Virus (ou malware) A360

youyous · le 18 février 2009

Bonjour,

Je suis nouveau sur le site ainsi que sur le forum que je ne connaissais pas.

Je souhaite savoir si quelqu'un pourrait m'aider à me débarasser du virus (ou quelle que soit son appellation) dénommé A360.

J'ai réussi (apparement) à me débarrasser du programme (.exe) ainsi que de l'icone dans la barre des taches et du raccourci sur le bureau.

Ainsi, il ne m'interromp plus par exemple lorsque je regarde une vidéo, comme auparavant en me demandant toutes les deux minutes si je savais que j'étais infecté et si je souhaitais continuer à le rester "" (le comble !)

Par contre, ma joie fut de courte durée lorsque je m'apperçus qu'il bloque et me renvoi à de nombreuses reprises sur une page d'erreur internet, qui porte le logo de malheur A360. Il m'affiche aussi de nombreux "Tips Google". J'utilise gmail comme messagerie et il m'ajoute de nombreux bandeaux en haut de ma messagerie, ce qui réduit la visibilité de ma fenêtre de message.

J'ai vu que d'autres personnes ont eu le mm souci, j'ai donc fait ce qui était conseillé auparavant, à savoir télécharger deux logiciels et en installer les fichiers au format blocs-notes sur ce forum.

Les voicis donc (j'ajoute aussi celui de hijackthis que j'avais fait auparavant au cas ou cela servirais) :

info.txt logfile of random's system information tool 1.05 2009-02-18 20:51:33

======Uninstall list======

-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0

3DMark06-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F3AD00A-1819-4B15-BB7D-08B3586336D7}\setup.exe" -l0x9 -removeonly

7-Zip 4.64-->"C:\Program Files\7-Zip\Uninstall.exe"

Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe

Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}

Adobe Shockwave Player-->C:\Windows\System32\Adobe\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Adobe\SHOCKW~1\Install.log

Adobe® Photoshop® Album Edition Découverte 3.2-->MsiExec.exe /I{A654A805-41D9-40C7-AA46-4AF04F044D61}

AI Suite-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{310BC5E2-31AF-49BB-904D-E71EB93645DC}\setup.exe" -l0x40c

Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}

Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}

Arx Fatalis-->MsiExec.exe /X{96443F45-13E2-11D6-AC87-00D0B7A9E540}

Assassin's Creed-->C:\Program Files\InstallShield Installation Information\{8CFA9151-6404-409A-AF22-4632D04582FD}\setup.exe -runfromtemp -l0x040c -removeonly

Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}

ASUS Gamer OSD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{315ACD04-BCEB-478B-9B1D-5431D0E6CB11}\setup.exe" -l0x40c -removeonly

ASUSUpdate-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{587178E7-B1DF-494E-9838-FA4DD36E873C}\setup.exe" -l0x40c

Atheros Communications Inc.® AR8121/AR8113 Gigabit/Fast Ethernet Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3108C217-BE83-42E4-AE9E-A56A2A92E549}\setup.exe" -l0x9 -removeonly

AVG Free 8.0-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL

Be a King 1.0-->d:\Program Files\Be a King\uninst.exe

BioShock-->C:\Program Files\InstallShield Installation Information\{E280923D-C5D9-4728-8C79-AC9A0DC75875}\setup.exe -runfromtemp -l0x040c -removeonly

Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}

Catalyst Control Center - Branding-->MsiExec.exe /I{B059A827-918F-4951-91E8-E19455C815C0}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{14574B7F-75D1-4718-B7F2-EBF6E2862A35}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{199E6632-EB28-4F73-AECB-3E192EB92D18}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{25724802-CC14-4B90-9F3B-3D6955EE27B1}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{50193078-F553-4EBA-AA77-64C9FAA12F98}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{51D718D1-DA81-4FAD-919F-5C1CE3C33379}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{66F78C51-D108-4F0C-A93C-1CBE74CE338F}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{80D03817-7943-4839-8E96-B9F924C5E67D}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{97E5205F-EA4F-438F-B211-F1846419F1C1}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{99A7722D-9ACB-43F3-A222-ABC7133F159E}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{BA801B94-C28D-46EE-B806-E1E021A3D519}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{D4D244D1-05E0-4D24-86A2-B2433C435671}

Company of Heroes - FAKEMSI-->MsiExec.exe /I{EAF636A9-F664-4703-A659-85A894DA264F}

Company of Heroes-->"D:\\Uninstall_English.exe"

Crysis®-->MsiExec.exe /I{000E79B7-E725-4F01-870A-C12942B7F8E4}

Disc2Phone-->MsiExec.exe /X{1C75E8E0-29D5-4298-AE16-B8604FD9DDE4}

Dofus 1.26.0-->D:\Program Files\Dofus\uninstall.exe

eMule-->"d:\Program Files\eMule\Uninstall.exe"

Express Gate-->MsiExec.exe /I{685C7EBA-82F4-44F8-9514-911A69850DA3}

Fable - The Lost Chapters-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{C3C9EB3D-24FA-4462-B784-0EC6AAFCD2DD}

Far Cry-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC} /l1036

GameSpy Comrade-->MsiExec.exe /X{F3630894-093B-4E39-8491-97E0046839CC}

GUILD WARS-->"D:\GUILD WARS\Gw.exe" -uninstall

HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall

HomePlayer 1.5.6b-->C:\Program Files\HomePlayer\uninst.exe

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""

iTunes-->MsiExec.exe /I{F5C63795-2708-4D15-BF18-5ABBFF7DFFC8}

marvell 61xx-->C:\Program Files\Marvell\61xx\uninst-61xx.exe

Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"

Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}

Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe

Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

Microsoft Rise of Nations-->"D:\Rise of Nations\UNINSTAL.EXE" /runtemp /addremove

Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}

Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe

MSI Live Update 3-->C:\Windows\IsUninst.exe -f"C:\Program Files\MSI\Live Update 3\Uninst.isu"

MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}

MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML4 Parser-->MsiExec.exe /I{01501EBA-EC35-4F9F-8889-3BE346E5DA13}

NETGEAR XE104 Powerline Encryption Utility-->C:\Program Files\InstallShield Installation Information\{5614A167-5CB3-4C4C-8C0C-E5FACB3D953C}\setup.exe -runfromtemp -l0x0409

NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI

Oblivion-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{35CB6715-41F8-4F99-8881-6FC75BF054B0}\setup.exe" -l0x40c -removeonly

Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe

QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}

Rappelz-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{01A8838A-9469-425F-A5FB-FC14D4CF93B9}\setup.exe" -l0x40c -removeonly

RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0

Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -removeonly

S.T.A.L.K.E.R. - Shadow of Chernobyl-->"D:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\unins000.exe"

SdLL - Petit à petit vers le temps et les saisons-->C:\Windows\IsUn040c.exe -fd:\Temps\Uninst.isu

SdLL - Petit à petit vers les chiffres-->C:\Windows\IsUn040c.exe -fC:\Chiffres\Uninst.isu

Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}

Sonic Riders Demo Uninstall-->"D:\Program Files\SEGA\Sonic Riders Demo\unins000.exe"

Sony Ericsson Device Data-->MsiExec.exe /I{C92E7DF1-624A-4D95-A4C4-18CB491B44A4}

Sony Ericsson Drivers-->MsiExec.exe /I{C60BA916-9E44-4DA4-B11A-9E27B7624EF5}

Sony Ericsson Media Manager 1.2-->MsiExec.exe /X{5F1ECBFB-048E-406E-A7AB-A81F9E359961}

Sony Ericsson PC Suite-->C:\Windows\Installer\{D6BF6477-8369-489F-8DE6-3731F4B88560}\Setup.exe /uninstall

Sony Ericsson PC Suite-->MsiExec.exe /I{25BEC3AB-5CD4-481D-9143-215C1BBB189E}

SpellForce-->D:\SPELLF~1\unwise.exe D:\SPELLF~1\install.log

Storm Angel (remove only)-->"d:\Program Files\StormAngel\uninst.exe"

TeamSpeak 2 RC2-->"C:\Program Files\Teamspeak2_RC2\unins000.exe"

Toy Story 2-->C:\Windows\IsUn040c.exe -fD:\JEUDAC~1\DeIsL1.isu

VirginMega.Fr Premium-->MsiExec.exe /I{EE467474-04A8-48D5-8DDF-0F8D3A3CCBE5}

Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}

Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}

WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

World of Battles-->"C:\Program Files\InstallShield Installation Information\{D7FD3F44-5AF4-441C-A476-1C514B69A20D}\setup.exe" -runfromtemp -l0x0009 -removeonly

World of Warcraft-->C:\Program Files\Common Files\Blizzard Entertainment\World of Warcraft\Uninstall.exe

Wow Cartographe 1.09-->D:\WowCartographe\uninst.exe

XviD MPEG-4 Video Codec-->C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection Remove_XviD 132 C:\Windows\INF\xvid.inf

Z Engine-->MsiExec.exe /X{67AEBC24-2D41-4E40-969C-0A6C6718856A}

======Hosts File======

127.0.0.1 localhost

::1 localhost

======Security center information======

AS: Windows Defender

System event log

Computer Name: PC-de-papapoule

Event Code: 7036

Message: Le service Service de découverte automatique de Proxy Web pour les services HTTP Windows est entré dans l'état : arrêté.

Record Number: 61017

Source Name: Service Control Manager

Time Written: 20090218185543.000000-000

Event Type: Information

User:

Computer Name: PC-de-papapoule

Event Code: 3004

Message: L’agent de protection en temps réel Windows Defender a détecté des modifications. Microsoft vous recommande d’analyser les logiciels responsables de ces modifications, à la recherche de risques potentiels. Vous pouvez vous servir des informations relatives au fonctionnement de ces programmes pour autoriser ou non leur exécution, ou pour les supprimer de l’ordinateur. N’autorisez les modifications que si vous faites confiance au programme ou à l’éditeur de logiciel. Windows Defender ne peut pas annuler les modifications que vous autorisez.

Pour plus d’informations, consultez les données suivantes :

Non applicable

ID d’analyse : {EB4C9DA0-8C72-42AF-8565-3DAF76AE1482}

Utilisateur : PC-de-papapoule\papa poule

Nom : Unknown

ID :

ID de gravité :

ID de catégorie :

Chemin d’accès trouvé : clsid:HKLM\SOFTWARE\CLASSES\CLSID\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499};regkey:HKLM\Software\Microsoft\Code Store Database\Distribution Units\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}\CONTAINS\FILES\\C:\Windows\Downloaded Program Files\scanoptions.tsi;regkey:HKLM\Software\Microsoft\Code Store Database\Distribution Units\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}\CONTAINS\FILES\\C:\Windows\Downloaded Program Files\oscan81.ocx_x;regkey:HKLM\Software\Microsoft\Code Store Database\Distribution Units\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}\CONTAINS\FILES\\C:\Windows\Downloaded Program Files\oscan8.ocx;regkey:HKLM\Software\Microsoft\Code Store Database\Distribution Units\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}\CONTAINS\FILES\\C:\Windows\Downloaded Program Files\live.ini;regkey:HKLM\Software\Microsoft\Code Store Database\Distribution Units\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}\CONTAINS\FILES\\C:\Windows\Downloaded Program Files\lang.ini;regkey:HKLM\Software\Microsoft\Code Store Database\Distribution Units\{5D86DDB5-BDF9-4

Type d’alerte : Logiciel non classifié

Type de détection :

Record Number: 61018

Source Name: Microsoft-Windows-Windows Defender

Time Written: 20090218191532.000000-000

Event Type: Avertissement

User:

Computer Name: PC-de-papapoule

Event Code: 3005

Message: L’agent de protection en temps réel Windows Defender a pris des mesures pour protéger cet ordinateur contre les logiciels espions ou autres logiciels potentiellement indésirables.

Pour plus d’informations, consultez les informations suivantes :

Non applicable

ID d’analyse : {EB4C9DA0-8C72-42AF-8565-3DAF76AE1482}

Utilisateur : PC-de-papapoule\papa poule

Nom : Unknown

ID :

ID de gravité :

ID de catégorie :

Type d’alerte : Logiciel non classifié

Action : Ignorer

Record Number: 61019

Source Name: Microsoft-Windows-Windows Defender

Time Written: 20090218191533.000000-000

Event Type: Information

User:

Computer Name: PC-de-papapoule

Event Code: 7036

Message: Le service Service de découverte automatique de Proxy Web pour les services HTTP Windows est entré dans l'état : en cours d'exécution.

Record Number: 61020

Source Name: Service Control Manager

Time Written: 20090218191533.000000-000

Event Type: Information

User:

Computer Name: PC-de-papapoule

Event Code: 7036

Message: Le service Service de découverte automatique de Proxy Web pour les services HTTP Windows est entré dans l'état : arrêté.

Record Number: 61021

Source Name: Service Control Manager

Time Written: 20090218193203.000000-000

Event Type: Information

User:

Application event log

Computer Name: PC-de-papapoule

Event Code: 1000

Message: Les compteurs de performances pour le service WmiApRpl (WmiApRpl) ont été chargés. Les données d'enregistrement dans la section des données contiennent les nouvelles valeurs d'index assignées à ce service.

Record Number: 14741

Source Name: Microsoft-Windows-LoadPerf

Time Written: 20090218181717.000000-000

Event Type: Information

User:

Computer Name: PC-de-papapoule

Event Code: 4101

Message: Licence Windows validée.

Record Number: 14742

Source Name: Microsoft-Windows-Winlogon

Time Written: 20090218183911.000000-000

Event Type: Information

User:

Computer Name: PC-de-papapoule

Event Code: 6000

Message: L’abonné aux notifications Winlogon <SessionEnv> n’était pas disponible pour traiter un événement de notification.

Record Number: 14743

Source Name: Microsoft-Windows-Winlogon

Time Written: 20090218183911.000000-000

Event Type: Information

User:

Computer Name: PC-de-papapoule

Event Code: 1

Message: Le client des services de certification a démarré correctement.

Record Number: 14744

Source Name: Microsoft-Windows-CertificateServicesClient

Time Written: 20090218183911.940215-000

Event Type: Information

User: PC-de-papapoule\papa poule

Computer Name: PC-de-papapoule

Event Code: 0

Message:

Record Number: 14745

Source Name: iPod Service

Time Written: 20090218183920.000000-000

Event Type: Information

User:

Security event log

Computer Name: PC-de-papapoule

Event Code: 5038

Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys

Record Number: 19244

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090218195132.047215-000

Event Type: Échec de l'audit

User:

Computer Name: PC-de-papapoule

Event Code: 5038

Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys

Record Number: 19245

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090218195132.062815-000

Event Type: Échec de l'audit

User:

Computer Name: PC-de-papapoule

Event Code: 5038

Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys

Record Number: 19246

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090218195132.094015-000

Event Type: Échec de l'audit

User:

Computer Name: PC-de-papapoule

Event Code: 5038

Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys

Record Number: 19247

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090218195132.125215-000

Event Type: Échec de l'audit

User:

Computer Name: PC-de-papapoule

Event Code: 5038

Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys

Record Number: 19248

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090218195132.140815-000

Event Type: Échec de l'audit

User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"Path"=C:\Program Files\Internet Explorer;;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\Common Files\Teleca Shared;C:\Program Files\QuickTime\QTSystem\

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

"PROCESSOR_ARCHITECTURE"=x86

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"USERNAME"=SYSTEM

"windir"=%SystemRoot%

"PROCESSOR_LEVEL"=6

"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 11, GenuineIntel

"PROCESSOR_REVISION"=0f0b

"NUMBER_OF_PROCESSORS"=4

"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat

"DFSTRACINGON"=FALSE

"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip

"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

Le second :

Logfile of random's system information tool 1.05 (written by random/random)

Run by papa poule at 2009-02-18 20:51:30

Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1

System drive C: has 56 GB (56%) free of 100 GB

Total RAM: 2046 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:51:32, on 18/02/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\ASUS\AASP\1.00.64\aaCenter.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe

C:\Program Files\ASUS\GamerOSD\GamerOSD.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\Internet Explorer\ieuser.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\conime.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\papa poule\Desktop\RSIT.exe

C:\Program Files\Trend Micro\HijackThis\papa poule.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: &Research - {D263FA6D-84CC-48A8-9AF6-C664362B7A5B} - C:\Windows\System32\winconfig.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"

O4 - HKLM\..\Run: [QFan Help] "C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe"

O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe

O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Zboard] C:\Program Files\Ideazon\ZEngine\Zboard.exe

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O13 - Gopher Prefix:

O15 - Trusted Zone: http://asia.msi.com.tw

O15 - Trusted Zone: http://global.msi.com.tw

O15 - Trusted Zone: http://www.msi.com.tw

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab

O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: avgrsstx.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: WoB Beta Testing Monitor v.0.8.10.1 - Unknown owner - d:\Program Files\Frogwares\World of Battles\release\btmonitor_0.8.10.1.exe

--

End of file - 7733 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{4A5E0E40-3F98-47FD-9C4A-8391ADB5128F}.job

C:\Windows\tasks\User_Feed_Synchronization-{F4AD50DB-BB68-4525-A162-BE3F31DB7C78}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]

Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-08-12 1437696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]

AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2009-02-15 1078552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D263FA6D-84CC-48A8-9AF6-C664362B7A5B}]

&Research - C:\Windows\System32\winconfig.dll [2009-02-15 299520]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]

"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-05-20 6144000]

"Ai Nap"=C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe [2008-05-21 1423360]

"QFan Help"=C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe [2008-05-06 594432]

"Cpu Level Up help"=C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe [2007-11-30 881152]

"ASUSGamerOSD"=C:\Program Files\ASUS\GamerOSD\GamerOSD.exe [2008-05-28 380928]

"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-07-26 13535776]

"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-07-26 92704]

"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]

"Zboard"=C:\Program Files\Ideazon\ZEngine\Zboard.exe [2008-06-27 53248]

"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-07-16 61440]

"LiveMonitor"=C:\Program Files\MSI\Live Update 3\LMonitor.exe [2008-04-30 498176]

"Sony Ericsson PC Suite"=C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2007-06-13 528384]

"Adobe Photo Downloader"=C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe [2007-03-16 63712]

"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696]

"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-01-06 290088]

"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-02-15 1601304]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-21 1233920]

"MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]

"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLS"="avgrsstx.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{111dfaa5-5cfe-11dd-8b0f-806e6f6e6963}]

shell\AutoRun\command - E:\.\Bin\ASSETUP.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{480548b1-a2c0-11dd-ab25-806e6f6e6963}]

shell\AutoRun\command - E:\Install.Exe /autorun

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{87d0bbf4-a37f-11dd-8a34-00221552e0c7}]

shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Toy.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0804672-a36a-11dd-bef4-00221552e0c7}]

shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Toy.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0804678-a36a-11dd-bef4-00221552e0c7}]

shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Toy.exe

======List of files/folders created in the last 1 months======

2009-02-18 20:51:30 ----D---- C:\rsit

2009-02-18 20:17:55 ----D---- C:\Program Files\Panda Security

2009-02-18 20:15:27 ----D---- C:\Windows\BDOSCAN8

2009-02-18 19:54:30 ----D---- C:\Program Files\Trend Micro

2009-02-17 14:11:34 ----D---- C:\Program Files\Enigma Software Group

2009-02-15 23:23:36 ----HD---- C:\$AVG8.VAULT$

2009-02-15 23:16:16 ----A---- C:\Windows\system32\avgrsstx.dll

2009-02-15 23:15:37 ----D---- C:\ProgramData\avg8

2009-02-15 23:15:37 ----D---- C:\Program Files\AVG

2009-02-15 22:44:11 ----A---- C:\Windows\system32\EncDec.dll

2009-02-15 22:44:09 ----A---- C:\Windows\system32\psisdecd.dll

2009-02-15 22:20:44 ----A---- C:\Windows\system32\winconfig.dll

2009-02-13 20:46:00 ----A---- C:\Windows\system32\XAudio2_0.dll

2009-02-13 20:45:59 ----A---- C:\Windows\system32\xactengine3_0.dll

2009-02-13 20:45:59 ----A---- C:\Windows\system32\xactengine2_10.dll

2009-02-13 20:45:59 ----A---- C:\Windows\system32\X3DAudio1_3.dll

2009-02-13 20:45:59 ----A---- C:\Windows\system32\D3DX9_37.dll

2009-02-13 20:45:59 ----A---- C:\Windows\system32\d3dx10_37.dll

2009-02-13 20:45:59 ----A---- C:\Windows\system32\D3DCompiler_37.dll

2009-02-13 20:45:58 ----A---- C:\Windows\system32\xactengine2_9.dll

2009-02-13 20:45:58 ----A---- C:\Windows\system32\d3dx9_36.dll

2009-02-13 20:45:58 ----A---- C:\Windows\system32\d3dx10_36.dll

2009-02-13 20:45:58 ----A---- C:\Windows\system32\D3DCompiler_36.dll

2009-02-13 20:45:57 ----A---- C:\Windows\system32\d3dx10_35.dll

2009-02-13 20:45:57 ----A---- C:\Windows\system32\D3DCompiler_35.dll

2009-02-13 20:45:56 ----A---- C:\Windows\system32\xactengine2_8.dll

2009-02-13 20:45:56 ----A---- C:\Windows\system32\X3DAudio1_2.dll

2009-02-13 20:45:56 ----A---- C:\Windows\system32\d3dx9_35.dll

2009-02-13 20:45:55 ----A---- C:\Windows\system32\d3dx10_34.dll

2009-02-13 20:45:55 ----A---- C:\Windows\system32\D3DCompiler_34.dll

2009-02-13 20:45:54 ----A---- C:\Windows\system32\xinput1_3.dll

2009-02-13 20:45:54 ----A---- C:\Windows\system32\xactengine2_7.dll

2009-02-13 20:45:54 ----A---- C:\Windows\system32\d3dx9_34.dll

2009-02-13 20:45:52 ----A---- C:\Windows\system32\d3dx10_33.dll

2009-02-13 20:45:52 ----A---- C:\Windows\system32\D3DCompiler_33.dll

2009-02-13 20:45:51 ----A---- C:\Windows\system32\d3dx9_33.dll

2009-02-13 20:45:50 ----A---- C:\Windows\system32\xactengine2_6.dll

2009-02-13 20:45:48 ----A---- C:\Windows\system32\x3daudio1_1.dll

2009-02-11 00:58:48 ----A---- C:\Windows\system32\mshtml.dll

2009-02-11 00:58:48 ----A---- C:\Windows\system32\ieframe.dll

2009-02-11 00:58:47 ----A---- C:\Windows\system32\wininet.dll

2009-02-11 00:58:47 ----A---- C:\Windows\system32\urlmon.dll

2009-02-11 00:58:47 ----A---- C:\Windows\system32\mstime.dll

2009-02-11 00:58:47 ----A---- C:\Windows\system32\msfeeds.dll

2009-02-11 00:58:47 ----A---- C:\Windows\system32\jsproxy.dll

2009-02-11 00:58:47 ----A---- C:\Windows\system32\iertutil.dll

2009-02-08 12:20:52 ----A---- C:\Windows\system32\PresentationHostProxy.dll

2009-02-08 12:20:52 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

2009-02-08 12:20:52 ----A---- C:\Windows\system32\infocardapi.dll

2009-02-08 12:20:52 ----A---- C:\Windows\system32\icardres.dll

2009-02-08 12:20:52 ----A---- C:\Windows\system32\icardagt.exe

2009-02-08 12:20:51 ----A---- C:\Windows\system32\PresentationNative_v0300.dll

2009-02-08 12:20:50 ----A---- C:\Windows\system32\PresentationHost.exe

2009-02-08 12:16:59 ----A---- C:\Windows\system32\dfshim.dll

2009-02-08 12:16:58 ----A---- C:\Windows\system32\netfxperf.dll

2009-02-08 12:16:58 ----A---- C:\Windows\system32\mscoree.dll

2009-02-08 12:16:52 ----A---- C:\Windows\system32\mscorier.dll

2009-02-08 12:16:50 ----A---- C:\Windows\system32\mscories.dll

2009-02-08 12:16:38 ----D---- C:\Program Files\Microsoft Silverlight

2009-02-07 02:47:36 ----D---- C:\Windows\system32\Adobe

2009-01-30 19:19:47 ----A---- C:\Windows\system32\xactengine2_5.dll

2009-01-30 19:19:47 ----A---- C:\Windows\system32\d3dx10.dll

2009-01-30 19:19:46 ----A---- C:\Windows\system32\xactengine2_4.dll

2009-01-30 19:19:46 ----A---- C:\Windows\system32\d3dx9_32.dll

2009-01-30 19:19:45 ----A---- C:\Windows\system32\xinput1_2.dll

2009-01-30 19:19:45 ----A---- C:\Windows\system32\xinput1_1.dll

2009-01-30 19:19:45 ----A---- C:\Windows\system32\xactengine2_3.dll

2009-01-30 19:19:45 ----A---- C:\Windows\system32\xactengine2_2.dll

2009-01-30 19:19:45 ----A---- C:\Windows\system32\d3dx9_31.dll

2009-01-30 19:19:44 ----A---- C:\Windows\system32\xactengine2_1.dll

2009-01-30 19:19:35 ----A---- C:\Windows\system32\d3dx9_30.dll

2009-01-30 19:19:34 ----A---- C:\Windows\system32\xactengine2_0.dll

2009-01-30 19:19:34 ----A---- C:\Windows\system32\x3daudio1_0.dll

2009-01-30 19:19:34 ----A---- C:\Windows\system32\d3dx9_29.dll

2009-01-30 19:19:33 ----A---- C:\Windows\system32\d3dx9_28.dll

2009-01-30 19:19:31 ----A---- C:\Windows\system32\d3dx9_26.dll

2009-01-30 19:19:28 ----A---- C:\Windows\system32\d3dx9_24.dll

2009-01-29 23:17:07 ----D---- C:\Program Files\Common Files\INCA Shared

2009-01-29 22:37:48 ----D---- C:\ProgramData\InstallShield

2009-01-24 14:06:16 ----D---- C:\Program Files\Bonjour

2009-01-24 13:48:24 ----D---- C:\Users\papa poule\AppData\Roaming\Apple Computer

2009-01-24 13:47:54 ----DC---- C:\Windows\system32\DRVSTORE

2009-01-24 13:47:54 ----A---- C:\Windows\system32\GEARAspi.dll

2009-01-24 13:47:45 ----D---- C:\Program Files\iPod

2009-01-24 13:47:43 ----D---- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2009-01-24 13:47:43 ----D---- C:\Program Files\iTunes

2009-01-24 13:46:48 ----D---- C:\Program Files\Common Files\Apple

2009-01-24 13:43:32 ----D---- C:\ProgramData\Apple Computer

2009-01-24 13:43:32 ----D---- C:\Program Files\QuickTime

======List of files/folders modified in the last 1 months======

2009-02-18 20:51:32 ----D---- C:\Windows\Prefetch

2009-02-18 20:51:17 ----D---- C:\Windows\Temp

2009-02-18 20:17:56 ----D---- C:\Windows\system32\drivers

2009-02-18 20:17:55 ----RD---- C:\Program Files

2009-02-18 20:17:30 ----SD---- C:\Windows\Downloaded Program Files

2009-02-18 20:15:27 ----D---- C:\Windows

2009-02-18 19:17:17 ----D---- C:\Windows\System32

2009-02-18 19:17:17 ----D---- C:\Windows\inf

2009-02-18 19:17:17 ----A---- C:\Windows\system32\PerfStringBackup.INI

2009-02-17 16:09:44 ----SHD---- C:\$Recycle.Bin

2009-02-17 14:11:41 ----D---- C:\Windows\system32\Tasks

2009-02-17 10:42:10 ----SHD---- C:\System Volume Information

2009-02-15 23:15:37 ----HD---- C:\ProgramData

2009-02-15 23:15:29 ----SHD---- C:\Windows\Installer

2009-02-15 23:14:53 ----SD---- C:\Users\papa poule\AppData\Roaming\Microsoft

2009-02-15 22:44:56 ----D---- C:\Windows\Microsoft.NET

2009-02-15 22:44:33 ----D---- C:\Windows\winsxs

2009-02-15 22:44:32 ----D---- C:\Windows\ehome

2009-02-15 22:43:34 ----D---- C:\Windows\system32\catroot2

2009-02-15 22:43:34 ----D---- C:\Windows\system32\catroot

2009-02-15 22:19:40 ----D---- C:\Program Files\Common Files\System

2009-02-15 20:12:20 ----D---- C:\Users\papa poule\AppData\Roaming\Skype

2009-02-15 20:03:34 ----D---- C:\Users\papa poule\AppData\Roaming\skypePM

2009-02-13 20:45:47 ----RSD---- C:\Windows\assembly

2009-02-13 20:29:41 ----HD---- C:\Program Files\InstallShield Installation Information

2009-02-11 01:14:23 ----D---- C:\Program Files\Windows Mail

2009-02-09 18:53:12 ----D---- C:\Windows\rescache

2009-02-08 13:19:33 ----D---- C:\Windows\system32\fr-FR

2009-02-08 13:19:31 ----D---- C:\Windows\system32\XPSViewer

2009-02-08 13:19:31 ----D---- C:\Windows\system32\wbem

2009-02-08 13:19:31 ----D---- C:\Windows\system32\en-US

2009-02-07 02:48:30 ----D---- C:\Windows\system32\Macromed

2009-02-04 00:21:12 ----A---- C:\Windows\system32\mrt.exe

2009-01-29 23:17:07 ----D---- C:\Program Files\Common Files

2009-01-29 22:34:06 ----D---- C:\Program Files\Common Files\InstallShield

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AsIO;AsIO; C:\Windows\system32\drivers\AsIO.sys [2007-12-17 12400]

R1 asuskbnt;Enhanced Display Driver Helper Service; C:\Windows\system32\drivers\atkkbnt.sys [2008-05-28 11136]

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\Windows\System32\Drivers\avgldx86.sys [2009-02-15 325128]

R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\Windows\System32\Drivers\avgmfx86.sys [2009-02-15 27656]

R1 AvgTdiX;AVG Free8 Network Redirector; C:\Windows\System32\Drivers\avgtdix.sys [2009-02-15 107272]

R2 RMCAST;Pilote du protocole RMCAT PGMP; C:\Windows\system32\DRIVERS\RMCAST.sys [2008-05-10 113664]

R3 Alpham1;Ideazon Merc USB Human Interface Device; C:\Windows\system32\DRIVERS\Alpham1.sys [2007-07-23 42624]

R3 Alpham2;Ideazon Merc MM USB Human Interface Device; C:\Windows\system32\DRIVERS\Alpham2.sys [2007-03-20 18432]

R3 asusgsb;ASUS Virtual Video Capture Device Driver; C:\Windows\system32\drivers\asusgsb.sys [2008-05-28 12416]

R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-08-08 3895808]

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]

R3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-05-20 2143136]

R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113 PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1E60x86.sys [2008-02-02 47616]

R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2006-10-18 7680]

R3 Video3D;ASUS Video3D Service; C:\Windows\System32\Drivers\Video3D32.sys [2008-05-28 10752]

S3 Alpham;Ideazon Merc Composite Keyboard Driver; C:\Windows\system32\DRIVERS\Alpham.sys [2006-03-12 37248]

S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]

S3 ENTECH;ENTECH; \??\C:\Windows\system32\DRIVERS\ENTECH.sys [2007-09-07 27672]

S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []

S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]

S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]

S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]

S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]

S3 NTACCESS;NTACCESS; \??\E:\NTACCESS.sys []

S3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-07-26 7465312]

S3 s125bus;Sony Ericsson Device 125 driver (WDM); C:\Windows\system32\DRIVERS\s125bus.sys [2007-04-24 83336]

S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s125mdfl.sys [2007-04-24 15112]

S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s125mdm.sys [2007-04-24 108680]

S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s125mgmt.sys [2007-04-24 100488]

S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s125obex.sys [2007-04-24 98696]

S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]

S3 XE104Sp50;XE104Sp50 NDIS Protocol Driver; C:\Windows\System32\Drivers\XE104Sp50.sys [2006-11-28 27072]

S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]

S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-21 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-08-08 700416]

R2 avg8emc;AVG Free8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2009-02-15 903960]

R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-02-15 298264]

R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]

R2 WoB Beta Testing Monitor v.0.8.10.1;WoB Beta Testing Monitor v.0.8.10.1; d:\Program Files\Frogwares\World of Battles\release\btmonitor_0.8.10.1.exe [2009-02-13 208896]

R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-01-06 536872]

S3 aspnet_state;Service d'état ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-27 34312]

S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]

S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]

S3 usprserv;User Privilege Service; C:\Windows\System32\svchost.exe [2008-01-21 21504]

S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]

S4 ATKKeyboardService;ATK Keyboard Service; C:\Windows\ATKKBService.exe [2008-05-28 262144]

S4 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-07-26 118784]

-----------------EOF-----------------

Et celui Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:55:05, on 18/02/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\ASUS\AASP\1.00.64\aaCenter.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe

C:\Program Files\ASUS\GamerOSD\GamerOSD.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\Internet Explorer\ieuser.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe