManual.isu" Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700} Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp" Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570} Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe" Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe" Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE} Microsoft Office Home and Student 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE} Microsoft Office OneNote MUI (French) 2007-->MsiExec.exe /X{90120000-00A1-040C-0000-0000000FF1CE} Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE} Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE} Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE} Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE} Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE} Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE} Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE} Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE} Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE} Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE} Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C} Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475} Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe" Mise à jour de sécurité pour Lecteur Windows Media (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe" Mise à jour de sécurité pour Lecteur Windows Media (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe" Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe" Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9L$\spuninst\spuninst.exe" Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 7 (KB972260)-->"C:\WINDOWS\ie7updates\KB972260-IE7\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 8 (KB972260)-->"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 8 (KB974455)-->"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows Internet Explorer 8 (KB976325)-->"C:\WINDOWS\ie8updates\KB976325-IE8\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe" Mise à jour de sécurité pour Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe" Mise à jour pour Windows Internet Explorer 8 (KB973874)-->"C:\WINDOWS\ie8updates\KB973874-IE8\spuninst\spuninst.exe" Mise à jour pour Windows Internet Explorer 8 (KB976749)-->"C:\WINDOWS\ie8updates\KB976749-IE8\spuninst\spuninst.exe" Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe" Mise à jour pour Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe" Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe" Mise à jour pour Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe" Mise à jour pour Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe" Mise à jour pour Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe" Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe" MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94} MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71} MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC} O2Micro MemoryCardBus Windows Driver-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{015D937D-9D52-45A4-BDAA-2413938C0564} /l1033 Orange - Logiciels Internet-->C:\Program Files\OrangeHSS\installation\core\Installgui.exe -u Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85} Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7} Security Update for 2007 Microsoft Office System (KB960003)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {F04F8702-18D0-458D-921E-146FB7CD38CF} Security Update for Microsoft Office Excel 2007 (KB959997)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {9EAC3AEC-5C81-4856-A05B-DE9DC236D740} Security Update for Microsoft Office OneNote 2007 (KB950130)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {F1B2401C-B610-4BF2-AA1C-52C55827A8F4} Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77} Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F} Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC} Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C} Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7} Skype™ 4.1-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36} Smart Link 56K Modem-->C:\WINDOWS\Modio\SLAMR2KV\Setup.exe /Remove Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004} Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D} Update for Office 2007 (KB934391)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {B3091818-7C56-4C45-BE7D-CA23027A5EA5} Urban Terror 4.1-->"C:\Program Files\UrbanTerror\unins000.exe" VDownloader 1.1-->"C:\Program Files\VDownloader\unins000.exe" VIA Audio Driver Setup Program-->RunDll32.exe UnAudioNT.dll,UninstallAudio C:\WINDOWS\IsUninst.exe -y-f"C:\PROGRA~1\VIAudioi\SBASetup\Uninst.isu" Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41} Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52} Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1} Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe" Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe" ======Security center information====== AV: Bitdefender Antivirus FW: Bitdefender Firewall ======System event log====== Computer Name: MAXIME Event Code: 7036 Message: Le service Service de la passerelle de la couche Application est entré dans l'état : en cours d'exécution. Record Number: 3716 Source Name: Service Control Manager Time Written: 20091101175842.000000+060 Event Type: Informations User: Computer Name: MAXIME Event Code: 7035 Message: Un contrôle Démarrer a correctement été envoyé au service Service de la passerelle de la couche Application. Record Number: 3715 Source Name: Service Control Manager Time Written: 20091101175842.000000+060 Event Type: Informations User: AUTORITE NT\SYSTEM Computer Name: MAXIME Event Code: 7036 Message: Le service NLA (Network Location Awareness) est entré dans l'état : en cours d'exécution. Record Number: 3714 Source Name: Service Control Manager Time Written: 20091101175840.000000+060 Event Type: Informations User: Computer Name: MAXIME Event Code: 7035 Message: Un contrôle Démarrer a correctement été envoyé au service NLA (Network Location Awareness). Record Number: 3713 Source Name: Service Control Manager Time Written: 20091101175840.000000+060 Event Type: Informations User: AUTORITE NT\SYSTEM Computer Name: MAXIME Event Code: 7036 Message: Le service Compatibilité avec le Changement rapide d'utilisateur est entré dans l'état : en cours d'exécution. Record Number: 3712 Source Name: Service Control Manager Time Written: 20091101175840.000000+060 Event Type: Informations User: =====Application event log===== Computer Name: PORTABLE Event Code: 4113 Message: Record Number: 2651 Source Name: Avira AntiVir Time Written: 20091212005801.000000+060 Event Type: Avertissement User: AUTORITE NT\SYSTEM Computer Name: PORTABLE Event Code: 4113 Message: Record Number: 2650 Source Name: Avira AntiVir Time Written: 20091212005300.000000+060 Event Type: Avertissement User: AUTORITE NT\SYSTEM Computer Name: PORTABLE Event Code: 4113 Message: Record Number: 2649 Source Name: Avira AntiVir Time Written: 20091212004758.000000+060 Event Type: Avertissement User: AUTORITE NT\SYSTEM Computer Name: PORTABLE Event Code: 4113 Message: Record Number: 2648 Source Name: Avira AntiVir Time Written: 20091212004257.000000+060 Event Type: Avertissement User: AUTORITE NT\SYSTEM Computer Name: PORTABLE Event Code: 4113 Message: Record Number: 2647 Source Name: Avira AntiVir Time Written: 20091212003756.000000+060 Event Type: Avertissement User: AUTORITE NT\SYSTEM ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel "windir"=%SystemRoot% "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "PROCESSOR_ARCHITECTURE"=x86 "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 6, GenuineIntel "PROCESSOR_REVISION"=0d06 "NUMBER_OF_PROCESSORS"=1 "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP -----------------EOF----------------- Merci pour ton aide
  12. pitixouxou
    Bonjour, Merci Gof pour cette aide précieuse aux débutants (tel que moi). Juste une remarque, je ne suis pas sûr mais n'y a-t-il pas une petite confusion entre deux images (la dernière de la 1ère méthode et la première de la 2ème méthode)? Merci
  13. pitixouxou
    Bien le bonsoir. Je suis tout nouveau et viens de m'inscrire car j'ai un sérieux problème d'infection. Cela fait un moment que le fichier tdlcmd.dll est infecté par un malware, et aucun moyen de m'en débarrasser! J'ai beau le supprimer avec Avira, MBAM ou Bit Defender, il revient sans cesse. De plus, lorsque je surfe sur Internet je suis souvent redirigé vers d'autres pages, que je ne voulais pas consulter. Je pense que les deux sont liés, mais sans certitude. J'ai trouvé sur le forum un sujet où quelqu'un avait le même problème, mais la procédure pour la désinfection ne s'appliquait qu'à cet utilisateur. Serait-il possible d'avoir de l'aide afin de m'en débarrasser également? Si il y a des manipulations à faire pas de soucis, mais il faut juste bien m'expliquer et détailler, ne voulant pas me planter Merci, et bonne soirée.
×
×
  • Créer...