Mon system32.exe est contaminer par un worm

Salut

Fais un nouveau scan avec malewarebayte antimalware et poste le rapport stp

@+

merci green day pour ta repense rapide ,desolé pour se retard j'ai fait un scanne complet avec malrewarebyte et voici le rapport(en meme temps avira me signaler des elements suspect que j'eliminer) merci beaucoup

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2069
Windows 5.1.2600 Service Pack 1

2009/05/03 17:09:18
mbam-log-2009-05-03 (17-09-18).txt

Type de recherche: Examen complet (C:\|F:\|H:\|)
Eléments examinés: 274091
Temps écoulé: 2 hour(s), 26 minute(s), 54 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
H:\internet02\logicieles\ACIDE SONY\keygen\keygen.exe.VIR (Trojan.Downloader) -> Quarantined and deleted successfully.
H:\internet02\VIRTUAL PC5\Nouveau dossier (4)\MSKey4in1.exe (Malware.Tool) -> Quarantined and deleted successfully.

j'aimerai ajouter qu' aprés avoire redéméré mon pc, demander par malwrebyte, le rundll32.exe perciste toujours ainsi que le processus svchost.exe qui consomme 68% de l'uc selement lorsque je suis connecter ,et ma connection est toujours ralentie meci de m'aidé.

re,

# Téléchargez ComboFix (par sUBs) sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
# Désactivez vos logiciels de protection avant de lancer Combofix.
# Double-cliquez ComboFix.exe (Sous Vista, il faut cliquer droit sur ComboFix.exe et choisir Exécuter en tant qu'administrateur).
# A l'apparition du message d'alerte, acceptez les conditions d'utilisation puis suivez les instructions.
# Il est vivement recommandé d'installer la Console de récupération ! (Sous XP)
# Le rapport sera créé dans : C:/Combofix.txt.
# Réactivez vos logiciels de protection.

==> poste le rapport stp

@+

merci encore green day pour ces répenses rapides ,voici le rapport de combofix
malheureusement rundll32.exe est toujours la!!!

ComboFix 09-05-02.4 - USER 2009/05/03 18:06.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.33.1036.18.991.696 [GMT 2:00]
Lancé depuis: c:\documents and settings\USER\Bureau\ComboFix.exe

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Fonts\DUKEPLUS.TTF
c:\windows\Fonts\RIYADH.TTF
c:\windows\IE4 Error Log.txt
c:\windows\secure32.html
c:\windows\system32\paytime.exe
c:\windows\system32\prsgrc.dll
c:\windows\system32\pYGgQqss.ini
c:\windows\system32\ssprs.dll
c:\windows\system32\wservice.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-03 au 2009-05-03 ))))))))))))))))))))))))))))))))))))
.

2009-07-10 05:12 . 2009-07-10 05:14 -------- d-----w c:\documents and settings\USER\Application Data\gtk-2.0
2009-07-10 04:19 . 2009-07-10 04:19 -------- d-----w c:\documents and settings\USER\Application Data\Inkscape
2009-05-03 11:35 . 2009-05-03 11:35 -------- d-----w c:\program files\Trend Micro
2009-05-03 04:53 . 2009-05-03 04:53 -------- d-----w c:\program files\TeaTimer (Spybot - Search & Destroy)
2009-05-03 04:53 . 2009-05-03 04:53 -------- d-----w c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-05-03 04:53 . 2009-05-03 04:53 -------- d-----w c:\program files\SDHelper (Spybot - Search & Destroy)
2009-05-03 04:53 . 2009-05-03 04:53 -------- d-----w c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-05-02 18:06 . 2009-05-02 18:06 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-05-01 14:57 . 2009-05-01 14:57 -------- d-----w C:\Sandbox
2009-04-30 10:20 . 2009-04-30 10:22 -------- d-----w c:\program files\Unlocker
2009-04-28 14:36 . 2009-04-28 14:36 141312 ----a-w c:\windows\system32\drivers\sp_rsdrv2.sys
2009-04-28 14:36 . 2009-04-28 14:40 -------- d-----w c:\documents and settings\All Users\Application Data\Spyware Terminator
2009-04-28 13:22 . 2009-04-28 18:43 -------- d-----w c:\documents and settings\USER\Application Data\Spyware Terminator
2009-04-18 20:57 . 2009-04-18 20:57 -------- d-----w c:\documents and settings\USER\Application Data\vlc
2009-04-18 00:06 . 2009-04-18 00:06 -------- d-----w c:\documents and settings\All Users\Application Data\DFX
2009-04-07 16:14 . 2009-04-07 16:14 -------- d-----w c:\temp\IMTmpFiles
2009-04-03 22:40 . 2009-04-03 22:40 16896 ----a-w c:\windows\system32\fltlib.dll
2009-04-03 21:17 . 2009-04-03 21:41 -------- d-----w c:\windows\system32\logs
2009-04-03 16:53 . 2009-04-03 16:53 -------- dc----w c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-03 16:11 . 2005-07-09 22:28 6 ---ha-w c:\windows\Tasks\SA.DAT
2009-05-02 03:19 . 2008-01-23 21:37 7518 ----a-w c:\windows\system32\KGyGaAvL.sys
2009-04-30 15:23 . 2008-05-05 02:11 -------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2009-04-28 14:20 . 2008-01-13 22:35 -------- d-----w c:\program files\InfoClock Screensaver
2009-04-27 14:18 . 2008-01-20 20:43 74 ----a-w c:\documents and settings\USER\Application Data\fspro2_0.tmp
2009-04-25 06:17 . 2008-11-21 07:15 290816 ------w c:\windows\Setup1.exe
2009-04-25 05:24 . 2004-12-13 04:59 -------- d-----w c:\program files\ACD Systems
2009-04-25 05:07 . 2007-04-17 19:06 -------- d-----w c:\program files\Sonique
2009-04-25 04:35 . 2008-08-07 05:28 -------- d-----w c:\program files\QuickTime
2009-04-24 12:54 . 2004-01-31 16:50 -------- d-----w c:\program files\SMWLink3.0
2009-04-20 09:42 . 2008-06-30 07:01 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-18 20:51 . 2006-12-29 22:29 -------- d-----w c:\program files\VideoLAN
2009-04-16 23:44 . 2008-10-05 23:04 -------- d-----w c:\program files\MSECache
2009-04-06 13:32 . 2008-07-19 10:09 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2008-06-30 07:01 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-29 12:49 . 2001-10-02 18:18 89290 ----a-w c:\windows\system32\perfc00C.dat
2009-03-29 12:49 . 2001-10-02 18:18 509704 ----a-w c:\windows\system32\perfh00C.dat
2009-03-28 00:13 . 2008-01-08 03:01 -------- d-----w c:\program files\eMachineShop
2009-03-27 14:48 . 2007-05-08 20:21 -------- d-----w c:\program files\Magic Video Converter
2009-03-25 17:57 . 2008-10-12 12:31 -------- d-----w c:\program files\Fichiers communs\Elecard
2009-03-24 00:03 . 2009-03-02 20:59 -------- d-----w c:\program files\The GodFather
2009-03-18 09:36 . 2008-04-27 18:16 -------- d-----w c:\program files\The KMPlayer
2009-03-17 13:17 . 2009-03-17 13:17 668 ----a-w C:\ICSdata.dat
2009-03-12 04:23 . 2004-01-29 20:41 -------- d-----w c:\program files\girder
2009-03-12 04:17 . 2005-07-17 18:37 -------- d-----w c:\program files\DVBViewerTE
2009-02-11 05:25 . 2002-08-29 10:44 1024 ----a-w c:\windows\system32\o1t0dis.dll
2009-02-11 05:25 . 2002-08-29 10:44 1024 ----a-w c:\windows\system32\grcauth2.dll
2009-02-11 05:25 . 2002-08-29 10:44 1024 ----a-w c:\windows\system32\grcauth1.dll
2009-02-11 05:25 . 2002-08-29 10:44 1024 ----a-w c:\windows\system32\clauth2.dll
2009-02-11 05:25 . 2002-08-29 10:44 1024 ----a-w c:\windows\system32\clauth1.dll
2009-02-07 05:01 . 2005-07-15 02:00 348832 ----a-w c:\documents and settings\USER\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2007-07-18 15:49 . 2007-07-18 11:17 158 ----a-w c:\program files\Compression.ini
2004-10-01 13:00 . 2007-03-24 17:36 40960 ----a-w c:\program files\Uninstall_CDS.exe
2004-08-25 00:00 . 2004-08-25 00:00 680 ----a-w c:\program files\mpc2.reg
2004-08-25 00:00 . 2004-08-25 00:00 596 ----a-w c:\program files\mpc1.reg
2004-08-25 00:00 . 2004-08-25 00:00 3476 ----a-w c:\program files\mpc7.reg
2004-08-25 00:00 . 2004-08-25 00:00 3026 ----a-w c:\program files\mpc3.reg
2004-08-25 00:00 . 2004-08-25 00:00 18156 ----a-w c:\program files\mpc6.reg
2004-08-25 00:00 . 2004-08-25 00:00 15752 ----a-w c:\program files\mpc5.reg
1996-12-02 16:44 . 1996-12-02 16:44 582144 ----a-w c:\program files\Fichiers communs\dao350.dll
2009-01-05 23:35 . 2007-10-30 16:42 67688 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2009-01-05 23:35 . 2007-10-30 16:42 54368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2009-01-05 23:35 . 2007-10-30 16:42 34944 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2009-01-05 23:35 . 2007-10-30 16:42 46712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2009-01-05 23:35 . 2007-10-30 16:42 172136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2008-10-11 05:29 . 2008-10-11 05:29 0 --sh--w c:\windows\S9EEE61AB.tmp
2008-08-06 06:03 . 2008-08-06 05:51 88 --sh--r c:\windows\system32\[u]0/uCACBFD60A.sys
2008-01-23 21:38 . 2008-01-23 21:37 56 --sha-r c:\windows\system32\3FA179BFAE.sys
2007-10-14 15:14 . 2007-10-14 14:56 88 --sh--r c:\windows\system32\AEBF79A13F.sys
2008-05-19 17:48 . 2008-02-04 20:56 499744 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-05-19 17:48 . 2008-02-04 20:56 87584 --sha-w c:\windows\system32\drivers\fidbox2.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DS Clock"="c:\program files\DS Clock\dsclock.exe" [2005-02-14 331776]
"ctfmon.exe"="c:\windows\System32\ctfmon.exe" [2002-08-29 13312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-07-15 98304]
"C-Media Mixer"="Mixer.exe" - c:\windows\mixer.exe [2003-03-20 1855488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\ctfmon.exe" [2002-08-29 13312]

c:\documents and settings\USER\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers winlirc.exe.lnk - c:\nouveau dossier\Nouveau dossier (7)\winlirc.exe [2008-1-24 98304]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Server4PC.lnk - c:\program files\TechniSat DVB\bin\Server4PC.exe [2008-8-30 450560]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave3"= serwvdrv.dll
"wave4"= serwvdrv.dll
"wave5"= serwvdrv.dll
"wave6"= serwvdrv.dll
"wave7"= serwvdrv.dll
"wave8"= serwvdrv.dll
"wave9"= serwvdrv.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^InterVideo WinCinema Manager.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\InterVideo WinCinema Manager.lnk
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^USER^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=c:\documents and settings\USER\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^USER^Menu Démarrer^Programmes^Démarrage^Sonic CinePlayer Quick Launch.lnk]
path=c:\documents and settings\USER\Menu Démarrer\Programmes\Démarrage\Sonic CinePlayer Quick Launch.lnk
backup=c:\windows\pss\Sonic CinePlayer Quick Launch.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\USER\\Mes documents\\Ad-Aware 2008 Pro 7.1.0.11 Multilenguaje\\Ad-Aware 2008 7.1.0.1 Español\\App\\AdAware\\Ad-Aware.exe"=

R2 HidCom;USB-HID -> COM Driver Service;c:\windows\system32\DRIVERS\HidCom.sys [2001-08-24 69575]
R3 GT680xNT;ColorPage-Vivid 1200XE;c:\windows\system32\drivers\gt680x.sys [2003-02-26 17376]
R3 MBAMDrvService;MBAMDrvService;c:\windows\System32\drivers\mbam.sys [2009-04-06 15504]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
R3 SIVDRIVER;SIV Kernel Driver;c:\windows\System32\Drivers\SIVX32.sys [2007-11-14 44000]
R3 tap0801co;TAP-Win32 Adapter V8 (coLinux);c:\windows\system32\DRIVERS\tap0801co.sys [2006-08-31 25856]
R3 usb2vcom;USB to Serial Bridge Controller;c:\windows\system32\Drivers\usb2vcom.sys [2005-09-02 28928]
S0 avgntmgr;avgntmgr;c:\windows\SYSTEM32\DRIVERS\avgntmgr.sys [2008-01-21 22336]
S1 avgntdd;avgntdd;c:\windows\system32\DRIVERS\avgntdd.sys [2008-07-18 45376]
S1 hwinterface;hwinterface;c:\windows\system32\Drivers\hwinterface.sys [2004-10-26 3026]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\System32\drivers\sp_rsdrv2.sys [2009-04-28 141312]
S2 mprmsg32;Multi-Protocol Router Service Messages DLL; [x]
S3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\DRIVERS\SkyNET.SYS [2004-10-13 462212]

.
.
------- Examen supplémentaire -------
.
uStart Page = about:blank
IE: &Tout télécharger avec FlashGet - c:\documents and settings\USER\Bureau\FlashGet\FlashGetPortable\App\FlashGet\jc_all.htm
IE: &Télécharger avec FlashGet - c:\documents and settings\USER\Bureau\FlashGet\FlashGetPortable\App\FlashGet\jc_link.htm
IE: &Télécharger avec NetTransport - c:\program files\Xi\NetTransport 2\NTAddLink.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Download All Links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
IE: Sothink SWF Catcher - c:\program files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
IE: Tout t&élécharger avec NetTransport - c:\program files\Xi\NetTransport 2\NTAddList.html
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
Trusted Zone: sat-television.com\www
TCP: {0D7F4480-B937-4671-B030-889FDFD02939} = 208.67.222.222 208.67.220.220
FF - ProfilePath - c:\documents and settings\USER\Application Data\Mozilla\Firefox\Profiles\yrvm81gp.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://fr.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - component: c:\documents and settings\USER\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-03 18:12
Windows 5.1.2600 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-343818398-1085031214-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{93A7C4A3-549D-3CD7-15A5-E83CBB0607A7}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iaeibekdhbeeakjgoh"=hex:6b,61,66,62,68,6c,6d,70,6a,6a,6a,66,65,67,62,64,67,68,
70,6b,70,6f,00,00
"hakihhigflcjhibi"=hex:6b,61,66,62,68,6c,6d,70,6a,6a,6a,66,65,67,62,64,67,68,
70,6b,70,6f,00,00

[HKEY_USERS\S-1-5-21-343818398-1085031214-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AD38FC91-F195-2EB8-1C4A-3760E35168D8}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iaphaalciecheeaelm"=hex:6a,61,62,61,62,6a,64,69,65,65,62,69,63,66,68,61,65,63,
62,6c,00,00
"hafjkkmbhcfkgimc"=hex:6a,61,62,61,62,6a,64,69,65,65,62,69,63,66,68,61,65,63,
62,6c,00,00

[HKEY_USERS\S-1-5-21-343818398-1085031214-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BD6587F7-EF57-9ADD-5D1C-CE3B9F56682D}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"abfhcfhpikcnkbgnklfjjhnhobbcdffbkc"=hex:6a,61,61,67,6e,6b,69,6c,6a,63,66,69,
6a,70,67,63,6f,66,63,68,00,00
"paphehedgfmlhhbegaemikmakiffkdck"=hex:69,61,6b,66,61,6e,66,67,70,64,6e,6f,6e,
6c,65,65,64,69,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):02,1e,3b,e2,d3,e0,23,f7,e7,f3,9e,03,ed,3d,d2,17,12,30,ec,fc,19,
72,90,43,e6,77,67,48,b1,50,05,35,79,21,f0,71,ff,ba,30,8b,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{93A7C4A3-549D-3CD7-15A5-E83CBB0607A7}\InProcServer32*]
"jagijhhapgdmjfmjgfof"=hex:6b,61,66,62,68,6c,6d,70,6a,6a,6a,66,65,67,62,64,67,
68,70,6b,70,6f,00,00
"iagipgnobklpopldfc"=hex:6b,61,66,62,68,6c,6d,70,6a,6a,6a,66,65,67,62,64,67,68,
70,6b,70,6f,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AD38FC91-F195-2EB8-1C4A-3760E35168D8}\InProcServer32*]
"jajjbblgjcajmcjjloil"=hex:6a,61,62,61,62,6a,64,69,65,65,62,69,63,66,68,61,65,
63,62,6c,00,00
"iajjlafghgbdjgiapd"=hex:6a,61,62,61,62,6a,64,69,65,65,62,69,63,66,68,61,65,63,
62,6c,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{c5554bbc-74b4-46f6-9f0c-286f2640ef2f}]
@Denied: (Full) (Everyone)
"Model"=dword:0000004f
"Therad"=dword:0000001e
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(940)
c:\windows\System32\ODBC32.dll
c:\windows\System32\msctfime.ime

- - - - - - - > 'lsass.exe'(996)
c:\windows\system32\MSVCRT40.dll
c:\windows\system32\MSVCIRT.dll
c:\windows\System32\dssenh.dll

- - - - - - - > 'explorer.exe'(1316)
c:\windows\System32\msctfime.ime
c:\windows\System32\msi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\rundll32.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\windows\system32\drivers\CDANTSRV.EXE
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\drivers\WtSrv.exe
.
**************************************************************************
.
Heure de fin: 2009-05-03 18:20 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-05-03 16:18

Avant-CF: 1 698 095 104 octets libres
Après-CF: 1 818 460 160 octets libres

winxpsp1_fr_pro_bf.exe

256

Rassure toi, on a pas encore fini !

Télécharge SDFix sur ton bureau : http://download.bleepingcomputer.com/andymanchesta/SDFix.exe
- Double clique sur SDFix qui à été créé sur le Bureau et installe le programme (l'installation va créer un dossier (par défaut à la racine du disque dur) nommé SDFix).
- Démarre en mode sans échec (impératif) sans passer par MSconfig : en tapotant la touche F8
- Vas dans c:/SDFix et double-clique sur RunThis.bat
- Appuie sur < Y > puis < Entrée >....Le nettoyage commence....patience...
- Le programme va te demander de relancer le PC, frappe une touche...
- Le nettoyage se termine...un rapport apparait...
- Copie/colle le contenu du fichier Report.txt dans ta prochaine réponse
NB : Le rapport se trouve aussi dans le dossier SDFix sous le nom Report.txt
- Si SDFix ne se lance pas :
- Clique sur Démarrer => Exécuter
- Copie/colle ceci : %systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe
- Clique sur <Ok>.
- Redémarre et essaie de relance SDFix.

==> poste le rapport stp

@+

resalue,voici le rapport sdfix

[b]SDFix: Version 1.240 [/b]
Run by Administrateur on 03/05/2009 at 19:20

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\TOOL1.EXE - Deleted
C:\WINDOWS\TOOL2.EXE - Deleted
C:\WINDOWS\TOOL3.EXE - Deleted
C:\WINDOWS\TOOL4.EXE - Deleted

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-03 19:43:11
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{93A7C4A3-549D-3CD7-15A5-E83CBB0607A7}]
"iaeibekdhbeeakjgoh"=hex:6b,61,66,62,68,6c,6d,70,6a,6a,6a,66,65,67,62,64,67,68,70,6b,70,..
"hakihhigflcjhibi"=hex:6b,61,66,62,68,6c,6d,70,6a,6a,6a,66,65,67,62,64,67,68,70,6b,70,..
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AD38FC91-F195-2EB8-1C4A-3760E35168D8}]
"iaphaalciecheeaelm"=hex:6a,61,62,61,62,6a,64,69,65,65,62,69,63,66,68,61,65,63,62,6c,00,..
"hafjkkmbhcfkgimc"=hex:6a,61,62,61,62,6a,64,69,65,65,62,69,63,66,68,61,65,63,62,6c,00,..
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BD6587F7-EF57-9ADD-5D1C-CE3B9F56682D}]
"abfhcfhpikcnkbgnklfjjhnhobbcdffbkc"=hex:6a,61,61,67,6e,6b,69,6c,6a,63,66,69,6a,70,67,63,6f,66,63,68,00,..
"paphehedgfmlhhbegaemikmakiffkdck"=hex:69,61,6b,66,61,6e,66,67,70,64,6e,6f,6e,6c,65,65,64,69,00,00

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Documents and Settings\\USER\\Mes documents\\Ad-Aware 2008 Pro 7.1.0.11 Multilenguaje\\Ad-Aware 2008 7.1.0.1 Español\\App\\AdAware\\Ad-Aware.exe"="C:\\Documents and Settings\\USER\\Mes documents\\Ad-Aware 2008 Pro 7.1.0.11 Multilenguaje\\Ad-Aware 2008 7.1.0.1 Español\\App\\AdAware\\Ad-Aware.exe:*:Enabled:AdAware"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\\DOCUME~1\\USER\\LOCALS~1\\Temp\\Rar$EX00.844\\Portable Google Earth 4.3.7284.3916 Beta Multilanguage\\App\\GoogleEarth\\googleearth.exe"="C:\\DOCUME~1\\USER\\LOCALS~1\\Temp\\Rar$EX00.844\\Portable Google Earth 4.3.7284.3916 Beta Multilanguage\\App\\GoogleEarth\\googleearth.exe:*:Enabled:GoogleEarth"
"C:\\Documents and Settings\\USER\\Local Settings\\Temp\\Rar$DR00.860\\ad aware 2007 pro 7.0.2.7 español\\App\\AdAware2007\\Ad-Aware2007.exe"="C:\\Documents and Settings\\USER\\Local Settings\\Temp\\Rar$DR00.860\\ad aware 2007 pro 7.0.2.7 español\\App\\AdAware2007\\Ad-Aware2007.exe:*:Enabled:AdAware2007"
"C:\\DOCUME~1\\USER\\LOCALS~1\\Temp\\Rar$EX00.672\\eMulePortable\\App\\eMule\\emule.exe"="C:\\DOCUME~1\\USER\\LOCALS~1\\Temp\\Rar$EX00.672\\eMulePortable\\App\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Documents and Settings\\USER\\Mes documents\\Ad-Aware 2008 Pro 7.1.0.11 Multilenguaje\\Ad-Aware 2008 7.1.0.1 Español\\App\\AdAware\\Ad-Aware.exe"="C:\\Documents and Settings\\USER\\Mes documents\\Ad-Aware 2008 Pro 7.1.0.11 Multilenguaje\\Ad-Aware 2008 7.1.0.1 Español\\App\\AdAware\\Ad-Aware.exe:*:Enabled:AdAware"

[b]Remaining Files [/b]:

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Tue 28 Sep 2004 301 ..SH. --- "C:\AUTOEXEC.BAK"
Sat 11 Oct 2008 0 ..SH. --- "C:\WINDOWS\S9EEE61AB.tmp"
Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\File Scanner Library (Spybot - Search & Destroy)\advcheck.dll"
Tue 20 Aug 2002 1,511,453 ...H. --- "C:\Program Files\Messenger\msmsgs.exe"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Misc. Support Library (Spybot - Search & Destroy)\Tools.dll"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\SDHelper (Spybot - Search & Destroy)\SDHelper.dll"
Thu 5 Mar 2009 2,260,480 A.SHR --- "C:\Program Files\TeaTimer (Spybot - Search & Destroy)\TeaTimer.exe"
Wed 6 Aug 2008 88 ..SHR --- "C:\WINDOWS\system32\0CACBFD60A.sys"
Wed 23 Jan 2008 56 A.SHR --- "C:\WINDOWS\system32\3FA179BFAE.sys"
Sun 14 Oct 2007 88 ..SHR --- "C:\WINDOWS\system32\AEBF79A13F.sys"
Thu 29 Aug 2002 16 ...H. --- "C:\WINDOWS\system32\nbfgj7h.dll"
Sat 30 Aug 2008 88 ..SHR --- "C:\Documents and Settings\All Users\Application Data\0CACBFD60A.sys"
Tue 29 Apr 2008 88 ..SHR --- "C:\Documents and Settings\All Users\Application Data\FFF0253AF9.sys"
Wed 13 Jul 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 2 Feb 2008 64,512 A..H. --- "C:\Documents and Settings\USER\Application Data\dach100.dll"
Fri 17 Apr 2009 49,152 A..H. --- "C:\Documents and Settings\USER\Application Data\Microsoft\Virtual PC\VPCKeyboard.dll"
Wed 13 Jul 2005 4,348 ...H. --- "C:\Documents and Settings\USER\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Fri 29 Dec 2006 20 A..H. --- "C:\Documents and Settings\USER\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Wed 13 Jul 2005 312 A.SH. --- "C:\Documents and Settings\USER\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"

[b]Finished![/b]

Re,

Ok,

Télécharge Gmer sur ton bureau : http://www.gmer.net

Déconnecte toi d'internet si possible et ferme tous les programmes.
Décompresse le fichier zip et double-clic sur gmer.exe
IMPORTANT Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.
Clic sur l'onglet "rootkit"
A droite, coche "Files" et "Services"
Clic sur Scan
Lorsque le scan est terminé, clique sur "copy"

Ouvre le bloc-note et clique sur le Menu Edition / Coller
Le rapport doit alors apparaître, poste le stp.

@+

bonjour,apres une nuit de scanne le resultat

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-05-04 09:40:51
Windows 5.1.2600 Service Pack 1

---- System - GMER 1.0.15 ----

SSDT F7E17BC4 ZwCreateThread
SSDT F7E17BB0 ZwOpenProcess
SSDT F7E17BB5 ZwOpenThread
SSDT F7E17BBF ZwTerminateProcess
SSDT F7E17BBA ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!KeInitializeInterrupt + B67 804DA23C 1 Byte [06]
.text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 1E0 8050265C 4 Bytes [C4, 7B, E1, F7]
.text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 2F4 80502770 4 Bytes [B0, 7B, E1, F7] {MOV AL, 0x7b; LOOPZ 0xfffffffffffffffb}
.text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 30C 80502788 4 Bytes [B5, 7B, E1, F7] {MOV CH, 0x7b; LOOPZ 0xfffffffffffffffb}
.text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 510 8050298C 4 Bytes [BF, 7B, E1, F7]
.text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 560 805029DC 4 Bytes [BA, 7B, E1, F7]
? C:\DOCUME~1\USER\LOCALS~1\Temp\catchme.sys Le fichier spécifié est introuvable. !

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs avgntmgr.sys (Avira AntiVir File Filter Driver Manager/Avira GmbH)
AttachedDevice \FileSystem\Fastfat \Fat avgntmgr.sys (Avira AntiVir File Filter Driver Manager/Avira GmbH)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}@scansk 0x02 0x1E 0x3B 0xE2 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{93A7C4A3-549D-3CD7-15A5-E83CBB0607A7}\InProcServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{93A7C4A3-549D-3CD7-15A5-E83CBB0607A7}\InProcServer32@jagijhhapgdmjfmjgfof 0x6B 0x61 0x66 0x62 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{93A7C4A3-549D-3CD7-15A5-E83CBB0607A7}\InProcServer32@iagipgnobklpopldfc 0x6B 0x61 0x66 0x62 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AD38FC91-F195-2EB8-1C4A-3760E35168D8}\InProcServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AD38FC91-F195-2EB8-1C4A-3760E35168D8}\InProcServer32@jajjbblgjcajmcjjloil 0x6A 0x61 0x62 0x61 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AD38FC91-F195-2EB8-1C4A-3760E35168D8}\InProcServer32@iajjlafghgbdjgiapd 0x6A 0x61 0x62 0x61 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{c5554bbc-74b4-46f6-9f0c-286f2640ef2f}@Model 79
Reg HKLM\SOFTWARE\Classes\CLSID\{c5554bbc-74b4-46f6-9f0c-286f2640ef2f}@Therad 30
Reg HKLM\SOFTWARE\Classes\CLSID\{c5554bbc-74b4-46f6-9f0c-286f2640ef2f}@MData 0xCB 0x9B 0xAD 0xEF ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{93A7C4A3-549D-3CD7-15A5-E83CBB0607A7}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{93A7C4A3-549D-3CD7-15A5-E83CBB0607A7}@iaeibekdhbeeakjgoh 0x6B 0x61 0x66 0x62 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{93A7C4A3-549D-3CD7-15A5-E83CBB0607A7}@hakihhigflcjhibi 0x6B 0x61 0x66 0x62 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AD38FC91-F195-2EB8-1C4A-3760E35168D8}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AD38FC91-F195-2EB8-1C4A-3760E35168D8}@iaphaalciecheeaelm 0x6A 0x61 0x62 0x61 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AD38FC91-F195-2EB8-1C4A-3760E35168D8}@hafjkkmbhcfkgimc 0x6A 0x61 0x62 0x61 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BD6587F7-EF57-9ADD-5D1C-CE3B9F56682D}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BD6587F7-EF57-9ADD-5D1C-CE3B9F56682D}@abfhcfhpikcnkbgnklfjjhnhobbcdffbkc 0x6A 0x61 0x61 0x67 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BD6587F7-EF57-9ADD-5D1C-CE3B9F56682D}@paphehedgfmlhhbegaemikmakiffkdck 0x69 0x61 0x6B 0x66 ...

---- EOF - GMER 1.0.15 ----

Salut,

ok, poste un nouveau hijack et précise l'évolution de la situation stp

@+

;-)

merci pour ta patience green day ,est bien toujours rundll32.exe au demarrage ,svchost 68% de l'uc connection toujours ralentie

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:31:48, on 2009/05/04
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\DS Clock\dsclock.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\taskmgr.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [DS Clock] "C:\Program Files\DS Clock\dsclock.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'Default user')
O4 - Startup: Raccourci vers winlirc.exe.lnk = C:\Nouveau dossier\Nouveau dossier (7)\winlirc.exe
O4 - Global Startup: Server4PC.lnk = C:\Program Files\TechniSat DVB\bin\Server4PC.exe
O8 - Extra context menu item: &Tout télécharger avec FlashGet - C:\Documents and Settings\USER\Bureau\FlashGet\FlashGetPortable\App\FlashGet\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - C:\Documents and Settings\USER\Bureau\FlashGet\FlashGetPortable\App\FlashGet\jc_link.htm
O8 - Extra context menu item: &Télécharger avec NetTransport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O8 - Extra context menu item: Tout t&élécharger avec NetTransport - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Add to TimeLeft Auction Watch - {21196042-830F-419f-A594-F9D456A6C29A} - C:\Program Files\TimeLeft3\TLIntergIE.html (HKCU)
O9 - Extra 'Tools' menuitem: Add to TimeLeft Auction Watch - {21196042-830F-419f-A594-F9D456A6C29A} - C:\Program Files\TimeLeft3\TLIntergIE.html (HKCU)
O12 - Plugin for .tif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin7.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D7F4480-B937-4671-B030-889FDFD02939}: NameServer = 208.67.222.222 208.67.220.220
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D7F4480-B937-4671-B030-889FDFD02939}: NameServer = 208.67.222.222 208.67.220.220
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Documents and Settings\USER\Mes documents\Ad-Aware 2008 Pro 7.1.0.11 Multilenguaje\Ad-Aware 2008 7.1.0.1 Español\App\AdAware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: HDD Information Service (HDDSvc) - Unknown owner - C:\Program Files\Hard Drive Inspector\HDDSvc.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Unknown owner - C:\DOCUME~1\USER\LOCALS~1\Temp\RarSFX2\sp_rsser.exe (file missing)
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\DRIVERS\WtSrv.exe

Re-salut,

Quel est le message d'erreur avec rundll32.exe ?

@+

bon il n'ya pas d'erreur avec rudll32 simplement il apparé au demarrage je le decouvre au gestinnaire de tache , mais le ralentissement de le connection a debuté lorsque rudll32 a commencé a apparaitre ainsi que svchost.exe pid 1196 qui commence a utilisé breacoup le systeme lorsque je suis connecté ,le probleme c que je sait qu'il ya quelque chose qui utilise ma connection meme si je ne surf pas ,voila j'espére n'avoir rien oublié

Ok; Rends toi sur ce site : https://www.virustotal.com/gui/

+ Cliquer sur Parcourir et chercher le fichier en gras à analyser : c:\windows\system32\rundll32.exe
+ Cliquer sur Send File
+ Attendre la fin du scan, le rapport doit comprendre la taille du fichier envoyé.
+ Sauvegarder le rapport avec le bloc-notes

==> poste le rapport stp

@+

voila le resultat

Fichier rundll32_ac0f912ea7571e9c1ad7b64c reçu le 2008.12.15 07:36:30 (CET)
Situation actuelle: terminé

Résultat: 0/38 (0.00%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.12.12.2 2008.12.15 -
AntiVir 7.9.0.45 2008.12.14 -
Authentium 5.1.0.4 2008.12.14 -
Avast 4.8.1281.0 2008.12.14 -
AVG 8.0.0.199 2008.12.14 -
BitDefender 7.2 2008.12.15 -
CAT-QuickHeal 10.00 2008.12.15 -
ClamAV 0.94.1 2008.12.15 -
Comodo 754 2008.12.14 -
DrWeb 4.44.0.09170 2008.12.14 -
eSafe 7.0.17.0 2008.12.14 -
eTrust-Vet 31.6.6258 2008.12.12 -
Ewido 4.0 2008.12.14 -
F-Prot 4.4.4.56 2008.12.14 -
F-Secure 8.0.14332.0 2008.12.15 -
Fortinet 3.117.0.0 2008.12.14 -
GData 19 2008.12.15 -
Ikarus T3.1.1.45.0 2008.12.15 -
K7AntiVirus 7.10.553 2008.12.13 -
Kaspersky 7.0.0.125 2008.12.15 -
McAfee 5464 2008.12.14 -
McAfee+Artemis 5464 2008.12.14 -
Microsoft 1.4205 2008.12.14 -
NOD32 3691 2008.12.14 -
Norman 5.80.02 2008.12.12 -
Panda 9.0.0.4 2008.12.14 -
PCTools 4.4.2.0 2008.12.14 -
Prevx1 V2 2008.12.15 -
Rising 21.07.62.00 2008.12.14 -
SecureWeb-Gateway 6.7.6 2008.12.14 -
Sophos 4.36.0 2008.12.15 -
Sunbelt 3.2.1801.2 2008.12.11 -
Symantec 10 2008.12.15 -
TheHacker 6.3.1.4.188 2008.12.14 -
TrendMicro 8.700.0.1004 2008.12.15 -
VBA32 3.12.8.10 2008.12.14 -
ViRobot 2008.12.15.1517 2008.12.15 -
VirusBuster 4.5.11.0 2008.12.14 -
Information additionnelle
File size: 32256 bytes
MD5...: ac0f912ea7571e9c1ad7b64c83f72bd9
SHA1..: 27c743a51da0c3a972f27e8e125a4fa30845d5bc
SHA256: 83e77bf02e75a965c2cbfebc9a4bcc7583c3507e2dba768b01452af707a34764
SHA512: fa7df089d5f8d27e83ac694f1c939315d7a5cc2bc751d7cd6d5c56349fe43be5
c7ece54f61243819ce7de7e2ada3a57a819f7017c0015abb8a02a5951b7a6959

ssdeep: 384:I/jUBoZXx5p7oNRhbHeJh8+oXBjxJd5IyYQGSbdkDjkoebjDIS09fNAWZjV:
I4BoZXNUbSEln5IyYpamDjobj8SMJ

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1001818
timedatestamp.....: 0x3b7d8492 (Fri Aug 17 20:54:42 2001)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xcc6 0xe00 5.88 6fb9e0c4af990799051d1c1a03a0630e
.data 0x2000 0x2c 0x200 0.09 13bc3d11970f7bb304eb058e83cefb1e
.rsrc 0x3000 0x6804 0x6a00 5.65 11da74a175f420d3e9c3f534701097bc

( 5 imports )
> msvcrt.dll: _except_handler3, wcslen, wcscpy
> KERNEL32.dll: FreeLibrary, LocalFree, GetProcAddress, lstrlenA, WideCharToMultiByte, LocalAlloc, FormatMessageW, GetLastError, LoadLibraryW, ActivateActCtx, CreateActCtxW, lstrcatW, lstrcpyW, lstrlenW, SearchPathW, GetFileAttributesW, ReleaseActCtx, DeactivateActCtx, SetErrorMode, ExitProcess, GetModuleHandleW, GetStartupInfoW, GetCommandLineW
> GDI32.dll: GetStockObject
> USER32.dll: LoadCursorW, LoadStringW, CharNextW, SetClassLongW, LoadIconW, DefWindowProcW, CreateWindowExW, RegisterClassW, wsprintfW, DestroyWindow, MessageBoxW
> IMAGEHLP.dll: ImageDirectoryEntryToData

( 0 exports )

Ok, Relance un scan avec combo et poste le stp

@+

;-)

merci pour se temps que tu me consacre green day

ComboFix 09-05-02.4 - USER 2009/05/04 19:22.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.33.1036.18.991.583 [GMT 2:00]
Lancé depuis: c:\documents and settings\USER\Bureau\ComboFix.exe

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

((((((((((((((((((((((((((((( Fichiers créés du 2009-04-04 au 2009-05-04 ))))))))))))))))))))))))))))))))))))
.

2009-07-10 05:12 . 2009-07-10 05:14 -------- d-----w c:\documents and settings\USER\Application Data\gtk-2.0
2009-07-10 04:19 . 2009-07-10 04:19 -------- d-----w c:\documents and settings\USER\Application Data\Inkscape
2009-05-03 17:15 . 2009-05-03 17:16 -------- d-----w c:\windows\ERUNT
2009-05-03 17:10 . 2009-05-03 17:49 -------- d-----w C:\SDFix
2009-05-03 11:35 . 2009-05-03 11:35 -------- d-----w c:\program files\Trend Micro
2009-05-03 04:53 . 2009-05-03 04:53 -------- d-----w c:\program files\TeaTimer (Spybot - Search & Destroy)
2009-05-03 04:53 . 2009-05-03 04:53 -------- d-----w c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-05-03 04:53 . 2009-05-03 04:53 -------- d-----w c:\program files\SDHelper (Spybot - Search & Destroy)
2009-05-03 04:53 . 2009-05-03 04:53 -------- d-----w c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-05-02 18:06 . 2009-05-02 18:06 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-05-01 14:57 . 2009-05-01 14:57 -------- d-----w C:\Sandbox
2009-04-30 10:20 . 2009-04-30 10:22 -------- d-----w c:\program files\Unlocker
2009-04-28 14:36 . 2009-04-28 14:36 141312 ----a-w c:\windows\system32\drivers\sp_rsdrv2.sys
2009-04-28 14:36 . 2009-04-28 14:40 -------- d-----w c:\documents and settings\All Users\Application Data\Spyware Terminator
2009-04-28 13:22 . 2009-04-28 18:43 -------- d-----w c:\documents and settings\USER\Application Data\Spyware Terminator
2009-04-18 20:57 . 2009-04-18 20:57 -------- d-----w c:\documents and settings\USER\Application Data\vlc
2009-04-18 00:06 . 2009-04-18 00:06 -------- d-----w c:\documents and settings\All Users\Application Data\DFX
2009-04-07 16:14 . 2009-04-07 16:14 -------- d-----w c:\temp\IMTmpFiles

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-04 17:21 . 2005-07-09 22:28 6 ---ha-w c:\windows\Tasks\SA.DAT
2009-05-02 03:19 . 2008-01-23 21:37 7518 ----a-w c:\windows\system32\KGyGaAvL.sys
2009-04-30 15:23 . 2008-05-05 02:11 -------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2009-04-28 14:20 . 2008-01-13 22:35 -------- d-----w c:\program files\InfoClock Screensaver
2009-04-27 14:18 . 2008-01-20 20:43 74 ----a-w c:\documents and settings\USER\Application Data\fspro2_0.tmp
2009-04-25 06:17 . 2008-11-21 07:15 290816 ------w c:\windows\Setup1.exe
2009-04-25 05:24 . 2004-12-13 04:59 -------- d-----w c:\program files\ACD Systems
2009-04-25 05:07 . 2007-04-17 19:06 -------- d-----w c:\program files\Sonique
2009-04-25 04:35 . 2008-08-07 05:28 -------- d-----w c:\program files\QuickTime
2009-04-24 12:54 . 2004-01-31 16:50 -------- d-----w c:\program files\SMWLink3.0
2009-04-20 09:42 . 2008-06-30 07:01 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-18 20:51 . 2006-12-29 22:29 -------- d-----w c:\program files\VideoLAN
2009-04-16 23:44 . 2008-10-05 23:04 -------- d-----w c:\program files\MSECache
2009-04-06 13:32 . 2008-07-19 10:09 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2008-06-30 07:01 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-03 22:40 . 2009-04-03 22:40 16896 ----a-w c:\windows\system32\fltlib.dll
2009-03-29 12:49 . 2001-10-02 18:18 89290 ----a-w c:\windows\system32\perfc00C.dat
2009-03-29 12:49 . 2001-10-02 18:18 509704 ----a-w c:\windows\system32\perfh00C.dat
2009-03-28 00:13 . 2008-01-08 03:01 -------- d-----w c:\program files\eMachineShop
2009-03-27 14:48 . 2007-05-08 20:21 -------- d-----w c:\program files\Magic Video Converter
2009-03-25 17:57 . 2008-10-12 12:31 -------- d-----w c:\program files\Fichiers communs\Elecard
2009-03-24 00:03 . 2009-03-02 20:59 -------- d-----w c:\program files\The GodFather
2009-03-18 09:36 . 2008-04-27 18:16 -------- d-----w c:\program files\The KMPlayer
2009-03-17 13:17 . 2009-03-17 13:17 668 ----a-w C:\ICSdata.dat
2009-03-12 04:23 . 2004-01-29 20:41 -------- d-----w c:\program files\girder
2009-03-12 04:17 . 2005-07-17 18:37 -------- d-----w c:\program files\DVBViewerTE
2009-02-11 05:25 . 2002-08-29 10:44 1024 ----a-w c:\windows\system32\o1t0dis.dll
2009-02-11 05:25 . 2002-08-29 10:44 1024 ----a-w c:\windows\system32\grcauth2.dll
2009-02-11 05:25 . 2002-08-29 10:44 1024 ----a-w c:\windows\system32\grcauth1.dll
2009-02-11 05:25 . 2002-08-29 10:44 1024 ----a-w c:\windows\system32\clauth2.dll
2009-02-11 05:25 . 2002-08-29 10:44 1024 ----a-w c:\windows\system32\clauth1.dll
2009-02-07 05:01 . 2005-07-15 02:00 348832 ----a-w c:\documents and settings\USER\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2007-07-18 15:49 . 2007-07-18 11:17 158 ----a-w c:\program files\Compression.ini
2004-10-01 13:00 . 2007-03-24 17:36 40960 ----a-w c:\program files\Uninstall_CDS.exe
2004-08-25 00:00 . 2004-08-25 00:00 680 ----a-w c:\program files\mpc2.reg
2004-08-25 00:00 . 2004-08-25 00:00 596 ----a-w c:\program files\mpc1.reg
2004-08-25 00:00 . 2004-08-25 00:00 3476 ----a-w c:\program files\mpc7.reg
2004-08-25 00:00 . 2004-08-25 00:00 3026 ----a-w c:\program files\mpc3.reg
2004-08-25 00:00 . 2004-08-25 00:00 18156 ----a-w c:\program files\mpc6.reg
2004-08-25 00:00 . 2004-08-25 00:00 15752 ----a-w c:\program files\mpc5.reg
1996-12-02 16:44 . 1996-12-02 16:44 582144 ----a-w c:\program files\Fichiers communs\dao350.dll
2009-01-05 23:35 . 2007-10-30 16:42 67688 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2009-01-05 23:35 . 2007-10-30 16:42 54368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2009-01-05 23:35 . 2007-10-30 16:42 34944 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2009-01-05 23:35 . 2007-10-30 16:42 46712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2009-01-05 23:35 . 2007-10-30 16:42 172136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2008-10-11 05:29 . 2008-10-11 05:29 0 --sh--w c:\windows\S9EEE61AB.tmp
2008-08-06 06:03 . 2008-08-06 05:51 88 --sh--r c:\windows\system32\[u]0/uCACBFD60A.sys
2008-01-23 21:38 . 2008-01-23 21:37 56 --sha-r c:\windows\system32\3FA179BFAE.sys
2007-10-14 15:14 . 2007-10-14 14:56 88 --sh--r c:\windows\system32\AEBF79A13F.sys
2008-05-19 17:48 . 2008-02-04 20:56 499744 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-05-19 17:48 . 2008-02-04 20:56 87584 --sha-w c:\windows\system32\drivers\fidbox2.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-05-03_16.12.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-03 17:16 . 2009-05-03 17:16 8192 c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0/u0000002\UsrClass.dat
+ 2009-05-03 17:16 . 2009-05-03 17:16 8192 c:\windows\ERUNT\SDFIX\Users\[u]0/u0000002\UsrClass.dat
+ 2009-05-03 17:16 . 2009-05-03 17:16 716800 c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0/u0000001\ntuser.dat
+ 2009-05-03 17:16 . 2008-08-07 13:27 163328 c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-05-03 17:16 . 2009-05-03 17:16 716800 c:\windows\ERUNT\SDFIX\Users\[u]0/u0000001\ntuser.dat
+ 2009-05-03 17:16 . 2008-08-07 13:27 163328 c:\windows\ERUNT\SDFIX\ERDNT.EXE
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DS Clock"="c:\program files\DS Clock\dsclock.exe" [2005-02-14 331776]
"ctfmon.exe"="c:\windows\System32\ctfmon.exe" [2002-08-29 13312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-07-15 98304]
"C-Media Mixer"="Mixer.exe" - c:\windows\mixer.exe [2003-03-20 1855488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\ctfmon.exe" [2002-08-29 13312]

c:\documents and settings\USER\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers winlirc.exe.lnk - c:\nouveau dossier\Nouveau dossier (7)\winlirc.exe [2008-1-24 98304]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Server4PC.lnk - c:\program files\TechniSat DVB\bin\Server4PC.exe [2008-8-30 450560]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave3"= serwvdrv.dll
"wave4"= serwvdrv.dll
"wave5"= serwvdrv.dll
"wave6"= serwvdrv.dll
"wave7"= serwvdrv.dll
"wave8"= serwvdrv.dll
"wave9"= serwvdrv.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^InterVideo WinCinema Manager.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\InterVideo WinCinema Manager.lnk
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^USER^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=c:\documents and settings\USER\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^USER^Menu Démarrer^Programmes^Démarrage^Sonic CinePlayer Quick Launch.lnk]
path=c:\documents and settings\USER\Menu Démarrer\Programmes\Démarrage\Sonic CinePlayer Quick Launch.lnk
backup=c:\windows\pss\Sonic CinePlayer Quick Launch.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\USER\\Mes documents\\Ad-Aware 2008 Pro 7.1.0.11 Multilenguaje\\Ad-Aware 2008 7.1.0.1 Español\\App\\AdAware\\Ad-Aware.exe"=

R2 HidCom;USB-HID -> COM Driver Service;c:\windows\system32\DRIVERS\HidCom.sys [2001-08-24 69575]
R2 mprmsg32;Multi-Protocol Router Service Messages DLL; [x]
R3 GT680xNT;ColorPage-Vivid 1200XE;c:\windows\system32\drivers\gt680x.sys [2003-02-26 17376]
R3 MBAMDrvService;MBAMDrvService;c:\windows\System32\drivers\mbam.sys [2009-04-06 15504]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
R3 SIVDRIVER;SIV Kernel Driver;c:\windows\System32\Drivers\SIVX32.sys [2007-11-14 44000]
R3 tap0801co;TAP-Win32 Adapter V8 (coLinux);c:\windows\system32\DRIVERS\tap0801co.sys [2006-08-31 25856]
R3 usb2vcom;USB to Serial Bridge Controller;c:\windows\system32\Drivers\usb2vcom.sys [2005-09-02 28928]
S0 avgntmgr;avgntmgr;c:\windows\SYSTEM32\DRIVERS\avgntmgr.sys [2008-01-21 22336]
S1 avgntdd;avgntdd;c:\windows\system32\DRIVERS\avgntdd.sys [2008-07-18 45376]
S1 hwinterface;hwinterface;c:\windows\system32\Drivers\hwinterface.sys [2004-10-26 3026]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\System32\drivers\sp_rsdrv2.sys [2009-04-28 141312]
S3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\DRIVERS\SkyNET.SYS [2004-10-13 462212]

.
.
------- Examen supplémentaire -------
.
uStart Page = about:blank
IE: &Tout télécharger avec FlashGet - c:\documents and settings\USER\Bureau\FlashGet\FlashGetPortable\App\FlashGet\jc_all.htm
IE: &Télécharger avec FlashGet - c:\documents and settings\USER\Bureau\FlashGet\FlashGetPortable\App\FlashGet\jc_link.htm
IE: &Télécharger avec NetTransport - c:\program files\Xi\NetTransport 2\NTAddLink.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Download All Links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
IE: Sothink SWF Catcher - c:\program files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
IE: Tout t&élécharger avec NetTransport - c:\program files\Xi\NetTransport 2\NTAddList.html
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
Trusted Zone: sat-television.com\www
TCP: {0D7F4480-B937-4671-B030-889FDFD02939} = 208.67.222.222 208.67.220.220
FF - ProfilePath - c:\documents and settings\USER\Application Data\Mozilla\Firefox\Profiles\yrvm81gp.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://fr.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - component: c:\documents and settings\USER\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-04 19:27
Windows 5.1.2600 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-343818398-1085031214-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{93A7C4A3-549D-3CD7-15A5-E83CBB0607A7}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iaeibekdhbeeakjgoh"=hex:6b,61,66,62,68,6c,6d,70,6a,6a,6a,66,65,67,62,64,67,68,
70,6b,70,6f,00,00
"hakihhigflcjhibi"=hex:6b,61,66,62,68,6c,6d,70,6a,6a,6a,66,65,67,62,64,67,68,
70,6b,70,6f,00,00

[HKEY_USERS\S-1-5-21-343818398-1085031214-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AD38FC91-F195-2EB8-1C4A-3760E35168D8}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iaphaalciecheeaelm"=hex:6a,61,62,61,62,6a,64,69,65,65,62,69,63,66,68,61,65,63,
62,6c,00,00
"hafjkkmbhcfkgimc"=hex:6a,61,62,61,62,6a,64,69,65,65,62,69,63,66,68,61,65,63,
62,6c,00,00

[HKEY_USERS\S-1-5-21-343818398-1085031214-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BD6587F7-EF57-9ADD-5D1C-CE3B9F56682D}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"abfhcfhpikcnkbgnklfjjhnhobbcdffbkc"=hex:6a,61,61,67,6e,6b,69,6c,6a,63,66,69,
6a,70,67,63,6f,66,63,68,00,00
"paphehedgfmlhhbegaemikmakiffkdck"=hex:69,61,6b,66,61,6e,66,67,70,64,6e,6f,6e,
6c,65,65,64,69,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):02,1e,3b,e2,d3,e0,23,f7,e7,f3,9e,03,ed,3d,d2,17,12,30,ec,fc,19,
72,90,43,e6,77,67,48,b1,50,05,35,79,21,f0,71,ff,ba,30,8b,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{93A7C4A3-549D-3CD7-15A5-E83CBB0607A7}\InProcServer32*]
"jagijhhapgdmjfmjgfof"=hex:6b,61,66,62,68,6c,6d,70,6a,6a,6a,66,65,67,62,64,67,
68,70,6b,70,6f,00,00
"iagipgnobklpopldfc"=hex:6b,61,66,62,68,6c,6d,70,6a,6a,6a,66,65,67,62,64,67,68,
70,6b,70,6f,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AD38FC91-F195-2EB8-1C4A-3760E35168D8}\InProcServer32*]
"jajjbblgjcajmcjjloil"=hex:6a,61,62,61,62,6a,64,69,65,65,62,69,63,66,68,61,65,
63,62,6c,00,00
"iajjlafghgbdjgiapd"=hex:6a,61,62,61,62,6a,64,69,65,65,62,69,63,66,68,61,65,63,
62,6c,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{c5554bbc-74b4-46f6-9f0c-286f2640ef2f}]
@Denied: (Full) (Everyone)
"Model"=dword:0000004f
"Therad"=dword:0000001e
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,f5,e5,c7,da,f4,f5,57,2d,fe,aa,63,64,dc,92,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(936)
c:\windows\System32\ODBC32.dll
c:\windows\System32\msctfime.ime

- - - - - - - > 'lsass.exe'(992)
c:\windows\System32\dssenh.dll

- - - - - - - > 'explorer.exe'(1236)
c:\windows\System32\msctfime.ime
c:\windows\System32\msi.dll
.
Heure de fin: 2009-05-04 19:32
ComboFix-quarantined-files.txt 2009-05-04 17:31
ComboFix2.txt 2009-05-03 16:20

Avant-CF: 2 102 439 936 octets libres
Après-CF: 2 169 552 896 octets libres

244

Ok, c'est parti !

1) Rendre visible les fichiers cachés et système
panneau de configuration > options des dossiers > onglet affichage
Cocher la case devant " afficher les fichiers et dossiers cachés "
Décocher la case devant " masquer les extensions des fichiers dont le type est connu"
Décocher la case devant " masquer les fichiers protégés du système"
clic sur [Appliquer] puis sur [ok] pour valider

2) Toujours sur le site virustotal, analyse les fichiers en gras stp et poste les rapports !

C:\WINDOWS\system32\nbfgj7h.dll
c:\windows\system32\o1t0dis.dll

c:\windows\system32\AEBF79A13F.sys
c:\windows\system32\3FA179BFAE.sys
c:\windows\system32\0CACBFD60A.sys

C:\Documents and Settings\All Users\Application Data\FFF0253AF9.sys
C:\Documents and Settings\All Users\Application Data\0CACBFD60A.sys

@+

;-)

le rapport des 9 fichiers

Fichier nbfgj7h.dll reçu le 2009.05.05 00:02:00 (CET)
Situation actuelle: terminé

Résultat: 0/40 (0.00%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.05.04 -
AhnLab-V3 5.0.0.2 2009.05.04 -
AntiVir 7.9.0.160 2009.05.04 -
Antiy-AVL 2.0.3.1 2009.04.30 -
Authentium 5.1.2.4 2009.05.04 -
Avast 4.8.1335.0 2009.05.04 -
AVG 8.5.0.327 2009.05.04 -
BitDefender 7.2 2009.05.04 -
CAT-QuickHeal 10.00 2009.05.04 -
ClamAV 0.94.1 2009.05.04 -
Comodo 1149 2009.05.03 -
DrWeb 4.44.0.09170 2009.05.04 -
eSafe 7.0.17.0 2009.05.03 -
eTrust-Vet 31.6.6488 2009.05.04 -
F-Prot 4.4.4.56 2009.05.04 -
F-Secure 8.0.14470.0 2009.05.04 -
Fortinet 3.117.0.0 2009.05.04 -
GData 19 2009.05.04 -
Ikarus T3.1.1.49.0 2009.05.04 -
K7AntiVirus 7.10.723 2009.05.04 -
Kaspersky 7.0.0.125 2009.05.04 -
McAfee 5605 2009.05.04 -
McAfee+Artemis 5605 2009.05.04 -
McAfee-GW-Edition 6.7.6 2009.05.04 -
Microsoft 1.4602 2009.05.04 -
NOD32 4052 2009.05.04 -
Norman 6.01.05 2009.05.04 -
nProtect 2009.1.8.0 2009.05.04 -
Panda 10.0.0.14 2009.05.04 -
PCTools 4.4.2.0 2009.05.03 -
Prevx1 3.0 2009.05.05 -
Rising 21.28.04.00 2009.05.04 -
Sophos 4.41.0 2009.05.04 -
Sunbelt 3.2.1858.2 2009.05.04 -
Symantec 1.4.4.12 2009.05.04 -
TheHacker 6.3.4.1.318 2009.05.04 -
TrendMicro 8.950.0.1092 2009.05.04 -
VBA32 3.12.10.4 2009.05.04 -
ViRobot 2009.5.4.1719 2009.05.04 -
VirusBuster 4.6.5.0 2009.05.04 -
Information additionnelle
File size: 16 bytes
MD5...: 7a6d7ed4ae4833c39db8ab57bf186a1b
SHA1..: 219f2f77ec4e1b48ff6c7f9fd9e1cd56e66cd38b
SHA256: a7f66a8e7400d64eff64afd7e84164b8b58df954c83e69da6e2b61cafbb61f30
SHA512: b94f1002be629f35368bf3d4f6430966670ff674e820996e73d3b918a7ba5b1f
8022c9e1ceee2437d44625b6e0ddb92628a98b19ad5e87a718a6ddcee93475eb
ssdeep: 3:ShVpne:SDJe

PEiD..: -
TrID..: File type identification
Unknown!
PEInfo: -
PDFiD.: -
RDS...: NSRL Reference Data Set

Fichier o1t0dis.dll reçu le 2009.05.05 00:05:49 (CET)
Situation actuelle: terminé

Résultat: 0/40 (0.00%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.05.04 -
AhnLab-V3 5.0.0.2 2009.05.04 -
AntiVir 7.9.0.160 2009.05.04 -
Antiy-AVL 2.0.3.1 2009.04.30 -
Authentium 5.1.2.4 2009.05.04 -
Avast 4.8.1335.0 2009.05.04 -
AVG 8.5.0.327 2009.05.04 -
BitDefender 7.2 2009.05.04 -
CAT-QuickHeal 10.00 2009.05.04 -
ClamAV 0.94.1 2009.05.04 -
Comodo 1149 2009.05.03 -
DrWeb 4.44.0.09170 2009.05.04 -
eSafe 7.0.17.0 2009.05.03 -
eTrust-Vet 31.6.6488 2009.05.04 -
F-Prot 4.4.4.56 2009.05.04 -
F-Secure 8.0.14470.0 2009.05.04 -
Fortinet 3.117.0.0 2009.05.04 -
GData 19 2009.05.04 -
Ikarus T3.1.1.49.0 2009.05.04 -
K7AntiVirus 7.10.723 2009.05.04 -
Kaspersky 7.0.0.125 2009.05.04 -
McAfee 5605 2009.05.04 -
McAfee+Artemis 5605 2009.05.04 -
McAfee-GW-Edition 6.7.6 2009.05.04 -
Microsoft 1.4602 2009.05.04 -
NOD32 4052 2009.05.04 -
Norman 6.01.05 2009.05.04 -
nProtect 2009.1.8.0 2009.05.04 -
Panda 10.0.0.14 2009.05.04 -
PCTools 4.4.2.0 2009.05.03 -
Prevx1 3.0 2009.05.05 -
Rising 21.28.04.00 2009.05.04 -
Sophos 4.41.0 2009.05.04 -
Sunbelt 3.2.1858.2 2009.05.04 -
Symantec 1.4.4.12 2009.05.04 -
TheHacker 6.3.4.1.318 2009.05.04 -
TrendMicro 8.950.0.1092 2009.05.04 -
VBA32 3.12.10.4 2009.05.04 -
ViRobot 2009.5.4.1719 2009.05.04 -
VirusBuster 4.6.5.0 2009.05.04 -
Information additionnelle
File size: 1024 bytes
MD5...: 6ffd6419086cba3ddfa17ce90cdac742
SHA1..: 699cf6b77fb513097dafe362b6b4b9378da3a2ee
SHA256: a254462c5d2eab1583facbc3b027a88e2a4002cf0f1e14ddda018141922cf818
SHA512: f7202f7615a0aab9a4ba6e71fe747fee61d10c33fd502bbe9b4d15cd2266619c
a725618e3ce2d60261ac8aad14d7f0494cf194e8fc564458d0df4ab434a9c12c
ssdeep: 6:R/R05XpzmwrKemsN/RdDQF1//RGV70Wdc2QleLuMbuxdX3CkZwGCdcw:/05Xpz
G6TdM3RGF0WK8uHJwjKw

PEiD..: -
TrID..: File type identification
Unknown!
PEInfo: -
PDFiD.: -
RDS...: NSRL Reference Data Set

Fichier AEBF79A13F.sys reçu le 2009.05.05 00:07:41 (CET)
Situation actuelle: terminé

Résultat: 0/40 (0.00%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.05.04 -
AhnLab-V3 5.0.0.2 2009.05.04 -
AntiVir 7.9.0.160 2009.05.04 -
Antiy-AVL 2.0.3.1 2009.04.30 -
Authentium 5.1.2.4 2009.05.04 -
Avast 4.8.1335.0 2009.05.04 -
AVG 8.5.0.327 2009.05.04 -
BitDefender 7.2 2009.05.04 -
CAT-QuickHeal 10.00 2009.05.04 -
ClamAV 0.94.1 2009.05.04 -
Comodo 1149 2009.05.03 -
DrWeb 4.44.0.09170 2009.05.05 -
eSafe 7.0.17.0 2009.05.03 -
eTrust-Vet 31.6.6488 2009.05.04 -
F-Prot 4.4.4.56 2009.05.04 -
F-Secure 8.0.14470.0 2009.05.04 -
Fortinet 3.117.0.0 2009.05.04 -
GData 19 2009.05.04 -
Ikarus T3.1.1.49.0 2009.05.04 -
K7AntiVirus 7.10.723 2009.05.04 -
Kaspersky 7.0.0.125 2009.05.04 -
McAfee 5605 2009.05.04 -
McAfee+Artemis 5605 2009.05.04 -
McAfee-GW-Edition 6.7.6 2009.05.04 -
Microsoft 1.4602 2009.05.04 -
NOD32 4052 2009.05.04 -
Norman 6.01.05 2009.05.04 -
nProtect 2009.1.8.0 2009.05.04 -
Panda 10.0.0.14 2009.05.04 -
PCTools 4.4.2.0 2009.05.03 -
Prevx1 3.0 2009.05.05 -
Rising 21.28.04.00 2009.05.04 -
Sophos 4.41.0 2009.05.04 -
Sunbelt 3.2.1858.2 2009.05.04 -
Symantec 1.4.4.12 2009.05.04 -
TheHacker 6.3.4.1.318 2009.05.04 -
TrendMicro 8.950.0.1092 2009.05.04 -
VBA32 3.12.10.4 2009.05.04 -
ViRobot 2009.5.4.1719 2009.05.04 -
VirusBuster 4.6.5.0 2009.05.04 -
Information additionnelle
File size: 88 bytes
MD5...: 4f9f159a64c35dcb196aeebdc985acb8
SHA1..: f92af4aade4bcc34fda6aba0d6f8ecf166cc99a0
SHA256: c7a57d0231fee45c545c7204d52bca5a444cda6f575f7ab4f2c7553f0e860803
SHA512: 1a6dfeb850135c83c955cda1942ee6b326cd4a49f5394746a8f2641ffaeae23b
60c2a658f45ebda7ad768a57d196ccca2a0733b413d9e1bd3e10058278dc68c5
ssdeep: 3:hl/JgMlll/VEo:K2VEo

PEiD..: -
TrID..: File type identification
MS Flight Simulator Aircraft Performance Info (100.0%)
PEInfo: -
PDFiD.: -
RDS...: NSRL Reference Data Set

Fichier 3FA179BFAE.sys reçu le 2009.05.05 00:10:04 (CET)
Situation actuelle: terminé

Résultat: 0/40 (0.00%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.05.04 -
AhnLab-V3 5.0.0.2 2009.05.04 -
AntiVir 7.9.0.160 2009.05.04 -
Antiy-AVL 2.0.3.1 2009.04.30 -
Authentium 5.1.2.4 2009.05.04 -
Avast 4.8.1335.0 2009.05.04 -
AVG 8.5.0.327 2009.05.04 -
BitDefender 7.2 2009.05.04 -
CAT-QuickHeal 10.00 2009.05.04 -
ClamAV 0.94.1 2009.05.04 -
Comodo 1149 2009.05.03 -
DrWeb 4.44.0.09170 2009.05.05 -
eSafe 7.0.17.0 2009.05.03 -
eTrust-Vet 31.6.6488 2009.05.04 -
F-Prot 4.4.4.56 2009.05.04 -
F-Secure 8.0.14470.0 2009.05.04 -
Fortinet 3.117.0.0 2009.05.04 -
GData 19 2009.05.04 -
Ikarus T3.1.1.49.0 2009.05.04 -
K7AntiVirus 7.10.723 2009.05.04 -
Kaspersky 7.0.0.125 2009.05.04 -
McAfee 5605 2009.05.04 -
McAfee+Artemis 5605 2009.05.04 -
McAfee-GW-Edition 6.7.6 2009.05.04 -
Microsoft 1.4602 2009.05.04 -
NOD32 4052 2009.05.04 -
Norman 6.01.05 2009.05.04 -
nProtect 2009.1.8.0 2009.05.04 -
Panda 10.0.0.14 2009.05.04 -
PCTools 4.4.2.0 2009.05.03 -
Prevx1 3.0 2009.05.05 -
Rising 21.28.04.00 2009.05.04 -
Sophos 4.41.0 2009.05.04 -
Sunbelt 3.2.1858.2 2009.05.04 -
Symantec 1.4.4.12 2009.05.04 -
TheHacker 6.3.4.1.318 2009.05.04 -
TrendMicro 8.950.0.1092 2009.05.04 -
VBA32 3.12.10.4 2009.05.04 -
ViRobot 2009.5.4.1719 2009.05.04 -
VirusBuster 4.6.5.0 2009.05.04 -
Information additionnelle
File size: 56 bytes
MD5...: 5316d6bdd5227317dbef12f7f5ddfbcf
SHA1..: 92ee49a673eb785773469bea03b9d27fd243845b
SHA256: ebe4932e65087d288b321c54575833f1843fa002cbecb742ada418f598bfe3e0
SHA512: 84cadf65c4aa642e2c1b810398713c5842d57ba2cd8441ce7f585404b1eae63e
4dd59d22e2a5643af04db96db1a82992aca80a120e7a1e74625f66be3d641cee
ssdeep: 3:/ldEVXbTZX:8

PEiD..: -
TrID..: File type identification
MS Flight Simulator Aircraft Performance Info (100.0%)
PEInfo: -
PDFiD.: -
RDS...: NSRL Reference Data Set

Fichier 0CACBFD60A.sys reçu le 2009.05.05 00:11:49 (CET)
Situation actuelle: terminé

Résultat: 0/40 (0.00%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.05.04 -
AhnLab-V3 5.0.0.2 2009.05.04 -
AntiVir 7.9.0.160 2009.05.04 -
Antiy-AVL 2.0.3.1 2009.04.30 -
Authentium 5.1.2.4 2009.05.04 -
Avast 4.8.1335.0 2009.05.04 -
AVG 8.5.0.327 2009.05.04 -
BitDefender 7.2 2009.05.04 -
CAT-QuickHeal 10.00 2009.05.04 -
ClamAV 0.94.1 2009.05.04 -
Comodo 1149 2009.05.03 -
DrWeb 4.44.0.09170 2009.05.05 -
eSafe 7.0.17.0 2009.05.03 -
eTrust-Vet 31.6.6488 2009.05.04 -
F-Prot 4.4.4.56 2009.05.04 -
F-Secure 8.0.14470.0 2009.05.04 -
Fortinet 3.117.0.0 2009.05.04 -
GData 19 2009.05.04 -
Ikarus T3.1.1.49.0 2009.05.04 -
K7AntiVirus 7.10.723 2009.05.04 -
Kaspersky 7.0.0.125 2009.05.04 -
McAfee 5605 2009.05.04 -
McAfee+Artemis 5605 2009.05.04 -
McAfee-GW-Edition 6.7.6 2009.05.04 -
Microsoft 1.4602 2009.05.04 -
NOD32 4052 2009.05.04 -
Norman 6.01.05 2009.05.04 -
nProtect 2009.1.8.0 2009.05.04 -
Panda 10.0.0.14 2009.05.04 -
PCTools 4.4.2.0 2009.05.03 -
Prevx1 3.0 2009.05.05 -
Rising 21.28.04.00 2009.05.04 -
Sophos 4.41.0 2009.05.04 -
Sunbelt 3.2.1858.2 2009.05.04 -
Symantec 1.4.4.12 2009.05.04 -
TheHacker 6.3.4.1.318 2009.05.04 -
TrendMicro 8.950.0.1092 2009.05.04 -
VBA32 3.12.10.4 2009.05.04 -
ViRobot 2009.5.4.1719 2009.05.04 -
VirusBuster 4.6.5.0 2009.05.04 -
Information additionnelle
File size: 88 bytes
MD5...: f52f238c4988871ab8b8eeb5e9d52665
SHA1..: c8054f8bf2a9273709a53b215ff083a4554d04f1
SHA256: f8c25358458fdb12a604eef48acac5873d351b1ffd2c91b2fc3fcb3343324a08
SHA512: 393d7415fa92b5d1302756e15c56b9cba8a586814615aa7539fd7e773ae78026
559b081f7d975ef260d393c8cc127d76cdd595a22e8847da8f0e3204384834c8
ssdeep: 3:hl/hdYfEVe4n:9dA4n

PEiD..: -
TrID..: File type identification
MS Flight Simulator Aircraft Performance Info (100.0%)
PEInfo: -
PDFiD.: -
RDS...: NSRL Reference Data Set

Fichier FFF0253AF9.sys reçu le 2009.05.05 00:17:07 (CET)
Situation actuelle: terminé

Résultat: 0/40 (0.00%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.05.04 -
AhnLab-V3 5.0.0.2 2009.05.04 -
AntiVir 7.9.0.160 2009.05.04 -
Antiy-AVL 2.0.3.1 2009.04.30 -
Authentium 5.1.2.4 2009.05.04 -
Avast 4.8.1335.0 2009.05.04 -
AVG 8.5.0.327 2009.05.04 -
BitDefender 7.2 2009.05.04 -
CAT-QuickHeal 10.00 2009.05.04 -
ClamAV 0.94.1 2009.05.04 -
Comodo 1149 2009.05.03 -
DrWeb 4.44.0.09170 2009.05.05 -
eSafe 7.0.17.0 2009.05.03 -
eTrust-Vet 31.6.6488 2009.05.04 -
F-Prot 4.4.4.56 2009.05.04 -
F-Secure 8.0.14470.0 2009.05.04 -
Fortinet 3.117.0.0 2009.05.04 -
GData 19 2009.05.04 -
Ikarus T3.1.1.49.0 2009.05.04 -
K7AntiVirus 7.10.723 2009.05.04 -
Kaspersky 7.0.0.125 2009.05.04 -
McAfee 5605 2009.05.04 -
McAfee+Artemis 5605 2009.05.04 -
McAfee-GW-Edition 6.7.6 2009.05.04 -
Microsoft 1.4602 2009.05.04 -
NOD32 4052 2009.05.04 -
Norman 6.01.05 2009.05.04 -
nProtect 2009.1.8.0 2009.05.04 -
Panda 10.0.0.14 2009.05.04 -
PCTools 4.4.2.0 2009.05.03 -
Prevx1 3.0 2009.05.05 -
Rising 21.28.04.00 2009.05.04 -
Sophos 4.41.0 2009.05.04 -
Sunbelt 3.2.1858.2 2009.05.04 -
Symantec 1.4.4.12 2009.05.04 -
TheHacker 6.3.4.1.318 2009.05.04 -
TrendMicro 8.950.0.1092 2009.05.04 -
VBA32 3.12.10.4 2009.05.04 -
ViRobot 2009.5.4.1719 2009.05.04 -
VirusBuster 4.6.5.0 2009.05.04 -
Information additionnelle
File size: 88 bytes
MD5...: 7f41ebcb5b841354ad842551942162c8
SHA1..: b26d60e5084f224737c6bd9bd0c53679bc7cc1b4
SHA256: 81d4781522a3e9e5e3e4bca0b017b04e6c484f0df8ebc124ad6b189e47e3b3d9
SHA512: 3c6cca20a98a7073a3c6b956a88ace03a83eb198dfa9ba7d84cea951a9a86305
09bed3cf74921b0c37cec6f77557d603c01a8dc5b45b33e421376b9c13ccd637
ssdeep: 3:hl/Vr7tlOLjruM:ELj3

PEiD..: -
TrID..: File type identification
MS Flight Simulator Aircraft Performance Info (100.0%)
PEInfo: -
PDFiD.: -
RDS...: NSRL Reference Data Set

Fichier 0CACBFD60A.sys reçu le 2009.05.05 00:14:13 (CET)
Situation actuelle: terminé

Résultat: 0/40 (0.00%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.05.04 -
AhnLab-V3 5.0.0.2 2009.05.04 -
AntiVir 7.9.0.160 2009.05.04 -
Antiy-AVL 2.0.3.1 2009.04.30 -
Authentium 5.1.2.4 2009.05.04 -
Avast 4.8.1335.0 2009.05.04 -
AVG 8.5.0.327 2009.05.04 -
BitDefender 7.2 2009.05.04 -
CAT-QuickHeal 10.00 2009.05.04 -
ClamAV 0.94.1 2009.05.04 -
Comodo 1149 2009.05.03 -
DrWeb 4.44.0.09170 2009.05.05 -
eSafe 7.0.17.0 2009.05.03 -
eTrust-Vet 31.6.6488 2009.05.04 -
F-Prot 4.4.4.56 2009.05.04 -
F-Secure 8.0.14470.0 2009.05.04 -
Fortinet 3.117.0.0 2009.05.04 -
GData 19 2009.05.04 -
Ikarus T3.1.1.49.0 2009.05.04 -
K7AntiVirus 7.10.723 2009.05.04 -
Kaspersky 7.0.0.125 2009.05.04 -
McAfee 5605 2009.05.04 -
McAfee+Artemis 5605 2009.05.04 -
McAfee-GW-Edition 6.7.6 2009.05.04 -
Microsoft 1.4602 2009.05.04 -
NOD32 4052 2009.05.04 -
Norman 6.01.05 2009.05.04 -
nProtect 2009.1.8.0 2009.05.04 -
Panda 10.0.0.14 2009.05.04 -
PCTools 4.4.2.0 2009.05.03 -
Prevx1 3.0 2009.05.05 -
Rising 21.28.04.00 2009.05.04 -
Sophos 4.41.0 2009.05.04 -
Sunbelt 3.2.1858.2 2009.05.04 -
Symantec 1.4.4.12 2009.05.04 -
TheHacker 6.3.4.1.318 2009.05.04 -
TrendMicro 8.950.0.1092 2009.05.04 -
VBA32 3.12.10.4 2009.05.04 -
ViRobot 2009.5.4.1719 2009.05.04 -
VirusBuster 4.6.5.0 2009.05.04 -
Information additionnelle
File size: 88 bytes
MD5...: e0ddcbb603ae474e0de8c4cfeadb14be
SHA1..: 0dcedeb12ffe4627a3fa6f1b83a796f7fcd3a1e3
SHA256: 06b3c5bb55e0a65cc51793a75adf6a5e5c63d6b12fb27d4f47047e289700ab6f
SHA512: 6b51887f90842f149dbc706c51ea50f5c3ee4d682920eab87f6c5b0bd5269381
42ec32aeeae5e4d486f306c254b04b922fb53a79e0c639d809d047caed9392fd
ssdeep: 3:hl/Vr7tlgT:O

PEiD..: -
TrID..: File type identification
MS Flight Simulator Aircraft Performance Info (100.0%)
PEInfo: -
PDFiD.: -
RDS...: NSRL Reference Data Set

sorry 7 fichiers :-)