probleme supression fichiers infectés avec AVG

raskaline · le 3 janvier 2010

bonjour,

Comme expliqué dans le titre, depuis quelques jours, AVG me détecte deux fichiers infectés sous le nom d "hidden driver"

Ils se trouvent tous les deux dans le même dossier ( C :Windows/system32/driver/alwlmwfd.SYS)comme me l'indique AVG

( C :Windows/system32/driver/a9a989g4.SYS)

Après analyse AVG, ils apparaissent sous l'onglet Rootkits, et si je cherche a les supprimés le message d'erreur apparait : some files cannot be healed Access is denied..

Mais en allant les chercher manuellement ils sont introuvables, j'imagine que ce sont des fichiers très bien cachés, car même en affichant les dossier cacher ils n'apparaissent toujours pas.

Donc voila je viens cherché de l'aide ici car je ne sais pas a quoi correspondent ces fichiers, ni si il faut que je m'en débarrasse ou pas. Je joins mon rapport hijackthis, je ne sais pas si il peu être utile, je n'ai jamais su analysé ca!

Je vous remercie de votre aide.

Aline

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 04:16:41, on 03/01/2010

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18865)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Users\Rogemont\AppData\Local\Temp\RtkBtMnt.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\BitTorrent\bittorrent.exe

C:\Windows\explorer.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\eMule\emule.exe

C:\Program Files\AVG\AVG8\avgui.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\Program Files\AVG\AVG8\avgscanx.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\PROGRA~1\FREEDO~1\fdm.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Users\Rogemont\Downloads\HiJackThis.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe

O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe

O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe

O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe

O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 4101 bytes

raskaline · le 3 janvier 2010

Personne pour m'aider?

pear · le 3 janvier 2010

Bonjour,

Créez un sur C:`\ un dossier nommé Gmer

Télécharger gmer

vers C:\gmer

Clic droit sur fichier téléchargé->Extraire ici

Avant toute utilisation de GMER, veuillez désactiver votre antivirus, antispyware sous peine de crash.

Double-clic sur gmer.exe

L'onglet Rootkit/Malware permet de lancer un scan anti-rootkit.

Clic sur l'onglet "rootkit"

Ne scanner que la partition système pour gagner du temps.

Faites un clic droit dans la fenêtre vide et dans options cliquez"Only non Ms Files"

Clic sur Scan

Les informations sur le scan s'affichent alors, les éléments détectés comme rootkit apparaissent en rouge dans chaque section.

C'est ce qu'il faudra copier.

Le bouton Copy permet de récupérer le résultat pour effectuer un copier/coller.

Le bouton Save permet l'enregistrement du rapport sur votre disque au format texte.

Collez le résultat dans un prochain message

raskaline · le 3 janvier 2010

Merci de ta réponse pear ,

voici le résultat du scan :

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit quick scan 2010-01-03 20:04:28

Windows 6.0.6002 Service Pack 2

Running: gmer.exe; Driver: C:\Users\Rogemont\AppData\Local\Temp\pxlyquod.sys

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 855221F8

AttachedDevice \FileSystem\Ntfs \Ntfs psdfilter.sys (Acer eDataSecurity Management PSD Filter Driver/Egis Incorporated)

AttachedDevice \Driver\tdx \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

---- EOF - GMER 1.0.15 ----

Voilà, et je n'avait pas remarqué mais les rootkits trouvés par AVG changent de nom régulièrement, et mon espace disque C diminue très rapidement.

raskaline · le 4 janvier 2010

dans le recapitulatif du scan, rien n'est en rouge, mais en cherchant bien, j'ai trouvé plusieur dossiers et fichiers marqué en rouge, dans l'onglet Registry puis HKEY_LOCAL_MACHINE puis security et la policy ainsi que tous les sous dossiers et RXACT sont en rouge, je ne sais pas si il y en a d'autres. J'ai cherché mais pas trouvé :P

pear · le 4 janvier 2010

Je vous propose une autre recherche avec un autre outil:

Recherche de Rootkit

Télécharger SysProtsur le bureau

Installez le et double cliquez sur "SysProt.exe"

Cliquez sur l'onglet "log" ;

Cochez toutes les cases présentes dans la fenêtre "Write to log" ;

Cochez Hidden Objects Only (au bas, à gauche)

Les "Objets cachés (Hidden)" sont en Rouge dans tous les modules

Cliquez sur Create log (au bas, à droite)

Une nouvelle fenêtre apparaîtra : cochez Scan root drive et cliquez sur Start ;

Un rapport sera sauvegardé dans le dossier SysProt.

Copiez/collez en le contenu dans votre réponse.

Et, votre rapport Hijackthis étant peu bavard:

Téléchargez Random's system information tool (RSIT) par random/random et sauvegardez-le sur le Bureau.

Double-cliquez sur RSIT.exe afin de lancer RSIT.

* Cliquez Continue à l'écran Disclaimer.

* Si l'outil HIjackThis (version à jour) n'est pas présent ou détecté sur l'ordinateur, RSIT le télécharge et vous acceptez la licence.

* L'analyse terminée, deux fichiers texte s'ouvriront.:

Poster le contenu de log.txt (qui sera affiché)

ainsi que de info.txt (qui sera réduit dans la Barre des Tâches).

* Si ces deux rapports n'apparaissent pas, vous les trouverez dans le dossier C:\rsit

Si les rapports sont trop lourds, postez les en plusieurs fois

Modifié le 4 janvier 2010 par pear

raskaline · le 4 janvier 2010

merci,

voici le rapport :

SysProt AntiRootkit v1.0.1.0

by swatkat

********************************************************************************

**********

********************************************************************************

**********

No Hidden Processes found

********************************************************************************

**********

********************************************************************************

**********

Kernel Modules:

Module Name: \SystemRoot\System32\Drivers\spdo.sys

Service Name: ---

Module Base: 80691000

Module End: 80792000

Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\aa4jhrdy.SYS

Service Name: ---

Module Base: 8FA07000

Module End: 8FA3E000

Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\aldkt62z.SYS

Service Name: ---

Module Base: 8FA3E000

Module End: 8FA76000

Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\dump_iaStor.sys

Service Name: ---

Module Base: 8A706000

Module End: 8A7DF000

Hidden: Yes

Module Name: \??\C:\Users\Rogemont\AppData\Local\Temp\pxlyquod.sys

Service Name: pxlyquod

Module Base: 807DF000

Module End: 807F6000

Hidden: Yes

********************************************************************************

**********

********************************************************************************

**********

No SSDT Hooks found

********************************************************************************

**********

********************************************************************************

**********

No Kernel Hooks found

********************************************************************************

**********

********************************************************************************

**********

IRP Hooks:

Hooked Module: \SystemRoot\System32\Drivers\aldkt62z.SYS

Hooked IRP: IRP_MJ_CREATE

Jump To: 874801F8

Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\aldkt62z.SYS

Hooked IRP: IRP_MJ_CLOSE

Jump To: 874801F8

Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\aldkt62z.SYS

Hooked IRP: IRP_MJ_DEVICE_CONTROL

Jump To: 874801F8

Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\aldkt62z.SYS

Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL

Jump To: 874801F8

Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\aldkt62z.SYS

Hooked IRP: IRP_MJ_POWER

Jump To: 874801F8

Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\aldkt62z.SYS

Hooked IRP: IRP_MJ_SYSTEM_CONTROL

Jump To: 874801F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\atapi.sys

Hooked IRP: IRP_MJ_CREATE

Jump To: 855211F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\atapi.sys

Hooked IRP: IRP_MJ_CLOSE

Jump To: 855211F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\atapi.sys

Hooked IRP: IRP_MJ_DEVICE_CONTROL

Jump To: 855211F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\atapi.sys

Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL

Jump To: 855211F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\atapi.sys

Hooked IRP: IRP_MJ_POWER

Jump To: 855211F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\atapi.sys

Hooked IRP: IRP_MJ_SYSTEM_CONTROL

Jump To: 855211F8

Hooking Module: _unknown_

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_CREATE

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_CREATE_NAMED_PIPE

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_CLOSE

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_READ

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_WRITE

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_QUERY_INFORMATION

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_SET_INFORMATION

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_QUERY_EA

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_SET_EA

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_FLUSH_BUFFERS

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_QUERY_VOLUME_INFORMATION

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_SET_VOLUME_INFORMATION

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_DIRECTORY_CONTROL

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_FILE_SYSTEM_CONTROL

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_DEVICE_CONTROL

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_SHUTDOWN

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_LOCK_CONTROL

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_CLEANUP

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_CREATE_MAILSLOT

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_QUERY_SECURITY

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_SET_SECURITY

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_POWER

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_SYSTEM_CONTROL

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_DEVICE_CHANGE

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_QUERY_QUOTA

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\sptd

Hooked IRP: IRP_MJ_SET_QUOTA

Jump To: 80692000

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: C:\Windows\system32\DRIVERS\usbuhci.sys

Hooked IRP: IRP_MJ_CREATE

Jump To: 8728F1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbuhci.sys

Hooked IRP: IRP_MJ_CLOSE

Jump To: 8728F1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbuhci.sys

Hooked IRP: IRP_MJ_DEVICE_CONTROL

Jump To: 8728F1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbuhci.sys

Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL

Jump To: 8728F1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbuhci.sys

Hooked IRP: IRP_MJ_POWER

Jump To: 8728F1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbuhci.sys

Hooked IRP: IRP_MJ_SYSTEM_CONTROL

Jump To: 8728F1F8

Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\aa4jhrdy.SYS

Hooked IRP: IRP_MJ_CREATE

Jump To: 872BC1F8

Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\aa4jhrdy.SYS

Hooked IRP: IRP_MJ_CLOSE

Jump To: 872BC1F8

Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\aa4jhrdy.SYS

Hooked IRP: IRP_MJ_DEVICE_CONTROL

Jump To: 872BC1F8

Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\aa4jhrdy.SYS

Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL

Jump To: 872BC1F8

Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\aa4jhrdy.SYS

Hooked IRP: IRP_MJ_POWER

Jump To: 872BC1F8

Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\aa4jhrdy.SYS

Hooked IRP: IRP_MJ_SYSTEM_CONTROL

Jump To: 872BC1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\iaStor.sys

Hooked IRP: IRP_MJ_CREATE

Jump To: 8A34DA60

Hooking Module: C:\Windows\system32\DRIVERS\iaStor.sys

Hooked Module: C:\Windows\system32\DRIVERS\iaStor.sys

Hooked IRP: IRP_MJ_CLOSE

Jump To: 8A34DA60

Hooking Module: C:\Windows\system32\DRIVERS\iaStor.sys

Hooked Module: C:\Windows\system32\DRIVERS\iaStor.sys

Hooked IRP: IRP_MJ_DEVICE_CONTROL

Jump To: 8A34DA60

Hooking Module: C:\Windows\system32\DRIVERS\iaStor.sys

Hooked Module: C:\Windows\system32\DRIVERS\iaStor.sys

Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL

Jump To: 8A34DA60

Hooking Module: C:\Windows\system32\DRIVERS\iaStor.sys

Hooked Module: C:\Windows\system32\DRIVERS\iaStor.sys

Hooked IRP: IRP_MJ_POWER

Jump To: 8A34DA60

Hooking Module: C:\Windows\system32\DRIVERS\iaStor.sys

Hooked Module: C:\Windows\system32\DRIVERS\iaStor.sys

Hooked IRP: IRP_MJ_SYSTEM_CONTROL

Jump To: 8A34DA60

Hooking Module: C:\Windows\system32\DRIVERS\iaStor.sys

Hooked Module: C:\Windows\system32\DRIVERS\smb.sys

Hooked IRP: IRP_MJ_CREATE

Jump To: 881F51F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\smb.sys

Hooked IRP: IRP_MJ_CLOSE

Jump To: 881F51F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\smb.sys

Hooked IRP: IRP_MJ_DEVICE_CONTROL

Jump To: 881F51F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\smb.sys

Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL

Jump To: 881F51F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\smb.sys

Hooked IRP: IRP_MJ_CLEANUP

Jump To: 881F51F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\System32\DRIVERS\netbt.sys

Hooked IRP: IRP_MJ_CREATE

Jump To: 881EA1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\System32\DRIVERS\netbt.sys

Hooked IRP: IRP_MJ_CLOSE

Jump To: 881EA1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\System32\DRIVERS\netbt.sys

Hooked IRP: IRP_MJ_DEVICE_CONTROL

Jump To: 881EA1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\System32\DRIVERS\netbt.sys

Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL

Jump To: 881EA1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\System32\DRIVERS\netbt.sys

Hooked IRP: IRP_MJ_CLEANUP

Jump To: 881EA1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys

Hooked IRP: IRP_MJ_CREATE

Jump To: 872C11F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys

Hooked IRP: IRP_MJ_CLOSE

Jump To: 872C11F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys

Hooked IRP: IRP_MJ_READ

Jump To: 872C11F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys

Hooked IRP: IRP_MJ_WRITE

Jump To: 872C11F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys

Hooked IRP: IRP_MJ_FLUSH_BUFFERS

Jump To: 872C11F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys

Hooked IRP: IRP_MJ_DEVICE_CONTROL

Jump To: 872C11F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys

Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL

Jump To: 872C11F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys

Hooked IRP: IRP_MJ_SHUTDOWN

Jump To: 872C11F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys

Hooked IRP: IRP_MJ_POWER

Jump To: 872C11F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys

Hooked IRP: IRP_MJ_SYSTEM_CONTROL

Jump To: 872C11F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\msiscsi.sys

Hooked IRP: IRP_MJ_CREATE

Jump To: 8742A1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\msiscsi.sys

Hooked IRP: IRP_MJ_CLOSE

Jump To: 8742A1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\msiscsi.sys

Hooked IRP: IRP_MJ_DEVICE_CONTROL

Jump To: 8742A1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\msiscsi.sys

Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL

Jump To: 8742A1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\msiscsi.sys

Hooked IRP: IRP_MJ_POWER

Jump To: 8742A1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\msiscsi.sys

Hooked IRP: IRP_MJ_SYSTEM_CONTROL

Jump To: 8742A1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys

Hooked IRP: IRP_MJ_CREATE

Jump To: 84B901F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys

Hooked IRP: IRP_MJ_READ

Jump To: 84B901F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys

Hooked IRP: IRP_MJ_WRITE

Jump To: 84B901F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys

Hooked IRP: IRP_MJ_FLUSH_BUFFERS

Jump To: 84B901F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys

Hooked IRP: IRP_MJ_DEVICE_CONTROL

Jump To: 84B901F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys

Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL

Jump To: 84B901F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys

Hooked IRP: IRP_MJ_SHUTDOWN

Jump To: 84B901F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys

Hooked IRP: IRP_MJ_CLEANUP

Jump To: 84B901F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys

Hooked IRP: IRP_MJ_POWER

Jump To: 84B901F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys

Hooked IRP: IRP_MJ_SYSTEM_CONTROL

Jump To: 84B901F8

Hooking Module: _unknown_

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_CREATE

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_CREATE_NAMED_PIPE

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_CLOSE

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_READ

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_WRITE

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_QUERY_INFORMATION

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_SET_INFORMATION

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_QUERY_EA

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_SET_EA

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_FLUSH_BUFFERS

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_QUERY_VOLUME_INFORMATION

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_SET_VOLUME_INFORMATION

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_DIRECTORY_CONTROL

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_FILE_SYSTEM_CONTROL

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_DEVICE_CONTROL

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_SHUTDOWN

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_LOCK_CONTROL

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_CLEANUP

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_CREATE_MAILSLOT

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_QUERY_SECURITY

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_SET_SECURITY

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_POWER

Jump To: 80699E30

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_SYSTEM_CONTROL

Jump To: 806AE514

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_DEVICE_CHANGE

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_QUERY_QUOTA

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: \Driver\PCI_PNP6656

Hooked IRP: IRP_MJ_SET_QUOTA

Jump To: 806D5AEA

Hooking Module: \SystemRoot\System32\Drivers\spdo.sys

Hooked Module: C:\Windows\system32\DRIVERS\usbehci.sys

Hooked IRP: IRP_MJ_CREATE

Jump To: 8707B1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbehci.sys

Hooked IRP: IRP_MJ_CLOSE

Jump To: 8707B1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbehci.sys

Hooked IRP: IRP_MJ_DEVICE_CONTROL

Jump To: 8707B1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbehci.sys

Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL

Jump To: 8707B1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbehci.sys

Hooked IRP: IRP_MJ_POWER

Jump To: 8707B1F8

Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbehci.sys

Hooked IRP: IRP_MJ_SYSTEM_CONTROL

Jump To: 8707B1F8

Hooking Module: _unknown_

********************************************************************************

**********

********************************************************************************

**********

Ports:

Local Address: ORDINATOUR:50584

Remote Address: SPYNETTEST.MICROSOFT.COM:HTTPS

Type: TCP

Process: C:\Program Files\Windows Defender\MSASCui.exe

State: ESTABLISHED

Local Address: ORDINATOUR:50583

Remote Address: 65.55.53.190:HTTP

Type: TCP

Process: [system Idle Process]

State: TIME_WAIT

Local Address: ORDINATOUR:50549

Remote Address: A92-123-19-17.DEPLOY.AKAMAITECHNOLOGIES.COM:HTTP

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: ESTABLISHED

Local Address: ORDINATOUR:50529

Remote Address: 213-248-111-27.CUSTOMER.TELIACARRIER.COM:HTTP

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: ESTABLISHED

Local Address: ORDINATOUR:50528

Remote Address: 213-248-111-27.CUSTOMER.TELIACARRIER.COM:HTTP

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: ESTABLISHED

Local Address: ORDINATOUR:50029

Remote Address: 66.212.228.131:4400

Type: TCP

Process: C:\poker\Poker 770\casino.exe

State: ESTABLISHED

Local Address: ORDINATOUR:49972

Remote Address: 66.212.228.136:4690

Type: TCP

Process: C:\poker\Poker 770\casino.exe

State: ESTABLISHED

Local Address: ORDINATOUR:49971

Remote Address: 66.212.228.134:4630

Type: TCP

Process: C:\poker\Poker 770\casino.exe

State: ESTABLISHED

Local Address: ORDINATOUR:49970

Remote Address: SUB-144IP116.E-COMMERCEPARK.COM:6344

Type: TCP

Process: C:\poker\Poker 770\casino.exe

State: ESTABLISHED

Local Address: ORDINATOUR:49534

Remote Address: SN1MSG1020115.PHX.GBL:MSNP

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: ESTABLISHED

Local Address: ORDINATOUR:NETBIOS-SSN

Remote Address: 0.0.0.0:0

Type: TCP

Process: System

State: LISTENING

Local Address: ORDINATOUR:50548

Remote Address: LOCALHOST:10080

Type: TCP

Process: C:\Program Files\Mozilla Firefox\firefox.exe

State: ESTABLISHED

Local Address: ORDINATOUR:50527

Remote Address: LOCALHOST:10080

Type: TCP

Process: C:\Program Files\Mozilla Firefox\firefox.exe

State: ESTABLISHED

Local Address: ORDINATOUR:50526

Remote Address: LOCALHOST:10080

Type: TCP

Process: C:\Program Files\Mozilla Firefox\firefox.exe

State: ESTABLISHED

Local Address: ORDINATOUR:49542

Remote Address: LOCALHOST:49539

Type: TCP

Process: C:\Program Files\Windows Live\Messenger\msnmsgr.exe

State: ESTABLISHED

Local Address: ORDINATOUR:49539

Remote Address: LOCALHOST:49542

Type: TCP

Process: C:\Program Files\Windows Live\Messenger\msnmsgr.exe

State: ESTABLISHED

Local Address: ORDINATOUR:49539

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\Windows Live\Messenger\msnmsgr.exe

State: LISTENING

Local Address: ORDINATOUR:49533

Remote Address: LOCALHOST:11863

Type: TCP

Process: C:\Program Files\Windows Live\Messenger\msnmsgr.exe

State: ESTABLISHED

Local Address: ORDINATOUR:49190

Remote Address: LOCALHOST:49189

Type: TCP

Process: C:\Program Files\Mozilla Firefox\firefox.exe

State: ESTABLISHED

Local Address: ORDINATOUR:49189

Remote Address: LOCALHOST:49190

Type: TCP

Process: C:\Program Files\Mozilla Firefox\firefox.exe

State: ESTABLISHED

Local Address: ORDINATOUR:49186

Remote Address: LOCALHOST:49185

Type: TCP

Process: C:\Program Files\Mozilla Firefox\firefox.exe

State: ESTABLISHED

Local Address: ORDINATOUR:49185

Remote Address: LOCALHOST:49186

Type: TCP

Process: C:\Program Files\Mozilla Firefox\firefox.exe

State: ESTABLISHED

Local Address: ORDINATOUR:27015

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

State: LISTENING

Local Address: ORDINATOUR:18080

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: LISTENING

Local Address: ORDINATOUR:15190

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: LISTENING

Local Address: ORDINATOUR:15050

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: LISTENING

Local Address: ORDINATOUR:13128

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: LISTENING

Local Address: ORDINATOUR:11863

Remote Address: LOCALHOST:49533

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: ESTABLISHED

Local Address: ORDINATOUR:11863

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: LISTENING

Local Address: ORDINATOUR:10110

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgemc.exe

State: LISTENING

Local Address: ORDINATOUR:10080

Remote Address: LOCALHOST:50574

Type: TCP

Process: [system Idle Process]

State: TIME_WAIT

Local Address: ORDINATOUR:10080

Remote Address: LOCALHOST:50548

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: ESTABLISHED

Local Address: ORDINATOUR:10080

Remote Address: LOCALHOST:50527

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: ESTABLISHED

Local Address: ORDINATOUR:10080

Remote Address: LOCALHOST:50526

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: ESTABLISHED

Local Address: ORDINATOUR:10080

Remote Address: LOCALHOST:50523

Type: TCP

Process: [system Idle Process]

State: TIME_WAIT

Local Address: ORDINATOUR:10080

Remote Address: LOCALHOST:50522

Type: TCP

Process: [system Idle Process]

State: TIME_WAIT

Local Address: ORDINATOUR:10080

Remote Address: LOCALHOST:50520

Type: TCP

Process: [system Idle Process]

State: TIME_WAIT

Local Address: ORDINATOUR:10080

Remote Address: LOCALHOST:50460

Type: TCP

Process: [system Idle Process]

State: TIME_WAIT

Local Address: ORDINATOUR:10080

Remote Address: LOCALHOST:50434

Type: TCP

Process: [system Idle Process]

State: TIME_WAIT

Local Address: ORDINATOUR:10080

Remote Address: LOCALHOST:50428

Type: TCP

Process: [system Idle Process]

State: TIME_WAIT

Local Address: ORDINATOUR:10080

Remote Address: LOCALHOST:50424

Type: TCP

Process: [system Idle Process]

State: TIME_WAIT

Local Address: ORDINATOUR:10080

Remote Address: LOCALHOST:50420

Type: TCP

Process: [system Idle Process]

State: TIME_WAIT

Local Address: ORDINATOUR:10080

Remote Address: LOCALHOST:50406

Type: TCP

Process: [system Idle Process]

State: TIME_WAIT

Local Address: ORDINATOUR:10080

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe

State: LISTENING

Local Address: ORDINATOUR:5354

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\Bonjour\mDNSResponder.exe

State: LISTENING

Local Address: ORDINATOUR:3826

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\Acer\Acer VCM\RS_Service.exe

State: LISTENING

Local Address: ORDINATOUR:49156

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Windows\System32\services.exe

State: LISTENING

Local Address: ORDINATOUR:49155

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Windows\System32\lsass.exe

State: LISTENING

Local Address: ORDINATOUR:49154

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Windows\System32\svchost.exe

State: LISTENING

Local Address: ORDINATOUR:49153

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Windows\System32\svchost.exe

State: LISTENING

Local Address: ORDINATOUR:49152

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Windows\System32\wininit.exe

State: LISTENING

Local Address: ORDINATOUR:10000

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

State: LISTENING

Local Address: ORDINATOUR:8384

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

State: LISTENING

Local Address: ORDINATOUR:5357

Remote Address: 0.0.0.0:0

Type: TCP

Process: System

State: LISTENING

Local Address: ORDINATOUR:5151

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

State: LISTENING

Local Address: ORDINATOUR:3261

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

State: LISTENING

Local Address: ORDINATOUR:3260

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

State: LISTENING

Local Address: ORDINATOUR:MICROSOFT-DS

Remote Address: 0.0.0.0:0

Type: TCP

Process: System

State: LISTENING

Local Address: ORDINATOUR:EPMAP

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Windows\System32\svchost.exe

State: LISTENING

Local Address: ORDINATOUR:52834

Remote Address: NA

Type: UDP

Process: C:\Windows\System32\svchost.exe

State: NA

Local Address: ORDINATOUR:5353

Remote Address: NA

Type: UDP

Process: C:\Program Files\Bonjour\mDNSResponder.exe

State: NA

Local Address: ORDINATOUR:SSDP

Remote Address: NA

Type: UDP

Process: C:\Windows\System32\svchost.exe

State: NA

Local Address: ORDINATOUR:138

Remote Address: NA

Type: UDP

Process: System

State: NA

Local Address: ORDINATOUR:NETBIOS-NS

Remote Address: NA

Type: UDP

Process: System

State: NA

Local Address: ORDINATOUR:DISCARD

Remote Address: NA

Type: UDP

Process: C:\Program Files\Windows Live\Messenger\msnmsgr.exe

State: NA

Local Address: ORDINATOUR:57453

Remote Address: NA

Type: UDP

Process: C:\poker\Poker 770\casino.exe

State: NA

Local Address: ORDINATOUR:54868

Remote Address: NA

Type: UDP

Process: C:\Program Files\Windows Live\Contacts\wlcomm.exe

State: NA

Local Address: ORDINATOUR:54010

Remote Address: NA

Type: UDP

Process: C:\Program Files\Windows Live\Mail\wlmail.exe

State: NA

Local Address: ORDINATOUR:52835

Remote Address: NA

Type: UDP

Process: C:\Windows\System32\svchost.exe

State: NA

Local Address: ORDINATOUR:50771

Remote Address: NA

Type: UDP

Process: C:\Program Files\Windows Live\Messenger\msnmsgr.exe

State: NA

Local Address: ORDINATOUR:SSDP

Remote Address: NA

Type: UDP

Process: C:\Windows\System32\svchost.exe

State: NA

Local Address: ORDINATOUR:57580

Remote Address: NA

Type: UDP

Process: C:\Windows\System32\svchost.exe

State: NA

Local Address: ORDINATOUR:55461

Remote Address: NA

Type: UDP

Process: C:\Program Files\Bonjour\mDNSResponder.exe

State: NA

Local Address: ORDINATOUR:49152

Remote Address: NA

Type: UDP

Process: C:\Program Files\Bonjour\mDNSResponder.exe

State: NA

Local Address: ORDINATOUR:10001

Remote Address: NA

Type: UDP

Process: C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

State: NA

Local Address: ORDINATOUR:LLMNR

Remote Address: NA

Type: UDP

Process: C:\Windows\System32\svchost.exe

State: NA

Local Address: ORDINATOUR:UPNP-DISCOVERY

Remote Address: NA

Type: UDP

Process: C:\Windows\System32\svchost.exe

State: NA

Local Address: ORDINATOUR:UPNP-DISCOVERY

Remote Address: NA

Type: UDP

Process: C:\Windows\System32\svchost.exe

State: NA

Local Address: ORDINATOUR:123

Remote Address: NA

Type: UDP

Process: C:\Windows\System32\svchost.exe

State: NA

********************************************************************************

**********

********************************************************************************

**********

Hidden files/folders:

Object: C:\System Volume Information\MountPointManagerRemoteDatabase

Status: Access denied

Object: C:\System Volume Information\SPP

Status: Access denied

Object: C:\System Volume Information\tracking.log

Status: Access denied

Object: C:\System Volume Information\Windows Backup

Status: Access denied

Object: C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}

Status: Access denied

Object: C:\System Volume Information\{e8bac45d-f888-11de-97ea-00238b48d06c}{3808876b-c176-4e48-b7ae-04046e6cc752}

Status: Access denied

Object: C:\System Volume Information\{e8bac464-f888-11de-97ea-00238b48d06c}{3808876b-c176-4e48-b7ae-04046e6cc752}

Status: Access denied

Object: C:\Users\Rogemont\Music\FRANCAISSS\Les Fatals Picards\Les Fatals Picards - Le Sens De La Gravite´

Status: Hidden

Object: C:\Users\Rogemont\Music\FRANCAISSS\zebda\Zebda - Le Bruit Et L'odeur\05. La bete (J-M-L-P).mp3

Status: Hidden

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl

Status: Access denied

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl

Status: Access denied

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl

Status: Access denied

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl

Status: Access denied

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTkerberos.etl

Status: Access denied

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMsMpPsSession.etl

Status: Access denied

pear · le 4 janvier 2010

Le rapport Rsit, svp.

raskaline · le 4 janvier 2010

désolé je n'avais pas vu le deuxième téléchargement,

voici le log txt :

Logfile of random's system information tool 1.06 (written by random/random)

Run by Rogemont at 2010-01-04 17:17:57

Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2

System drive C: has 13 GB (9%) free of 153 GB

Total RAM: 3066 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:18:13, on 04/01/2010

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18865)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\SuperCopier2\SuperCopier2.exe

C:\Users\Rogemont\AppData\Local\Temp\RtkBtMnt.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\System32\mobsync.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\poker\Poker 770\casino.exe

C:\Windows\system32\taskeng.exe

C:\Users\Rogemont\Downloads\SysProt\SysProt\SysProt.exe

C:\Program Files\AVG\AVG8\avgui.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\Users\Rogemont\Downloads\RSIT.exe

C:\Program Files\Trend Micro\HijackThis\Rogemont.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a...m=aspire_6930zg

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.ijji.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a...m=aspire_6930zg

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - (no file)

O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe

O4 - HKLM\..\Run: [bkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"

O4 - HKLM\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [skytel] Skytel.exe

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [superCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe