Analyse HijackThis suite à une infection importante [Résolu]

Ewee · le 10 novembre 2009

Ok, alors voilà l'analyse des fichiers:

File 4ekjtruvvuoh.dll received on 2009.11.10 14:55:49 (UTC)

Antivirus Version Last Update Result

a-squared 4.5.0.41 2009.11.10 Trojan.Win32.Mespam!IK

AhnLab-V3 5.0.0.2 2009.11.06 -

AntiVir 7.9.1.61 2009.11.10 -

Antiy-AVL 2.0.3.7 2009.11.10 -

Authentium 5.2.0.5 2009.11.10 -

Avast 4.8.1351.0 2009.11.10 -

AVG 8.5.0.423 2009.11.10 -

BitDefender 7.2 2009.11.10 -

CAT-QuickHeal 10.00 2009.11.10 -

ClamAV 0.94.1 2009.11.10 -

Comodo 2905 2009.11.10 -

DrWeb 5.0.0.12182 2009.11.10 -

eSafe 7.0.17.0 2009.11.10 -

eTrust-Vet 35.1.7113 2009.11.10 -

F-Prot 4.5.1.85 2009.11.10 -

Fortinet 3.120.0.0 2009.11.10 -

GData 19 2009.11.10 -

Ikarus T3.1.1.74.0 2009.11.10 Trojan.Win32.Mespam

Jiangmin 11.0.800 2009.11.10 -

K7AntiVirus 7.10.892 2009.11.09 -

Kaspersky 7.0.0.125 2009.11.10 -

McAfee 5797 2009.11.09 -

McAfee+Artemis 5797 2009.11.09 Artemis!3C0C06C7909E

McAfee-GW-Edition 6.8.5 2009.11.10 -

Microsoft 1.5202 2009.11.10 Trojan:Win32/Mespam.G

NOD32 4592 2009.11.10 -

Norman 6.03.02 2009.11.09 -

nProtect 2009.1.8.0 2009.11.10 -

Panda 10.0.2.2 2009.11.09 -

PCTools 7.0.3.5 2009.11.10 -

Prevx 3.0 2009.11.10 High Risk Fraudulent Security Program

Rising 22.21.01.09 2009.11.10 -

Sophos 4.47.0 2009.11.10 -

Sunbelt 3.2.1858.2 2009.11.10 -

Symantec 1.4.4.12 2009.11.10 -

TheHacker 6.5.0.2.064 2009.11.09 -

TrendMicro 9.0.0.1003 2009.11.10 -

VBA32 3.12.10.11 2009.11.09 -

ViRobot 2009.11.10.2029 2009.11.10 -

VirusBuster 4.6.5.0 2009.11.09 -

Additional information

File size: 311296 bytes

MD5 : 3c0c06c7909edd50c032382dfe0e0a95

SHA1 : 118459fe08c6cf0192461837bbe46910947c69d7

SHA256: c548d6fdd4ffbcdd91de41b3f6ae5e1ac0713e688327d8ccc0bef8569c8b1ead

PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x20EED timedatestamp.....: 0x4AECCCD9 (Sun Nov 1 00:48:41 2009) machinetype.......: 0x14C (Intel I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x3985A 0x3A000 6.60 b23071ac831eefb9423e1f864bafc2f3 .rdata 0x3B000 0x8E67 0x9000 4.97 1bab9368bd51d00965a68168dd28f458 .data 0x44000 0x3AEC 0x2000 4.56 6d16611faeefde14e35ec0de22368cc2 .tls 0x48000 0x3 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110 .reloc 0x49000 0x446E 0x5000 4.38 1d10a5610b1bfbfdf5673868952c4444 ( 10 imports ) > advapi32.dll: SetSecurityDescriptorDacl, RegOpenKeyExA, RegQueryValueExA, AddAccessAllowedAce, InitializeAcl, GetLengthSid, AllocateAndInitializeSid, InitializeSecurityDescriptor, RegCreateKeyA, RegCloseKey > gdi32.dll: CreateFontIndirectA, CreateRectRgn, SelectObject, SetTextColor, SetBkMode, DeleteObject > kernel32.dll: RaiseException, InitializeCriticalSection, DeleteCriticalSection, GetVersionExA, GetThreadLocale, GetLocaleInfoW, ReadFile, SetStdHandle, GetOEMCP, GetLocaleInfoA, GetACP, InterlockedExchange, EnterCriticalSection, LeaveCriticalSection, CloseHandle, WriteFile, GetLastError, ExitThread, InterlockedDecrement, InterlockedIncrement, CreateThread, SetEvent, lstrcpyA, WaitForSingleObject, OpenEventA, lstrlenA, UnmapViewOfFile, MapViewOfFile, OpenFileMappingA, CreateFileMappingA, DeleteFileA, GetProcAddress, LoadLibraryA, OutputDebugStringA, GetModuleFileNameW, GetModuleFileNameA, ReleaseMutex, Sleep, CreateProcessA, CreateMutexA, GetModuleHandleA, GetProcessHeap, HeapDestroy, HeapFree, TerminateThread, lstrcmpiA, WaitForMultipleObjects, lstrcpynA, CreateEventA, HeapCreate, HeapAlloc, GetCurrentProcessId, GetCurrentThreadId, GetLocalTime, SetWaitableTimer, CreateWaitableTimerA, GetTickCount, GetSystemTime, GlobalAlloc, GlobalFree, FreeLibrary, LoadLibraryW, ExpandEnvironmentStringsW, GetVolumeInformationA, GetDriveTypeA, MultiByteToWideChar, WideCharToMultiByte, lstrlenW, GetSystemTimeAsFileTime, GetExitCodeThread, ExitProcess, RtlUnwind, GetCommandLineA, HeapReAlloc, LCMapStringA, LCMapStringW, GetCPInfo, QueryPerformanceCounter, VirtualQuery, VirtualFree, VirtualAlloc, IsBadWritePtr, TerminateProcess, GetCurrentProcess, HeapSize, TlsAlloc, SetLastError, TlsFree, TlsSetValue, TlsGetValue, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, FlushFileBuffers, SetFilePointer, VirtualProtect, GetSystemInfo, GetStringTypeA, GetStringTypeW, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, IsValidCodePage, IsBadReadPtr, IsBadCodePtr > ole32.dll: CoInitialize, CoCreateInstance, CLSIDFromString, CoUninitialize > rpcrt4.dll: UuidCreate > shlwapi.dll: StrStrIA > urlmon.dll: URLDownloadToCacheFileA > user32.dll: GetSysColor, wsprintfA, CallNextHookEx, PtInRect, GetCursorPos, SystemParametersInfoA, GetSystemMetrics, GetWindowRect, SendMessageA, DrawTextExA, GetWindowTextA, ReleaseDC, GetWindowDC, GetWindowLongA > wininet.dll: InternetCloseHandle, InternetReadFile, InternetQueryOptionA, HttpSendRequestA, HttpOpenRequestA, InternetConnectA, InternetOpenA > ws2_32.dll: -, -, -, WSCDeinstallProvider, WSCGetProviderPath, WSCInstallProvider, WSCEnumProtocols, -, -, -, - ( 1 exports ) > CallWndRetProc, DllMain, DllRegisterServer, DllUnregisterServer, MouseProc, WSPStartup

TrID : File type identification Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%)

ssdeep: 6144:Qc5PZDl1F9mJ30nTGg/zHrQlecUntVVyCu6U72beP5Ng:Qc5RnQ3OL/7rAecwtVVy6U6os%

Ok, alors voilà l'analyse des fichiers:

File 4ekjtruvvuoh.dll received on 2009.11.10 14:55:49 (UTC)

Antivirus Version Last Update Result

a-squared 4.5.0.41 2009.11.10 Trojan.Win32.Mespam!IK

AhnLab-V3 5.0.0.2 2009.11.06 -

AntiVir 7.9.1.61 2009.11.10 -

Antiy-AVL 2.0.3.7 2009.11.10 -

Authentium 5.2.0.5 2009.11.10 -

Avast 4.8.1351.0 2009.11.10 -

AVG 8.5.0.423 2009.11.10 -

BitDefender 7.2 2009.11.10 -

CAT-QuickHeal 10.00 2009.11.10 -

ClamAV 0.94.1 2009.11.10 -

Comodo 2905 2009.11.10 -

DrWeb 5.0.0.12182 2009.11.10 -

eSafe 7.0.17.0 2009.11.10 -

eTrust-Vet 35.1.7113 2009.11.10 -

F-Prot 4.5.1.85 2009.11.10 -

Fortinet 3.120.0.0 2009.11.10 -

GData 19 2009.11.10 -

Ikarus T3.1.1.74.0 2009.11.10 Trojan.Win32.Mespam

Jiangmin 11.0.800 2009.11.10 -

K7AntiVirus 7.10.892 2009.11.09 -

Kaspersky 7.0.0.125 2009.11.10 -

McAfee 5797 2009.11.09 -

McAfee+Artemis 5797 2009.11.09 Artemis!3C0C06C7909E

McAfee-GW-Edition 6.8.5 2009.11.10 -

Microsoft 1.5202 2009.11.10 Trojan:Win32/Mespam.G

NOD32 4592 2009.11.10 -

Norman 6.03.02 2009.11.09 -

nProtect 2009.1.8.0 2009.11.10 -

Panda 10.0.2.2 2009.11.09 -

PCTools 7.0.3.5 2009.11.10 -

Prevx 3.0 2009.11.10 High Risk Fraudulent Security Program

Rising 22.21.01.09 2009.11.10 -

Sophos 4.47.0 2009.11.10 -

Sunbelt 3.2.1858.2 2009.11.10 -

Symantec 1.4.4.12 2009.11.10 -

TheHacker 6.5.0.2.064 2009.11.09 -

TrendMicro 9.0.0.1003 2009.11.10 -

VBA32 3.12.10.11 2009.11.09 -

ViRobot 2009.11.10.2029 2009.11.10 -

VirusBuster 4.6.5.0 2009.11.09 -

Additional information

File size: 311296 bytes

MD5 : 3c0c06c7909edd50c032382dfe0e0a95

SHA1 : 118459fe08c6cf0192461837bbe46910947c69d7

SHA256: c548d6fdd4ffbcdd91de41b3f6ae5e1ac0713e688327d8ccc0bef8569c8b1ead

PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x20EED timedatestamp.....: 0x4AECCCD9 (Sun Nov 1 00:48:41 2009) machinetype.......: 0x14C (Intel I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x3985A 0x3A000 6.60 b23071ac831eefb9423e1f864bafc2f3 .rdata 0x3B000 0x8E67 0x9000 4.97 1bab9368bd51d00965a68168dd28f458 .data 0x44000 0x3AEC 0x2000 4.56 6d16611faeefde14e35ec0de22368cc2 .tls 0x48000 0x3 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110 .reloc 0x49000 0x446E 0x5000 4.38 1d10a5610b1bfbfdf5673868952c4444 ( 10 imports ) > advapi32.dll: SetSecurityDescriptorDacl, RegOpenKeyExA, RegQueryValueExA, AddAccessAllowedAce, InitializeAcl, GetLengthSid, AllocateAndInitializeSid, InitializeSecurityDescriptor, RegCreateKeyA, RegCloseKey > gdi32.dll: CreateFontIndirectA, CreateRectRgn, SelectObject, SetTextColor, SetBkMode, DeleteObject > kernel32.dll: RaiseException, InitializeCriticalSection, DeleteCriticalSection, GetVersionExA, GetThreadLocale, GetLocaleInfoW, ReadFile, SetStdHandle, GetOEMCP, GetLocaleInfoA, GetACP, InterlockedExchange, EnterCriticalSection, LeaveCriticalSection, CloseHandle, WriteFile, GetLastError, ExitThread, InterlockedDecrement, InterlockedIncrement, CreateThread, SetEvent, lstrcpyA, WaitForSingleObject, OpenEventA, lstrlenA, UnmapViewOfFile, MapViewOfFile, OpenFileMappingA, CreateFileMappingA, DeleteFileA, GetProcAddress, LoadLibraryA, OutputDebugStringA, GetModuleFileNameW, GetModuleFileNameA, ReleaseMutex, Sleep, CreateProcessA, CreateMutexA, GetModuleHandleA, GetProcessHeap, HeapDestroy, HeapFree, TerminateThread, lstrcmpiA, WaitForMultipleObjects, lstrcpynA, CreateEventA, HeapCreate, HeapAlloc, GetCurrentProcessId, GetCurrentThreadId, GetLocalTime, SetWaitableTimer, CreateWaitableTimerA, GetTickCount, GetSystemTime, GlobalAlloc, GlobalFree, FreeLibrary, LoadLibraryW, ExpandEnvironmentStringsW, GetVolumeInformationA, GetDriveTypeA, MultiByteToWideChar, WideCharToMultiByte, lstrlenW, GetSystemTimeAsFileTime, GetExitCodeThread, ExitProcess, RtlUnwind, GetCommandLineA, HeapReAlloc, LCMapStringA, LCMapStringW, GetCPInfo, QueryPerformanceCounter, VirtualQuery, VirtualFree, VirtualAlloc, IsBadWritePtr, TerminateProcess, GetCurrentProcess, HeapSize, TlsAlloc, SetLastError, TlsFree, TlsSetValue, TlsGetValue, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, FlushFileBuffers, SetFilePointer, VirtualProtect, GetSystemInfo, GetStringTypeA, GetStringTypeW, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, IsValidCodePage, IsBadReadPtr, IsBadCodePtr > ole32.dll: CoInitialize, CoCreateInstance, CLSIDFromString, CoUninitialize > rpcrt4.dll: UuidCreate > shlwapi.dll: StrStrIA > urlmon.dll: URLDownloadToCacheFileA > user32.dll: GetSysColor, wsprintfA, CallNextHookEx, PtInRect, GetCursorPos, SystemParametersInfoA, GetSystemMetrics, GetWindowRect, SendMessageA, DrawTextExA, GetWindowTextA, ReleaseDC, GetWindowDC, GetWindowLongA > wininet.dll: InternetCloseHandle, InternetReadFile, InternetQueryOptionA, HttpSendRequestA, HttpOpenRequestA, InternetConnectA, InternetOpenA > ws2_32.dll: -, -, -, WSCDeinstallProvider, WSCGetProviderPath, WSCInstallProvider, WSCEnumProtocols, -, -, -, - ( 1 exports ) > CallWndRetProc, DllMain, DllRegisterServer, DllUnregisterServer, MouseProc, WSPStartup

TrID : File type identification Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%)

ssdeep: 6144:Qc5PZDl1F9mJ30nTGg/zHrQlecUntVVyCu6U72beP5Ng:Qc5RnQ3OL/7rAecwtVVy6U6os%

Thanos · le 10 novembre 2009

Ok merci! est ce que tu peux aussi faire de même pour C:\WINDOWS\system32\xraidsetup .exe ?

Tu as posté deux fois l'analyse du fichier 4ekjtruvvuoh.dll

Ewee · le 10 novembre 2009

Ok, alors voilà l'analyse des fichiers:

File 4ekjtruvvuoh.dll received on 2009.11.10 14:55:49 (UTC)

Antivirus Version Last Update Result

a-squared 4.5.0.41 2009.11.10 Trojan.Win32.Mespam!IK

AhnLab-V3 5.0.0.2 2009.11.06 -

AntiVir 7.9.1.61 2009.11.10 -

Antiy-AVL 2.0.3.7 2009.11.10 -

Authentium 5.2.0.5 2009.11.10 -

Avast 4.8.1351.0 2009.11.10 -

AVG 8.5.0.423 2009.11.10 -

BitDefender 7.2 2009.11.10 -

CAT-QuickHeal 10.00 2009.11.10 -

ClamAV 0.94.1 2009.11.10 -

Comodo 2905 2009.11.10 -

DrWeb 5.0.0.12182 2009.11.10 -

eSafe 7.0.17.0 2009.11.10 -

eTrust-Vet 35.1.7113 2009.11.10 -

F-Prot 4.5.1.85 2009.11.10 -

Fortinet 3.120.0.0 2009.11.10 -

GData 19 2009.11.10 -

Ikarus T3.1.1.74.0 2009.11.10 Trojan.Win32.Mespam

Jiangmin 11.0.800 2009.11.10 -

K7AntiVirus 7.10.892 2009.11.09 -

Kaspersky 7.0.0.125 2009.11.10 -

McAfee 5797 2009.11.09 -

McAfee+Artemis 5797 2009.11.09 Artemis!3C0C06C7909E

McAfee-GW-Edition 6.8.5 2009.11.10 -

Microsoft 1.5202 2009.11.10 Trojan:Win32/Mespam.G

NOD32 4592 2009.11.10 -

Norman 6.03.02 2009.11.09 -

nProtect 2009.1.8.0 2009.11.10 -

Panda 10.0.2.2 2009.11.09 -

PCTools 7.0.3.5 2009.11.10 -

Prevx 3.0 2009.11.10 High Risk Fraudulent Security Program

Rising 22.21.01.09 2009.11.10 -

Sophos 4.47.0 2009.11.10 -

Sunbelt 3.2.1858.2 2009.11.10 -

Symantec 1.4.4.12 2009.11.10 -

TheHacker 6.5.0.2.064 2009.11.09 -

TrendMicro 9.0.0.1003 2009.11.10 -

VBA32 3.12.10.11 2009.11.09 -

ViRobot 2009.11.10.2029 2009.11.10 -

VirusBuster 4.6.5.0 2009.11.09 -

Additional information

File size: 311296 bytes

MD5 : 3c0c06c7909edd50c032382dfe0e0a95

SHA1 : 118459fe08c6cf0192461837bbe46910947c69d7

SHA256: c548d6fdd4ffbcdd91de41b3f6ae5e1ac0713e688327d8ccc0bef8569c8b1ead

PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x20EED timedatestamp.....: 0x4AECCCD9 (Sun Nov 1 00:48:41 2009) machinetype.......: 0x14C (Intel I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x3985A 0x3A000 6.60 b23071ac831eefb9423e1f864bafc2f3 .rdata 0x3B000 0x8E67 0x9000 4.97 1bab9368bd51d00965a68168dd28f458 .data 0x44000 0x3AEC 0x2000 4.56 6d16611faeefde14e35ec0de22368cc2 .tls 0x48000 0x3 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110 .reloc 0x49000 0x446E 0x5000 4.38 1d10a5610b1bfbfdf5673868952c4444 ( 10 imports ) > advapi32.dll: SetSecurityDescriptorDacl, RegOpenKeyExA, RegQueryValueExA, AddAccessAllowedAce, InitializeAcl, GetLengthSid, AllocateAndInitializeSid, InitializeSecurityDescriptor, RegCreateKeyA, RegCloseKey > gdi32.dll: CreateFontIndirectA, CreateRectRgn, SelectObject, SetTextColor, SetBkMode, DeleteObject > kernel32.dll: RaiseException, InitializeCriticalSection, DeleteCriticalSection, GetVersionExA, GetThreadLocale, GetLocaleInfoW, ReadFile, SetStdHandle, GetOEMCP, GetLocaleInfoA, GetACP, InterlockedExchange, EnterCriticalSection, LeaveCriticalSection, CloseHandle, WriteFile, GetLastError, ExitThread, InterlockedDecrement, InterlockedIncrement, CreateThread, SetEvent, lstrcpyA, WaitForSingleObject, OpenEventA, lstrlenA, UnmapViewOfFile, MapViewOfFile, OpenFileMappingA, CreateFileMappingA, DeleteFileA, GetProcAddress, LoadLibraryA, OutputDebugStringA, GetModuleFileNameW, GetModuleFileNameA, ReleaseMutex, Sleep, CreateProcessA, CreateMutexA, GetModuleHandleA, GetProcessHeap, HeapDestroy, HeapFree, TerminateThread, lstrcmpiA, WaitForMultipleObjects, lstrcpynA, CreateEventA, HeapCreate, HeapAlloc, GetCurrentProcessId, GetCurrentThreadId, GetLocalTime, SetWaitableTimer, CreateWaitableTimerA, GetTickCount, GetSystemTime, GlobalAlloc, GlobalFree, FreeLibrary, LoadLibraryW, ExpandEnvironmentStringsW, GetVolumeInformationA, GetDriveTypeA, MultiByteToWideChar, WideCharToMultiByte, lstrlenW, GetSystemTimeAsFileTime, GetExitCodeThread, ExitProcess, RtlUnwind, GetCommandLineA, HeapReAlloc, LCMapStringA, LCMapStringW, GetCPInfo, QueryPerformanceCounter, VirtualQuery, VirtualFree, VirtualAlloc, IsBadWritePtr, TerminateProcess, GetCurrentProcess, HeapSize, TlsAlloc, SetLastError, TlsFree, TlsSetValue, TlsGetValue, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, FlushFileBuffers, SetFilePointer, VirtualProtect, GetSystemInfo, GetStringTypeA, GetStringTypeW, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, IsValidCodePage, IsBadReadPtr, IsBadCodePtr > ole32.dll: CoInitialize, CoCreateInstance, CLSIDFromString, CoUninitialize > rpcrt4.dll: UuidCreate > shlwapi.dll: StrStrIA > urlmon.dll: URLDownloadToCacheFileA > user32.dll: GetSysColor, wsprintfA, CallNextHookEx, PtInRect, GetCursorPos, SystemParametersInfoA, GetSystemMetrics, GetWindowRect, SendMessageA, DrawTextExA, GetWindowTextA, ReleaseDC, GetWindowDC, GetWindowLongA > wininet.dll: InternetCloseHandle, InternetReadFile, InternetQueryOptionA, HttpSendRequestA, HttpOpenRequestA, InternetConnectA, InternetOpenA > ws2_32.dll: -, -, -, WSCDeinstallProvider, WSCGetProviderPath, WSCInstallProvider, WSCEnumProtocols, -, -, -, - ( 1 exports ) > CallWndRetProc, DllMain, DllRegisterServer, DllUnregisterServer, MouseProc, WSPStartup

TrID : File type identification Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%)

ssdeep: 6144:Qc5PZDl1F9mJ30nTGg/zHrQlecUntVVyCu6U72beP5Ng:Qc5RnQ3OL/7rAecwtVVy6U6os

Prevx Info: <a href="http://info.prevx.com/aboutprogramtext.asp?PX5=A43FCE5800743FDAC02D04E002F38000441AFCF4"'>http://info.prevx.com/aboutprogramtext.asp?PX5=A43FCE5800743FDAC02D04E002F38000441AFCF4" target="_blank">http://info.prevx.com/aboutprogramtext.asp?PX5=A43FCE5800743FDAC02D04E002F38000441AFCF4</a>'>http://info.prevx.com/aboutprogramtext.asp?PX5=A43FCE5800743FDAC02D04E002F38000441AFCF4</a>

PEiD : -

RDS : NSRL Reference Data Set -

Antivirus Version Last Update Result

a-squared 4.5.0.41 2009.11.10 Trojan.Win32.Mespam!IK

AhnLab-V3 5.0.0.2 2009.11.06 -

AntiVir 7.9.1.61 2009.11.10 -

Antiy-AVL 2.0.3.7 2009.11.10 -

Authentium 5.2.0.5 2009.11.10 -

Avast 4.8.1351.0 2009.11.10 -

AVG 8.5.0.423 2009.11.10 -

BitDefender 7.2 2009.11.10 -

CAT-QuickHeal 10.00 2009.11.10 -

ClamAV 0.94.1 2009.11.10 -

Comodo 2905 2009.11.10 -

DrWeb 5.0.0.12182 2009.11.10 -

eSafe 7.0.17.0 2009.11.10 -

eTrust-Vet 35.1.7113 2009.11.10 -

F-Prot 4.5.1.85 2009.11.10 -

Fortinet 3.120.0.0 2009.11.10 -

GData 19 2009.11.10 -

Ikarus T3.1.1.74.0 2009.11.10 Trojan.Win32.Mespam

Jiangmin 11.0.800 2009.11.10 -

K7AntiVirus 7.10.892 2009.11.09 -

Kaspersky 7.0.0.125 2009.11.10 -

McAfee 5797 2009.11.09 -

McAfee+Artemis 5797 2009.11.09 Artemis!3C0C06C7909E

McAfee-GW-Edition 6.8.5 2009.11.10 -

Microsoft 1.5202 2009.11.10 Trojan:Win32/Mespam.G

NOD32 4592 2009.11.10 -

Norman 6.03.02 2009.11.09 -

nProtect 2009.1.8.0 2009.11.10 -

Panda 10.0.2.2 2009.11.09 -

PCTools 7.0.3.5 2009.11.10 -

Prevx 3.0 2009.11.10 High Risk Fraudulent Security Program

Rising 22.21.01.09 2009.11.10 -

Sophos 4.47.0 2009.11.10 -

Sunbelt 3.2.1858.2 2009.11.10 -

Symantec 1.4.4.12 2009.11.10 -

TheHacker 6.5.0.2.064 2009.11.09 -

TrendMicro 9.0.0.1003 2009.11.10 -

VBA32 3.12.10.11 2009.11.09 -

ViRobot 2009.11.10.2029 2009.11.10 -

VirusBuster 4.6.5.0 2009.11.09 -

Additional information

File size: 311296 bytes

MD5 : 3c0c06c7909edd50c032382dfe0e0a95

SHA1 : 118459fe08c6cf0192461837bbe46910947c69d7

SHA256: c548d6fdd4ffbcdd91de41b3f6ae5e1ac0713e688327d8ccc0bef8569c8b1ead

PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x20EED timedatestamp.....: 0x4AECCCD9 (Sun Nov 1 00:48:41 2009) machinetype.......: 0x14C (Intel I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x3985A 0x3A000 6.60 b23071ac831eefb9423e1f864bafc2f3 .rdata 0x3B000 0x8E67 0x9000 4.97 1bab9368bd51d00965a68168dd28f458 .data 0x44000 0x3AEC 0x2000 4.56 6d16611faeefde14e35ec0de22368cc2 .tls 0x48000 0x3 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110 .reloc 0x49000 0x446E 0x5000 4.38 1d10a5610b1bfbfdf5673868952c4444 ( 10 imports ) > advapi32.dll: SetSecurityDescriptorDacl, RegOpenKeyExA, RegQueryValueExA, AddAccessAllowedAce, InitializeAcl, GetLengthSid, AllocateAndInitializeSid, InitializeSecurityDescriptor, RegCreateKeyA, RegCloseKey > gdi32.dll: CreateFontIndirectA, CreateRectRgn, SelectObject, SetTextColor, SetBkMode, DeleteObject > kernel32.dll: RaiseException, InitializeCriticalSection, DeleteCriticalSection, GetVersionExA, GetThreadLocale, GetLocaleInfoW, ReadFile, SetStdHandle, GetOEMCP, GetLocaleInfoA, GetACP, InterlockedExchange, EnterCriticalSection, LeaveCriticalSection, CloseHandle, WriteFile, GetLastError, ExitThread, InterlockedDecrement, InterlockedIncrement, CreateThread, SetEvent, lstrcpyA, WaitForSingleObject, OpenEventA, lstrlenA, UnmapViewOfFile, MapViewOfFile, OpenFileMappingA, CreateFileMappingA, DeleteFileA, GetProcAddress, LoadLibraryA, OutputDebugStringA, GetModuleFileNameW, GetModuleFileNameA, ReleaseMutex, Sleep, CreateProcessA, CreateMutexA, GetModuleHandleA, GetProcessHeap, HeapDestroy, HeapFree, TerminateThread, lstrcmpiA, WaitForMultipleObjects, lstrcpynA, CreateEventA, HeapCreate, HeapAlloc, GetCurrentProcessId, GetCurrentThreadId, GetLocalTime, SetWaitableTimer, CreateWaitableTimerA, GetTickCount, GetSystemTime, GlobalAlloc, GlobalFree, FreeLibrary, LoadLibraryW, ExpandEnvironmentStringsW, GetVolumeInformationA, GetDriveTypeA, MultiByteToWideChar, WideCharToMultiByte, lstrlenW, GetSystemTimeAsFileTime, GetExitCodeThread, ExitProcess, RtlUnwind, GetCommandLineA, HeapReAlloc, LCMapStringA, LCMapStringW, GetCPInfo, QueryPerformanceCounter, VirtualQuery, VirtualFree, VirtualAlloc, IsBadWritePtr, TerminateProcess, GetCurrentProcess, HeapSize, TlsAlloc, SetLastError, TlsFree, TlsSetValue, TlsGetValue, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, FlushFileBuffers, SetFilePointer, VirtualProtect, GetSystemInfo, GetStringTypeA, GetStringTypeW, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, IsValidCodePage, IsBadReadPtr, IsBadCodePtr > ole32.dll: CoInitialize, CoCreateInstance, CLSIDFromString, CoUninitialize > rpcrt4.dll: UuidCreate > shlwapi.dll: StrStrIA > urlmon.dll: URLDownloadToCacheFileA > user32.dll: GetSysColor, wsprintfA, CallNextHookEx, PtInRect, GetCursorPos, SystemParametersInfoA, GetSystemMetrics, GetWindowRect, SendMessageA, DrawTextExA, GetWindowTextA, ReleaseDC, GetWindowDC, GetWindowLongA > wininet.dll: InternetCloseHandle, InternetReadFile, InternetQueryOptionA, HttpSendRequestA, HttpOpenRequestA, InternetConnectA, InternetOpenA > ws2_32.dll: -, -, -, WSCDeinstallProvider, WSCGetProviderPath, WSCInstallProvider, WSCEnumProtocols, -, -, -, - ( 1 exports ) > CallWndRetProc, DllMain, DllRegisterServer, DllUnregisterServer, MouseProc, WSPStartup

TrID : File type identification Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%)

ssdeep: 6144:Qc5PZDl1F9mJ30nTGg/zHrQlecUntVVyCu6U72beP5Ng:Qc5RnQ3OL/7rAecwtVVy6U6os

Prevx Info: <a href="http://info.prevx.com/aboutprogramtext.asp?PX5=A43FCE5800743FDAC02D04E002F38000441AFCF4" target="_blank">http://info.prevx.com/aboutprogramtext.asp?PX5=A43FCE5800743FDAC02D04E002F38000441AFCF4</a>

PEiD : -

RDS : NSRL Reference Data Set -

et le second:

File xraidsetup_.exe received on 2009.11.10 15:01:35 (UTC)

Antivirus Version Last Update Result

a-squared 4.5.0.41 2009.11.10 Trojan-Downloader.Win32.Unruy!IK

AhnLab-V3 5.0.0.2 2009.11.06 -

AntiVir 7.9.1.61 2009.11.10 -

Antiy-AVL 2.0.3.7 2009.11.10 -

Authentium 5.2.0.5 2009.11.10 -

Avast 4.8.1351.0 2009.11.10 Win32:Agent-AHPW

AVG 8.5.0.423 2009.11.10 -

BitDefender 7.2 2009.11.10 Trojan.Agent.ANVH

CAT-QuickHeal 10.00 2009.11.10 -

ClamAV 0.94.1 2009.11.10 -

Comodo 2905 2009.11.10 -

DrWeb 5.0.0.12182 2009.11.10 -

eSafe 7.0.17.0 2009.11.10 -

eTrust-Vet 35.1.7113 2009.11.10 -

F-Prot 4.5.1.85 2009.11.10 -

F-Secure 9.0.15370.0 2009.11.09 -

Fortinet 3.120.0.0 2009.11.10 -

GData 19 2009.11.10 Trojan.Agent.ANVH

Ikarus T3.1.1.74.0 2009.11.10 Trojan-Downloader.Win32.Unruy

Jiangmin 11.0.800 2009.11.10 -

K7AntiVirus 7.10.892 2009.11.09 -

Kaspersky 7.0.0.125 2009.11.10 -

McAfee 5797 2009.11.09 -

McAfee+Artemis 5797 2009.11.09 -

McAfee-GW-Edition 6.8.5 2009.11.10 Heuristic.BehavesLike.Win32.Suspicious.H

Microsoft 1.5202 2009.11.10 -

NOD32 4592 2009.11.10 -

Norman 6.03.02 2009.11.09 -

nProtect 2009.1.8.0 2009.11.10 -

Panda 10.0.2.2 2009.11.09 -

PCTools 7.0.3.5 2009.11.10 -

Prevx 3.0 2009.11.10 Medium Risk Malware

Rising 22.21.01.09 2009.11.10 -

Sophos 4.47.0 2009.11.10 -

Sunbelt 3.2.1858.2 2009.11.10 -

Symantec 1.4.4.12 2009.11.10 -

TheHacker 6.5.0.2.064 2009.11.09 -

TrendMicro 9.0.0.1003 2009.11.10 -

VBA32 3.12.10.11 2009.11.09 -

ViRobot 2009.11.10.2029 2009.11.10 -

VirusBuster 4.6.5.0 2009.11.09 -

Additional information

File size: 37390 bytes

MD5...: 89733c98518279d29a7a5c64103d8bd4

SHA1..: dac35b3927c3f39376e548f7fcc4e6f9d0842e79

SHA256: 7eba1212f4f0c480b4dc2f9081b91f2fe8f3ab16d4af8f6ce0e8d4388fe72d1d

ssdeep: 768:X/9RM3J8SdbnSXWHqeEMzfOyzp5G7Yf1L3NO9WsZX6SFvGJEM3Jz5bOR46aP w:P9RM3JF7SXWHqeEMzfOyN5G7Yfd3+3X7

PEiD..: -

PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x37d7 timedatestamp.....: 0x4af8f551 (Tue Nov 10 05:08:33 2009) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x28b6 0x2a00 5.72 825461214bb5fea37ff10fd417a69a87 .rdata 0x4000 0x294 0x400 3.46 9521b29606a8f5674a826051d05c7018 .data 0x5000 0x14dec 0x6000 6.84 6e6c01ab617cb72754875d83f1d89459 ( 1 imports ) > KERNEL32.dll: GetFileAttributesExA, HeapDestroy, HeapFree, HeapCreate, HeapAlloc, GetProcessHeap, CloseHandle, Sleep, ReadFile, SetFilePointer, CreateFileA, ExitProcess, GetModuleFileNameA, QueryPerformanceCounter, GetProcAddress, LoadLibraryA, VirtualAlloc, VirtualFree, IsBadReadPtr, lstrcmpiA, FreeLibrary, HeapReAlloc, GetModuleHandleA, GetStartupInfoA, GetCommandLineA ( 0 exports )

RDS...: NSRL Reference Data Set -

pdfid.: -

sigcheck: publisher....: n/a copyright....: n/a product......: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments.....: n/a signers......: - signing date.: - verified.....: Unsigned

<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=08CF56CB0E1E2C7092EC0006FB89A1003C0CBE31''>http://info.prevx.com/aboutprogramtext.asp?PX5=08CF56CB0E1E2C7092EC0006FB89A1003C0CBE31' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=08CF56CB0E1E2C7092EC0006FB89A1003C0CBE31</a>'>http://info.prevx.com/aboutprogramtext.asp?PX5=08CF56CB0E1E2C7092EC0006FB89A1003C0CBE31</a>

trid..: Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

Antivirus Version Last Update Result

a-squared 4.5.0.41 2009.11.10 Trojan-Downloader.Win32.Unruy!IK

AhnLab-V3 5.0.0.2 2009.11.06 -

AntiVir 7.9.1.61 2009.11.10 -

Antiy-AVL 2.0.3.7 2009.11.10 -

Authentium 5.2.0.5 2009.11.10 -

Avast 4.8.1351.0 2009.11.10 Win32:Agent-AHPW

AVG 8.5.0.423 2009.11.10 -

BitDefender 7.2 2009.11.10 Trojan.Agent.ANVH

CAT-QuickHeal 10.00 2009.11.10 -

ClamAV 0.94.1 2009.11.10 -

Comodo 2905 2009.11.10 -

DrWeb 5.0.0.12182 2009.11.10 -

eSafe 7.0.17.0 2009.11.10 -

eTrust-Vet 35.1.7113 2009.11.10 -

F-Prot 4.5.1.85 2009.11.10 -

F-Secure 9.0.15370.0 2009.11.09 -

Fortinet 3.120.0.0 2009.11.10 -

GData 19 2009.11.10 Trojan.Agent.ANVH

Ikarus T3.1.1.74.0 2009.11.10 Trojan-Downloader.Win32.Unruy

Jiangmin 11.0.800 2009.11.10 -

K7AntiVirus 7.10.892 2009.11.09 -

Kaspersky 7.0.0.125 2009.11.10 -

McAfee 5797 2009.11.09 -

McAfee+Artemis 5797 2009.11.09 -

McAfee-GW-Edition 6.8.5 2009.11.10 Heuristic.BehavesLike.Win32.Suspicious.H

Microsoft 1.5202 2009.11.10 -

NOD32 4592 2009.11.10 -

Norman 6.03.02 2009.11.09 -

nProtect 2009.1.8.0 2009.11.10 -

Panda 10.0.2.2 2009.11.09 -

PCTools 7.0.3.5 2009.11.10 -

Prevx 3.0 2009.11.10 Medium Risk Malware

Rising 22.21.01.09 2009.11.10 -

Sophos 4.47.0 2009.11.10 -

Sunbelt 3.2.1858.2 2009.11.10 -

Symantec 1.4.4.12 2009.11.10 -

TheHacker 6.5.0.2.064 2009.11.09 -

TrendMicro 9.0.0.1003 2009.11.10 -

VBA32 3.12.10.11 2009.11.09 -

ViRobot 2009.11.10.2029 2009.11.10 -

VirusBuster 4.6.5.0 2009.11.09 -

Additional information

File size: 37390 bytes

MD5...: 89733c98518279d29a7a5c64103d8bd4

SHA1..: dac35b3927c3f39376e548f7fcc4e6f9d0842e79

SHA256: 7eba1212f4f0c480b4dc2f9081b91f2fe8f3ab16d4af8f6ce0e8d4388fe72d1d

ssdeep: 768:X/9RM3J8SdbnSXWHqeEMzfOyzp5G7Yf1L3NO9WsZX6SFvGJEM3Jz5bOR46aP w:P9RM3JF7SXWHqeEMzfOyN5G7Yfd3+3X7

PEiD..: -

PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x37d7 timedatestamp.....: 0x4af8f551 (Tue Nov 10 05:08:33 2009) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x28b6 0x2a00 5.72 825461214bb5fea37ff10fd417a69a87 .rdata 0x4000 0x294 0x400 3.46 9521b29606a8f5674a826051d05c7018 .data 0x5000 0x14dec 0x6000 6.84 6e6c01ab617cb72754875d83f1d89459 ( 1 imports ) > KERNEL32.dll: GetFileAttributesExA, HeapDestroy, HeapFree, HeapCreate, HeapAlloc, GetProcessHeap, CloseHandle, Sleep, ReadFile, SetFilePointer, CreateFileA, ExitProcess, GetModuleFileNameA, QueryPerformanceCounter, GetProcAddress, LoadLibraryA, VirtualAlloc, VirtualFree, IsBadReadPtr, lstrcmpiA, FreeLibrary, HeapReAlloc, GetModuleHandleA, GetStartupInfoA, GetCommandLineA ( 0 exports )

RDS...: NSRL Reference Data Set -

pdfid.: -

sigcheck: publisher....: n/a copyright....: n/a product......: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments.....: n/a signers......: - signing date.: - verified.....: Unsigned

<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=08CF56CB0E1E2C7092EC0006FB89A1003C0CBE31' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=08CF56CB0E1E2C7092EC0006FB89A1003C0CBE31</a>

trid..: Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

C'est fait!

Merci par avance!

Désolée, le 1er post etait de l'autre pc, il a merdouillé...

J'ai copié collé depuis le portable le .txt.

Thanos · le 10 novembre 2009

ok je te poste un procédure pour nettoyer ca sous peu...

Ewee · le 10 novembre 2009

Ok j'attends ça impatiemment XD

Merci beaucoup! =D

Thanos · le 10 novembre 2009

1°) Expédie moi le fichier suivant stp >>

Rend toi sur cette page > http://www.senduit.com/
Clique sur le bouton "Parcourir" à droite de File: une fenêtre s'ouvre.
Copie/colle ceci dans le champs à droite de "Nom du Fichier" en bas de page >> C:\WINDOWS\system32\4ekjtruvvuoh.dll
Clique maintenant sur "ouvrir" en bas de la fenêtre.
A droite de Expire in, sélectionne 1 Day
Clique enfin sur le bouton Upload.
Une nouvelle fenêtre va s'ouvrir et te donner le lien d'upload : envoie le moi par MP stp

2°) Téléchargement des outils sur le Bureau.

Télécharge LSPFix de Cexx.org sur ton bureau.

Télécharge OTM par OldTimer et enregistre ce fichier sur le Bureau.

Déconnecte ton pc d'internet physiquement après ca.

3°) Uilisation de LSPFix.

Démarre LSPFix

Coche I know what I'm doing

Sélectionne toutes les instances de la dll suivante (clique dessus une fois) => 4ekjtruvvuoh.dll

Clique ensuite sur le bouton en signe de ">>" afin de faire passer la dll du panneau de gauche, appelé "keep" au panneau de droite, appelé "Remove".

Clique sur Finish puis redémarre ton pc.

Note: ne touche pas aux autres Dlls!

4°) Utilisation d'OTM

Fais un double clic sur OTM.exe pour lancer l'exécution de l'outil. (Note: Si tu utilises Vista, fais un clic droit sur le fichier puis choisir Exécuter en tant qu'administrateur).

Copie les lignes de la zone "Code" ci-dessous dans le Presse-papiers en les sélectionnant toutes puis en appuyant simultanément sur les touches CTRL et C (ou, après les avoir sélectionnées, en faisant un clic droit puis en choisissant Copier):

:first

:processes
explorer.exe

:drivers
tdidis32.sys
appxyw5l

:files
C:\WINDOWS\system32\mcen.exe
C:\WINDOWS\system32\4ekjtruvvuoh.dll
C:\WINDOWS\system32\tdidis32.sys
C:\WINDOWS\system32\drivers\appxyw5l.sys
C:\WINDOWS\system32\xraidsetup.exe boot
C:\WINDOWS\system32\xraidsetup .exe
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\At5.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At8.job
C:\WINDOWS\tasks\At9.job
C:\Program Files\AskBarDis
C:\ComboFix
C:\Qoobox
C:\WINDOWS\system32\WS2Fix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\swxcacls.exe
C:\WINDOWS\system32\swsc.exe
C:\WINDOWS\system32\swreg.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\system32\o4Patch.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\IEDFix.C.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\Agent.OMZ.Fix.exe
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\zip.exe
C:\WINDOWS\SWXCACLS.exe
C:\WINDOWS\SWSC.exe
C:\WINDOWS\SWREG.exe
C:\WINDOWS\sed.exe
C:\WINDOWS\PEV.exe
C:\WINDOWS\NIRCMD.exe
C:\WINDOWS\MBR.exe
C:\WINDOWS\grep.exe

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"GEST"=-
"mcen"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tdidis32.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\system32\mcen.exe"=-

:commands
[emptytemp]
[start explorer]

Retourne dans la fenêtre de OTMoveIt3, fais un clic droit dans la zone de gauche intitulée puis choisis Coller.
Clique sur le bouton rouge
Ferme OTM
Poste dans ta prochaine réponse le rapport de OTM (contenu du fichier C:\_OTM\MovedFiles\********_******.log - les *** sont des chiffres représentant la date [moisjourannée] et l'heure)

Notes:

-Si un fichier ou un dossier ne peut pas être déplacé immédiatement, un redémarrage sera peut-être nécessaire pour permettre de terminer le processus de déplacement. Si le redémarrage de la machine vous est demandé, choisir Oui/Yes.

-Le script proposé est adapté au cas de Ewee : Vous ne devez en aucun cas l'utiliser sur votre pc!

Poste aussi un nouveau rapport RSIT stp (poste juste le rapport log.txt) ainsi que le rapport d'OTM.

J'aimerai aussi que tu m'expédie un fichier stp >>

Fais un clic droit sur le dossier C:\_OTM
Dans la liste qui se déroule, choisis > Envoyer vers > Dossier compressé
Un fichier nommé _OTM.zip doit apparaitre dans le même répertoire (C:\)
Rend toi sur cette page > http://www.senduit.com/
Clique sur le bouton "Parcourir" à droite de File: une fenêtre s'ouvre.
Copie/colle ceci dans le champs à droite de "Nom du Fichier" en bas de page >> C:\_OTM.zip
Clique maintenant sur "ouvrir" en bas de la fenêtre.
A droite de Expire in, sélectionne 1 Day
Clique enfin sur le bouton Upload.
Une nouvelle fenêtre va s'ouvrir et te donner le lien d'upload : envoie le moi par MP stp

Courage!!

Modifié le 10 novembre 2009 par Thanos

Ewee · le 10 novembre 2009

Pour ce qui est de OMT, la première fois le pc s'est bloqué, plus rien d'affiché sur le bureau, aucune tâche lancée, et toujours tout mon tas de processus...

Donc j'ai redémarré, enregistré le log.

Et j'ai refait, et là il m'a proposé de redémmarer, ce que j'ai accepté.

Voilà donc le dernier log:

All processes killed

Error: Unable to interpret <:first> in the current context!

========== PROCESSES ==========

No active process named explorer.exe was found!

Error: Unable to interpret <:drivers> in the current context!

Error: Unable to interpret <tdidis32.sys> in the current context!

Error: Unable to interpret <appxyw5l> in the current context!

========== FILES ==========

File/Folder C:\WINDOWS\system32\mcen.exe not found.

File/Folder C:\WINDOWS\system32\4ekjtruvvuoh.dll not found.

File/Folder C:\WINDOWS\system32\tdidis32.sys not found.

File/Folder C:\WINDOWS\system32\drivers\appxyw5l.sys not found.

C:\WINDOWS\system32\xraidsetup.exe boot moved successfully.

File/Folder C:\WINDOWS\system32\xraidsetup .exe not found.

C:\WINDOWS\tasks\At1.job moved successfully.

C:\WINDOWS\tasks\At10.job moved successfully.

C:\WINDOWS\tasks\At11.job moved successfully.

C:\WINDOWS\tasks\At12.job moved successfully.

C:\WINDOWS\tasks\At13.job moved successfully.

C:\WINDOWS\tasks\At14.job moved successfully.

C:\WINDOWS\tasks\At15.job moved successfully.

C:\WINDOWS\tasks\At16.job moved successfully.

C:\WINDOWS\tasks\At17.job moved successfully.

C:\WINDOWS\tasks\At18.job moved successfully.

C:\WINDOWS\tasks\At19.job moved successfully.

C:\WINDOWS\tasks\At2.job moved successfully.

C:\WINDOWS\tasks\At20.job moved successfully.

C:\WINDOWS\tasks\At21.job moved successfully.

C:\WINDOWS\tasks\At22.job moved successfully.

C:\WINDOWS\tasks\At23.job moved successfully.

C:\WINDOWS\tasks\At24.job moved successfully.

C:\WINDOWS\tasks\At3.job moved successfully.

C:\WINDOWS\tasks\At4.job moved successfully.

C:\WINDOWS\tasks\At5.job moved successfully.

C:\WINDOWS\tasks\At6.job moved successfully.

C:\WINDOWS\tasks\At7.job moved successfully.

C:\WINDOWS\tasks\At8.job moved successfully.

C:\WINDOWS\tasks\At9.job moved successfully.

File/Folder C:\Program Files\AskBarDis not found.

File/Folder C:\ComboFix not found.

File/Folder C:\Qoobox not found.

File/Folder C:\WINDOWS\system32\WS2Fix.exe not found.

File/Folder C:\WINDOWS\system32\VCCLSID.exe not found.

File/Folder C:\WINDOWS\system32\VACFix.exe not found.

File/Folder C:\WINDOWS\system32\swxcacls.exe not found.

File/Folder C:\WINDOWS\system32\swsc.exe not found.

File/Folder C:\WINDOWS\system32\swreg.exe not found.

File/Folder C:\WINDOWS\system32\SrchSTS.exe not found.

File/Folder C:\WINDOWS\system32\Process.exe not found.

File/Folder C:\WINDOWS\system32\o4Patch.exe not found.

File/Folder C:\WINDOWS\system32\IEDFix.exe not found.

File/Folder C:\WINDOWS\system32\IEDFix.C.exe not found.

File/Folder C:\WINDOWS\system32\dumphive.exe not found.

File/Folder C:\WINDOWS\system32\Agent.OMZ.Fix.exe not found.

File/Folder C:\WINDOWS\system32\404Fix.exe not found.

File/Folder C:\WINDOWS\zip.exe not found.

File/Folder C:\WINDOWS\SWXCACLS.exe not found.

File/Folder C:\WINDOWS\SWSC.exe not found.

File/Folder C:\WINDOWS\SWREG.exe not found.

File/Folder C:\WINDOWS\sed.exe not found.

File/Folder C:\WINDOWS\PEV.exe not found.

File/Folder C:\WINDOWS\NIRCMD.exe not found.

File/Folder C:\WINDOWS\MBR.exe not found.

File/Folder C:\WINDOWS\grep.exe not found.

========== REGISTRY ==========

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{3041d03e-fd4b-44e0-b742-2d9b88305f98} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\GEST not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\mcen not found.

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tdidis32.sys\ not found.

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart\ not found.

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys\ not found.

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart\ not found.

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys\ not found.

Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\WINDOWS\system32\mcen.exe not found.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur

C:\Documents and Settings\Administrateur\Local Settings\Temp\Arabic.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Czech.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Danish.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Dutch.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\English.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Finnish.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\French.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\German.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Greek.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Hebrew.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Hungarian.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Italian.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Japanese.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\jusched.log deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Korean.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Norwegian.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Polish.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Portuguese(Brazil).bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Portuguese.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Russian.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\SimChin.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Spanish.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\SWEDISH.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Thai.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\TradChin.bin deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temp\Turkish.bin deleted successfully.

->Temp folder emptied: 587929 bytes

C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\TU8ZNP4C\desktop.ini deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OA300AC4\desktop.ini deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\IR6C5D90\desktop.ini deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\D6E28WQI\desktop.ini deleted successfully.

C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini deleted successfully.

File delete failed. C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\desktop.ini deleted successfully.

->Temporary Internet Files folder emptied: 33170 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 0 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_20c.dat scheduled to be deleted on reboot.

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_238.dat scheduled to be deleted on reboot.

C:\WINDOWS\temp\WGAErrLog.txt deleted successfully.

Windows Temp folder emptied: 33023 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 0,62 mb

OTM by OldTimer - Version 3.1.0.1 log created on 11102009_173831

Files moved on Reboot...

File C:\WINDOWS\temp\Perflib_Perfdata_20c.dat not found!

File C:\WINDOWS\temp\Perflib_Perfdata_238.dat not found!

Registry entries deleted on Reboot...

Pour ce qui est de rsit pareil, je l'ai fait après le redémarrage "forcé", puis de nouveau après le reboot proposé; voilà le dernier rapport:

Logfile of random's system information tool 1.06 (written by random/random)

Run by Administrateur at 2009-11-10 17:43:20

Microsoft Windows XP Professionnel Service Pack 3

System drive C: has 100 GB (56%) free of 180 GB

Total RAM: 3326 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:44:03, on 10/11/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Silicon Image\57xx SteelVine\SteelVineManager.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Silicon Image\57xx SteelVine\steelvinemanager.exe

C:\Program Files\Silicon Image\57xx SteelVine\steelvinemanager .exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Documents and Settings\Administrateur\Bureau\RSIT.exe

C:\Program Files\trend micro\Administrateur.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe

O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot

O4 - HKLM\..\Run: [57xxSteelVine] C:\Program Files\Silicon Image\57xx SteelVine\SteelVineManager.exe

O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [DNS7reminder] "C:\Program Files\Drangon Speaking\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\Nuance\NaturallySpeaking9\Ereg.ini

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu

O4 - HKCU\..\Run: [LMDVox] C:\Program Files\Micro Application\Votre PC prend la parole\LMDVox.exe Lancement

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Tout télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: Télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: Télécharger toutes les vidéos avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll/206 (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O10 - Broken Internet access because of LSP provider 'c:\windows\system32\4ekjtruvvuoh.dll' missing

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGam...1/GAME_UNO1.cab

O23 - Service: 57xx SteelVine (57xx SteelVine Manager) - Unknown owner - C:\Program Files\Silicon Image\57xx SteelVine\SteelVine.exe

O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe

O23 - Service: Service Google Update (gupdate1ca407a69b35f52) (gupdate1ca407a69b35f52) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 8547 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

C:\WINDOWS\tasks\At1.job

C:\WINDOWS\tasks\At10.job

C:\WINDOWS\tasks\At11.job

C:\WINDOWS\tasks\At12.job

C:\WINDOWS\tasks\At13.job

C:\WINDOWS\tasks\At14.job

C:\WINDOWS\tasks\At15.job

C:\WINDOWS\tasks\At16.job

C:\WINDOWS\tasks\At17.job

C:\WINDOWS\tasks\At18.job

C:\WINDOWS\tasks\At19.job

C:\WINDOWS\tasks\At2.job

C:\WINDOWS\tasks\At20.job

C:\WINDOWS\tasks\At21.job

C:\WINDOWS\tasks\At22.job

C:\WINDOWS\tasks\At23.job

C:\WINDOWS\tasks\At24.job

C:\WINDOWS\tasks\At3.job

C:\WINDOWS\tasks\At4.job

C:\WINDOWS\tasks\At5.job

C:\WINDOWS\tasks\At6.job

C:\WINDOWS\tasks\At7.job

C:\WINDOWS\tasks\At8.job

C:\WINDOWS\tasks\At9.job

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]

BitComet Helper - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll [2009-07-16 664888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]

EpsonToolBandKicker Class - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-21 368640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{EE5D279F-081B-4404-994D-C6B60AAEBA6D} - EPSON Web-To-Page - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-21 368640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-05-07 16862208]

"JMB36X IDE Setup"=C:\WINDOWS\RaidTool\xInsIDE.exe []

"36X Raid Configurer"=C:\WINDOWS\system32\xRaidSetup.exe [2007-11-19 1966080]

"57xxSteelVine"=C:\Program Files\Silicon Image\57xx SteelVine\SteelVineManager.exe [2009-11-10 37390]

"nwiz"=C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [2009-07-08 1657376]

"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-07-14 86016]

"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-07-14 13877248]

"SSBkgdUpdate"=C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25 210472]

"ISUSPM Startup"=C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2005-02-16 221184]

"ISUSScheduler"=C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe [2005-02-16 81920]

"DNS7reminder"=C:\Program Files\Drangon Speaking\Ereg\Ereg.exe [2007-03-19 259624]

"BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent []

"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]

"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-10-28 141600]

"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]

"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]

"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"WIAWizardMenu"=C:\WINDOWS\system32\sti_ci.dll [2008-05-02 679936]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"LMDVox"=C:\Program Files\Micro Application\Votre PC prend la parole\LMDVox.exe [2007-12-18 456704]

"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-05-02 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]

C:\WINDOWS\system32\WgaLogon.dll [2008-05-02 200064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-05-02 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=323

"NoDriveAutoRun"=67108863

"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"HonorAutoRunSetting"=

"NoDriveAutoRun"=

"NoDriveTypeAutoRun"=

"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet.exe"

"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"

"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"

"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"

"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat"="C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat:*:Enabled:La Bataille pour la Terre du Milieu ™ II"

"C:\Program Files\Electronic Arts\L'Avènement du Roi-sorcier\game.dat"="C:\Program Files\Electronic Arts\L'Avènement du Roi-sorcier\game.dat:*:Enabled:LSDA, L'Avènement du Roi-sorcier™"

"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

"C:\Program Files\Electronic Arts\L'Ave`nement du Roi-sorcier\game.dat"="C:\Program Files\Electronic Arts\L'Ave`nement du Roi-sorcier\game.dat:*:Enabled:LSDA, L'Ave`nement du Roi-sorcier™"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"

"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf1368ba-a43b-11de-ab58-001fd02192d2}]

shell\AutoRun\command - imt8.cmd

shell\explore\command - imt8.cmd

shell\open\command - imt8.cmd

======File associations======

.scr - open - C:\WINDOWS\system32\notepad.exe "%1"

.scr - install -

.scr - config -

======List of files/folders created in the last 1 months======

2009-11-10 17:40:14 ----A---- C:\WINDOWS\system32\xraidsetup.exe boot

2009-11-10 17:28:02 ----D---- C:\_OTM

2009-11-10 15:55:32 ----D---- C:\Program Files\VirusTotalUploader

2009-11-10 13:50:55 ----D---- C:\Program Files\trend micro

2009-11-10 13:50:40 ----D---- C:\rsit

2009-11-10 12:34:52 ----D---- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes

2009-11-10 12:32:38 ----D---- C:\Program Files\Avira

2009-11-10 12:32:38 ----D---- C:\Documents and Settings\All Users\Application Data\Avira

2009-11-10 12:32:15 ----SHD---- C:\Config.Msi

2009-11-10 01:27:30 ----D---- C:\Program Files\HijackThis

2009-11-09 23:56:34 ----A---- C:\WINDOWS\ntbtlog.txt

2009-11-09 22:54:06 ----A---- C:\WINDOWS\is-RQG47.exe

2009-11-09 22:46:48 ----D---- C:\Program Files\Fichiers communs\PC Tools

2009-11-09 22:46:44 ----D---- C:\Program Files\Spyware Doctor

2009-11-09 22:46:44 ----D---- C:\Documents and Settings\All Users\Application Data\PC Tools

2009-11-09 22:46:44 ----D---- C:\Documents and Settings\Administrateur\Application Data\PC Tools

2009-11-09 22:12:26 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files

2009-11-09 22:07:07 ----A---- C:\WINDOWS\system32\vswmi.dll

2009-11-09 22:07:06 ----A---- C:\WINDOWS\system32\zpeng25.dll

2009-11-09 22:06:56 ----A---- C:\WINDOWS\system32\vsmonapi.dll

2009-11-09 22:05:00 ----D---- C:\WINDOWS\system32\ZoneLabs

2009-11-09 22:05:00 ----D---- C:\Program Files\Zone Labs

2009-11-09 22:05:00 ----A---- C:\WINDOWS\system32\vsxml.dll

2009-11-09 22:05:00 ----A---- C:\WINDOWS\system32\vspubapi.dll

2009-11-09 22:04:03 ----N---- C:\WINDOWS\system32\vsutil.dll

2009-11-09 22:04:03 ----N---- C:\WINDOWS\system32\vsinit.dll

2009-11-09 22:04:03 ----N---- C:\WINDOWS\system32\vsdata.dll

2009-11-09 22:03:28 ----D---- C:\WINDOWS\Internet Logs

2009-11-09 21:56:39 ----A---- C:\rapport.txt

2009-11-09 21:50:56 ----A---- C:\WINDOWS\SchedLgU.Txt

2009-11-09 20:46:03 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes

2009-11-09 20:46:02 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

2009-11-09 18:55:02 ----D---- C:\Program Files\Alwil Software

2009-11-09 18:39:11 ----A---- C:\ComboFix.txt

2009-11-09 17:58:53 ----D---- C:\Program Files\Enigma Software Group

2009-11-08 23:27:06 ----A---- C:\WINDOWS\system32\lsdelete.exe

2009-11-08 23:27:02 ----AH---- C:\aaw7boot.cmd

2009-11-08 22:02:19 ----D---- C:\Documents and Settings\Administrateur\Application Data\Lavasoft

2009-11-08 21:57:44 ----HDC---- C:\Documents and Settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}

2009-11-08 21:57:36 ----D---- C:\Program Files\Lavasoft

2009-11-08 21:57:36 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft

2009-11-08 21:45:07 ----D---- C:\Program Files\Spybot - Search & Destroy

2009-11-08 21:45:07 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2009-11-08 21:41:04 ----D---- C:\WINDOWS\system32\xircom

2009-11-08 21:41:04 ----D---- C:\WINDOWS\system32\oobe

2009-11-08 21:41:04 ----D---- C:\WINDOWS\system32\npp

2009-11-08 21:41:04 ----D---- C:\WINDOWS\system32\ime

2009-11-08 21:41:04 ----D---- C:\WINDOWS\msagent

2009-11-08 21:41:04 ----D---- C:\Program Files\xerox

2009-11-08 21:41:04 ----D---- C:\Program Files\windows nt

2009-11-08 21:41:04 ----D---- C:\Program Files\netmeeting

2009-11-08 21:41:04 ----D---- C:\Program Files\msn gaming zone

2009-11-08 21:41:04 ----D---- C:\Program Files\movie maker

2009-11-08 21:41:04 ----D---- C:\Program Files\microsoft frontpage

2009-11-08 21:41:04 ----D---- C:\Program Files\Fichiers communs\speechengines

2009-11-08 21:32:10 ----A---- C:\Boot.bak

2009-11-08 21:32:03 ----RASHD---- C:\cmdcons

2009-11-08 21:31:18 ----D---- C:\WINDOWS\ERDNT

2009-11-08 20:53:49 ----D---- C:\WINDOWS\system32\LogFiles

2009-11-08 20:53:34 ----D---- C:\Program Files\Adobe

2009-11-08 20:40:08 ----D---- C:\Documents and Settings\Administrateur\Application Data\Broad Intelligence

2009-11-08 20:16:45 ----D---- C:\Program Files\Total Video Converter

2009-11-08 20:05:25 ----A---- C:\WINDOWS\#1 Video Converter.INI

2009-11-06 17:58:48 ----A---- C:\WINDOWS\system32\javaws.exe

2009-11-06 17:58:48 ----A---- C:\WINDOWS\system32\javaw.exe

2009-11-06 17:58:48 ----A---- C:\WINDOWS\system32\java.exe

2009-10-30 12:50:04 ----D---- C:\Program Files\iPod

2009-10-30 12:50:02 ----D---- C:\Program Files\iTunes

2009-10-29 23:18:40 ----D---- C:\Program Files\GPLGS

2009-10-29 23:18:07 ----A---- C:\WINDOWS\system32\cpwmon2k.dll

2009-10-29 23:18:01 ----D---- C:\Program Files\Acro Software

2009-10-27 21:44:52 ----D---- C:\Documents and Settings\All Users\Application Data\TmForever

2009-10-27 21:42:47 ----D---- C:\Program Files\TmNationsForever

2009-10-23 21:27:28 ----D---- C:\Documents and Settings\Administrateur\Application Data\Talkback

2009-10-23 21:27:17 ----D---- C:\Documents and Settings\Administrateur\Application Data\Thunderbird

2009-10-18 18:27:01 ----D---- C:\Documents and Settings\All Users\Application Data\AVS4YOU

2009-10-18 18:27:01 ----D---- C:\Documents and Settings\Administrateur\Application Data\AVS4YOU

2009-10-18 18:26:35 ----D---- C:\Program Files\Fichiers communs\AVSMedia

2009-10-18 18:26:35 ----A---- C:\WINDOWS\system32\msvcr70.dll

2009-10-18 18:26:35 ----A---- C:\WINDOWS\system32\msvcp70.dll

2009-10-18 18:26:35 ----A---- C:\WINDOWS\system32\mfc70.dll

2009-10-18 18:26:34 ----D---- C:\Program Files\AVS4YOU

2009-10-18 18:26:34 ----A---- C:\WINDOWS\system32\msxml3a.dll

2009-10-18 18:26:34 ----A---- C:\WINDOWS\system32\GdiPlus.dll

2009-10-18 18:18:12 ----D---- C:\Documents and Settings\Administrateur\Application Data\FreeVideoConverter

2009-10-18 11:47:38 ----D---- C:\Documents and Settings\Administrateur\Application Data\GetRight

2009-10-16 16:33:57 ----D---- C:\Documents and Settings\Administrateur\Application Data\DAEMON Tools Pro

2009-10-16 16:27:05 ----D---- C:\Documents and Settings\Administrateur\Application Data\La Bataille pour la Terre du Milieu ™ II

2009-10-15 16:38:19 ----A---- C:\WINDOWS\system32\unrar.dll

2009-10-15 16:38:19 ----A---- C:\WINDOWS\avisplitter.ini

2009-10-15 16:38:18 ----A---- C:\WINDOWS\system32\yv12vfw.dll

2009-10-15 16:38:18 ----A---- C:\WINDOWS\system32\xvidcore.dll

2009-10-15 16:38:17 ----A---- C:\WINDOWS\system32\xvidvfw.dll

2009-10-15 16:38:17 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest

2009-10-15 16:38:17 ----A---- C:\WINDOWS\system32\ff_vfw.dll

2009-10-15 16:38:15 ----D---- C:\Program Files\K-Lite Codec Pack

2009-10-15 16:29:30 ----D---- C:\Documents and Settings\Administrateur\Application Data\vlc

2009-10-15 16:28:47 ----D---- C:\Program Files\VideoLAN

2009-10-15 15:52:43 ----D---- C:\Program Files\Guitar Pro 5

2009-10-13 18:32:06 ----D---- C:\Documents and Settings\Administrateur\Application Data\Mes fichiers de LSDA, L'Avènement du Roi-sorcier™

2009-10-13 18:23:07 ----D---- C:\WINDOWS\RegisteredPackages

2009-10-13 18:22:49 ----A---- C:\WINDOWS\system32\dxdllreg.exe

2009-10-13 18:18:30 ----D---- C:\Program Files\Electronic Arts

2009-10-11 22:29:49 ----D---- C:\Program Files\APCS4F

======List of files/folders modified in the last 1 months======

2009-11-10 17:40:28 ----SD---- C:\WINDOWS\Tasks

2009-11-10 17:40:14 ----D---- C:\WINDOWS\system32

2009-11-10 17:39:55 ----D---- C:\WINDOWS\system32\CatRoot2

2009-11-10 17:39:53 ----D---- C:\WINDOWS\Temp

2009-11-10 17:38:31 ----D---- C:\WINDOWS\RaidTool

2009-11-10 17:28:06 ----D---- C:\WINDOWS

2009-11-10 17:10:24 ----D---- C:\Program Files\Mozilla Firefox

2009-11-10 15:55:32 ----D---- C:\Program Files

2009-11-10 13:46:06 ----D---- C:\WINDOWS\system32\drivers

2009-11-10 13:23:03 ----D---- C:\Program Files\TaskSwitchXP

2009-11-10 12:32:48 ----D---- C:\WINDOWS\inf

2009-11-10 12:32:20 ----SHD---- C:\WINDOWS\Installer

2009-11-10 12:32:18 ----D---- C:\WINDOWS\WinSxS

2009-11-09 23:01:23 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP

2009-11-09 22:46:48 ----D---- C:\Program Files\Fichiers communs

2009-11-09 21:48:22 ----D---- C:\WINDOWS\Debug

2009-11-09 19:12:44 ----D---- C:\WINDOWS\system32\config

2009-11-09 18:37:04 ----A---- C:\WINDOWS\system.ini

2009-11-09 18:33:20 ----D---- C:\WINDOWS\AppPatch

2009-11-08 22:02:49 ----D---- C:\Program Files\Ad-Aware

2009-11-08 21:58:44 ----DC---- C:\WINDOWS\system32\DRVSTORE

2009-11-08 21:41:04 ----D---- C:\WINDOWS\system32\wbem

2009-11-08 21:41:04 ----D---- C:\WINDOWS\pchealth

2009-11-08 21:41:04 ----D---- C:\WINDOWS\ime

2009-11-08 21:41:04 ----D---- C:\WINDOWS\Help

2009-11-08 21:41:04 ----D---- C:\Program Files\Internet Explorer

2009-11-08 21:41:04 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared

2009-11-08 21:32:10 ----RASH---- C:\boot.ini

2009-11-08 20:53:15 ----D---- C:\WINDOWS\system32\dllcache

2009-11-08 20:16:47 ----RSD---- C:\WINDOWS\Fonts

2009-11-08 19:56:23 ----D---- C:\Program Files\Free Video Converter

2009-11-08 19:56:22 ----A---- C:\WINDOWS\win.ini

2009-11-08 17:11:21 ----D---- C:\Program Files\Messenger Plus! Live

2009-11-07 14:42:29 ----D---- C:\Program Files\BitComet

2009-11-07 14:42:23 ----D---- C:\Downloads

2009-11-06 17:58:45 ----D---- C:\Program Files\Java

2009-11-06 17:39:32 ----D---- C:\Program Files\Steam

2009-11-06 16:13:47 ----D---- C:\Documents and Settings\Administrateur\Application Data\dvdcss

2009-11-01 17:19:41 ----D---- C:\Documents and Settings\Administrateur\Application Data\Bioshock

2009-10-30 12:49:59 ----D---- C:\Program Files\Fichiers communs\Apple

2009-10-29 16:14:59 ----D---- C:\Program Files\Warcraft III

2009-10-27 21:44:21 ----RSD---- C:\WINDOWS\assembly

2009-10-27 21:44:02 ----D---- C:\WINDOWS\system32\DirectX

2009-10-25 13:27:34 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

2009-10-23 22:32:28 ----SD---- C:\WINDOWS\Downloaded Program Files

2009-10-23 21:27:28 ----D---- C:\Program Files\Mozilla Thunderbird

2009-10-23 21:27:18 ----D---- C:\Documents and Settings\Administrateur\Application Data\Mozilla

2009-10-18 11:43:42 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft

2009-10-17 15:41:53 ----D---- C:\Program Files\abgx360

2009-10-11 04:17:27 ----A---- C:\WINDOWS\system32\deploytk.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []

R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]

R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]

R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-11-10 28520]

R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-05-02 12032]

R2 Aspi32;Aspi32; C:\WINDOWS\System32\drivers\aspi32.sys [2008-05-06 16512]

R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-11-10 55656]

R2 WIBUKEY;WIBU-KEY Kernel Driver; C:\WINDOWS\SYSTEM32\DRIVERS\WibuKey.sys [2008-07-01 72704]

R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-05-02 60800]

R3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]

R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-05-02 144384]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-05-07 4739072]

R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-05-02 61824]

R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-07-14 7741664]

R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-08-18 47360]

R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-03 105856]

R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]

R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]

R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]

S1 tdidis32.sys;tdidis32.sys; \??\C:\WINDOWS\system32\tdidis32.sys []

S3 aow4fr93;aow4fr93; C:\WINDOWS\system32\drivers\aow4fr93.sys []

S3 Bridge;Pont MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-05-02 71552]

S3 BridgeMP;Miniport de pont MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-05-02 71552]

S3 BthEnum;Pilote de bloc de demande Bluetooth; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-13 17024]

S3 BthPan;Périphérique Bluetooth (réseau personnel); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-13 101120]

S3 BTHPORT;Pilote de port Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-05-02 272768]

S3 BTHUSB;Pilote USB radio Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-13 18944]

S3 catchme;catchme; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys []

S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []

S3 RFCOMM;Périphérique Bluetooth (TDI protocole RFCOMM); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-13 59136]

S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-08-28 40448]

S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]

S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]

S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]

S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

S3 Wibukey2;Wibukey2; C:\WINDOWS\system32\drivers\wibukey2.sys [2008-07-01 16384]

S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-05-02 77568]

S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-05-02 82944]

S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-11-10 108289]

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-11-10 185089]

R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-05-02 17408]

R2 GEST Service;GEST Service for program management.; C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe [2008-05-13 80392]

R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2009-11-08 1179232]

R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-07-14 168004]

R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-10-28 545568]

S2 57xx SteelVine Manager;57xx SteelVine; C:\Program Files\Silicon Image\57xx SteelVine\SteelVine.exe [2007-08-20 1282048]

S2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-07-09 144712]

S2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]

S2 gupdate1ca407a69b35f52;Service Google Update (gupdate1ca407a69b35f52); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-09-28 133104]

S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]

S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-09-23 651720]

S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]

S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]

S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]

S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]

S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]

S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-05-02 17408]

S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Et l'upload est en cours (il est un peu plus long celui-ci...)

Merci

Ewee · le 10 novembre 2009

Euh, ta boite étant pleine, je n'ai pas pu t'envoyer le lien de l'upload en MP.

Tu me diras quans tu l'as vidée que je le fasse.

Thanos · le 10 novembre 2009

ok c'est beaucoup mieux!

Merci pour le fichier! je viens de vider ma boite: expédie moi le fichier _OTM.zip une fois ce qui suit fait stp.

On continue comme ceci >>

1°) Démarre LSPFix

Coche I know what I'm doing

Clique sur Finish puis redémarre ton pc.

Branche ta clé usb au pc avant de faire le scan qui suit >>

2°) Utilisation d'OTM

Fais un double clic sur OTM.exe pour lancer l'exécution de l'outil. (Note: Si tu utilises Vista, fais un clic droit sur le fichier puis choisir Exécuter en tant qu'administrateur).

Copie les lignes de la zone "Code" ci-dessous dans le Presse-papiers en les sélectionnant toutes puis en appuyant simultanément sur les touches CTRL et C (ou, après les avoir sélectionnées, en faisant un clic droit puis en choisissant Copier):

:first

:processes
explorer.exe

:Services
tdidis32.sys
appxyw5l

:files
C:\WINDOWS\system32\mcen.exe
C:\WINDOWS\system32\tdidis32.sys
C:\WINDOWS\system32\drivers\appxyw5l.sys
C:\WINDOWS\system32\xraidsetup.exe boot
C:\WINDOWS\system32\xraidsetup .exe
C:\imt8.cmd
C:\autorun.inf
Q:\imt8.cmd
Q:\autorun.inf
|:\imt8.cmd
|:\autorun.inf
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\At5.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At8.job
C:\WINDOWS\tasks\At9.job

:reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf1368ba-a43b-11de-ab58-001fd02192d2}]

:commands
[emptytemp]
[start explorer]

Retourne dans la fenêtre de OTMoveIt3, fais un clic droit dans la zone de gauche intitulée puis choisis Coller.
Clique sur le bouton rouge
Ferme OTM
Poste dans ta prochaine réponse le rapport de OTM (contenu du fichier C:\_OTM\MovedFiles\********_******.log - les *** sont des chiffres représentant la date [moisjourannée] et l'heure)

Notes:

-Si un fichier ou un dossier ne peut pas être déplacé immédiatement, un redémarrage sera peut-être nécessaire pour permettre de terminer le processus de déplacement. Si le redémarrage de la machine vous est demandé, choisir Oui/Yes.

-Le script proposé est adapté au cas de Ewee : Vous ne devez en aucun cas l'utiliser sur votre pc!

Poste aussi un nouveau rapport RSIT stp (poste juste le rapport log.txt) ainsi que le rapport d'OTM.

3°) Le pc a redémarré: dis moi si tu parviens à te connecter à internet.

Si c'est le cas, un autre fichier à faire analyser en ligne stp >>

C:\WINDOWS\is-RQG47.exe (voir plus haut pour soumission au VirusTotal).

Modifié le 10 novembre 2009 par Thanos

Ewee · le 10 novembre 2009

Voilà les log:

-OTM:

All processes killed

Error: Unable to interpret <:first> in the current context!

========== PROCESSES ==========

Process explorer.exe killed successfully!

========== SERVICES/DRIVERS ==========

Service tdidis32.sys stopped successfully!

Service tdidis32.sys deleted successfully!

No service named appxyw5l was found to stop!

Unable to stop service appxyw5l!

========== FILES ==========

File/Folder C:\WINDOWS\system32\mcen.exe not found.

File/Folder C:\WINDOWS\system32\tdidis32.sys not found.

File/Folder C:\WINDOWS\system32\drivers\appxyw5l.sys not found.

C:\WINDOWS\system32\xraidsetup.exe boot moved successfully.

C:\WINDOWS\system32\xraidsetup .exe moved successfully.

File/Folder C:\imt8.cmd not found.

File/Folder C:\autorun.inf not found.

C:\WINDOWS\tasks\At1.job moved successfully.

C:\WINDOWS\tasks\At10.job moved successfully.

C:\WINDOWS\tasks\At11.job moved successfully.

C:\WINDOWS\tasks\At12.job moved successfully.

C:\WINDOWS\tasks\At13.job moved successfully.

C:\WINDOWS\tasks\At14.job moved successfully.

C:\WINDOWS\tasks\At15.job moved successfully.

C:\WINDOWS\tasks\At16.job moved successfully.

C:\WINDOWS\tasks\At17.job moved successfully.

C:\WINDOWS\tasks\At18.job moved successfully.

C:\WINDOWS\tasks\At19.job moved successfully.

C:\WINDOWS\tasks\At2.job moved successfully.

C:\WINDOWS\tasks\At20.job moved successfully.

C:\WINDOWS\tasks\At21.job moved successfully.

C:\WINDOWS\tasks\At22.job moved successfully.

C:\WINDOWS\tasks\At23.job moved successfully.

C:\WINDOWS\tasks\At24.job moved successfully.

C:\WINDOWS\tasks\At3.job moved successfully.

C:\WINDOWS\tasks\At4.job moved successfully.

C:\WINDOWS\tasks\At5.job moved successfully.

C:\WINDOWS\tasks\At6.job moved successfully.

C:\WINDOWS\tasks\At7.job moved successfully.

C:\WINDOWS\tasks\At8.job moved successfully.

C:\WINDOWS\tasks\At9.job moved successfully.

========== REGISTRY ==========

Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf1368ba-a43b-11de-ab58-001fd02192d2}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cf1368ba-a43b-11de-ab58-001fd02192d2}\ not found.