Infections Malwarebyte Résolu

Question

Bonsoir,

Malwarebytes' vient de finir une analyse. Le programme me rapporte 3 infections. Voici le résultat : 

Malwarebytes' Anti-Malware 1.40 
Version de la base de données: 2623 
Windows 5.1.2600 Service Pack 3 

14/08/2009 21:15:44 
Malwarebytes infections 

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|) 
Eléments examinés: 174893 
Temps écoulé: 2 hour(s), 9 minute(s), 6 second(s) 

Processus mémoire infecté(s): 0 
Module(s) mémoire infecté(s): 0 
Clé(s) du Registre infectée(s): 0 
Valeur(s) du Registre infectée(s): 0 
Elément(s) de données du Registre infecté(s): 0 
Dossier(s) infecté(s): 0 
Fichier(s) infecté(s): 3 

Processus mémoire infecté(s): 
(Aucun élément nuisible détecté) 

Module(s) mémoire infecté(s): 
(Aucun élément nuisible détecté) 

Clé(s) du Registre infectée(s): 
(Aucun élément nuisible détecté) 

Valeur(s) du Registre infectée(s): 
(Aucun élément nuisible détecté) 

Elément(s) de données du Registre infecté(s): 
(Aucun élément nuisible détecté) 

Dossier(s) infecté(s): 
(Aucun élément nuisible détecté) 

Fichier(s) infecté(s): 
C:\Program Files\ISP\AOL9\comps\fw
isale.exe (Adware.BHO) -> No action taken. 
C:\WINDOWS\GnuHashes.ini (Malware.Trace) -> No action taken. 
C:\WINDOWS\system32\GroupPolicy000.dat (Malware.Trace) -> No action taken. 

Je me demande ce que je dois faire à cette étape ? Dois je ignorer ces éléments ou m'en inquiéter et dans les deux cas, comment dois je procéder ? 

Configuration: Windows XP Internet Explorer 8.0
Lire la suite

nihat42 · Answer

Bonjour,

C:\Program Files\ISP\AOL9\comps\fw
isale.exe (Adware.BHO) -> No action taken.
C:\WINDOWS\GnuHashes.ini (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\GroupPolicy000.dat (Malware.Trace) -> No action taken. 

Il faut appuyer sur "Supprimer la sélection"

_____________________________________________________________________________________

&#9679;Télécharge GenProc  (de Jean-Chretien1 et Narco4) sur ton bureau 


&#9679;Déconnecte toi et ferme tes applications en cours 


&#9679; double-clique sur GenProc.exe. 

&#9679;Réponds par oui a la question qui sera posée. 

&#9679;Laisse le scanner ton PC ... 

&#9679;Poste le rapport

&#9658;Aide en images

Thomas · Answer

Rapport GenProc 2.615 [1] - ven. 14/08/2009 à 22:26:15 
@ Windows XP Service Pack 3 - Mode normal
@ Internet Explorer (8.0.6001.18702) [Navigateur par défaut]

# Etape 1/ Télécharge :
 
- CCleaner https://www.ccleaner.com/ccleaner/download (FileHippo). Ce logiciel va permettre de supprimer tous les fichiers temporaires. Lance-le et clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. Ferme le programme.

- Lop S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2 (Eric 71 & Angeldark) sur ton Bureau.


 Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/  ; Choisis ta session courante *** Thomas *** (pour retrouver le rapport, clique sur le raccourci "Rapport GenProc[1]" sur ton bureau).


# Etape 2/ 

 Double-clique sur Lop S&D pour lancer l'installation, séléctionne la langue souhaitée, puis choisis l'Option 2 - Suppression - et patiente jusqu'à ce qu'il ait terminé.

# Etape 3/ 

 Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 4/ 

 Redémarre normalement et poste, dans la même réponse : 

- Le contenu du rapport lopR.txt situé dans C:\ ; 
- Un nouveau rapport HijackThis http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ;
- Un nouveau rapport GenProc ;

 Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

~~ Arguments de la procédure ~~


# Détections [1] GenProc 2.615 ven. 14/08/2009 à 22:26:30 
Lop:le ven. 14/08/2009 à 22:27:11 "C:\Program Files\Adverts" 

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à 22:27:36 ~~

Thomas · Answer

Je suis donc cette procédure ?

Thomas · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free :         Intel(R) Pentium(R) M processor 1.73GHz )
   BIOS : Phoenix NoteBIOS 4.0 Release 6.0     
   USER : Thomas ( Administrator )
   BOOT : Fail-safe boot
   Antivirus : AVG Anti-Virus 8.5 (Activated)
   C:\ (Local Disk) - NTFS - Total:32 Go (Free:5 Go)
   D:\ (Local Disk) - NTFS - Total:34 Go (Free:25 Go)
   F:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( ven. 14/08/2009|23:33 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\Thomas\LOCALS~1\Temp\msgpl_2214.tmp
   Supprime! - C:\DOCUME~1\Thomas\LOCALS~1\Temp\msgpl_b245.tmp
   Supprime! - C:\Program Files\Adverts
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [27/11/2008|20:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [11/02/2009|16:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [01/07/2007|21:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [25/12/2006|14:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [22/02/2009|14:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg8
   [29/12/2007|19:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
   [20/12/2008|23:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\E31C
   [29/01/2009|00:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ESET
   [13/07/2005|13:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intel
   [30/11/2005|16:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Anti-Virus Personal
   [26/05/2009|03:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [02/04/2008|22:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Maxtor
   [28/12/2005|14:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [05/03/2009|21:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [26/03/2009|21:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [02/03/2009|11:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
   [13/07/2005|15:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [25/11/2005|18:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Corporation
   [26/05/2009|14:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
   [21/03/2008|17:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Support.com
   [30/11/2005|16:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [12/08/2009|13:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [11/01/2009|17:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TVU Networks
   [25/11/2005|18:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\VAIO Media Platform
   [19/08/2006|09:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [23/02/2008|16:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [13/07/2005|15:37] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Adobe
   [13/07/2005|12:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [13/07/2005|15:52] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [13/07/2005|15:31] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sony Corporation
   [13/07/2005|15:40] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec

   [08/02/2006|17:13] C:\DOCUME~1\LOCALS~1\APPLIC~1\Macromedia
   [03/02/2009|21:53] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [08/02/2006|17:13] C:\DOCUME~1\LOCALS~1\APPLIC~1\sony
   [17/04/2006|19:56] C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot

   [03/02/2009|21:53] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft


   [15/02/2007|16:11] C:\DOCUME~1\Thomas\APPLIC~1\ACT
   [21/03/2009|22:14] C:\DOCUME~1\Thomas\APPLIC~1\Adobe
   [17/06/2007|08:16] C:\DOCUME~1\Thomas\APPLIC~1\AdobeUM
   [05/01/2007|14:51] C:\DOCUME~1\Thomas\APPLIC~1\Apple Computer
   [17/04/2006|11:38] C:\DOCUME~1\Thomas\APPLIC~1\Block Checker
   [03/04/2007|11:15] C:\DOCUME~1\Thomas\APPLIC~1\DivX
   [27/03/2006|14:18] C:\DOCUME~1\Thomas\APPLIC~1\Dossier de t‚l‚chargement Share-to-Web
   [28/05/2006|17:11] C:\DOCUME~1\Thomas\APPLIC~1\Dossier de t‚l‚chargement Share-to-Web 
   [26/12/2005|19:39] C:\DOCUME~1\Thomas\APPLIC~1\FotoWire
   [20/01/2008|23:41] C:\DOCUME~1\Thomas\APPLIC~1\Google
   [14/12/2005|21:03] C:\DOCUME~1\Thomas\APPLIC~1\Help
   [13/07/2005|12:04] C:\DOCUME~1\Thomas\APPLIC~1\Identities
   [30/03/2006|11:02] C:\DOCUME~1\Thomas\APPLIC~1\iMesh
   [28/11/2005|15:45] C:\DOCUME~1\Thomas\APPLIC~1\InterVideo
   [28/11/2005|17:09] C:\DOCUME~1\Thomas\APPLIC~1\Leadertech
   [09/07/2009|22:11] C:\DOCUME~1\Thomas\APPLIC~1\LKSoft
   [21/03/2009|22:14] C:\DOCUME~1\Thomas\APPLIC~1\Macromedia
   [26/05/2009|03:24] C:\DOCUME~1\Thomas\APPLIC~1\Malwarebytes
   [05/03/2009|22:01] C:\DOCUME~1\Thomas\APPLIC~1\Microsoft
   [28/06/2009|22:05] C:\DOCUME~1\Thomas\APPLIC~1\Mozilla
   [30/10/2007|15:51] C:\DOCUME~1\Thomas\APPLIC~1\Screenshot Sender
   [07/07/2009|12:22] C:\DOCUME~1\Thomas\APPLIC~1\Shareaza
   [15/01/2009|15:34] C:\DOCUME~1\Thomas\APPLIC~1\Sibelius Software
   [28/11/2005|17:10] C:\DOCUME~1\Thomas\APPLIC~1\Sonic
   [26/11/2005|15:10] C:\DOCUME~1\Thomas\APPLIC~1\sony
   [30/03/2007|10:33] C:\DOCUME~1\Thomas\APPLIC~1\Sony Corporation
   [10/12/2005|11:40] C:\DOCUME~1\Thomas\APPLIC~1\Sun
   [27/05/2009|12:08] C:\DOCUME~1\Thomas\APPLIC~1\SUPERAntiSpyware.com
   [25/11/2005|22:45] C:\DOCUME~1\Thomas\APPLIC~1\Symantec
   [28/11/2005|16:52] C:\DOCUME~1\Thomas\APPLIC~1\Talkback
   [02/02/2009|21:25] C:\DOCUME~1\Thomas\APPLIC~1\TeamViewer
   [25/12/2007|19:20] C:\DOCUME~1\Thomas\APPLIC~1\U3
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [14/08/2009 21:04][--ah-----] C:\WINDOWS	asks\User_Feed_Synchronization-{A2F56C06-8E86-4012-96DF-0F74E45F7FA0}.job
   [30/07/2009 19:33][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [14/08/2009 23:27][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 14:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [31/01/2009|23:45] C:\Program Files\AC3Filter
   [15/02/2007|16:10] C:\Program Files\ACT
   [30/11/2005|17:44] C:\Program Files\Activision
   [27/05/2009|12:00] C:\Program Files\Adobe
   [30/11/2005|18:03] C:\Program Files\Ahead
   [13/07/2005|13:58] C:\Program Files\Apoint
   [06/08/2008|20:50] C:\Program Files\Apple Software Update
   [17/04/2006|22:16] C:\Program Files\Audacity
   [08/05/2008|14:44] C:\Program Files\AVG
   [14/08/2009|22:39] C:\Program Files\CCleaner
   [13/07/2005|12:02] C:\Program Files\ComPlus Applications
   [13/07/2005|12:12] C:\Program Files\CONEXANT
   [27/05/2009|01:02] C:\Program Files\Defraggler
   [04/02/2009|15:33] C:\Program Files\DivX
   [30/11/2005|17:33] C:\Program Files\EPSON
   [29/01/2009|00:43] C:\Program Files\ESET
   [30/11/2005|18:49] C:\Program Files\ffdshow
   [09/07/2009|22:11] C:\Program Files\Fichiers communs
   [13/07/2005|15:35] C:\Program Files\FlashPlayer
   [31/05/2009|16:11] C:\Program Files\GenoPro
   [12/10/2008|18:37] C:\Program Files\GiveMeTac 1.1
   [03/07/2008|20:32] C:\Program Files\Google
   [08/05/2008|14:47] C:\Program Files\Grisoft
   [28/05/2006|17:19] C:\Program Files\Hewlett-Packard
   [28/05/2006|17:24] C:\Program Files\hp deskjet 990c series
   [30/11/2005|18:18] C:\Program Files\iMeshBar
   [30/10/2007|22:22] C:\Program Files\ING
   [20/04/2009|20:33] C:\Program Files\InstallShield Installation Information
   [13/07/2005|13:41] C:\Program Files\Intel
   [31/07/2009|11:25] C:\Program Files\Internet Explorer
   [13/07/2005|15:34] C:\Program Files\InterVideo
   [27/11/2008|20:46] C:\Program Files\iPod
   [13/07/2005|15:33] C:\Program Files\ISP
   [27/11/2008|20:46] C:\Program Files\iTunes
   [05/08/2009|10:30] C:\Program Files\Java
   [13/07/2005|14:08] C:\Program Files\LanExpress
   [26/12/2005|19:39] C:\Program Files\Logitech
   [14/08/2009|15:50] C:\Program Files\Malwarebytes' Anti-Malware
   [10/10/2008|14:12] C:\Program Files\Maxtor
   [16/02/2009|00:59] C:\Program Files\Messenger
   [15/07/2009|15:28] C:\Program Files\Messenger Plus! Live
   [19/04/2006|14:53] C:\Program Files\MessengerPlus! 3
   [05/03/2009|21:56] C:\Program Files\Microsoft
   [23/02/2008|21:08] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [13/07/2005|12:04] C:\Program Files\microsoft frontpage
   [10/09/2008|19:29] C:\Program Files\Microsoft LifeChat
   [28/04/2009|11:06] C:\Program Files\Microsoft Office
   [01/08/2009|18:12] C:\Program Files\Microsoft Silverlight
   [12/02/2009|00:49] C:\Program Files\Microsoft SQL Server
   [05/03/2009|21:52] C:\Program Files\Microsoft SQL Server Compact Edition
   [05/03/2009|21:54] C:\Program Files\Microsoft Sync Framework
   [15/02/2009|21:24] C:\Program Files\Microsoft Works
   [15/02/2007|16:13] C:\Program Files\Microsoft.NET
   [28/11/2005|17:08] C:\Program Files\MoodLogic
   [25/11/2005|18:32] C:\Program Files\Moodlogic HTML
   [15/02/2009|23:11] C:\Program Files\Movie Maker
   [28/11/2005|17:06] C:\Program Files\Mozilla Firefox
   [20/04/2009|21:17] C:\Program Files\MSBuild
   [07/06/2008|15:44] C:\Program Files\MSECache
   [13/07/2005|12:01] C:\Program Files\MSN
   [13/07/2005|12:01] C:\Program Files\MSN Gaming Zone
   [18/11/2006|14:12] C:\Program Files\MSXML 4.0
   [16/08/2007|11:37] C:\Program Files\MSXML 6.0
   [29/11/2005|19:59] C:\Program Files\MUSICMATCH
   [31/01/2009|23:59] C:\Program Files\Native Instruments
   [15/02/2009|23:01] C:\Program Files\NetMeeting
   [26/03/2009|21:09] C:\Program Files\NOS
   [13/07/2005|12:01] C:\Program Files\Online Services
   [26/04/2008|23:38] C:\Program Files\OOBOX
   [28/05/2006|16:45] C:\Program Files\Outils de Guitare-Online
   [13/08/2009|00:43] C:\Program Files\Outlook Express
   [27/11/2008|20:44] C:\Program Files\QuickTime
   [25/11/2005|18:23] C:\Program Files\Raccourcis de programmes
   [13/07/2005|13:14] C:\Program Files\Realtek
   [20/04/2009|21:16] C:\Program Files\Reference Assemblies
   [13/07/2005|12:02] C:\Program Files\Services en ligne
   [07/07/2009|12:22] C:\Program Files\Shareaza
   [20/12/2008|19:59] C:\Program Files\Sony
   [12/08/2009|13:08] C:\Program Files\SpywareBlaster
   [27/05/2009|12:32] C:\Program Files\Sunbelt Software
   [27/05/2009|12:08] C:\Program Files\SUPERAntiSpyware
   [21/03/2008|17:49] C:\Program Files\support.com
   [30/11/2005|16:58] C:\Program Files\Symantec
   [26/11/2005|00:47] C:\Program Files\SymNetDrv
   [26/05/2009|01:04] C:\Program Files\Trend Micro
   [25/11/2005|18:34] C:\Program Files\Uninstall Information
   [08/04/2009|14:55] C:\Program Files\Windows Live
   [05/03/2009|21:49] C:\Program Files\Windows Live SkyDrive
   [09/12/2006|14:42] C:\Program Files\Windows Media Connect 2
   [15/02/2009|23:01] C:\Program Files\Windows Media Player
   [15/02/2009|23:01] C:\Program Files\Windows NT
   [13/07/2005|12:02] C:\Program Files\WindowsUpdate
   [30/11/2005|18:29] C:\Program Files\WinRAR
   [13/07/2005|12:04] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [14/08/2009|18:57] C:\Program Files\Fichiers communs\Adobe
   [30/11/2005|18:03] C:\Program Files\Fichiers communs\Ahead
   [31/01/2009|23:54] C:\Program Files\Fichiers communs\Apple
   [25/11/2005|18:44] C:\Program Files\Fichiers communs\DESIGNER
   [26/12/2005|19:39] C:\Program Files\Fichiers communs\FotoWire
   [13/07/2005|15:34] C:\Program Files\Fichiers communs\InstallShield
   [13/07/2005|15:31] C:\Program Files\Fichiers communs\Java
   [09/07/2009|22:11] C:\Program Files\Fichiers communs\LKSoft
   [26/12/2005|19:38] C:\Program Files\Fichiers communs\Logitech
   [28/04/2009|11:06] C:\Program Files\Fichiers communs\Microsoft Shared
   [13/07/2005|12:02] C:\Program Files\Fichiers communs\MSSoap
   [31/01/2009|23:59] C:\Program Files\Fichiers communs\Native Instruments
   [13/07/2005|13:57] C:\Program Files\Fichiers communs\ODBC
   [13/07/2005|12:02] C:\Program Files\Fichiers communs\Services
   [25/11/2005|18:35] C:\Program Files\Fichiers communs\Sony Shared
   [13/07/2005|13:57] C:\Program Files\Fichiers communs\SpeechEngines
   [26/11/2005|15:10] C:\Program Files\Fichiers communs\SWF Studio
   [30/11/2005|16:57] C:\Program Files\Fichiers communs\Symantec Shared
   [15/02/2009|23:00] C:\Program Files\Fichiers communs\System
   [05/03/2009|21:40] C:\Program Files\Fichiers communs\Windows Live
   [23/02/2008|16:38] C:\Program Files\Fichiers communs\WindowsLiveInstaller

   --------------------\  Process

   ( 14 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-08-14 23:35:26
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 917
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:293][D:22]-> C:\DOCUME~1\Thomas\LOCALS~1\Temp
   [F:93][D:0]-> C:\DOCUME~1\Thomas\Cookies
   [F:2456][D:16]-> C:\DOCUME~1\Thomas\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - ven. 14/08/2009|23:38 - Option : [2]

   --------------------\  Fin du rapport a 23:38:06
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:49:35, on 14/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Microsoft LifeChat\LifeChat.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Live\Device Manager\msgrdvmn.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://news.google.com/topstories?hl=fr&tab=wn&gl=BE&ceid=BE:fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.sony.jp/support/vaio/index.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [LifeChat] "C:\Program Files\Microsoft LifeChat\LifeChat.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [WindowsLivePhone] C:\Program Files\Windows Live\Device Manager\msgrdvmn.exe /AutoRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WindowsLivePhone] "C:\Program Files\Windows Live\Device Manager\msgrdvmn.exe" /AutoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe (User 'Default user')
O4 - .DEFAULT User Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe (User 'Default user')
O4 - Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

Thomas · Answer

[ Rapport ToolsCleaner version 2.3.10 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\lopR.txt: trouvé !
C:\Lop SD: trouvé !
C:\GenProc: trouvé !
C:\UsbFix: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Thomas\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Thomas\Bureau\LopSD.exe: trouvé !
C:\Documents and Settings\Thomas\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\Thomas\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\Thomas\Bureau\lopR.txt: trouvé !
C:\Genproc\Genproc.exe: trouvé !
C:\Genproc\outil\hijackthis.log: trouvé !
C:\Genproc\outil\mbr.exe: trouvé !
C:\Genproc\Page\GenProc[*].html: trouvé !
C:\Lop SD\catchme.exe: trouvé !
C:\Lop SD\catchme.log: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Thomas\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Thomas\Bureau\LopSD.exe: supprimé !
C:\Documents and Settings\Thomas\Bureau\HJTInstall.exe: supprimé !
C:\Lop SD\catchme.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\lopR.txt: supprimé !
C:\Documents and Settings\Thomas\Bureau\hijackthis.log: supprimé !
C:\Documents and Settings\Thomas\Bureau\lopR.txt: supprimé !
C:\Genproc\Genproc.exe: supprimé !
C:\Genproc\outil\hijackthis.log: supprimé !
C:\Genproc\outil\mbr.exe: supprimé !
C:\Genproc\Page\GenProc[*].html: ERREUR DE SUPPRESSION !!
C:\Lop SD\catchme.log: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Lop SD: supprimé !
C:\GenProc: supprimé !
C:\UsbFix: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Thomas · Answer

;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-08-15 09:33:48
PROTECTIONS: 1
MALWARE: 6
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
AVG Anti-Virus                               8.5                           Yes       Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Thomas\Cookies	homas@atdmt[2].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Thomas\Cookies	homas@xiti[1].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Thomas\Cookies	homas@weborama[1].txt
00172449  Cookie/MetriWeb                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Thomas\Cookies	homas@metriweb[1].txt
00200583  adware/block-checker               Adware              No        1         Yes            No           c:\documents and settings	homas\application data\microsoft\internet explorer\quick launch\block checker.lnk
00590315  Rootkit/Agent.LNB                  HackTools           No        0         Yes            No           C:\System Volume Information\_restore{28B95B92-4ADC-47B5-B9D3-0B42A08FD847}\RP1042\A0141969.sys
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ^
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ^
;===================================================================================================================================================================================
;===================================================================================================================================================================================

Thomas · Answer

Bonjour,

Voilà j'ai réalisé ce qui était dit. Je n'ai pas rencontré de problèmes. Quelle est la suite de la procédure ? Merci.

Thomas · Answer

En réalité, j'ai lancé Malwarebyte à la suite d'un souci dont je n'arrivais pas à comprendre la cause.

Avant les analyses d'hier soir, l'écran de mon pc s'éteignait par moment par va et vient, il se brouillait également et des erreurs graphiques (barres horizontales jaunes) survenaient derrière le pointeur de la souris. Je ne sais cependant pas s'il y a un lien ou non. 

Egalement, le pc est incapable d'installer une mise à jour pour windows : 

Microsoft SQL Server 2005 Express Edition Service Pack 3 (KB955706)

Voilà les problèmes qui m'ont poussé à lancer des analyses en tout genre voire inutiles.

Thomas · Answer

Bonjour,

Toujours pas de trace de mon possible sauver d'hier ??

gen-hackman · Answer

bonsoir pour avancer :

Télécharge OTL de OLDTimer

&#9654 enregistre le sur ton Bureau.

&#9654 Double clic sur OTL.exe pour le lancer.

&#9654 Coche les 2 cases Lop et Purity

&#9654 Coche la case devant scan all users

&#9654 règle-le sur "60 Days"

&#9654Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier ci-dessus.

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

Tu feras la meme chose avec le "Extra.txt".

Maud · Answer

Voici:

http://www.cijoint.fr/cjlink.php?file=cj200908/cij5ElTUvz.txt
http://www.cijoint.fr/cjlink.php?file=cj200908/cijYPUKWYB.txt

Maud · Answer

NB: Le portable vient d'avoir bcp de mal à se rallumer (démarrage en boucle), il a finalement réussi mais les graphismes sont extrêmement grands. Mais tant qu'il est allumé je ne titille pas la bête.

Maud · Answer

Ai-je envoyé les liens corrects ?

gen-hackman · Answer

ok lis ce qui est ecrit en cliquant sur le lien , ce que je dois te faire faire ne rentre pas sur le forum ^^

http://www.cijoint.fr/cjlink.php?file=cj200908/cijuCKcDOH.txt

Maud · Answer

Bonjour, merci en tout cas de me (re)venir en aide. C'est quoi cette saleté encore ? Voici le rapport:

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
ADS C:\WINDOWS\wmprfFRA.prx:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper TrueColor 1280x800.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wshfr.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wmaudsdk.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wfwnet.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\W29MLRES.DLL:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\vga.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\vga.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\user.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\unicode.nls:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32	ssoft32.acm:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32	sbyuv.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32	imer.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\system.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\sound.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\sortkey.nls:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32svp.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32iched32.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32asmontr.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\pxwma.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\olethk32.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\oleaccrc.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\OEMLOGO.BMP:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32
vsvc32.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32
vrsfr.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32
v4_disp.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32
etmsg.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msvidc32.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msvcr70.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msvcp70.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msstkprp.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msgsm32.acm:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msg723.acm:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msg711.acm:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\msacm32.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\mouse.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\mmsystem.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\mmdrv.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\mfc42loc.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\lz32.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\keyboard.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\kdcom.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\kbdus.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\kbdfr.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\kbdbe.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\jsfr.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\ir32_32.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\ipxpromn.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\ipxmontr.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\inetcplc.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\ImagXRA7.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\ImagXR7.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\ImagXpr7.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\ImagX7.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\igfxtray.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\igfxsrvc.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\igfxsrvc.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\igfxdev.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\HUFFYUV.DLL:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\hnetmon.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\hkcmd.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\hccutils.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\fixmapi.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drwtsn32.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\wmilib.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\w29n51.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers	ifmsony.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\Drivers\SYMTDI.SYS:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\Drivers\SYMREDRV.SYS:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\Drivers\SYMNDIS.SYS:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\Drivers\SYMIDS.SYS:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\Drivers\SYMFW.SYS:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\Drivers\SYMDNS.SYS:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\Drivers\SonyNC.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\s24trans.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\RtkHDAud.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERSaspti.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERSasacd.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ptilink.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\system32\DRIVERS\pciide.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\oprghdlr.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS
wlnkfwd.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS
wlnkflt.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS
v4_mini.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\mouhid.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\imagesrv.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\imagedrv.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ialmnt5.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\HSFHWAZL.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\system32\DRIVERS\ftdisk.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\ExpasAG.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\e100b325.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\dmload.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\DMICall.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\audstub.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\Apfiltr.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\DRIVERS\AegisP.sys:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\d3dx9_25.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\ctype.nls:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\comm.drv:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\clb.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\c_28591.nls:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\c_1253.nls:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\c_1251.nls:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\c_1250.nls:KAVICHS deleted successfully.
ADS C:\WINDOWS\SOUNDMAN.EXE:KAVICHS deleted successfully.
ADS C:\Program Files\Sony\VAIO Launcher\Launcher.exe:KAVICHS deleted successfully.
ADS C:\Program Files\Sony\VAIO Event Service\VESMgr.exe:KAVICHS deleted successfully.
ADS C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe:KAVICHS deleted successfully.
ADS C:\Program Files\Sony\Image Converter 2\IcVzMon.exe:KAVICHS deleted successfully.
ADS C:\Program Files\mozilla firefox\searchplugins\googlefr.src:KAVICHS deleted successfully.
ADS C:\Program Files\mozilla firefox\searchplugins\google.src:KAVICHS deleted successfully.
ADS C:\Program Files\mozilla firefox\plugins
pnul32.dll:KAVICHS deleted successfully.
ADS C:\Program Files\Mozilla Firefox\firefox.exe:KAVICHS deleted successfully.
ADS C:\Program Files\mozilla firefox\components\qfaservices.dll:KAVICHS deleted successfully.
ADS C:\Program Files\mozilla firefox\components\jar50.dll:KAVICHS deleted successfully.
ADS C:\Program Files\mozilla firefox\components\fullsoft.dll:KAVICHS deleted successfully.
ADS C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe:KAVICHS deleted successfully.
ADS C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe:KAVICHS deleted successfully.
ADS C:\Program Files\Intel\Wireless\Bin\EvtEng.exe:KAVICHS deleted successfully.
ADS C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe:KAVICHS deleted successfully.
ADS C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe:KAVICHS deleted successfully.
ADS C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe:KAVICHS deleted successfully.
ADS C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe:KAVICHS deleted successfully.
ADS C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe:KAVICHS deleted successfully.
ADS C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe:KAVICHS deleted successfully.
ADS C:\Documents and Settings\Thomas\Mes documents\desktop.ini:KAVICHS deleted successfully.
ADS C:\Documents and Settings\Thomas\Menu Démarrer\Programmes\Démarrage\VAIO Launcher.lnk:KAVICHS deleted successfully.
ADS C:\Documents and Settings\Thomas\Menu Démarrer\Programmes\Démarrage\desktop.ini:KAVICHS deleted successfully.
ADS C:\Documents and Settings\Thomas\Application Data\desktop.ini:KAVICHS deleted successfully.
ADS C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini:KAVICHS deleted successfully.
ADS C:\Documents and Settings\All Users\Documents\winamp5112_full.exe:KAVICHS deleted successfully.
ADS C:\Documents and Settings\All Users\Documents\Setup_Zeb-Utility.exe:KAVICHS deleted successfully.
ADS C:\Documents and Settings\All Users\Documents\desktop.ini:KAVICHS deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\desktop.ini:KAVICHS deleted successfully.
ADS C:\WINDOWS\Zapotec.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\winnt256.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\winnt.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\WININIT.INI:KAVICHS deleted successfully.
ADS C:\WINDOWS\winhelp.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\Winchat.ini:KAVICHS deleted successfully.
ADS C:\WINDOWS\vmmreg32.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\Vent de prairie.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\vbaddin.ini:KAVICHS deleted successfully.
ADS C:\WINDOWS\vb.ini:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Long Battery Life Wallpaper HighColor 1680x1050.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Long Battery Life Wallpaper HighColor 1280x800.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper TrueColor 1920x1200.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper TrueColor 1920x1080.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper TrueColor 1776x1000.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper TrueColor 1680x1050.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper TrueColor 1600x1200.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper TrueColor 1440x900.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper TrueColor 1400x1050.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper TrueColor 1366x768.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper TrueColor 1280x768.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper TrueColor 1280x720.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper TrueColor 1280x1024.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper TrueColor 1024x768.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper HighColor 1920x1200.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper HighColor 1920x1080.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper HighColor 1776x1000.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper HighColor 1680x1050.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper HighColor 1600x1200.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper HighColor 1440x900.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper HighColor 1400x1050.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper HighColor 1366x768.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper HighColor 1280x800.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper HighColor 1280x768.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper HighColor 1280x720.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper HighColor 1280x1024.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\VAIO Light Flo Wallpaper HighColor 1024x768.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\UninstallFirefox.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS	wunk_32.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS	wunk_16.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS	wain.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\Tasse à café.bmp:KAVICHS deleted successfully.
ADS C:\WINDOWS\TASKMAN.EXE:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\xenroll.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wupdmgr.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wuaueng1.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wuauclt1.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wshnetbs.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wshisn.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wshatm.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\write.exe:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wpdtrace.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wpdmtpdr.dll:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wpa.dbl:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\wowfaxui.dll:KAVICHS deleted successfully.

Maud · Answer

La totalité de l'analyse ne passe pas sur le forum. J'ai tenté de c/c la partie manquante mais il ne l'a pas postée et pourtant il m'a dit que l'opération a déjà été effectuée. Soit. Je poste sur cijoint ??

gen-hackman · Answer

oui s'il te plait

Maud · Answer

Voilà c'est fait. J'ai quelques difficultés étant donné que le pc commence à laterner écran noir - écran - écran noir (...)

http://www.cijoint.fr/cjlink.php?file=cj200908/cij42Qd1Ct.txt

gen-hackman · Answer

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent

&#9654 Télécharge List'em et enregistre le sur ton bureau

Il ne necessite pas d'installation 

&#9654double clic (clic droit "executer en tant qu'administrateur" pour Vista) pour lancer le scan

&#9654laisse travailler l'outil

le rapport va s'afficher , une fois le scan fini

&#9654colle le contenu dans ta prochaine réponse

Maud · Answer

List'em by g3n-h@ckm@n 1.0.2.0 

dim. 16/08/2009    13:42:32,18 

Microsoft Windows XP [version 5.1.2600]
 

Infections possibles : 
==================== 
 

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

C:\WINDOWS\system32\Drivers\ati1btxx.sys  
C:\WINDOWS\system32\Drivers\ati1mdxx.sys  
C:\WINDOWS\system32\Drivers\ati1pdxx.sys  
C:\WINDOWS\system32\Drivers\ati1raxx.sys  
C:\WINDOWS\system32\Drivers\ati1rvxx.sys  
C:\WINDOWS\system32\Drivers\ati1snxx.sys  
C:\WINDOWS\system32\Drivers\ati1ttxx.sys  
C:\WINDOWS\system32\Drivers\ati1tuxx.sys  
C:\WINDOWS\system32\Drivers\ati1xbxx.sys  
C:\WINDOWS\system32\Drivers\ati1xsxx.sys  
C:\WINDOWS\system32\Drivers\atinbtxx.sys  
C:\WINDOWS\system32\Drivers\atinmdxx.sys  
C:\WINDOWS\system32\Drivers\atinpdxx.sys  
C:\WINDOWS\system32\Drivers\atinraxx.sys  
C:\WINDOWS\system32\Drivers\atinrvxx.sys  
C:\WINDOWS\system32\Drivers\atinsnxx.sys  
C:\WINDOWS\system32\Drivers\atinttxx.sys  
C:\WINDOWS\system32\Drivers\atintuxx.sys  
C:\WINDOWS\system32\Drivers\atinxbxx.sys  
C:\WINDOWS\system32\Drivers\atinxsxx.sys  
 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

 
¤¤¤¤¤¤¤¤¤¤ Windows\Prefetch : 

C:\WINDOWS\Prefetch\ALBUMDB2.EXE-1F918EF2.pf
C:\WINDOWS\Prefetch\ALG.EXE-275708CF.pf
C:\WINDOWS\Prefetch\AVGCMGR.EXE-017B654E.pf
C:\WINDOWS\Prefetch\AVGUI.EXE-0D7989A9.pf
C:\WINDOWS\Prefetch\AVGUPD.EXE-2AED0BE6.pf
C:\WINDOWS\Prefetch\CHECKER.EXE-035DF12F.pf
C:\WINDOWS\Prefetch\CMD.EXE-034B0549.pf
C:\WINDOWS\Prefetch\DEFRAG.EXE-2858C7E2.pf
C:\WINDOWS\Prefetch\DFRGNTFS.EXE-38C3807C.pf
C:\WINDOWS\Prefetch\DW20.EXE-0A0B1C6C.pf
C:\WINDOWS\Prefetch\DWTRIG20.EXE-05D8A0C7.pf
C:\WINDOWS\Prefetch\EXPAND.EXE-14A1B56D.pf
C:\WINDOWS\Prefetch\FIXCFG.EXE-3A39BB3F.pf
C:\WINDOWS\Prefetch\FXSVR2.EXE-34D06B28.pf
C:\WINDOWS\Prefetch\IEXPLORE.EXE-2D97EBE6.pf
C:\WINDOWS\Prefetch\IGFXSRVC.EXE-1D88F978.pf
C:\WINDOWS\Prefetch\IMAPI.EXE-201490BB.pf
C:\WINDOWS\Prefetch\layout.ini
C:\WINDOWS\Prefetch\LISTEM.EXE-29880F81.pf
C:\WINDOWS\Prefetch\LVCOMSX.EXE-30FB8DC0.pf
C:\WINDOWS\Prefetch\MODE.COM-318FFE37.pf
C:\WINDOWS\Prefetch\MSCORSVW.EXE-310BC412.pf
C:\WINDOWS\Prefetch\MSFEEDSSYNC.EXE-05335A39.pf
C:\WINDOWS\Prefetch\MSIEXEC.EXE-330626DC.pf
C:\WINDOWS\Prefetch\MSNMSGR.EXE-0EBDBC56.pf
C:\WINDOWS\Prefetch\NGEN.EXE-20BDC4FB.pf
C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf
C:\WINDOWS\Prefetch\REG.EXE-07FA5B3F.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-3D479208.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-54023F1C.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-57C8756E.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-5F120771.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-753F1DF3.pf
C:\WINDOWS\Prefetch\SETUP.EXE-02D9625A.pf
C:\WINDOWS\Prefetch\SQLBROWSER.EXE-008F6C94.pf
C:\WINDOWS\Prefetch\SSTEXT3D.SCR-0586736D.pf
C:\WINDOWS\Prefetch\SVCHOST.EXE-2D5FBD18.pf
C:\WINDOWS\Prefetch\VCSW.EXE-228F95AF.pf
C:\WINDOWS\Prefetch\VERCLSID.EXE-28F52AD2.pf
C:\WINDOWS\Prefetch\VZRS.EXE-22BC1C1C.pf
C:\WINDOWS\Prefetch\WLTUSER.EXE-2E4DF564.pf
C:\WINDOWS\Prefetch\WMIAPSRV.EXE-02740A4B.pf
C:\WINDOWS\Prefetch\WMIPRVSE.EXE-0D449B4F.pf
C:\WINDOWS\Prefetch\WSCNTFY.EXE-0B14C27D.pf
C:\WINDOWS\Prefetch\WUAUCLT.EXE-1360D60A.pf
 
 
--------EOF------------

gen-hackman · Answer

&#9654 Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
* - Coche    Afficher les fichiers et dossiers cachés
* - Décoche Masquer les extensions des fichiers dont le type est connu
* - Décoche Masquer les fichiers protégés du système d'exploitation (recommandé)

&#9654 clique sur Appliquer, puis OK.

N'oublie pas de recacher à nouveau les fichiers cachés et protégés du système d'exploitation en fin de désinfection, c'est important

Fais analyser le(s) fichier(s) suivants sur Virustotal :

Virus Total

    * Clique sur Parcourir en haut, choisis Poste de travail et cherche ces fichiers :

C:\WINDOWS\system32\Drivers\ati1snxx.sys
C:\WINDOWS\system32\Drivers\ati1ttxx.sys 
C:\WINDOWS\system32\Drivers\atinsnxx.sys
C:\WINDOWS\system32\Drivers\atinttxx.sys 

    * Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
    * Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
    * Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté
    * Une nouvelle fenêtre de ton navigateur va apparaître
    * Clique alors sur les deux fleches
    * Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
    * Enfin colle le résultat dans ta prochaine réponse.

Note : Pour analyser un autre fichier, clique en bas sur Autre fichier.

Maud · Answer

1er fichier: Fichier b12dd4a0005f1c4b7090009378b5920090fee997.EXE reçu le 2009.03.31 15:27:09 (UTC)Antivirus Version Dernière mise à jour Résultat AhnLab-V3 5.0.0.2 2009.03.31 - AntiVir 7.9.0.129 2009.03.31 - Antiy-AVL 2.0.3.1 2009.03.31 - Authentium 5.1.2.4 2009.03.30 - Avast 4.8.1335.0 2009.03.30 - AVG 8.5.0.285 2009.03.31 - BitDefender 7.2 2009.03.31 - CAT-QuickHeal 10.00 2009.03.31 - ClamAV 0.94.1 2009.03.31 - Comodo 1090 2009.03.31 - DrWeb 4.44.0.09170 2009.03.31 - eSafe 7.0.17.0 2009.03.31 - eTrust-Vet 31.6.6427 2009.03.31 - F-Prot 4.4.4.56 2009.03.30 - F-Secure 8.0.14470.0 2009.03.31 - Fortinet 3.117.0.0 2009.03.31 - GData 19 2009.03.31 - Ikarus T3.1.1.49.0 2009.03.31 - K7AntiVirus 7.10.685 2009.03.30 - Kaspersky 7.0.0.125 2009.03.31 - McAfee 5569 2009.03.30 - McAfee+Artemis 5569 2009.03.30 - McAfee-GW-Edition 6.0.0 2009.03.31 - Microsoft 1.4502 2009.03.31 - NOD32 3976 2009.03.30 - Norman 2009.03.31 - nProtect 2009.1.8.0 2009.03.31 - Panda 10.0.0.14 2009.03.31 - PCTools 4.4.2.0 2009.03.31 - Prevx1 V2 2009.03.31 - Rising 21.23.12.00 2009.03.31 - Sophos 4.40.0 2009.03.31 - Sunbelt 3.2.1858.2 2009.03.31 - Symantec 1.4.4.12 2009.03.31 - TheHacker 6.3.3.9.296 2009.03.30 - TrendMicro 8.700.0.1004 2009.03.31 - VBA32 3.12.10.1 2009.03.31 - ViRobot 2009.3.31.1669 2009.03.31 - VirusBuster 4.6.5.0 2009.03.31 - Information additionnelle File size: 28672 bytes MD5 : ceddee2e0591894d19654d458fd3b9be SHA1 : c58ba65bff4e5e4ba7e78599b583829d56e76e2a SHA256: 712ba390891faf0d52aeadbbaef7fe14a655611984cd3db1709f665482e9fa9b PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1301
timedatestamp.....: 0x40787439 (Sun Apr 11 00:24:57 2004)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x50E8 0x5200 6.48 7071acd55cb7b9f4377885dab92bdeb8
.rdata 0x7000 0xA7F 0xC00 4.55 cbf801a89a20762706eaf0d93c1eb2a6
.data 0x8000 0x38 0x200 0.50 1bad19bae9d56027544774597c2bce5e
.rsrc 0x9000 0x618 0x800 2.78 7ffcbc84ac6844b1edea17f1d1734c22
.reloc 0xA000 0x290 0x400 4.60 6d95403a18601703a8c7d2d7f27f4db7

( 3 imports )

> hal.dll: KfAcquireSpinLock, KfReleaseSpinLock
> ntoskrnl.exe: ExFreePool, KeInitializeSpinLock, PoStartNextPowerIrp, IofCompleteRequest, _purecall, KeSetEvent, IoFreeIrp, KeWaitForSingleObject, IofCallDriver, KeInitializeEvent, IoAllocateIrp, KeQuerySystemTime, wcsncmp, ZwClose, ZwOpenKey, RtlInitUnicodeString, ExAllocatePoolWithTag, KeDelayExecutionThread, RtlGUIDFromString, ZwQueryValueKey, RtlAppendUnicodeStringToString, RtlCopyUnicodeString, RtlIntegerToUnicodeString, IoOpenDeviceRegistryKey, ZwSetValueKey, strchr, RtlUnicodeStringToAnsiString, RtlInitAnsiString, ZwCreateKey
> stream.sys: StreamClassRegisterFilterWithNoKSPins, StreamClassScheduleTimer, StreamClassRegisterAdapter, StreamClassDeviceNotification

( 0 exports )
TrID : File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) ssdeep: 384:UsA3COA9Q6Yd/AikFzp95UwbZLk4suw15Mdrjg2ohzWP3DdgQII9oZ8J3bJz7j:Us7OGQs5PNL6uwGrmgqQIuoZ8dJz7j PEiD : - RDS : NSRL Reference Data Set

( Gateway )

Gateway Operating System Windows XP Pro Edition SP2: atinsnxx.sys
( Microsoft )

Disc 2438.5: atinsnxx.sysMSDN Disc 2428.4: atinsnxx.sysMSDN Disc 2428.5: atinsnxx.sysMSDN Disc 2428.8: atinsnxx.sysMSDN Disc 2438.7: atinsnxx.sysMSDN Disc 2438.8: atinsnxx.sysMSDN Disc 2439.6: atinsnxx.sysMSDN Disc 2439.7: atinsnxx.sysMSDN Disc 2439.8: atinsnxx.sysMSDN Disc 2440.3: atinsnxx.sysMSDN Disc 2440.4: atinsnxx.sysMSDN Disc 2440.5: atinsnxx.sysMSDN Disc 2441.5: atinsnxx.sysMSDN Disc 2441.6: atinsnxx.sysMSDN Disc 2441.7: atinsnxx.sysMSDN Disc 2442.4: atinsnxx.sysMSDN Disc 2442.6: atinsnxx.sysMSDN Disc 2443.2: atinsnxx.sysMSDN Disc 2443.4: atinsnxx.sysMSDN Disc 2444.3: atinsnxx.sysMSDN Disc 2444.3: atinsnxx.sysMSDN Disc 2444.4: atinsnxx.sysMSDN Disc 2444.6: atinsnxx.sysMSDN Disc 2455.6: atinsnxx.sysMSDN Disc 2464.5: atinsnxx.sysMSDN Disc 2465.4: atinsnxx.sysMSDN Disc 2465.5: atinsnxx.sysMSDN Disc 2466.2: atinsnxx.sysMSDN Disc 2466.4: atinsnxx.sysMSDN Disc 2476.2: atinsnxx.sysMSDN Disc 2476.4: atinsnxx.sysMSDN Disc 2477.2: atinsnxx.sysOperating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: atinsnxx.sysVirtual PC for Mac Windows XP Home Edition: atinsnxx.sysVirtual PC for Mac Windows XP Professional Edition: atinsnxx.sys Antivirus Version Dernière mise à jour Résultat AhnLab-V3 5.0.0.2 2009.03.31 - AntiVir 7.9.0.129 2009.03.31 - Antiy-AVL 2.0.3.1 2009.03.31 - Authentium 5.1.2.4 2009.03.30 - Avast 4.8.1335.0 2009.03.30 - AVG 8.5.0.285 2009.03.31 - BitDefender 7.2 2009.03.31 - CAT-QuickHeal 10.00 2009.03.31 - ClamAV 0.94.1 2009.03.31 - Comodo 1090 2009.03.31 - DrWeb 4.44.0.09170 2009.03.31 - eSafe 7.0.17.0 2009.03.31 - eTrust-Vet 31.6.6427 2009.03.31 - F-Prot 4.4.4.56 2009.03.30 - F-Secure 8.0.14470.0 2009.03.31 - Fortinet 3.117.0.0 2009.03.31 - GData 19 2009.03.31 - Ikarus T3.1.1.49.0 2009.03.31 - K7AntiVirus 7.10.685 2009.03.30 - Kaspersky 7.0.0.125 2009.03.31 - McAfee 5569 2009.03.30 - McAfee+Artemis 5569 2009.03.30 - McAfee-GW-Edition 6.0.0 2009.03.31 - Microsoft 1.4502 2009.03.31 - NOD32 3976 2009.03.30 - Norman 2009.03.31 - nProtect 2009.1.8.0 2009.03.31 - Panda 10.0.0.14 2009.03.31 - PCTools 4.4.2.0 2009.03.31 - Prevx1 V2 2009.03.31 - Rising 21.23.12.00 2009.03.31 - Sophos 4.40.0 2009.03.31 - Sunbelt 3.2.1858.2 2009.03.31 - Symantec 1.4.4.12 2009.03.31 - TheHacker 6.3.3.9.296 2009.03.30 - TrendMicro 8.700.0.1004 2009.03.31 - VBA32 3.12.10.1 2009.03.31 - ViRobot 2009.3.31.1669 2009.03.31 - VirusBuster 4.6.5.0 2009.03.31 - Information additionnelle File size: 28672 bytes MD5 : ceddee2e0591894d19654d458fd3b9be SHA1 : c58ba65bff4e5e4ba7e78599b583829d56e76e2a SHA256: 712ba390891faf0d52aeadbbaef7fe14a655611984cd3db1709f665482e9fa9b PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1301
timedatestamp.....: 0x40787439 (Sun Apr 11 00:24:57 2004)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x50E8 0x5200 6.48 7071acd55cb7b9f4377885dab92bdeb8
.rdata 0x7000 0xA7F 0xC00 4.55 cbf801a89a20762706eaf0d93c1eb2a6
.data 0x8000 0x38 0x200 0.50 1bad19bae9d56027544774597c2bce5e
.rsrc 0x9000 0x618 0x800 2.78 7ffcbc84ac6844b1edea17f1d1734c22
.reloc 0xA000 0x290 0x400 4.60 6d95403a18601703a8c7d2d7f27f4db7

( 3 imports )

> hal.dll: KfAcquireSpinLock, KfReleaseSpinLock
> ntoskrnl.exe: ExFreePool, KeInitializeSpinLock, PoStartNextPowerIrp, IofCompleteRequest, _purecall, KeSetEvent, IoFreeIrp, KeWaitForSingleObject, IofCallDriver, KeInitializeEvent, IoAllocateIrp, KeQuerySystemTime, wcsncmp, ZwClose, ZwOpenKey, RtlInitUnicodeString, ExAllocatePoolWithTag, KeDelayExecutionThread, RtlGUIDFromString, ZwQueryValueKey, RtlAppendUnicodeStringToString, RtlCopyUnicodeString, RtlIntegerToUnicodeString, IoOpenDeviceRegistryKey, ZwSetValueKey, strchr, RtlUnicodeStringToAnsiString, RtlInitAnsiString, ZwCreateKey
> stream.sys: StreamClassRegisterFilterWithNoKSPins, StreamClassScheduleTimer, StreamClassRegisterAdapter, StreamClassDeviceNotification

( 0 exports )
TrID : File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) ssdeep: 384:UsA3COA9Q6Yd/AikFzp95UwbZLk4suw15Mdrjg2ohzWP3DdgQII9oZ8J3bJz7j:Us7OGQs5PNL6uwGrmgqQIuoZ8dJz7j PEiD : - RDS : NSRL Reference Data Set

( Gateway )

Gateway Operating System Windows XP Pro Edition SP2: atinsnxx.sys
( Microsoft )

Disc 2438.5: atinsnxx.sysMSDN Disc 2428.4: atinsnxx.sysMSDN Disc 2428.5: atinsnxx.sysMSDN Disc 2428.8: atinsnxx.sysMSDN Disc 2438.7: atinsnxx.sysMSDN Disc 2438.8: atinsnxx.sysMSDN Disc 2439.6: atinsnxx.sysMSDN Disc 2439.7: atinsnxx.sysMSDN Disc 2439.8: atinsnxx.sysMSDN Disc 2440.3: atinsnxx.sysMSDN Disc 2440.4: atinsnxx.sysMSDN Disc 2440.5: atinsnxx.sysMSDN Disc 2441.5: atinsnxx.sysMSDN Disc 2441.6: atinsnxx.sysMSDN Disc 2441.7: atinsnxx.sysMSDN Disc 2442.4: atinsnxx.sysMSDN Disc 2442.6: atinsnxx.sysMSDN Disc 2443.2: atinsnxx.sysMSDN Disc 2443.4: atinsnxx.sysMSDN Disc 2444.3: atinsnxx.sysMSDN Disc 2444.3: atinsnxx.sysMSDN Disc 2444.4: atinsnxx.sysMSDN Disc 2444.6: atinsnxx.sysMSDN Disc 2455.6: atinsnxx.sysMSDN Disc 2464.5: atinsnxx.sysMSDN Disc 2465.4: atinsnxx.sysMSDN Disc 2465.5: atinsnxx.sysMSDN Disc 2466.2: atinsnxx.sysMSDN Disc 2466.4: atinsnxx.sysMSDN Disc 2476.2: atinsnxx.sysMSDN Disc 2476.4: atinsnxx.sysMSDN Disc 2477.2: atinsnxx.sysOperating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: atinsnxx.sysVirtual PC for Mac Windows XP Home Edition: atinsnxx.sysVirtual PC for Mac Windows XP Professional Edition: atinsnxx.sys

Maud · Answer

2ème fichier: Fichier 9031E7695FDBA0F15365004FF9F694004110881D.sys reçu le 2009.07.22 03:53:13 (UTC)Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.07.22 - AhnLab-V3 5.0.0.2 2009.07.21 - AntiVir 7.9.0.222 2009.07.21 - Antiy-AVL 2.0.3.7 2009.07.22 - Authentium 5.1.2.4 2009.07.22 - Avast 4.8.1335.0 2009.07.21 - AVG 8.5.0.387 2009.07.21 - BitDefender 7.2 2009.07.22 - CAT-QuickHeal 10.00 2009.07.21 - ClamAV 0.94.1 2009.07.22 - Comodo 1670 2009.07.21 - DrWeb 5.0.0.12182 2009.07.22 - eSafe 7.0.17.0 2009.07.21 - eTrust-Vet 31.6.6632 2009.07.22 - F-Prot 4.4.4.56 2009.07.21 - F-Secure 8.0.14470.0 2009.07.21 Suspicious:W32/Malware!Gemini Fortinet 3.120.0.0 2009.07.22 - GData 19 2009.07.22 - Ikarus T3.1.1.64.0 2009.07.22 - Jiangmin 11.0.800 2009.07.21 - K7AntiVirus 7.10.798 2009.07.21 - McAfee 5683 2009.07.21 - McAfee+Artemis 5683 2009.07.21 - McAfee-GW-Edition 6.8.5 2009.07.22 - Microsoft 1.4903 2009.07.22 - NOD32 4265 2009.07.21 - Norman 2009.07.21 - nProtect 2009.1.8.0 2009.07.21 - Panda 10.0.0.14 2009.07.21 - PCTools 4.4.2.0 2009.07.21 - Prevx 3.0 2009.07.22 - Rising 21.39.14.00 2009.07.22 - Sophos 4.43.0 2009.07.22 - Sunbelt 3.2.1858.2 2009.07.21 - Symantec 1.4.4.12 2009.07.22 - TheHacker 6.3.4.3.372 2009.07.21 - TrendMicro 8.950.0.1094 2009.07.21 - VBA32 3.12.10.8 2009.07.21 - ViRobot 2009.7.22.1846 2009.07.22 - VirusBuster 4.6.5.0 2009.07.21 - Information additionnelle File size: 21343 bytes MD5 : f7706dae7d101f1b19ce552d772ebfce SHA1 : 5f2e56b7f68bfa8cb5bcbba354a14e8a44b5df7b SHA256: 727d5662b2e7069c25f2cc794f1385c21509dcdceb7c68c037857ccf388a04e4 PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x270
timedatestamp.....: 0x4027D5A2 (Mon Feb 9 19:46:58 2004)
machinetype.......: 0x14C (Intel I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x270 0x18C0 0x18C0 6.54 b24893df48ba4a4ddd58e6be375f1e33
.rdata 0x1B30 0x2C0 0x2C0 2.51 920926a42d5483cf4170b6c0d1399501
.data 0x1DF0 0x2AA4 0x2AB0 0.55 309c105d13db5b8f63fac780ac14ffea
.idata 0x48A0 0x2EC 0x2F0 4.76 18a0d95f831b02a0f0e3b8b6e29e9e7f
.rsrc 0x4B90 0x634 0x640 3.46 b90dc64981ad6950b4c6da858262c9f5
.reloc 0x51D0 0x16C 0x170 5.76 2146c23b62f01fbeaa1f1f2704814989

( 3 imports )

> hal.dll: KeQueryPerformanceCounter
> ntoskrnl.exe: ExAllocatePoolWithTag, IoCreateSymbolicLink, IofCompleteRequest, PoStartNextPowerIrp, InterlockedExchange, RtlInitUnicodeString, ZwSetValueKey, ZwClose, ZwOpenKey, IoOpenDeviceRegistryKey, strchr, RtlUnicodeStringToAnsiString, RtlInitAnsiString, wcsncmp, ZwCreateKey, ExFreePool, ZwQueryValueKey
> stream.sys: StreamClassDeviceNotification, StreamClassStreamNotification, StreamClassRegisterAdapter

( 0 exports )
TrID : File type identification
95.5% (.EXE) Win64 Executable Generic (85619/45/3)
2.2% (.EXE) Generic Win/DOS Executable (2002/3)
2.2% (.EXE) DOS Executable Generic (2000/1)
0.0% (.CEL) Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) ssdeep: 192:2lipxVuTpK7ptQ4qtsX495HO0wy+EPtEg5cOw2DHTB:2lauTpK7pG4csX43u0wqP/2R2DHTB PEiD : - RDS : NSRL Reference Data Set

( Gateway )

Gateway Operating System Windows XP Pro Edition SP2: ati1ttxx.sys
( Microsoft )

Disc 2438.5: ati1ttxx.sysMSDN Disc 2428.4: ati1ttxx.sysMSDN Disc 2428.5: ati1ttxx.sysMSDN Disc 2428.8: ati1ttxx.sysMSDN Disc 2438.7: ati1ttxx.sysMSDN Disc 2438.8: ati1ttxx.sysMSDN Disc 2439.6: ati1ttxx.sysMSDN Disc 2439.7: ati1ttxx.sysMSDN Disc 2439.8: ati1ttxx.sysMSDN Disc 2440.3: ati1ttxx.sysMSDN Disc 2440.4: ati1ttxx.sysMSDN Disc 2440.5: ati1ttxx.sysMSDN Disc 2441.5: ati1ttxx.sysMSDN Disc 2441.6: ati1ttxx.sysMSDN Disc 2441.7: ati1ttxx.sysMSDN Disc 2442.4: ati1ttxx.sysMSDN Disc 2442.6: ati1ttxx.sysMSDN Disc 2443.2: ati1ttxx.sysMSDN Disc 2443.4: ati1ttxx.sysMSDN Disc 2444.3: ati1ttxx.sysMSDN Disc 2444.3: ati1ttxx.sysMSDN Disc 2444.4: ati1ttxx.sysMSDN Disc 2444.6: ati1ttxx.sysMSDN Disc 2455.6: ati1ttxx.sysMSDN Disc 2464.5: ati1ttxx.sysMSDN Disc 2465.4: ati1ttxx.sysMSDN Disc 2465.5: ati1ttxx.sysMSDN Disc 2466.2: ati1ttxx.sysMSDN Disc 2466.4: ati1ttxx.sysMSDN Disc 2476.2: ati1ttxx.sysMSDN Disc 2476.4: ati1ttxx.sysMSDN Disc 2477.2: ati1ttxx.sysOperating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: ati1ttxx.sysVirtual PC for Mac Windows XP Home Edition: ati1ttxx.sysVirtual PC for Mac Windows XP Professional Edition: ati1ttxx.sys Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.07.22 - AhnLab-V3 5.0.0.2 2009.07.21 - AntiVir 7.9.0.222 2009.07.21 - Antiy-AVL 2.0.3.7 2009.07.22 - Authentium 5.1.2.4 2009.07.22 - Avast 4.8.1335.0 2009.07.21 - AVG 8.5.0.387 2009.07.21 - BitDefender 7.2 2009.07.22 - CAT-QuickHeal 10.00 2009.07.21 - ClamAV 0.94.1 2009.07.22 - Comodo 1670 2009.07.21 - DrWeb 5.0.0.12182 2009.07.22 - eSafe 7.0.17.0 2009.07.21 - eTrust-Vet 31.6.6632 2009.07.22 - F-Prot 4.4.4.56 2009.07.21 - F-Secure 8.0.14470.0 2009.07.21 Suspicious:W32/Malware!Gemini Fortinet 3.120.0.0 2009.07.22 - GData 19 2009.07.22 - Ikarus T3.1.1.64.0 2009.07.22 - Jiangmin 11.0.800 2009.07.21 - K7AntiVirus 7.10.798 2009.07.21 - McAfee 5683 2009.07.21 - McAfee+Artemis 5683 2009.07.21 - McAfee-GW-Edition 6.8.5 2009.07.22 - Microsoft 1.4903 2009.07.22 - NOD32 4265 2009.07.21 - Norman 2009.07.21 - nProtect 2009.1.8.0 2009.07.21 - Panda 10.0.0.14 2009.07.21 - PCTools 4.4.2.0 2009.07.21 - Prevx 3.0 2009.07.22 - Rising 21.39.14.00 2009.07.22 - Sophos 4.43.0 2009.07.22 - Sunbelt 3.2.1858.2 2009.07.21 - Symantec 1.4.4.12 2009.07.22 - TheHacker 6.3.4.3.372 2009.07.21 - TrendMicro 8.950.0.1094 2009.07.21 - VBA32 3.12.10.8 2009.07.21 - ViRobot 2009.7.22.1846 2009.07.22 - VirusBuster 4.6.5.0 2009.07.21 - Information additionnelle File size: 21343 bytes MD5 : f7706dae7d101f1b19ce552d772ebfce SHA1 : 5f2e56b7f68bfa8cb5bcbba354a14e8a44b5df7b SHA256: 727d5662b2e7069c25f2cc794f1385c21509dcdceb7c68c037857ccf388a04e4 PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x270
timedatestamp.....: 0x4027D5A2 (Mon Feb 9 19:46:58 2004)
machinetype.......: 0x14C (Intel I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x270 0x18C0 0x18C0 6.54 b24893df48ba4a4ddd58e6be375f1e33
.rdata 0x1B30 0x2C0 0x2C0 2.51 920926a42d5483cf4170b6c0d1399501
.data 0x1DF0 0x2AA4 0x2AB0 0.55 309c105d13db5b8f63fac780ac14ffea
.idata 0x48A0 0x2EC 0x2F0 4.76 18a0d95f831b02a0f0e3b8b6e29e9e7f
.rsrc 0x4B90 0x634 0x640 3.46 b90dc64981ad6950b4c6da858262c9f5
.reloc 0x51D0 0x16C 0x170 5.76 2146c23b62f01fbeaa1f1f2704814989

( 3 imports )

> hal.dll: KeQueryPerformanceCounter
> ntoskrnl.exe: ExAllocatePoolWithTag, IoCreateSymbolicLink, IofCompleteRequest, PoStartNextPowerIrp, InterlockedExchange, RtlInitUnicodeString, ZwSetValueKey, ZwClose, ZwOpenKey, IoOpenDeviceRegistryKey, strchr, RtlUnicodeStringToAnsiString, RtlInitAnsiString, wcsncmp, ZwCreateKey, ExFreePool, ZwQueryValueKey
> stream.sys: StreamClassDeviceNotification, StreamClassStreamNotification, StreamClassRegisterAdapter

( 0 exports )
TrID : File type identification
95.5% (.EXE) Win64 Executable Generic (85619/45/3)
2.2% (.EXE) Generic Win/DOS Executable (2002/3)
2.2% (.EXE) DOS Executable Generic (2000/1)
0.0% (.CEL) Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) ssdeep: 192:2lipxVuTpK7ptQ4qtsX495HO0wy+EPtEg5cOw2DHTB:2lauTpK7pG4csX43u0wqP/2R2DHTB PEiD : - RDS : NSRL Reference Data Set

( Gateway )

Gateway Operating System Windows XP Pro Edition SP2: ati1ttxx.sys
( Microsoft )

Disc 2438.5: ati1ttxx.sysMSDN Disc 2428.4: ati1ttxx.sysMSDN Disc 2428.5: ati1ttxx.sysMSDN Disc 2428.8: ati1ttxx.sysMSDN Disc 2438.7: ati1ttxx.sysMSDN Disc 2438.8: ati1ttxx.sysMSDN Disc 2439.6: ati1ttxx.sysMSDN Disc 2439.7: ati1ttxx.sysMSDN Disc 2439.8: ati1ttxx.sysMSDN Disc 2440.3: ati1ttxx.sysMSDN Disc 2440.4: ati1ttxx.sysMSDN Disc 2440.5: ati1ttxx.sysMSDN Disc 2441.5: ati1ttxx.sysMSDN Disc 2441.6: ati1ttxx.sysMSDN Disc 2441.7: ati1ttxx.sysMSDN Disc 2442.4: ati1ttxx.sysMSDN Disc 2442.6: ati1ttxx.sysMSDN Disc 2443.2: ati1ttxx.sysMSDN Disc 2443.4: ati1ttxx.sysMSDN Disc 2444.3: ati1ttxx.sysMSDN Disc 2444.3: ati1ttxx.sysMSDN Disc 2444.4: ati1ttxx.sysMSDN Disc 2444.6: ati1ttxx.sysMSDN Disc 2455.6: ati1ttxx.sysMSDN Disc 2464.5: ati1ttxx.sysMSDN Disc 2465.4: ati1ttxx.sysMSDN Disc 2465.5: ati1ttxx.sysMSDN Disc 2466.2: ati1ttxx.sysMSDN Disc 2466.4: ati1ttxx.sysMSDN Disc 2476.2: ati1ttxx.sysMSDN Disc 2476.4: ati1ttxx.sysMSDN Disc 2477.2: ati1ttxx.sysOperating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: ati1ttxx.sysVirtual PC for Mac Windows XP Home Edition: ati1ttxx.sysVirtual PC for Mac Windows XP Professional Edition: ati1ttxx.sys

Maud · Answer

3ème fichier: Fichier b12dd4a0005f1c4b7090009378b5920090fee997.EXE reçu le 2009.03.31 15:27:09 (UTC)Antivirus Version Dernière mise à jour Résultat AhnLab-V3 5.0.0.2 2009.03.31 - AntiVir 7.9.0.129 2009.03.31 - Antiy-AVL 2.0.3.1 2009.03.31 - Authentium 5.1.2.4 2009.03.30 - Avast 4.8.1335.0 2009.03.30 - AVG 8.5.0.285 2009.03.31 - BitDefender 7.2 2009.03.31 - CAT-QuickHeal 10.00 2009.03.31 - ClamAV 0.94.1 2009.03.31 - Comodo 1090 2009.03.31 - DrWeb 4.44.0.09170 2009.03.31 - eSafe 7.0.17.0 2009.03.31 - eTrust-Vet 31.6.6427 2009.03.31 - F-Prot 4.4.4.56 2009.03.30 - F-Secure 8.0.14470.0 2009.03.31 - Fortinet 3.117.0.0 2009.03.31 - GData 19 2009.03.31 - Ikarus T3.1.1.49.0 2009.03.31 - K7AntiVirus 7.10.685 2009.03.30 - Kaspersky 7.0.0.125 2009.03.31 - McAfee 5569 2009.03.30 - McAfee+Artemis 5569 2009.03.30 - McAfee-GW-Edition 6.0.0 2009.03.31 - Microsoft 1.4502 2009.03.31 - NOD32 3976 2009.03.30 - Norman 2009.03.31 - nProtect 2009.1.8.0 2009.03.31 - Panda 10.0.0.14 2009.03.31 - PCTools 4.4.2.0 2009.03.31 - Prevx1 V2 2009.03.31 - Rising 21.23.12.00 2009.03.31 - Sophos 4.40.0 2009.03.31 - Sunbelt 3.2.1858.2 2009.03.31 - Symantec 1.4.4.12 2009.03.31 - TheHacker 6.3.3.9.296 2009.03.30 - TrendMicro 8.700.0.1004 2009.03.31 - VBA32 3.12.10.1 2009.03.31 - ViRobot 2009.3.31.1669 2009.03.31 - VirusBuster 4.6.5.0 2009.03.31 - Information additionnelle File size: 28672 bytes MD5 : ceddee2e0591894d19654d458fd3b9be SHA1 : c58ba65bff4e5e4ba7e78599b583829d56e76e2a SHA256: 712ba390891faf0d52aeadbbaef7fe14a655611984cd3db1709f665482e9fa9b PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1301
timedatestamp.....: 0x40787439 (Sun Apr 11 00:24:57 2004)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x50E8 0x5200 6.48 7071acd55cb7b9f4377885dab92bdeb8
.rdata 0x7000 0xA7F 0xC00 4.55 cbf801a89a20762706eaf0d93c1eb2a6
.data 0x8000 0x38 0x200 0.50 1bad19bae9d56027544774597c2bce5e
.rsrc 0x9000 0x618 0x800 2.78 7ffcbc84ac6844b1edea17f1d1734c22
.reloc 0xA000 0x290 0x400 4.60 6d95403a18601703a8c7d2d7f27f4db7

( 3 imports )

> hal.dll: KfAcquireSpinLock, KfReleaseSpinLock
> ntoskrnl.exe: ExFreePool, KeInitializeSpinLock, PoStartNextPowerIrp, IofCompleteRequest, _purecall, KeSetEvent, IoFreeIrp, KeWaitForSingleObject, IofCallDriver, KeInitializeEvent, IoAllocateIrp, KeQuerySystemTime, wcsncmp, ZwClose, ZwOpenKey, RtlInitUnicodeString, ExAllocatePoolWithTag, KeDelayExecutionThread, RtlGUIDFromString, ZwQueryValueKey, RtlAppendUnicodeStringToString, RtlCopyUnicodeString, RtlIntegerToUnicodeString, IoOpenDeviceRegistryKey, ZwSetValueKey, strchr, RtlUnicodeStringToAnsiString, RtlInitAnsiString, ZwCreateKey
> stream.sys: StreamClassRegisterFilterWithNoKSPins, StreamClassScheduleTimer, StreamClassRegisterAdapter, StreamClassDeviceNotification

( 0 exports )
TrID : File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) ssdeep: 384:UsA3COA9Q6Yd/AikFzp95UwbZLk4suw15Mdrjg2ohzWP3DdgQII9oZ8J3bJz7j:Us7OGQs5PNL6uwGrmgqQIuoZ8dJz7j PEiD : - RDS : NSRL Reference Data Set

( Gateway )

Gateway Operating System Windows XP Pro Edition SP2: atinsnxx.sys
( Microsoft )

Disc 2438.5: atinsnxx.sysMSDN Disc 2428.4: atinsnxx.sysMSDN Disc 2428.5: atinsnxx.sysMSDN Disc 2428.8: atinsnxx.sysMSDN Disc 2438.7: atinsnxx.sysMSDN Disc 2438.8: atinsnxx.sysMSDN Disc 2439.6: atinsnxx.sysMSDN Disc 2439.7: atinsnxx.sysMSDN Disc 2439.8: atinsnxx.sysMSDN Disc 2440.3: atinsnxx.sysMSDN Disc 2440.4: atinsnxx.sysMSDN Disc 2440.5: atinsnxx.sysMSDN Disc 2441.5: atinsnxx.sysMSDN Disc 2441.6: atinsnxx.sysMSDN Disc 2441.7: atinsnxx.sysMSDN Disc 2442.4: atinsnxx.sysMSDN Disc 2442.6: atinsnxx.sysMSDN Disc 2443.2: atinsnxx.sysMSDN Disc 2443.4: atinsnxx.sysMSDN Disc 2444.3: atinsnxx.sysMSDN Disc 2444.3: atinsnxx.sysMSDN Disc 2444.4: atinsnxx.sysMSDN Disc 2444.6: atinsnxx.sysMSDN Disc 2455.6: atinsnxx.sysMSDN Disc 2464.5: atinsnxx.sysMSDN Disc 2465.4: atinsnxx.sysMSDN Disc 2465.5: atinsnxx.sysMSDN Disc 2466.2: atinsnxx.sysMSDN Disc 2466.4: atinsnxx.sysMSDN Disc 2476.2: atinsnxx.sysMSDN Disc 2476.4: atinsnxx.sysMSDN Disc 2477.2: atinsnxx.sysOperating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: atinsnxx.sysVirtual PC for Mac Windows XP Home Edition: atinsnxx.sysVirtual PC for Mac Windows XP Professional Edition: atinsnxx.sys

Maud · Answer

4ème fichier: Fichier atinttxx.sys reçu le 2009.08.14 19:42:30 (UTC)Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.14 - AhnLab-V3 5.0.0.2 2009.08.14 - AntiVir 7.9.1.1 2009.08.14 - Antiy-AVL 2.0.3.7 2009.08.14 - Authentium 5.1.2.4 2009.08.13 - Avast 4.8.1335.0 2009.08.14 - AVG 8.5.0.406 2009.08.14 - BitDefender 7.2 2009.08.14 - CAT-QuickHeal 10.00 2009.08.13 - ClamAV 0.94.1 2009.08.14 - Comodo 1965 2009.08.14 - DrWeb 5.0.0.12182 2009.08.14 - eSafe 7.0.17.0 2009.08.13 - eTrust-Vet 31.6.6677 2009.08.14 - F-Prot 4.4.4.56 2009.08.13 - F-Secure 8.0.14470.0 2009.08.14 - Fortinet 3.120.0.0 2009.08.14 - GData 19 2009.08.14 - Ikarus T3.1.1.64.0 2009.08.14 - Jiangmin 11.0.800 2009.08.14 - K7AntiVirus 7.10.819 2009.08.14 - Kaspersky 7.0.0.125 2009.08.14 - McAfee 5709 2009.08.14 - McAfee+Artemis 5709 2009.08.14 - McAfee-GW-Edition 6.8.5 2009.08.14 - Microsoft 1.4903 2009.08.14 - NOD32 4336 2009.08.14 - Norman 2009.08.14 - nProtect 2009.1.8.0 2009.08.14 - Panda 10.0.0.14 2009.08.14 - PCTools 4.4.2.0 2009.08.12 - Prevx 3.0 2009.08.14 - Rising 21.42.44.00 2009.08.14 - Sophos 4.44.0 2009.08.14 - Sunbelt 3.2.1858.2 2009.08.13 - Symantec 1.4.4.12 2009.08.14 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.14 - VBA32 3.12.10.9 2009.08.13 - ViRobot 2009.8.14.1885 2009.08.14 - VirusBuster 4.6.5.0 2009.08.14 - Information additionnelle File size: 13824 bytes MD5 : d80a8f6c0a717446496c3a06d33b0d9c SHA1 : c79a0db42f5d0bbcb7ed85e78578025179123080 SHA256: 0e3025a38f060b643914c099792f3e5d2c80c3d039af07fb71e33b678fcee15d PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x16B3
timedatestamp.....: 0x4078749C (Sun Apr 11 00:26:36 2004)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1860 0x1A00 6.30 e723576cc001e80a0fb6055f359170f1
.rdata 0x3000 0x896 0xA00 3.66 eb8a1ef19e143e3191bd57f659470e4f
.data 0x4000 0x29C0 0x400 3.12 bf3d146f65e46ad39ad3218cea1242bb
.rsrc 0x7000 0x638 0x800 2.80 91983aa4359b28b3a4f68a40c31e5fd4
.reloc 0x8000 0x162 0x200 4.39 03f121f28732ec37b185e80288d1023a

( 3 imports )

> hal.dll: KeQueryPerformanceCounter
> ntoskrnl.exe: PoStartNextPowerIrp, IofCompleteRequest, IoCreateSymbolicLink, RtlInitUnicodeString, _allmul, _aulldiv, InterlockedExchange, ZwClose, ZwOpenKey, IoOpenDeviceRegistryKey, ExFreePool, ZwQueryValueKey, ExAllocatePoolWithTag, ZwSetValueKey, strchr, RtlUnicodeStringToAnsiString, RtlInitAnsiString, wcsncmp, ZwCreateKey
> stream.sys: StreamClassRegisterAdapter, StreamClassDeviceNotification, StreamClassStreamNotification

( 0 exports )
TrID : File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) ssdeep: 192:bq9O6kUX9yI4hStJpNqEMgGxDMCLMCViviiHexNGYYshf:b5/69hvN9sNdXy+dYshf PEiD : - RDS : NSRL Reference Data Set

( Gateway )

Gateway Operating System Windows XP Pro Edition SP2: atinttxx.sys
( Microsoft )

Disc 2438.5: atinttxx.sysMSDN Disc 2428.4: atinttxx.sysMSDN Disc 2428.5: atinttxx.sysMSDN Disc 2428.8: atinttxx.sysMSDN Disc 2438.7: atinttxx.sysMSDN Disc 2438.8: atinttxx.sysMSDN Disc 2439.6: atinttxx.sysMSDN Disc 2439.7: atinttxx.sysMSDN Disc 2439.8: atinttxx.sysMSDN Disc 2440.3: atinttxx.sysMSDN Disc 2440.4: atinttxx.sysMSDN Disc 2440.5: atinttxx.sysMSDN Disc 2441.5: atinttxx.sysMSDN Disc 2441.6: atinttxx.sysMSDN Disc 2441.7: atinttxx.sysMSDN Disc 2442.4: atinttxx.sysMSDN Disc 2442.6: atinttxx.sysMSDN Disc 2443.2: atinttxx.sysMSDN Disc 2443.4: atinttxx.sysMSDN Disc 2444.3: atinttxx.sysMSDN Disc 2444.3: atinttxx.sysMSDN Disc 2444.4: atinttxx.sysMSDN Disc 2444.6: atinttxx.sysMSDN Disc 2455.6: atinttxx.sysMSDN Disc 2464.5: atinttxx.sysMSDN Disc 2465.4: atinttxx.sysMSDN Disc 2465.5: atinttxx.sysMSDN Disc 2466.2: atinttxx.sysMSDN Disc 2466.4: atinttxx.sysMSDN Disc 2476.2: atinttxx.sysMSDN Disc 2476.4: atinttxx.sysMSDN Disc 2477.2: atinttxx.sysOperating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: atinttxx.sysVirtual PC for Mac Windows XP Home Edition: atinttxx.sysVirtual PC for Mac Windows XP Professional Edition: atinttxx.sys Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.14 - AhnLab-V3 5.0.0.2 2009.08.14 - AntiVir 7.9.1.1 2009.08.14 - Antiy-AVL 2.0.3.7 2009.08.14 - Authentium 5.1.2.4 2009.08.13 - Avast 4.8.1335.0 2009.08.14 - AVG 8.5.0.406 2009.08.14 - BitDefender 7.2 2009.08.14 - CAT-QuickHeal 10.00 2009.08.13 - ClamAV 0.94.1 2009.08.14 - Comodo 1965 2009.08.14 - DrWeb 5.0.0.12182 2009.08.14 - eSafe 7.0.17.0 2009.08.13 - eTrust-Vet 31.6.6677 2009.08.14 - F-Prot 4.4.4.56 2009.08.13 - F-Secure 8.0.14470.0 2009.08.14 - Fortinet 3.120.0.0 2009.08.14 - GData 19 2009.08.14 - Ikarus T3.1.1.64.0 2009.08.14 - Jiangmin 11.0.800 2009.08.14 - K7AntiVirus 7.10.819 2009.08.14 - Kaspersky 7.0.0.125 2009.08.14 - McAfee 5709 2009.08.14 - McAfee+Artemis 5709 2009.08.14 - McAfee-GW-Edition 6.8.5 2009.08.14 - Microsoft 1.4903 2009.08.14 - NOD32 4336 2009.08.14 - Norman 2009.08.14 - nProtect 2009.1.8.0 2009.08.14 - Panda 10.0.0.14 2009.08.14 - PCTools 4.4.2.0 2009.08.12 - Prevx 3.0 2009.08.14 - Rising 21.42.44.00 2009.08.14 - Sophos 4.44.0 2009.08.14 - Sunbelt 3.2.1858.2 2009.08.13 - Symantec 1.4.4.12 2009.08.14 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.14 - VBA32 3.12.10.9 2009.08.13 - ViRobot 2009.8.14.1885 2009.08.14 - VirusBuster 4.6.5.0 2009.08.14 - Information additionnelle File size: 13824 bytes MD5 : d80a8f6c0a717446496c3a06d33b0d9c SHA1 : c79a0db42f5d0bbcb7ed85e78578025179123080 SHA256: 0e3025a38f060b643914c099792f3e5d2c80c3d039af07fb71e33b678fcee15d PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x16B3
timedatestamp.....: 0x4078749C (Sun Apr 11 00:26:36 2004)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1860 0x1A00 6.30 e723576cc001e80a0fb6055f359170f1
.rdata 0x3000 0x896 0xA00 3.66 eb8a1ef19e143e3191bd57f659470e4f
.data 0x4000 0x29C0 0x400 3.12 bf3d146f65e46ad39ad3218cea1242bb
.rsrc 0x7000 0x638 0x800 2.80 91983aa4359b28b3a4f68a40c31e5fd4
.reloc 0x8000 0x162 0x200 4.39 03f121f28732ec37b185e80288d1023a

( 3 imports )

> hal.dll: KeQueryPerformanceCounter
> ntoskrnl.exe: PoStartNextPowerIrp, IofCompleteRequest, IoCreateSymbolicLink, RtlInitUnicodeString, _allmul, _aulldiv, InterlockedExchange, ZwClose, ZwOpenKey, IoOpenDeviceRegistryKey, ExFreePool, ZwQueryValueKey, ExAllocatePoolWithTag, ZwSetValueKey, strchr, RtlUnicodeStringToAnsiString, RtlInitAnsiString, wcsncmp, ZwCreateKey
> stream.sys: StreamClassRegisterAdapter, StreamClassDeviceNotification, StreamClassStreamNotification

( 0 exports )
TrID : File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) ssdeep: 192:bq9O6kUX9yI4hStJpNqEMgGxDMCLMCViviiHexNGYYshf:b5/69hvN9sNdXy+dYshf PEiD : - RDS : NSRL Reference Data Set

( Gateway )

Gateway Operating System Windows XP Pro Edition SP2: atinttxx.sys
( Microsoft )

Disc 2438.5: atinttxx.sysMSDN Disc 2428.4: atinttxx.sysMSDN Disc 2428.5: atinttxx.sysMSDN Disc 2428.8: atinttxx.sysMSDN Disc 2438.7: atinttxx.sysMSDN Disc 2438.8: atinttxx.sysMSDN Disc 2439.6: atinttxx.sysMSDN Disc 2439.7: atinttxx.sysMSDN Disc 2439.8: atinttxx.sysMSDN Disc 2440.3: atinttxx.sysMSDN Disc 2440.4: atinttxx.sysMSDN Disc 2440.5: atinttxx.sysMSDN Disc 2441.5: atinttxx.sysMSDN Disc 2441.6: atinttxx.sysMSDN Disc 2441.7: atinttxx.sysMSDN Disc 2442.4: atinttxx.sysMSDN Disc 2442.6: atinttxx.sysMSDN Disc 2443.2: atinttxx.sysMSDN Disc 2443.4: atinttxx.sysMSDN Disc 2444.3: atinttxx.sysMSDN Disc 2444.3: atinttxx.sysMSDN Disc 2444.4: atinttxx.sysMSDN Disc 2444.6: atinttxx.sysMSDN Disc 2455.6: atinttxx.sysMSDN Disc 2464.5: atinttxx.sysMSDN Disc 2465.4: atinttxx.sysMSDN Disc 2465.5: atinttxx.sysMSDN Disc 2466.2: atinttxx.sysMSDN Disc 2466.4: atinttxx.sysMSDN Disc 2476.2: atinttxx.sysMSDN Disc 2476.4: atinttxx.sysMSDN Disc 2477.2: atinttxx.sysOperating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: atinttxx.sysVirtual PC for Mac Windows XP Home Edition: atinttxx.sysVirtual PC for Mac Windows XP Professional Edition: atinttxx.sys

gen-hackman · Answer

tu habites au benglasdesh ? 

reçu le 2009.08.14 19:42:30

Maud · Answer

Voilà. Je n'ai pas eu à réaliser "cocher/décocher" dans la première étape car c'était déjà dans l'état demandé. Merci. J'ai l'impression que le travail va être long... :)

Maud · Answer

Je ne suis pas contre les voyages mais je suis belge. :s

gen-hackman · Answer

je ne comprends pas pourquoi l'heure et la date d'ailleurs , d'analyse ne correspond pas à aujourd'hui

Maud · Answer

Et moi donc ... :s

gen-hackman · Answer

tu peux me rendre un service ?

je suis en train de corriger des erreurs de detection sur List'em

peux-tu le supprimer , le retelecharger , et le repasser une fois ? merci d'avance

sinon pour la suite :

Télécharge OTL de OLDTimer

&#9654 enregistre le sur ton Bureau.

&#9654 Double clic sur OTL.exe pour le lancer.

&#9654 Coche les 2 cases Lop et Purity

&#9654 Coche la case devant scan all users

&#9654 règle-le sur "60 Days"

&#9654Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier ci-dessus.

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

Tu feras la meme chose avec le "Extra.txt".

Maud · Answer

Suppression et deuxième passation de "listem":

List'em by g3n-h@ckm@n 1.0.2.0 

dim. 16/08/2009    14:37:45,42 

Microsoft Windows XP [version 5.1.2600]
 

Infections possibles : 
==================== 
 

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

 
¤¤¤¤¤¤¤¤¤¤ Windows\Prefetch : 

C:\WINDOWS\Prefetch\ALBUMDB2.EXE-1F918EF2.pf
C:\WINDOWS\Prefetch\ALG.EXE-275708CF.pf
C:\WINDOWS\Prefetch\AVGCMGR.EXE-017B654E.pf
C:\WINDOWS\Prefetch\AVGDIAGEX.EXE-174D8C7C.pf
C:\WINDOWS\Prefetch\AVGTRAY.EXE-11DB8130.pf
C:\WINDOWS\Prefetch\AVGUI.EXE-0D7989A9.pf
C:\WINDOWS\Prefetch\AVGUPD.EXE-2AED0BE6.pf
C:\WINDOWS\Prefetch\CHECKER.EXE-035DF12F.pf
C:\WINDOWS\Prefetch\CMD.EXE-034B0549.pf
C:\WINDOWS\Prefetch\CONTROL.EXE-24FBF8B3.pf
C:\WINDOWS\Prefetch\DEFRAG.EXE-2858C7E2.pf
C:\WINDOWS\Prefetch\DFRGNTFS.EXE-38C3807C.pf
C:\WINDOWS\Prefetch\DW20.EXE-0A0B1C6C.pf
C:\WINDOWS\Prefetch\DWTRIG20.EXE-05D8A0C7.pf
C:\WINDOWS\Prefetch\EXPAND.EXE-14A1B56D.pf
C:\WINDOWS\Prefetch\FIXCFG.EXE-3A39BB3F.pf
C:\WINDOWS\Prefetch\FXSVR2.EXE-34D06B28.pf
C:\WINDOWS\Prefetch\IEXPLORE.EXE-2D97EBE6.pf
C:\WINDOWS\Prefetch\IGFXSRVC.EXE-1D88F978.pf
C:\WINDOWS\Prefetch\IMAPI.EXE-201490BB.pf
C:\WINDOWS\Prefetch\INFOCARD.EXE-0146833D.pf
C:\WINDOWS\Prefetch\layout.ini
C:\WINDOWS\Prefetch\LISTEM.EXE-29880F81.pf
C:\WINDOWS\Prefetch\LVCOMSX.EXE-30FB8DC0.pf
C:\WINDOWS\Prefetch\MODE.COM-318FFE37.pf
C:\WINDOWS\Prefetch\MSCORSVW.EXE-310BC412.pf
C:\WINDOWS\Prefetch\MSFEEDSSYNC.EXE-05335A39.pf
C:\WINDOWS\Prefetch\MSIEXEC.EXE-330626DC.pf
C:\WINDOWS\Prefetch\MSNMSGR.EXE-0EBDBC56.pf
C:\WINDOWS\Prefetch\NGEN.EXE-20BDC4FB.pf
C:\WINDOWS\Prefetch\NOTEPAD.EXE-2F2D61E1.pf
C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf
C:\WINDOWS\Prefetch\REG.EXE-07FA5B3F.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-3D479208.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-419F288A.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-54023F1C.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-57C8756E.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-5F120771.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-645E91B7.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-6DF739B2.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-753F1DF3.pf
C:\WINDOWS\Prefetch\SETUP.EXE-02D9625A.pf
C:\WINDOWS\Prefetch\SQLBROWSER.EXE-008F6C94.pf
C:\WINDOWS\Prefetch\SSTEXT3D.SCR-0586736D.pf
C:\WINDOWS\Prefetch\SVCHOST.EXE-2D5FBD18.pf
C:\WINDOWS\Prefetch\VCSW.EXE-228F95AF.pf
C:\WINDOWS\Prefetch\VERCLSID.EXE-28F52AD2.pf
C:\WINDOWS\Prefetch\VZRS.EXE-22BC1C1C.pf
C:\WINDOWS\Prefetch\WLTUSER.EXE-2E4DF564.pf
C:\WINDOWS\Prefetch\WMIAPSRV.EXE-02740A4B.pf
C:\WINDOWS\Prefetch\WMIPRVSE.EXE-0D449B4F.pf
C:\WINDOWS\Prefetch\WSCNTFY.EXE-0B14C27D.pf
C:\WINDOWS\Prefetch\WUAUCLT.EXE-1360D60A.pf
 
 
--------EOF------------

gen-hackman · Answer

ok faux positif écarté , tu peux continuer merci ;)

Maud · Answer

http://www.cijoint.fr/cjlink.php?file=cj200908/cijq0DxJ9F.txt 

http://www.cijoint.fr/cjlink.php?file=cj200908/cijEQS1ON5.txt

gen-hackman · Answer

&#9654 Double clic sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous Customs Scans/Fixes :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\msdaipp - No CLSID value found
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\ctl3dv2.dll:KAVICHS
@Alternate Data Stream - 100 bytes -> C:\WINDOWS\System32\DF4264A10A.sys:KAVICHS

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"QuickTime Task"=-

:files
C:\Documents and Settings\All Users\Application Data\E31C

:commands
[emptytemp]
[reboot]


&#9654 Clique sur RunFix pour lancer la suppression.


&#9654 Poste le rapport.

Maud · Answer

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
Starting removal of ActiveX control {166B1BCA-3F9C-11CF-8075-444553540000}
C:\WINDOWS\Downloaded Program Files\swdir.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ipp\ deleted successfully.
File Protocol\Handler\ipp - No CLSID value found not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ deleted successfully.
File Protocol\Handler\msdaipp - No CLSID value found not found.
Unable to delete ADS C:\WINDOWS\System32\ctl3dv2.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DF4264A10A.sys:KAVICHS .
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task deleted successfully.
========== FILES ==========
C:\Documents and Settings\All Users\Application Data\E31C moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Propriétaire
 
User: Thomas
->Temp folder emptied: 59067 bytes
->Temporary Internet Files folder emptied: 15304910 bytes
->Java cache emptied: 25493131 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 57123 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 39,08 mb
 
 
OTL by OldTimer - Version 3.0.10.7 log created on 08162009_151244

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

gen-hackman · Answer

repasse le avec ceci en mode sans echec stp


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\ctl3dv2.dll:KAVICHS
@Alternate Data Stream - 100 bytes -> C:\WINDOWS\System32\DF4264A10A.sys:KAVICHS

:commands
[emptytemp]
[reboot]

Maud · Answer

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
Unable to delete ADS C:\WINDOWS\System32\ctl3dv2.dll:KAVICHS .
Unable to delete ADS C:\WINDOWS\System32\DF4264A10A.sys:KAVICHS .
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Propriétaire
 
User: Thomas
->Temp folder emptied: 67013 bytes
->Temporary Internet Files folder emptied: 28872924 bytes
->Java cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 255 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 27,63 mb
 
 
OTL by OldTimer - Version 3.0.10.7 log created on 08162009_171658

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

gen-hackman · Answer

&#9654 Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
* - Coche    Afficher les fichiers et dossiers cachés
* - Décoche Masquer les extensions des fichiers dont le type est connu
* - Décoche Masquer les fichiers protégés du système d'exploitation (recommandé)

&#9654 clique sur Appliquer, puis OK.

N'oublie pas de recacher à nouveau les fichiers cachés et protégés du système d'exploitation en fin de désinfection, c'est important

Fais analyser le(s) fichier(s) suivants sur Virustotal :

Virus Total

    * Clique sur Parcourir en haut, choisis Poste de travail et cherche ces fichiers :

C:\WINDOWS\System32\ctl3dv2.dll:KAVICHS .
C:\WINDOWS\System32\DF4264A10A.sys:KAVICHS .  

    * Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
    * Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
    * Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté
    * Une nouvelle fenêtre de ton navigateur va apparaître
    * Clique alors sur les deux fleches
    * Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
    * Enfin colle le résultat dans ta prochaine réponse.

Note : Pour analyser un autre fichier, clique en bas sur Autre fichier.

Maud · Answer

Maud · Answer

Second fichier: Fichier DF4264A10A.sys reçu le 2009.08.16 15:49:26 (UTC)Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.16 - AhnLab-V3 5.0.0.2 2009.08.15 - AntiVir 7.9.1.1 2009.08.14 - Antiy-AVL 2.0.3.7 2009.08.14 - Authentium 5.1.2.4 2009.08.15 - Avast 4.8.1335.0 2009.08.15 - AVG 8.5.0.406 2009.08.16 - BitDefender 7.2 2009.08.16 - CAT-QuickHeal 10.00 2009.08.16 - ClamAV 0.94.1 2009.08.16 - Comodo 1990 2009.08.16 - DrWeb 5.0.0.12182 2009.08.16 - eSafe 7.0.17.0 2009.08.16 - eTrust-Vet 31.6.6678 2009.08.14 - F-Prot 4.4.4.56 2009.08.15 - F-Secure 8.0.14470.0 2009.08.16 - Fortinet 3.120.0.0 2009.08.16 - GData 19 2009.08.16 - Ikarus T3.1.1.64.0 2009.08.16 - Jiangmin 11.0.800 2009.08.16 - K7AntiVirus 7.10.819 2009.08.14 - Kaspersky 7.0.0.125 2009.08.16 - McAfee 5710 2009.08.15 - McAfee+Artemis 5710 2009.08.15 - McAfee-GW-Edition 6.8.5 2009.08.16 - Microsoft 1.4903 2009.08.16 - NOD32 4339 2009.08.16 - Norman 6.01.09 2009.08.14 - nProtect 2009.1.8.0 2009.08.16 - Panda 10.0.0.14 2009.08.16 - PCTools 4.4.2.0 2009.08.16 - Prevx 3.0 2009.08.16 - Rising 21.42.62.00 2009.08.16 - Sophos 4.44.0 2009.08.16 - Sunbelt 3.2.1858.2 2009.08.16 - Symantec 1.4.4.12 2009.08.16 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.14 - VBA32 3.12.10.9 2009.08.16 - ViRobot 2009.8.14.1885 2009.08.14 - VirusBuster 4.6.5.0 2009.08.16 - Information additionnelle File size: 56 bytes MD5...: 3166f3da522db79be1ba42eea0c0786a SHA1..: 589e3fa461c9aac0454f011c0e58922bd7fb0d2a SHA256: 6848a44e6364f2b8777b2993a2f9557b96f1ea261dd88cdd4d50f6585765e8bd ssdeep: 3:/ldEVD:W
PEiD..: - TrID..: File type identification
MS Flight Simulator Aircraft Performance Info (100.0%) PEInfo: - PDFiD.: - RDS...: NSRL Reference Data Set
- Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.16 - AhnLab-V3 5.0.0.2 2009.08.15 - AntiVir 7.9.1.1 2009.08.14 - Antiy-AVL 2.0.3.7 2009.08.14 - Authentium 5.1.2.4 2009.08.15 - Avast 4.8.1335.0 2009.08.15 - AVG 8.5.0.406 2009.08.16 - BitDefender 7.2 2009.08.16 - CAT-QuickHeal 10.00 2009.08.16 - ClamAV 0.94.1 2009.08.16 - Comodo 1990 2009.08.16 - DrWeb 5.0.0.12182 2009.08.16 - eSafe 7.0.17.0 2009.08.16 - eTrust-Vet 31.6.6678 2009.08.14 - F-Prot 4.4.4.56 2009.08.15 - F-Secure 8.0.14470.0 2009.08.16 - Fortinet 3.120.0.0 2009.08.16 - GData 19 2009.08.16 - Ikarus T3.1.1.64.0 2009.08.16 - Jiangmin 11.0.800 2009.08.16 - K7AntiVirus 7.10.819 2009.08.14 - Kaspersky 7.0.0.125 2009.08.16 - McAfee 5710 2009.08.15 - McAfee+Artemis 5710 2009.08.15 - McAfee-GW-Edition 6.8.5 2009.08.16 - Microsoft 1.4903 2009.08.16 - NOD32 4339 2009.08.16 - Norman 6.01.09 2009.08.14 - nProtect 2009.1.8.0 2009.08.16 - Panda 10.0.0.14 2009.08.16 - PCTools 4.4.2.0 2009.08.16 - Prevx 3.0 2009.08.16 - Rising 21.42.62.00 2009.08.16 - Sophos 4.44.0 2009.08.16 - Sunbelt 3.2.1858.2 2009.08.16 - Symantec 1.4.4.12 2009.08.16 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.14 - VBA32 3.12.10.9 2009.08.16 - ViRobot 2009.8.14.1885 2009.08.14 - VirusBuster 4.6.5.0 2009.08.16 - Information additionnelle File size: 56 bytes MD5...: 3166f3da522db79be1ba42eea0c0786a SHA1..: 589e3fa461c9aac0454f011c0e58922bd7fb0d2a SHA256: 6848a44e6364f2b8777b2993a2f9557b96f1ea261dd88cdd4d50f6585765e8bd ssdeep: 3:/ldEVD:W
PEiD..: - TrID..: File type identification
MS Flight Simulator Aircraft Performance Info (100.0%) PEInfo: - PDFiD.: - RDS...: NSRL Reference Data Set
-

Maud · Answer

En tout cas, merci bcp de prendre autant de temps ! 

Les fichiers ci-dessus ne correspondent pas totalement. Pour les deux, il manque ' :KAVICHS ' mais je n'en ai pas trouvé d'autres.

Encore une fois, je n'ai pas eu à "cocher/décocher" car c'était déjà comme demandé. Ce que je ne comprends pas car je m'étais assuré d'appliquer avant de mettre "ok".

gen-hackman · Answer

2009.07.20 23:12:49 lol


&#9654 Télécharge SDFix sur ton bureau : 
ici :SDFix 
ou ici SDFix 
ou ici SDFix 

&#9654 Double-clique sur SDFix.exe et choisis "Install" . 

Tuto 

Puis une fois l'installe faite , 

Impératif !!!: Démarrer en mode sans echec . 

/!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\ 

Comment aller en Mode sans échec : 
&#9654 Redémarre ton ordi . 
&#9654 Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" . 
&#9654 Tu tapotes jusqu' à l'apparition de l'écran avec les options de démarrage . 
&#9654 Choisis la première option : Sans Échec , et valide en tapant sur [Entrée] . 
&#9654 Choisis ton compte habituel ( et pas Administrateur ).
 
attention : pas de connexion possible en mode sans échec , donc copie ou imprime bien la manipe pour éviter les erreurs ... 


&#9654 Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double-clique sur RunThis.bat pour lancer l'outil . 

&#9654 Tapes Y pour lancer le script ...
 
Le Fix supprime les services du virus et nettoie le registre, de ce fait un redémarrage est nécessaire , donc :
 
&#9654 presse une touche pour redémarrer quand il te le sera demandé . 

Le PC va mettre du temps avant de démarrer ( c'est normal ), après le chargement du Bureau :

&#9654 presse une touche lorsque "Finished" s'affiche . 

Le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier
 
C:\SDFix sous le nom "Report.txt". 

&#9654 Poste ce dernier dans ta prochaine réponse
__________________________________________________________

&#9654Si SDfix ne se lance pas (ça arrive!) 

&#9654 Démarrer->Exécuter 

&#9654 Copie/colle ceci : 

%systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe 

&#9654 Clique sur ok, et valide. 

&#9654 Redémarre et essaye de nouveau de lancer SDfix , toujours en mode sans echec .

Maud · Answer

Bonsoir,

Juste pour être certain, est il normal que ça fasse près de 2h que le programme tourne ('finishing (...)') ?

Merci

gen-hackman · Answer

tu l'as bien fait tourner en mode sans echec sans prise en charge reseau ?

Maud · Answer

Oui oui comme prévu. :)

gen-hackman · Answer

2 h non ou alors ton pc est vraiment lent

regarde si tu as un report.txt dans C:\

Maud · Answer

Pour être plus précis, j'ai installé le programme avec le premier lien. A partir de WinRar je l'ai décompressé. Je l'ai exécuté à partir du poste de travail. La phase 'Y' s'est bien passée app, le pc a redémarré, il est maintenant en phase "Finishing malware check - It may takes several minutes" (C'est plus ou moins la phrase, je suis sur un autre pc je ne m'en souviens plus bien). 

Bloquage ou pas ? Le pc ne fait pas de bruit comme s'il travaillait, le curseur ne répond pas.

Maud · Answer

Le pc n'est plus une flèche mais bon de manière générale il n'est pas si lent. 

Là par contre je n'ai plus le contrôle, il est bloqué je pense.

Maud · Answer

En fin de compte peut être travaille-t-il ... Le curseur de la souris s'est déplacé difficilement après que je me sois qqe peu excité sur le pad.

gen-hackman · Answer

la lumiere temoin du disque dur clignote ?

Maud · Answer

J'aurais dû y penser ... *Honte* Non, juste celle de mise sous tension.

Maud · Answer

Que dois je fais faire, l'éteindre 'de force' ?

gen-hackman · Answer

si tu fais ctrl+alt+sup , il vient le gestionnnaire des taches ?

Maud · Answer

Non j'avais déjà essayé ... :s

gen-hackman · Answer

coupe-le et redemarre-le

Maud · Answer

J'ai redémarré. J'ai retrouvé ça dans le dossier:

[b]SDFix: Version 1.240 [/b]
Run by Thomas on dim. 16/08/2009 at 19:07

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting

gen-hackman · Answer

refais un examen complet avec Malwarebytes apres mise a joour

Maud · Answer

Voilà il est lancé pour une analyse complète.

Sait on ce qui s'est passé ? C'était un "virus" ? Comment se serait il invité, je suis pourtant protégé. Est ce que cela explique les allumages répétitifs, les pertes d'écran (écran noir à répétition), les différences de taille de police sur le bureau, ... ?

Merci en tout cas ... !

gen-hackman · Answer

lol sache qu'un virus peut faire faire ce qu'il veut a ton pc

Maud · Answer

Okay... :d Là pour le coup je pense qu'il s'est amusé. Je me demande quand même cmt j'ai pu le choper. Enfin. Je posterai sans doute le rapport demain matin car s'il est parti pour deux heures d'analyse... :)

Merci beaucoup, content d'entretenir tes/vos compétences ;)

gen-hackman · Answer

lol :)

Maud · Answer

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2636
Windows 5.1.2600 Service Pack 3

17/08/2009 9:19:32
mbam-log-2009-08-17 (09-19-32).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|)
Eléments examinés: 171748
Temps écoulé: 1 hour(s), 14 minute(s), 16 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Maud · Answer

Bonjour,

Le dernier rapport semble ne rien indiquer de suspect si je ne me trompe. Pourtant, les soucis d'écran continuent : le curseur se fige, l'écran disparaît, pour enfin réapparaître qqes secondes plus tard. A l'excès, le pc redémarre et affiche une police différente (proche de celle du démarrage sans échec). 

A plus tard ! :)

Maud · Answer

Re,

Après un redémarrage du pc, une fenêtre SDFix est apparue (la deuxième fois depuis hier d'ailleurs). Je pensais que le programme ne travaillait plus mais il travaille, "finished" :


[b]SDFix: Version 1.240 [/b]
Run by Thomas on dim. 16/08/2009 at 19:07

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-17 13:25:15
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

C:\Documents and Settings\Thomas\Cookies	homas@live[2].txt

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Yahoo!\Messenger\YPager.exe"="C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\UltraVNC\winvnc.exe"="C:\Program Files\UltraVNC\winvnc.exe:*:Enabled:VNC server for Win32"
"C:\StubInstaller.exe"="C:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Grisoft\AVG7\avginet.exe"="C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe"
"C:\Program Files\Grisoft\AVG7\avgamsvr.exe"="C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\Program Files\Grisoft\AVG7\avgcc.exe"="C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\Sony\VAIO Media 4.0\Vc.exe"="C:\Program Files\Sony\VAIO Media 4.0\Vc.exe:*:Disabled:[VAIO Media] VAIO Media"
"C:\Program Files\iMesh\iMesh5\iMesh.exe"="C:\Program Files\iMesh\iMesh5\iMesh.exe:*:Disabled:iMesh 5"
"C:\Program Files\iMesh Applications\iMesh6\iMesh6.exe"="C:\Program Files\iMesh Applications\iMesh6\iMesh6.exe:*:Disabled:iMesh 6"
"C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe"="C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe:*:Disabled:Kerio Personal Firewall 4 - GUI"
"C:\Program Files\Microsoft Office\Office10\WINWORD.EXE"="C:\Program Files\Microsoft Office\Office10\WINWORD.EXE:*:Enabled:Microsoft Word"
"C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe"="C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe:*:Enabled:Vcsw"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Enabled:Explorateur Windows"
"C:\Program Files\AVG\AVG8\avgam.exe"="C:\Program Files\AVG\AVG8\avgam.exe:*:Enabled:avgam.exe"
"C:\Program Files\AVG\AVG8\avgnsx.exe"="C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe"
"C:\Program Files\Microsoft Games\Age of Empires II Trial\EMPIRES2.EXE"="C:\Program Files\Microsoft Games\Age of Empires II Trial\EMPIRES2.EXE:*:Enabled:Age of Empires II"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Shareaza\Shareaza.exe"="C:\Program Files\Shareaza\Shareaza.exe:*:Enabled:Shareaza"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Thu  5 Aug 2004        94,864 A.SH. --- "C:\WINDOWS	wain.dll"
Wed 30 Nov 2005            56 ..SHR --- "C:\WINDOWS\system32\DF4264A10A.sys"
Wed 30 Nov 2005         1,890 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Mon 14 Apr 2008       551,936 ..SH. --- "C:\WINDOWS\system32\oleaut32.dll"
Thu 29 Dec 2005         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 26 May 2009        36,864 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0004.tmp"
Fri 27 Feb 2009       200,192 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0135.tmp"
Fri 27 Feb 2009       202,752 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0175.tmp"
Fri 27 Feb 2009       212,480 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0288.tmp"
Tue 14 Apr 2009        60,928 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0334.tmp"
Fri 27 Feb 2009       203,264 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0406.tmp"
Fri 27 Feb 2009       213,504 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0412.tmp"
Fri 27 Feb 2009       210,432 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0575.tmp"
Tue 14 Apr 2009        60,928 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0598.tmp"
Tue 26 May 2009        39,424 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0599.tmp"
Wed  3 Dec 2008       102,912 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0618.tmp"
Fri 27 Feb 2009       204,288 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0728.tmp"
Tue 26 May 2009        40,448 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0757.tmp"
Fri 27 Feb 2009       208,384 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0779.tmp"
Tue 14 Apr 2009        61,952 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0833.tmp"
Fri 27 Feb 2009       212,992 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL0906.tmp"
Fri 27 Feb 2009       207,360 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL1035.tmp"
Fri 27 Feb 2009       208,384 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL1198.tmp"
Fri 27 Feb 2009       206,848 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL1253.tmp"
Tue 14 Apr 2009        61,440 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL1390.tmp"
Fri 27 Feb 2009       210,432 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL1440.tmp"
Tue 26 May 2009        38,912 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL1540.tmp"
Mon 19 May 2008        63,488 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL1576.tmp"
Fri 27 Feb 2009       206,848 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL1656.tmp"
Fri 27 Feb 2009       205,824 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL1765.tmp"
Tue 26 May 2009        40,960 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL1768.tmp"
Fri 27 Feb 2009       208,384 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL1816.tmp"
Fri 27 Feb 2009       210,944 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL2239.tmp"
Tue 26 May 2009        39,424 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL2288.tmp"
Sat 11 Apr 2009        59,904 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL2430.tmp"
Mon 13 Apr 2009        59,904 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL2579.tmp"
Mon 13 Apr 2009        59,904 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL2836.tmp"
Fri 27 Feb 2009       201,216 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL2889.tmp"
Fri 27 Feb 2009       202,752 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL2995.tmp"
Fri 27 Feb 2009       211,456 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3001.tmp"
Tue 14 Apr 2009        61,440 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3081.tmp"
Fri 27 Feb 2009       208,384 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3104.tmp"
Tue 26 May 2009        40,448 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3122.tmp"
Tue 14 Apr 2009        60,416 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3221.tmp"
Wed  3 Dec 2008       106,496 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3278.tmp"
Fri 27 Feb 2009       202,752 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3435.tmp"
Fri 27 Feb 2009       208,896 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3554.tmp"
Fri 27 Feb 2009       201,216 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3559.tmp"
Tue 26 May 2009        40,448 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3576.tmp"
Tue 26 May 2009        37,376 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3684.tmp"
Tue 26 May 2009        39,424 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3741.tmp"
Tue 14 Apr 2009        60,928 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3869.tmp"
Tue 26 May 2009        39,424 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3880.tmp"
Fri 27 Feb 2009       210,432 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3913.tmp"
Fri 27 Feb 2009       206,336 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3978.tmp"
Tue 14 Apr 2009        60,928 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3984.tmp"
Tue 26 May 2009        38,400 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL3998.tmp"
Fri 10 Apr 2009        59,392 ...H. --- "C:\Documents and Settings\Thomas\Bureau\~WRL4053.tmp"
Wed 16 May 2007        57,856 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\~WRL0978.tmp"
Sat  2 Jun 2007       138,752 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\~WRL0979.tmp"
Wed 16 May 2007       164,864 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\~WRL1504.tmp"
Sat  2 Jun 2007       138,752 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\~WRL2324.tmp"
Sat  2 Jun 2007        60,928 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\~WRL2420.tmp"
Sat  2 Jun 2007       132,608 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\~WRL2502.tmp"
Sat  2 Jun 2007       103,424 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\~WRL2757.tmp"
Sat  2 Jun 2007        87,040 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\~WRL2893.tmp"
Sat  2 Jun 2007        97,280 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\~WRL3253.tmp"
Sat  2 Jun 2007        60,928 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\~WRL3679.tmp"
Sat  2 Jun 2007       124,928 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\~WRL3690.tmp"
Wed 16 May 2007       164,864 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\~WRL3762.tmp"
Sat  2 Jun 2007       100,352 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\~WRL3831.tmp"
Sat  9 Dec 2006             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Tue  5 Jun 2007       146,944 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\Mes fichiers re‡us\~WRL1682.tmp"
Thu 24 Jan 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT4.tmp"
Mon 12 Feb 2007     3,096,576 A..H. --- "C:\Documents and Settings\Thomas\Application Data\U3	emp\Launchpad Removal.exe"
Thu 29 Dec 2005         4,348 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Mon 31 Jul 2006            20 A..H. --- "C:\Documents and Settings\Thomas\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Wed  4 Jan 2006           400 A.SH. --- "C:\Documents and Settings\Thomas\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Mon 12 May 2008        35,328 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0016.tmp"
Mon 19 May 2008        88,576 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0051.tmp"
Mon 19 May 2008        74,752 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0052.tmp"
Tue 13 May 2008        38,400 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0066.tmp"
Wed 21 May 2008       119,808 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0082.tmp"
Mon 19 May 2008        65,024 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0105.tmp"
Mon 19 May 2008        84,992 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0150.tmp"
Tue 20 May 2008       105,472 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0175.tmp"
Tue 20 May 2008       113,664 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0211.tmp"
Mon 19 May 2008        91,648 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0263.tmp"
Tue 20 May 2008       114,176 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0325.tmp"
Mon 19 May 2008        66,048 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0366.tmp"
Thu 15 May 2008        45,056 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0372.tmp"
Mon 19 May 2008        81,920 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0381.tmp"
Mon 19 May 2008        94,208 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0498.tmp"
Mon 19 May 2008        74,752 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0525.tmp"
Mon 19 May 2008        63,488 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0543.tmp"
Mon 19 May 2008        66,048 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0566.tmp"
Mon 19 May 2008        63,488 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0608.tmp"
Tue 13 May 2008        35,840 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0615.tmp"
Wed 14 May 2008        43,008 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0626.tmp"
Mon 19 May 2008        63,488 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0667.tmp"
Tue 13 May 2008        42,496 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0678.tmp"
Mon 12 May 2008        31,232 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0684.tmp"
Wed 21 May 2008       121,344 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0727.tmp"
Tue 20 May 2008       114,176 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0729.tmp"
Mon 19 May 2008        67,072 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0730.tmp"
Mon 19 May 2008        76,288 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0733.tmp"
Tue 20 May 2008       110,592 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0754.tmp"
Tue 20 May 2008       118,272 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0761.tmp"
Mon 19 May 2008        74,752 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0787.tmp"
Thu 15 May 2008        43,520 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0843.tmp"
Tue 20 May 2008       107,008 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0850.tmp"
Mon 19 May 2008        96,768 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0853.tmp"
Mon 19 May 2008        94,208 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0875.tmp"
Mon 19 May 2008        84,992 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0879.tmp"
Mon 19 May 2008        66,048 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL0889.tmp"
Mon 12 May 2008        34,816 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1029.tmp"
Mon 19 May 2008        82,944 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1030.tmp"
Tue 20 May 2008       110,592 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1056.tmp"
Tue 13 May 2008        40,448 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1239.tmp"
Mon 19 May 2008        66,048 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1293.tmp"
Mon 19 May 2008        64,512 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1316.tmp"
Mon 19 May 2008        92,160 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1370.tmp"
Mon 19 May 2008        86,016 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1390.tmp"
Wed 21 May 2008       121,344 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1398.tmp"
Tue 20 May 2008       118,272 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1477.tmp"
Mon 19 May 2008        74,240 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1493.tmp"
Tue 20 May 2008        98,816 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1514.tmp"
Mon 19 May 2008        89,600 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1544.tmp"
Mon 19 May 2008        71,168 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1545.tmp"
Mon 19 May 2008        62,464 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1593.tmp"
Mon 19 May 2008        94,208 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1603.tmp"
Mon 19 May 2008        76,800 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1619.tmp"
Tue 20 May 2008       101,376 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1661.tmp"
Mon 19 May 2008        90,112 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1666.tmp"
Tue 20 May 2008       104,448 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1757.tmp"
Mon 19 May 2008        63,488 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1825.tmp"
Tue 20 May 2008       117,248 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1868.tmp"
Mon 19 May 2008        61,952 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL1948.tmp"
Tue 20 May 2008       107,008 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2007.tmp"
Tue 20 May 2008       118,784 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2021.tmp"
Tue 13 May 2008        38,400 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2034.tmp"
Mon 19 May 2008        64,512 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2081.tmp"
Mon 19 May 2008        81,920 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2089.tmp"
Mon 12 May 2008        30,720 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2132.tmp"
Tue 13 May 2008        39,424 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2190.tmp"
Mon 19 May 2008        66,048 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2206.tmp"
Tue 20 May 2008       115,712 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2264.tmp"
Mon 12 May 2008        34,816 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2309.tmp"
Tue 20 May 2008       118,272 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2321.tmp"
Mon 19 May 2008        96,768 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2374.tmp"
Mon 19 May 2008        74,240 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2411.tmp"
Mon 12 May 2008        35,328 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2480.tmp"
Tue 13 May 2008        42,496 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2590.tmp"
Tue 20 May 2008       102,912 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2662.tmp"
Mon 19 May 2008        66,048 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2664.tmp"
Mon 12 May 2008        34,816 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2782.tmp"
Mon 19 May 2008        96,256 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2833.tmp"
Tue 20 May 2008       118,272 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2877.tmp"
Mon 19 May 2008        66,048 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2881.tmp"
Wed 21 May 2008       119,808 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2887.tmp"
Mon 19 May 2008        67,072 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2888.tmp"
Mon 19 May 2008        67,072 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2896.tmp"
Mon 19 May 2008        75,264 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2926.tmp"
Tue 20 May 2008       116,224 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2957.tmp"
Mon 19 May 2008        88,576 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2960.tmp"
Tue 20 May 2008       107,008 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL2973.tmp"
Mon 19 May 2008        67,072 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3044.tmp"
Mon 19 May 2008        67,072 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3138.tmp"
Fri  9 May 2008        26,624 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3140.tmp"
Mon 12 May 2008        28,160 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3147.tmp"
Mon 19 May 2008        81,920 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3188.tmp"
Mon 19 May 2008        74,240 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3210.tmp"
Mon 19 May 2008        91,648 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3213.tmp"
Mon 12 May 2008        30,720 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3217.tmp"
Mon 19 May 2008        61,952 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3226.tmp"
Tue 20 May 2008       102,400 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3270.tmp"
Mon 19 May 2008        76,288 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3323.tmp"
Mon 19 May 2008        66,048 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3426.tmp"
Wed 21 May 2008       120,832 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3459.tmp"
Tue 20 May 2008       118,272 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3520.tmp"
Tue 20 May 2008       109,568 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3648.tmp"
Thu 15 May 2008        45,056 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3691.tmp"
Mon 19 May 2008        96,256 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3696.tmp"
Mon 19 May 2008        67,072 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3806.tmp"
Mon 19 May 2008        89,600 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3898.tmp"
Mon 19 May 2008        66,048 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3907.tmp"
Mon 19 May 2008        63,488 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3914.tmp"
Mon 19 May 2008        67,072 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3943.tmp"
Mon 19 May 2008        66,048 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL3986.tmp"
Mon 19 May 2008        66,048 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL4038.tmp"
Mon 12 May 2008        34,816 A..H. --- "C:\Documents and Settings\Thomas\Bureau\Nouveau dossier\Rapport de stage\Rorschach + TAT\~WRL4059.tmp"

[b]Finished![/b]

gen-hackman · Answer

&#9654 Télécharge ZHPDiag (de Nicolas Coolman) 

ou :ZHPDiag

&#9654 Enregistre le sur ton Bureau.

Une fois le téléchargement achevé, 

&#9654 lance ZHPDiag.exe et clique sur Unzip dans la fenêtre qui s'ouvre.

&#9654 Clique sur la clé à molette puis sur Tous pour cocher toutes les cases des options.

&#9654 Clique sur la loupe pour lancer l'analyse.

A la fin de l'analyse, 

&#9654 clique sur l'appareil photo et enregistre le rapport sur ton Bureau.

Pour me le transmettre clique sur ce lien :

http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier C:\Documents and settings\le_nom_de_ta_session\.ZHPDiag.txt

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cj200905/ci53SU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

Maud · Answer

Bonjour,

http://www.cijoint.fr/cjlink.php?file=cj200908/cijJK8L4vc.txt   

Merci

gen-hackman · Answer

▶ Télécharge :ATF Cleaner par Atribune Double-clique (clic droit "en tant qu'administrateur" pour Vista) ATF-Cleaner.exe afin de lancer le programme. Sous l'onglet Main, choisis : Select All Clique sur le bouton Empty Selected Si tu utilises le navigateur Firefox : Clique Firefox au haut et choisis : Select All Clique le bouton Empty Selected a NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invité. Si tu utilises le navigateur Opera : Clique Opera au haut et choisis : Select All Clique le bouton Empty Selected NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invité. Clique Exit, du menu prinicipal, afin de fermer le programme. Pour obtenir du Support technique, double-clique l'adresse électronique située au bas de chacun des menus. __________________________________________________ ▶ Tu peux garder ATF pour d'eventuels netttoyages un peu plus poussés __________________________________________________ ▶---> Télécharge ToolsCleaner2sur ton Bureau. * Double-clique (clic droit "en tant qu'administrateur" pour Vista) sur ToolsCleaner2.exe pour le lancer. * Clique sur Recherche et laisse le scan agir. * Clique sur Suppression pour finaliser. * Tu peux, si tu le souhaites, te servir des Options Facultatives. * Clique sur Quitter pour obtenir le rapport. * Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). ________________________________________________ ▶ Tu peux supprimer ToolCleaner _________________________________________________ ▶ Télécharge et installe CCleaner (N'installe pas la Yahoo Toolbar) : * Lance-le.(clic droit "en tant qu'administrateur" pour Vista) Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc.... * Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage. * Ensuite, choisis Registre, puis Chercher des erreurs. Une fois terminé, répare toutes les erreurs tant de fois qu il en trouve a l analyse * Veille a ce que dans les options le reglage soit au demarrage de windows et réglé sur "effacement securisé" 35 passes (guttman) __________________________________________________ Attention : ne pas toucher au PC pendant qu'il travaille ! ▶ Nettoyage et Défragmentation de tes Disques *Nettoyage : Clic droit sur "poste de travail"(ordinateur pour vista) ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Général" Cliques sur le bouton "nettoyage de disque", OK tu le fais pour chacun de tes disques ________________________________________________ *Vérifications des erreurs : Clic droit sur "poste de travail"(ordinateur pour vista) ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Outil" "Vérifier maintenant", une boîte s'ouvre, cocher les cases : -réparer automatiquement les erreurs... -rechercher et tenter une récupération... --->Démarrer, ok Note : s'il te dis de redémarrer ton Pc pour le faire , tu redémarres et tu laisses faire, cela prend un peu de temps c'est normal tu le fais pour chacun de tes disques ________________________________________________ ensuite toujours dans le même onglet tu choisis : *Défragmentation : "défragmenter maintenant", OK une boîte s'ouvre, tu sélectionnes le disque à défragmenter, et tu cliques sur "analyser", puis après l'analyse, "défragmenter" . OK tu le fais pour chacun de tes disques _______________________________________________ Note : si tu as un utilitaire pour défragmenter , utilises le à la place pour ce faire Defraggler est proposé _________________________________________________ ▶ Peux-tu vérifier ta Console Java ? : et installer la nouvelle version si besoin est (dans ce cas désinstalle avant l'ancienne version). voici pour desinstaller : JavaRa Décompresse le fichier sur le Bureau (Clic droit > Extraire tout). * Double-clique (clic droit "en tant qu'administrateur" pour Vista) sur le répertoire JavaRa. * Puis double-clique sur le fichier JavaRa.exe (le exe peut ne pas s'afficher). * Choisis Français puis clique sur Select. * Clique sur Recherche de mises à jour. * Sélectionne Mettre à jour via jucheck.exe puis clique sur Rechercher. * Autorise le processus à se connecter s'il le demande, clique sur Installer et suis les instructions d'installation qui prennent quelques minutes. * L'installation est terminée, reviens à l'écran de JavaRa et clique sur Effacer les anciennes versions. * Clique sur Oui pour confirmer. Laisse travailler et clique ensuite sur OK, puis une deuxième fois sur OK. * Un rapport va s'ouvrir. Poste-le dans ta prochaine réponse. * Ferme l'application. Note : le rapport se trouve aussi dans C:\ sous le nom JavaRa.log. _________________________________________________ ▶ Mets à jour Adobe Reader si ce n'est pas le cas (désinstalle avant la version antérieure) __________________________________________________ ▶ Je te conseille si tu n en as pas , afin de mieux securiser ton pc , d'installer un parefeu : Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) ou COMODO https://www.commentcamarche.net/telecharger/securite/16545-online-armor-personal-firewall/ https://www.01net.com/telecharger/windows/Securite/firewall/fiches/39911.html https://forum.pcastuces.com/sujet.asp?f=25&s=35606 https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html https://manuelsdaide.com/contact/ http://www.open-files.com/forum/index.php?showtopic=29277 https://www.commentcamarche.net/telecharger/securite/24863-zonealarm/ ___________________________________________________ ▶ Tu peux aussi vider ta corbeille,quoi que Ccleaner le fasse tout seul _____________________________________________________ ▶ Si nous avons utilisé MalwareByte's Anti-Malware , vide sa quarantaine : * Lance le programme puis clique sur . * Sélectionne tous les éléments puis clique sur . * Quitte le programme. ______________________________________________________ ▶ si tu as installé Antivir : Configuration ________________________________________________________ ▶ Idem pour ton antivirus : vide sa quarantaine si ce n'est pas déjà fait ______________________________________________________ ▶ Désactive et réactive la restauration de système, pour cela : suis les instructions du lien : Lien XP Lien Vista ▶ Sitôt fait , recrées un point de restoration dit "sain" pour parer à quelques eventuels problêmes dans le futur ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Quelques conseils et recommandations pour l'avenir : ▶ Passe un coup de MalwareByte's Anti-Malware de temps en temps (1 fois par semaine , suivant l'utilisation que tu fais de ton PC. ▶ Utilise aussi tes autres logiciels de protection (scannes antivirus, antispywares...). N'oublie pas de faire les mises à jour avant de les utiliser. * Pense aussi à faire une défragmentation de tes disques durs de temps en temps (garde suffisamment d'espace sur C:\ (1/3 de libre pour être à l'aise)) _____________ ▶ Pour bien protéger ton PC : [1 seul Antivirus] + [1 seul Pare feu] + [Un bon Antispyware avec immunisation] + [Mises à Jour récentes Windows et Logiciels de Protection] + [Utilisation de Firefox -ou autres- (Internet Explorer présente des failles de sécurité qui mettent longtemps avant d'être corrigées mais il faut absolument le conserver pour les mises à jour Windows et Windows live Messenger)] Je te conseille d'installer cette extension pour Firefox pour securiser ton surf : WOT Je te conseille d'installer cette extension pour Internet Explorer pour securiser ton surf : WOT PS : En fait la meilleure des protections c'est toi même : ce que tu fais avec ton PC : où tu surfes, télécharges...ect.... Les virus utilisent les failles de ton PC pour infecter un système ▶ dans le souhait de vouloir desinstaller un antivirus au profit d'un autre , voici quelques liens : Desinstaller Avast Desinstaller BitDefender Desinstaller Norton Desinstaller Kaspersky Desinstaller AVG ou tout en un : Désinstallation Antivirus , Parefeu , Antispyware _____________ ▶ SpywareBlaster = petit logiciel qui bloque l'installation d'activeX nuisibles au PC.(Fonctionne en arrière plan) ____________ ▶ Si tu as Vista n'oublie pas de réactiver le controle des comptes des utilisateurs(UAC) ___________ ▶ Si tu as Spybot S&D et que nous avons desactive le "Tea-timer" tu peux le réactiver ___________ ▶ si nous avons affiché les fichiers cachés , n'oublies pas de les remettre en attribut "caché" ▶ Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage * - Décoche Afficher les fichiers et dossiers cachés * - coche Masquer les extensions des fichiers dont le type est connu * - coche Masquer les fichiers protégés du système d'exploitation (recommandé) ▶ clique sur Appliquer, puis OK. ____________ Voila, Bonne lecture, à bientot , une fois tout ceci fait, tu peux mettre le topic en resolu Bonne continuation et surtout , prudence et bon surf :)

Maud · Answer

[ Rapport ToolsCleaner version 2.3.10 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\SDFIX: trouvé !
C:\Backups\catchme.log: trouvé !
C:\Program Files\ZHPDiag: trouvé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: trouvé !
C:\SDFix\catchme.exe: trouvé !

---------------------------------
--> Suppression: 

C:\Program Files\ZHPDiag\ZHPdiag.exe: supprimé !
C:\SDFix\catchme.exe: supprimé !
C:\Backups\catchme.log: supprimé !
C:\SDFIX: supprimé !
C:\Program Files\ZHPDiag: supprimé !

Maud · Answer

"Sitôt fait , recrées un point de restoration dit "sain" pour parer à quelques eventuels problêmes dans le futur"

Comment réalise-t-on cela ? :)

Maud · Answer

Voilà j'ai trouvé ! 

J'ai bien suivi les instructions, j'espère que je ne rencontrerai plus les problèmes d'écran qui plante et de pc qui redémarre ... Vraiment j'espère.

Encore un tout grand merci pour le temps que tu/vous m'as/avez accordé !

Je vous dis à la prochaine, on ne sait jamais ;) 

Bonne continuation !

gen-hackman · Answer

merci je suis seul ^^ lol

bon surf ^^

Maud · Answer

Ca n'aura pas vraiment duré longtemps avant que je revienne par ici... J'ai redémarré le pc, les problèmes persistent. C'est le moment où je dois trouver ça inquiétant ?!

gen-hackman · Answer

tu vas pas me faire deplacer en belgique ??    mdr !!!!

Maud · Answer

Lol Non évidemment pas ... :(

gen-hackman · Answer

tu as tout fait du nettoyage ?

Maud · Answer

Oui tout. Là j'ai redémarré et plus de problèmes app... Je me suis rendu compte toutefois que Kerio ne se lançait pas au démarrage du pc. Je dois le lancer manuellement, c'est assez délicat. :s

Maud · Answer

J'ai réinstallé et Kerio se lance mnt au démarrage. Mon souci est que windows m'informe que je n'ai pas de pare feu actif alors que Kerio est en fonctionnement. Ca doit surement être une question de réglages dans le centre de sécurité.

Enfin, je vais dormir les doigts croisés. :)

Bonne nuit !

gen-hackman · Answer

ok ^^ si demain ce n'est mieux , on envisagera quelque chose :D

Thomas · Answer

Bonjour,

Pas de soucis aujourd'hui. Juste le service pack3 qui n'arrive tjs pas à installer le fichier qu'il veut alors le symbole jaune "des mises à jour sont prêtes (...)" est constamment allumé. Et en ce qui concerne Kerio, il s'allume mnt au démarrage mais windows ne le détecte pas il faut croire vu que le symbole rouge apparaît également au démarrage pour me dire qu'un risque est présent. Mais bon je n'suis plus à un risque près... :)

Bonne journée ;)

gen-hackman · Answer

tu as toujours OTL sur ton bureau ?

Thomas · Answer

Normalement non, j'ai désinstallé les programmes. AVG vient par contre de me trouver un cheval de troie dans un fichier musical qui date d'un mois ainsi que d'autres cookies:

Détection de : Tracking Cookie.Admt                               3fois
Détection de : Tracking Cookie.Weborama                      4fois
Cheval de Troie : Downloader.Wimad.K                           1fois (heureusement)

NB: Le nettoyage par CCleaner se fait au démarrage, j'ai laissé l'option.

gen-hackman · Answer

et qu'en a fait AVG ?

Thomas · Answer

Le tout en quarantaine ...

gen-hackman · Answer

ok :

Télécharge OTL de OLDTimer

&#9654 enregistre le sur ton Bureau.

&#9654 Double clic sur OTL.exe pour le lancer.

&#9654 Coche les 2 cases Lop et Purity

&#9654 Coche la case devant scan all users

&#9654 règle-le sur "60 Days"

&#9654 dans la colonne de gauche , mets tout sur all

&#9654Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier ci-dessus.

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

Tu feras la meme chose avec le "Extra.txt".

Thomas · Answer

http://www.cijoint.fr/cjlink.php?file=cj200908/cijSF2ONzE.txt 

http://www.cijoint.fr/cjlink.php?file=cj200908/cij8k7b3sU.txt

gen-hackman · Answer

&#9654 Double clic sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous Customs Scans/Fixes :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF  [binary data]
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF  [binary data]
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\drivers\etc\services:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\drivers\etc\protocol:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\drivers\etc
etworks:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\drivers\etc\lmhosts.sam:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\WINDOWS\System32\ctl3dv2.dll:KAVICHS
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 100 bytes -> C:\WINDOWS\System32\DF4264A10A.sys:KAVICHS

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=-

:commands
[emptytemp]
[reboot]


&#9654 Clique sur RunFix pour lancer la suppression.


&#9654 Poste le rapport.

Thomas · Answer

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveAutoRun deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveAutoRun deleted successfully.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll unregistered successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwfile-8876480\ not found.
Invalid CLSID key: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll not found.
ADS C:\WINDOWS\System32\drivers\etc\services:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\etc\protocol:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\etc
etworks:KAVICHS deleted successfully.
ADS C:\WINDOWS\System32\drivers\etc\lmhosts.sam:KAVICHS deleted successfully.
Unable to delete ADS C:\WINDOWS\System32\ctl3dv2.dll:KAVICHS .
ADS C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 deleted successfully.
Unable to delete ADS C:\WINDOWS\System32\DF4264A10A.sys:KAVICHS .
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msnmsgr deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Propriétaire
 
User: Thomas
->Temp folder emptied: 1368313 bytes
->Temporary Internet Files folder emptied: 55759285 bytes
->Java cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 69649 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 54,61 mb
 
 
OTL by OldTimer - Version 3.0.10.7 log created on 08182009_174235

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

gen-hackman · Answer

refais ceci

https://forums.commentcamarche.net/forum/affich-13884626-infections-malwarebyte?entiere#21

et essaie de m'avoir les rapports datant d'aujourd'hui et non du mois de mars stp

Thomas · Answer

Le lien m'amène à la première page, je dois réaliser à nouveau la totalité des opérations (toutes réponses confondues) ? J'espère avoir bien compris.

gen-hackman · Answer

absolument pas juste le poste 21 commme l'indique le lien

Thomas · Answer

Okay je le fais... C'est pas un souci mais le lien m'envoie sur la première page. ;)

Thomas · Answer

Fichier ati1snxx.sys reçu le 2009.08.18 17:56:10 (UTC)Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.18 - AhnLab-V3 5.0.0.2 2009.08.18 - AntiVir 7.9.1.3 2009.08.18 - Antiy-AVL 2.0.3.7 2009.08.18 - Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.17 - AVG 8.5.0.406 2009.08.18 - BitDefender 7.2 2009.08.18 - CAT-QuickHeal 10.00 2009.08.18 - ClamAV 0.94.1 2009.08.18 - Comodo 2013 2009.08.18 - DrWeb 5.0.0.12182 2009.08.18 - eSafe 7.0.17.0 2009.08.18 - eTrust-Vet 31.6.6685 2009.08.18 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.18 Suspicious:W32/Malware!Gemini Fortinet 3.120.0.0 2009.08.18 - GData 19 2009.08.18 - Ikarus T3.1.1.68.0 2009.08.18 - Jiangmin 11.0.800 2009.08.18 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.18 - McAfee 5713 2009.08.18 - McAfee+Artemis 5713 2009.08.18 - McAfee-GW-Edition 6.8.5 2009.08.18 - Microsoft 1.4903 2009.08.18 - NOD32 4346 2009.08.18 - Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.18 - Panda 10.0.0.14 2009.08.18 - PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.18 - Rising 21.43.14.00 2009.08.18 - Sophos 4.44.0 2009.08.18 - Sunbelt 3.2.1858.2 2009.08.18 - Symantec 1.4.4.12 2009.08.18 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.18 - VBA32 3.12.10.9 2009.08.18 - ViRobot 2009.8.18.1889 2009.08.18 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 26367 bytes MD5...: dac7d785cf62f5bd41441e9d6f5a6efe SHA1..: 19496cb16f3532d6aa9f796436465ba3efecd23a SHA256: d4195304dba41a8be523a9f4fb0670313573ef9e36ea99057b10a325b21cdd54 ssdeep: 384:lbU2cn1fh+UR3+bOJzIVIfo9w6RUtrUkha9PkEDFF:lQr15tQAcVID6KtrnU
P5DFF
PEiD..: - TrID..: File type identification
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x282
timedatestamp.....: 0x4027d57a (Mon Feb 09 18:46:18 2004)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x270 0x51d0 0x51d0 6.48 57c586104de8f2d1565b1f29259f6b57
.rdata 0x5440 0x1a4 0x1b0 5.25 a4d339187842601ca81121cc281ad6df
.data 0x55f0 0x3c0 0x3c0 3.49 26cae34435d0ad477a1825d5628d4425
.idata 0x59b0 0x46c 0x470 4.94 2f2428df6772adbc3db5271f8d9295ad
.rsrc 0x5e20 0x614 0x620 3.48 d57bc0e3e67da2d6db90c40441ff5493
.reloc 0x6440 0x292 0x2a0 6.03 db823fd9928dbf8e8f4de7ae344c2844

( 3 imports )
> STREAM.SYS: StreamClassScheduleTimer, StreamClassRegisterFilterWithNoKSPins, StreamClassDeviceNotification, StreamClassRegisterAdapter
> NTOSKRNL.EXE: RtlInitAnsiString, ExFreePool, ZwCreateKey, ZwSetValueKey, KeInitializeSpinLock, IofCompleteRequest, PoStartNextPowerIrp, ZwClose, ExAllocatePoolWithTag, KeSetEvent, IoFreeIrp, KeWaitForSingleObject, IofCallDriver, KeInitializeEvent, IoAllocateIrp, KeQuerySystemTime, wcsncmp, ZwOpenKey, RtlInitUnicodeString, KeDelayExecutionThread, RtlGUIDFromString, ZwQueryValueKey, RtlAppendUnicodeStringToString, RtlCopyUnicodeString, RtlIntegerToUnicodeString, IoOpenDeviceRegistryKey, strchr, RtlUnicodeStringToAnsiString
> HAL.DLL: KfAcquireSpinLock, KfReleaseSpinLock

( 0 exports )
PDFiD.: - RDS...: NSRL Reference Data Set

( Microsoft )

> MSDN Disc 2443.2: ati1snxx.sys
> MSDN Disc 2443.4: ati1snxx.sys
> MSDN Disc 2440.5: ati1snxx.sys
> Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: ati1snxx.sys
> MSDN Disc 2440.3: ati1snxx.sys
> MSDN Disc 2466.2: ati1snxx.sys
> Virtual PC for Mac Windows XP Home Edition: ati1snxx.sys
> MSDN Disc 2441.6: ati1snxx.sys
> MSDN Disc 2441.7: ati1snxx.sys
> MSDN Disc 2466.4: ati1snxx.sys
> MSDN Disc 2476.4: ati1snxx.sys
> MSDN Disc 2455.6: ati1snxx.sys
> MSDN Disc 2476.2: ati1snxx.sys
> Disc 2438.5: ati1snxx.sys
> MSDN Disc 2440.4: ati1snxx.sys
> MSDN Disc 2444.3: ati1snxx.sys
> MSDN Disc 2444.6: ati1snxx.sys
> MSDN Disc 2444.4: ati1snxx.sys
> MSDN Disc 2438.7: ati1snxx.sys
> MSDN Disc 2477.2: ati1snxx.sys
> MSDN Disc 2439.7: ati1snxx.sys
> MSDN Disc 2439.6: ati1snxx.sys
> MSDN Disc 2442.4: ati1snxx.sys
> MSDN Disc 2442.6: ati1snxx.sys
> MSDN Disc 2438.8: ati1snxx.sys
> MSDN Disc 2465.4: ati1snxx.sys
> MSDN Disc 2465.5: ati1snxx.sys
> MSDN Disc 2464.5: ati1snxx.sys
> MSDN Disc 2428.4: ati1snxx.sys
> MSDN Disc 2439.8: ati1snxx.sys
> MSDN Disc 2428.8: ati1snxx.sys
> Virtual PC for Mac Windows XP Professional Edition: ati1snxx.sys
> MSDN Disc 2428.5: ati1snxx.sys
> MSDN Disc 2441.5: ati1snxx.sys

( Gateway )

> Gateway Operating System Windows XP Pro Edition SP2: ati1snxx.sys

Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.18 - AhnLab-V3 5.0.0.2 2009.08.18 - AntiVir 7.9.1.3 2009.08.18 - Antiy-AVL 2.0.3.7 2009.08.18 - Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.17 - AVG 8.5.0.406 2009.08.18 - BitDefender 7.2 2009.08.18 - CAT-QuickHeal 10.00 2009.08.18 - ClamAV 0.94.1 2009.08.18 - Comodo 2013 2009.08.18 - DrWeb 5.0.0.12182 2009.08.18 - eSafe 7.0.17.0 2009.08.18 - eTrust-Vet 31.6.6685 2009.08.18 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.18 Suspicious:W32/Malware!Gemini Fortinet 3.120.0.0 2009.08.18 - GData 19 2009.08.18 - Ikarus T3.1.1.68.0 2009.08.18 - Jiangmin 11.0.800 2009.08.18 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.18 - McAfee 5713 2009.08.18 - McAfee+Artemis 5713 2009.08.18 - McAfee-GW-Edition 6.8.5 2009.08.18 - Microsoft 1.4903 2009.08.18 - NOD32 4346 2009.08.18 - Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.18 - Panda 10.0.0.14 2009.08.18 - PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.18 - Rising 21.43.14.00 2009.08.18 - Sophos 4.44.0 2009.08.18 - Sunbelt 3.2.1858.2 2009.08.18 - Symantec 1.4.4.12 2009.08.18 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.18 - VBA32 3.12.10.9 2009.08.18 - ViRobot 2009.8.18.1889 2009.08.18 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 26367 bytes MD5...: dac7d785cf62f5bd41441e9d6f5a6efe SHA1..: 19496cb16f3532d6aa9f796436465ba3efecd23a SHA256: d4195304dba41a8be523a9f4fb0670313573ef9e36ea99057b10a325b21cdd54 ssdeep: 384:lbU2cn1fh+UR3+bOJzIVIfo9w6RUtrUkha9PkEDFF:lQr15tQAcVID6KtrnU
P5DFF
PEiD..: - TrID..: File type identification
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x282
timedatestamp.....: 0x4027d57a (Mon Feb 09 18:46:18 2004)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x270 0x51d0 0x51d0 6.48 57c586104de8f2d1565b1f29259f6b57
.rdata 0x5440 0x1a4 0x1b0 5.25 a4d339187842601ca81121cc281ad6df
.data 0x55f0 0x3c0 0x3c0 3.49 26cae34435d0ad477a1825d5628d4425
.idata 0x59b0 0x46c 0x470 4.94 2f2428df6772adbc3db5271f8d9295ad
.rsrc 0x5e20 0x614 0x620 3.48 d57bc0e3e67da2d6db90c40441ff5493
.reloc 0x6440 0x292 0x2a0 6.03 db823fd9928dbf8e8f4de7ae344c2844

( 3 imports )
> STREAM.SYS: StreamClassScheduleTimer, StreamClassRegisterFilterWithNoKSPins, StreamClassDeviceNotification, StreamClassRegisterAdapter
> NTOSKRNL.EXE: RtlInitAnsiString, ExFreePool, ZwCreateKey, ZwSetValueKey, KeInitializeSpinLock, IofCompleteRequest, PoStartNextPowerIrp, ZwClose, ExAllocatePoolWithTag, KeSetEvent, IoFreeIrp, KeWaitForSingleObject, IofCallDriver, KeInitializeEvent, IoAllocateIrp, KeQuerySystemTime, wcsncmp, ZwOpenKey, RtlInitUnicodeString, KeDelayExecutionThread, RtlGUIDFromString, ZwQueryValueKey, RtlAppendUnicodeStringToString, RtlCopyUnicodeString, RtlIntegerToUnicodeString, IoOpenDeviceRegistryKey, strchr, RtlUnicodeStringToAnsiString
> HAL.DLL: KfAcquireSpinLock, KfReleaseSpinLock

( 0 exports )
PDFiD.: - RDS...: NSRL Reference Data Set

( Microsoft )

> MSDN Disc 2443.2: ati1snxx.sys
> MSDN Disc 2443.4: ati1snxx.sys
> MSDN Disc 2440.5: ati1snxx.sys
> Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: ati1snxx.sys
> MSDN Disc 2440.3: ati1snxx.sys
> MSDN Disc 2466.2: ati1snxx.sys
> Virtual PC for Mac Windows XP Home Edition: ati1snxx.sys
> MSDN Disc 2441.6: ati1snxx.sys
> MSDN Disc 2441.7: ati1snxx.sys
> MSDN Disc 2466.4: ati1snxx.sys
> MSDN Disc 2476.4: ati1snxx.sys
> MSDN Disc 2455.6: ati1snxx.sys
> MSDN Disc 2476.2: ati1snxx.sys
> Disc 2438.5: ati1snxx.sys
> MSDN Disc 2440.4: ati1snxx.sys
> MSDN Disc 2444.3: ati1snxx.sys
> MSDN Disc 2444.6: ati1snxx.sys
> MSDN Disc 2444.4: ati1snxx.sys
> MSDN Disc 2438.7: ati1snxx.sys
> MSDN Disc 2477.2: ati1snxx.sys
> MSDN Disc 2439.7: ati1snxx.sys
> MSDN Disc 2439.6: ati1snxx.sys
> MSDN Disc 2442.4: ati1snxx.sys
> MSDN Disc 2442.6: ati1snxx.sys
> MSDN Disc 2438.8: ati1snxx.sys
> MSDN Disc 2465.4: ati1snxx.sys
> MSDN Disc 2465.5: ati1snxx.sys
> MSDN Disc 2464.5: ati1snxx.sys
> MSDN Disc 2428.4: ati1snxx.sys
> MSDN Disc 2439.8: ati1snxx.sys
> MSDN Disc 2428.8: ati1snxx.sys
> Virtual PC for Mac Windows XP Professional Edition: ati1snxx.sys
> MSDN Disc 2428.5: ati1snxx.sys
> MSDN Disc 2441.5: ati1snxx.sys

( Gateway )

> Gateway Operating System Windows XP Pro Edition SP2: ati1snxx.sys

Fichier ati1ttxx.sys reçu le 2009.08.19 12:07:49 (UTC)Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.19 - AhnLab-V3 5.0.0.2 2009.08.19 - AntiVir 7.9.1.3 2009.08.19 - Antiy-AVL 2.0.3.7 2009.08.18 - Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.18 - AVG 8.5.0.406 2009.08.19 - BitDefender 7.2 2009.08.19 - CAT-QuickHeal 10.00 2009.08.19 - ClamAV 0.94.1 2009.08.19 - Comodo 2021 2009.08.19 - DrWeb 5.0.0.12182 2009.08.19 - eSafe 7.0.17.0 2009.08.18 - eTrust-Vet 31.6.6687 2009.08.19 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.19 Suspicious:W32/Malware!Gemini Fortinet 3.120.0.0 2009.08.19 - GData 19 2009.08.19 - Ikarus T3.1.1.68.0 2009.08.19 - Jiangmin 11.0.800 2009.08.19 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.19 - McAfee 5713 2009.08.18 - McAfee+Artemis 5713 2009.08.18 - McAfee-GW-Edition 6.8.5 2009.08.19 - Microsoft 1.4903 2009.08.19 - NOD32 4347 2009.08.19 - Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.19 - Panda 10.0.0.14 2009.08.18 - PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.19 - Rising 21.43.23.00 2009.08.19 - Sophos 4.44.0 2009.08.19 - Sunbelt 3.2.1858.2 2009.08.19 - Symantec 1.4.4.12 2009.08.19 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.19 - VBA32 3.12.10.9 2009.08.19 - ViRobot 2009.8.19.1891 2009.08.19 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 21343 bytes MD5...: f7706dae7d101f1b19ce552d772ebfce SHA1..: 5f2e56b7f68bfa8cb5bcbba354a14e8a44b5df7b SHA256: 727d5662b2e7069c25f2cc794f1385c21509dcdceb7c68c037857ccf388a04e4 ssdeep: 192:2lipxVuTpK7ptQ4qtsX495HO0wy+EPtEg5cOw2DHTB:2lauTpK7pG4csX43u
0wqP/2R2DHTB
PEiD..: - TrID..: File type identification
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x270
timedatestamp.....: 0x4027d5a2 (Mon Feb 09 18:46:58 2004)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x270 0x18c0 0x18c0 6.54 b24893df48ba4a4ddd58e6be375f1e33
.rdata 0x1b30 0x2c0 0x2c0 2.51 920926a42d5483cf4170b6c0d1399501
.data 0x1df0 0x2aa4 0x2ab0 0.55 309c105d13db5b8f63fac780ac14ffea
.idata 0x48a0 0x2ec 0x2f0 4.76 18a0d95f831b02a0f0e3b8b6e29e9e7f
.rsrc 0x4b90 0x634 0x640 3.46 b90dc64981ad6950b4c6da858262c9f5
.reloc 0x51d0 0x16c 0x170 5.76 2146c23b62f01fbeaa1f1f2704814989

( 3 imports )
> STREAM.SYS: StreamClassDeviceNotification, StreamClassStreamNotification, StreamClassRegisterAdapter
> NTOSKRNL.EXE: ExAllocatePoolWithTag, IoCreateSymbolicLink, IofCompleteRequest, PoStartNextPowerIrp, InterlockedExchange, RtlInitUnicodeString, ZwSetValueKey, ZwClose, ZwOpenKey, IoOpenDeviceRegistryKey, strchr, RtlUnicodeStringToAnsiString, RtlInitAnsiString, wcsncmp, ZwCreateKey, ExFreePool, ZwQueryValueKey
> HAL.DLL: KeQueryPerformanceCounter

( 0 exports )
PDFiD.: - RDS...: NSRL Reference Data Set

( Microsoft )

> MSDN Disc 2443.2: ati1ttxx.sys
> MSDN Disc 2443.4: ati1ttxx.sys
> MSDN Disc 2440.5: ati1ttxx.sys
> Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: ati1ttxx.sys
> MSDN Disc 2440.3: ati1ttxx.sys
> MSDN Disc 2466.2: ati1ttxx.sys
> Virtual PC for Mac Windows XP Home Edition: ati1ttxx.sys
> MSDN Disc 2441.6: ati1ttxx.sys
> MSDN Disc 2441.7: ati1ttxx.sys
> MSDN Disc 2466.4: ati1ttxx.sys
> MSDN Disc 2476.4: ati1ttxx.sys
> MSDN Disc 2455.6: ati1ttxx.sys
> MSDN Disc 2476.2: ati1ttxx.sys
> Disc 2438.5: ati1ttxx.sys
> MSDN Disc 2440.4: ati1ttxx.sys
> MSDN Disc 2444.3: ati1ttxx.sys
> MSDN Disc 2444.6: ati1ttxx.sys
> MSDN Disc 2444.4: ati1ttxx.sys
> MSDN Disc 2438.7: ati1ttxx.sys
> MSDN Disc 2477.2: ati1ttxx.sys
> MSDN Disc 2439.7: ati1ttxx.sys
> MSDN Disc 2439.6: ati1ttxx.sys
> MSDN Disc 2442.4: ati1ttxx.sys
> MSDN Disc 2442.6: ati1ttxx.sys
> MSDN Disc 2438.8: ati1ttxx.sys
> MSDN Disc 2465.4: ati1ttxx.sys
> MSDN Disc 2465.5: ati1ttxx.sys
> MSDN Disc 2464.5: ati1ttxx.sys
> MSDN Disc 2428.4: ati1ttxx.sys
> MSDN Disc 2439.8: ati1ttxx.sys
> MSDN Disc 2428.8: ati1ttxx.sys
> Virtual PC for Mac Windows XP Professional Edition: ati1ttxx.sys
> MSDN Disc 2428.5: ati1ttxx.sys
> MSDN Disc 2441.5: ati1ttxx.sys

( Gateway )

> Gateway Operating System Windows XP Pro Edition SP2: ati1ttxx.sys

Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.19 - AhnLab-V3 5.0.0.2 2009.08.19 - AntiVir 7.9.1.3 2009.08.19 - Antiy-AVL 2.0.3.7 2009.08.18 - Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.18 - AVG 8.5.0.406 2009.08.19 - BitDefender 7.2 2009.08.19 - CAT-QuickHeal 10.00 2009.08.19 - ClamAV 0.94.1 2009.08.19 - Comodo 2021 2009.08.19 - DrWeb 5.0.0.12182 2009.08.19 - eSafe 7.0.17.0 2009.08.18 - eTrust-Vet 31.6.6687 2009.08.19 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.19 Suspicious:W32/Malware!Gemini Fortinet 3.120.0.0 2009.08.19 - GData 19 2009.08.19 - Ikarus T3.1.1.68.0 2009.08.19 - Jiangmin 11.0.800 2009.08.19 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.19 - McAfee 5713 2009.08.18 - McAfee+Artemis 5713 2009.08.18 - McAfee-GW-Edition 6.8.5 2009.08.19 - Microsoft 1.4903 2009.08.19 - NOD32 4347 2009.08.19 - Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.19 - Panda 10.0.0.14 2009.08.18 - PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.19 - Rising 21.43.23.00 2009.08.19 - Sophos 4.44.0 2009.08.19 - Sunbelt 3.2.1858.2 2009.08.19 - Symantec 1.4.4.12 2009.08.19 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.19 - VBA32 3.12.10.9 2009.08.19 - ViRobot 2009.8.19.1891 2009.08.19 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 21343 bytes MD5...: f7706dae7d101f1b19ce552d772ebfce SHA1..: 5f2e56b7f68bfa8cb5bcbba354a14e8a44b5df7b SHA256: 727d5662b2e7069c25f2cc794f1385c21509dcdceb7c68c037857ccf388a04e4 ssdeep: 192:2lipxVuTpK7ptQ4qtsX495HO0wy+EPtEg5cOw2DHTB:2lauTpK7pG4csX43u
0wqP/2R2DHTB
PEiD..: - TrID..: File type identification
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x270
timedatestamp.....: 0x4027d5a2 (Mon Feb 09 18:46:58 2004)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x270 0x18c0 0x18c0 6.54 b24893df48ba4a4ddd58e6be375f1e33
.rdata 0x1b30 0x2c0 0x2c0 2.51 920926a42d5483cf4170b6c0d1399501
.data 0x1df0 0x2aa4 0x2ab0 0.55 309c105d13db5b8f63fac780ac14ffea
.idata 0x48a0 0x2ec 0x2f0 4.76 18a0d95f831b02a0f0e3b8b6e29e9e7f
.rsrc 0x4b90 0x634 0x640 3.46 b90dc64981ad6950b4c6da858262c9f5
.reloc 0x51d0 0x16c 0x170 5.76 2146c23b62f01fbeaa1f1f2704814989

( 3 imports )
> STREAM.SYS: StreamClassDeviceNotification, StreamClassStreamNotification, StreamClassRegisterAdapter
> NTOSKRNL.EXE: ExAllocatePoolWithTag, IoCreateSymbolicLink, IofCompleteRequest, PoStartNextPowerIrp, InterlockedExchange, RtlInitUnicodeString, ZwSetValueKey, ZwClose, ZwOpenKey, IoOpenDeviceRegistryKey, strchr, RtlUnicodeStringToAnsiString, RtlInitAnsiString, wcsncmp, ZwCreateKey, ExFreePool, ZwQueryValueKey
> HAL.DLL: KeQueryPerformanceCounter

( 0 exports )
PDFiD.: - RDS...: NSRL Reference Data Set

( Microsoft )

> MSDN Disc 2443.2: ati1ttxx.sys
> MSDN Disc 2443.4: ati1ttxx.sys
> MSDN Disc 2440.5: ati1ttxx.sys
> Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: ati1ttxx.sys
> MSDN Disc 2440.3: ati1ttxx.sys
> MSDN Disc 2466.2: ati1ttxx.sys
> Virtual PC for Mac Windows XP Home Edition: ati1ttxx.sys
> MSDN Disc 2441.6: ati1ttxx.sys
> MSDN Disc 2441.7: ati1ttxx.sys
> MSDN Disc 2466.4: ati1ttxx.sys
> MSDN Disc 2476.4: ati1ttxx.sys
> MSDN Disc 2455.6: ati1ttxx.sys
> MSDN Disc 2476.2: ati1ttxx.sys
> Disc 2438.5: ati1ttxx.sys
> MSDN Disc 2440.4: ati1ttxx.sys
> MSDN Disc 2444.3: ati1ttxx.sys
> MSDN Disc 2444.6: ati1ttxx.sys
> MSDN Disc 2444.4: ati1ttxx.sys
> MSDN Disc 2438.7: ati1ttxx.sys
> MSDN Disc 2477.2: ati1ttxx.sys
> MSDN Disc 2439.7: ati1ttxx.sys
> MSDN Disc 2439.6: ati1ttxx.sys
> MSDN Disc 2442.4: ati1ttxx.sys
> MSDN Disc 2442.6: ati1ttxx.sys
> MSDN Disc 2438.8: ati1ttxx.sys
> MSDN Disc 2465.4: ati1ttxx.sys
> MSDN Disc 2465.5: ati1ttxx.sys
> MSDN Disc 2464.5: ati1ttxx.sys
> MSDN Disc 2428.4: ati1ttxx.sys
> MSDN Disc 2439.8: ati1ttxx.sys
> MSDN Disc 2428.8: ati1ttxx.sys
> Virtual PC for Mac Windows XP Professional Edition: ati1ttxx.sys
> MSDN Disc 2428.5: ati1ttxx.sys
> MSDN Disc 2441.5: ati1ttxx.sys

( Gateway )

> Gateway Operating System Windows XP Pro Edition SP2: ati1ttxx.sys

Thomas · Answer

Fichier atinsnxx.sys reçu le 2009.08.19 12:09:20 (UTC)Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.19 - AhnLab-V3 5.0.0.2 2009.08.19 - AntiVir 7.9.1.3 2009.08.19 - Antiy-AVL 2.0.3.7 2009.08.18 - Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.18 - AVG 8.5.0.406 2009.08.19 - BitDefender 7.2 2009.08.19 - CAT-QuickHeal 10.00 2009.08.19 - ClamAV 0.94.1 2009.08.19 - Comodo 2021 2009.08.19 - DrWeb 5.0.0.12182 2009.08.19 - eSafe 7.0.17.0 2009.08.18 - eTrust-Vet 31.6.6687 2009.08.19 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.19 - Fortinet 3.120.0.0 2009.08.19 - GData 19 2009.08.19 - Ikarus T3.1.1.68.0 2009.08.19 - Jiangmin 11.0.800 2009.08.19 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.19 - McAfee 5713 2009.08.18 - McAfee+Artemis 5713 2009.08.18 - McAfee-GW-Edition 6.8.5 2009.08.19 - Microsoft 1.4903 2009.08.19 - NOD32 4347 2009.08.19 - Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.19 - PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.19 - Rising 21.43.23.00 2009.08.19 - Sophos 4.44.0 2009.08.19 - Sunbelt 3.2.1858.2 2009.08.19 - Symantec 1.4.4.12 2009.08.19 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.19 - VBA32 3.12.10.9 2009.08.19 - ViRobot 2009.8.19.1891 2009.08.19 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 28672 bytes MD5...: ceddee2e0591894d19654d458fd3b9be SHA1..: c58ba65bff4e5e4ba7e78599b583829d56e76e2a SHA256: 712ba390891faf0d52aeadbbaef7fe14a655611984cd3db1709f665482e9fa9b ssdeep: 384:UsA3COA9Q6Yd/AikFzp95UwbZLk4suw15Mdrjg2ohzWP3DdgQII9oZ8J3bJz
7j:Us7OGQs5PNL6uwGrmgqQIuoZ8dJz7j
PEiD..: - TrID..: File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1301
timedatestamp.....: 0x40787439 (Sat Apr 10 22:24:57 2004)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x50e8 0x5200 6.48 7071acd55cb7b9f4377885dab92bdeb8
.rdata 0x7000 0xa7f 0xc00 4.55 cbf801a89a20762706eaf0d93c1eb2a6
.data 0x8000 0x38 0x200 0.50 1bad19bae9d56027544774597c2bce5e
.rsrc 0x9000 0x618 0x800 2.78 7ffcbc84ac6844b1edea17f1d1734c22
.reloc 0xa000 0x290 0x400 4.60 6d95403a18601703a8c7d2d7f27f4db7

( 3 imports )
> STREAM.SYS: StreamClassRegisterFilterWithNoKSPins, StreamClassScheduleTimer, StreamClassRegisterAdapter, StreamClassDeviceNotification
> HAL.dll: KfAcquireSpinLock, KfReleaseSpinLock
> ntoskrnl.exe: ExFreePool, KeInitializeSpinLock, PoStartNextPowerIrp, IofCompleteRequest, _purecall, KeSetEvent, IoFreeIrp, KeWaitForSingleObject, IofCallDriver, KeInitializeEvent, IoAllocateIrp, KeQuerySystemTime, wcsncmp, ZwClose, ZwOpenKey, RtlInitUnicodeString, ExAllocatePoolWithTag, KeDelayExecutionThread, RtlGUIDFromString, ZwQueryValueKey, RtlAppendUnicodeStringToString, RtlCopyUnicodeString, RtlIntegerToUnicodeString, IoOpenDeviceRegistryKey, ZwSetValueKey, strchr, RtlUnicodeStringToAnsiString, RtlInitAnsiString, ZwCreateKey

( 0 exports )
PDFiD.: - RDS...: NSRL Reference Data Set

( Microsoft )

> MSDN Disc 2443.2: atinsnxx.sys
> MSDN Disc 2443.4: atinsnxx.sys
> MSDN Disc 2440.5: atinsnxx.sys
> Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: atinsnxx.sys
> MSDN Disc 2440.3: atinsnxx.sys
> MSDN Disc 2466.2: atinsnxx.sys
> Virtual PC for Mac Windows XP Home Edition: atinsnxx.sys
> MSDN Disc 2441.6: atinsnxx.sys
> MSDN Disc 2441.7: atinsnxx.sys
> MSDN Disc 2466.4: atinsnxx.sys
> MSDN Disc 2476.4: atinsnxx.sys
> MSDN Disc 2455.6: atinsnxx.sys
> MSDN Disc 2476.2: atinsnxx.sys
> Disc 2438.5: atinsnxx.sys
> MSDN Disc 2440.4: atinsnxx.sys
> MSDN Disc 2444.3: atinsnxx.sys
> MSDN Disc 2444.6: atinsnxx.sys
> MSDN Disc 2444.4: atinsnxx.sys
> MSDN Disc 2438.7: atinsnxx.sys
> MSDN Disc 2477.2: atinsnxx.sys
> MSDN Disc 2439.7: atinsnxx.sys
> MSDN Disc 2439.6: atinsnxx.sys
> MSDN Disc 2442.4: atinsnxx.sys
> MSDN Disc 2442.6: atinsnxx.sys
> MSDN Disc 2438.8: atinsnxx.sys
> MSDN Disc 2465.4: atinsnxx.sys
> MSDN Disc 2465.5: atinsnxx.sys
> MSDN Disc 2464.5: atinsnxx.sys
> MSDN Disc 2428.4: atinsnxx.sys
> MSDN Disc 2439.8: atinsnxx.sys
> MSDN Disc 2428.8: atinsnxx.sys
> Virtual PC for Mac Windows XP Professional Edition: atinsnxx.sys
> MSDN Disc 2428.5: atinsnxx.sys
> MSDN Disc 2441.5: atinsnxx.sys

( Gateway )

> Gateway Operating System Windows XP Pro Edition SP2: atinsnxx.sys

Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.19 - AhnLab-V3 5.0.0.2 2009.08.19 - AntiVir 7.9.1.3 2009.08.19 - Antiy-AVL 2.0.3.7 2009.08.18 - Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.18 - AVG 8.5.0.406 2009.08.19 - BitDefender 7.2 2009.08.19 - CAT-QuickHeal 10.00 2009.08.19 - ClamAV 0.94.1 2009.08.19 - Comodo 2021 2009.08.19 - DrWeb 5.0.0.12182 2009.08.19 - eSafe 7.0.17.0 2009.08.18 - eTrust-Vet 31.6.6687 2009.08.19 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.19 - Fortinet 3.120.0.0 2009.08.19 - GData 19 2009.08.19 - Ikarus T3.1.1.68.0 2009.08.19 - Jiangmin 11.0.800 2009.08.19 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.19 - McAfee 5713 2009.08.18 - McAfee+Artemis 5713 2009.08.18 - McAfee-GW-Edition 6.8.5 2009.08.19 - Microsoft 1.4903 2009.08.19 - NOD32 4347 2009.08.19 - Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.19 - PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.19 - Rising 21.43.23.00 2009.08.19 - Sophos 4.44.0 2009.08.19 - Sunbelt 3.2.1858.2 2009.08.19 - Symantec 1.4.4.12 2009.08.19 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.19 - VBA32 3.12.10.9 2009.08.19 - ViRobot 2009.8.19.1891 2009.08.19 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 28672 bytes MD5...: ceddee2e0591894d19654d458fd3b9be SHA1..: c58ba65bff4e5e4ba7e78599b583829d56e76e2a SHA256: 712ba390891faf0d52aeadbbaef7fe14a655611984cd3db1709f665482e9fa9b ssdeep: 384:UsA3COA9Q6Yd/AikFzp95UwbZLk4suw15Mdrjg2ohzWP3DdgQII9oZ8J3bJz
7j:Us7OGQs5PNL6uwGrmgqQIuoZ8dJz7j
PEiD..: - TrID..: File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1301
timedatestamp.....: 0x40787439 (Sat Apr 10 22:24:57 2004)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x50e8 0x5200 6.48 7071acd55cb7b9f4377885dab92bdeb8
.rdata 0x7000 0xa7f 0xc00 4.55 cbf801a89a20762706eaf0d93c1eb2a6
.data 0x8000 0x38 0x200 0.50 1bad19bae9d56027544774597c2bce5e
.rsrc 0x9000 0x618 0x800 2.78 7ffcbc84ac6844b1edea17f1d1734c22
.reloc 0xa000 0x290 0x400 4.60 6d95403a18601703a8c7d2d7f27f4db7

( 3 imports )
> STREAM.SYS: StreamClassRegisterFilterWithNoKSPins, StreamClassScheduleTimer, StreamClassRegisterAdapter, StreamClassDeviceNotification
> HAL.dll: KfAcquireSpinLock, KfReleaseSpinLock
> ntoskrnl.exe: ExFreePool, KeInitializeSpinLock, PoStartNextPowerIrp, IofCompleteRequest, _purecall, KeSetEvent, IoFreeIrp, KeWaitForSingleObject, IofCallDriver, KeInitializeEvent, IoAllocateIrp, KeQuerySystemTime, wcsncmp, ZwClose, ZwOpenKey, RtlInitUnicodeString, ExAllocatePoolWithTag, KeDelayExecutionThread, RtlGUIDFromString, ZwQueryValueKey, RtlAppendUnicodeStringToString, RtlCopyUnicodeString, RtlIntegerToUnicodeString, IoOpenDeviceRegistryKey, ZwSetValueKey, strchr, RtlUnicodeStringToAnsiString, RtlInitAnsiString, ZwCreateKey

( 0 exports )
PDFiD.: - RDS...: NSRL Reference Data Set

( Microsoft )

> MSDN Disc 2443.2: atinsnxx.sys
> MSDN Disc 2443.4: atinsnxx.sys
> MSDN Disc 2440.5: atinsnxx.sys
> Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: atinsnxx.sys
> MSDN Disc 2440.3: atinsnxx.sys
> MSDN Disc 2466.2: atinsnxx.sys
> Virtual PC for Mac Windows XP Home Edition: atinsnxx.sys
> MSDN Disc 2441.6: atinsnxx.sys
> MSDN Disc 2441.7: atinsnxx.sys
> MSDN Disc 2466.4: atinsnxx.sys
> MSDN Disc 2476.4: atinsnxx.sys
> MSDN Disc 2455.6: atinsnxx.sys
> MSDN Disc 2476.2: atinsnxx.sys
> Disc 2438.5: atinsnxx.sys
> MSDN Disc 2440.4: atinsnxx.sys
> MSDN Disc 2444.3: atinsnxx.sys
> MSDN Disc 2444.6: atinsnxx.sys
> MSDN Disc 2444.4: atinsnxx.sys
> MSDN Disc 2438.7: atinsnxx.sys
> MSDN Disc 2477.2: atinsnxx.sys
> MSDN Disc 2439.7: atinsnxx.sys
> MSDN Disc 2439.6: atinsnxx.sys
> MSDN Disc 2442.4: atinsnxx.sys
> MSDN Disc 2442.6: atinsnxx.sys
> MSDN Disc 2438.8: atinsnxx.sys
> MSDN Disc 2465.4: atinsnxx.sys
> MSDN Disc 2465.5: atinsnxx.sys
> MSDN Disc 2464.5: atinsnxx.sys
> MSDN Disc 2428.4: atinsnxx.sys
> MSDN Disc 2439.8: atinsnxx.sys
> MSDN Disc 2428.8: atinsnxx.sys
> Virtual PC for Mac Windows XP Professional Edition: atinsnxx.sys
> MSDN Disc 2428.5: atinsnxx.sys
> MSDN Disc 2441.5: atinsnxx.sys

( Gateway )

> Gateway Operating System Windows XP Pro Edition SP2: atinsnxx.sys

Fichier atinttxx.sys reçu le 2009.08.18 17:57:27 (UTC)Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.18 - AhnLab-V3 5.0.0.2 2009.08.18 - AntiVir 7.9.1.3 2009.08.18 - Antiy-AVL 2.0.3.7 2009.08.18 - Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.17 - AVG 8.5.0.406 2009.08.18 - BitDefender 7.2 2009.08.18 - CAT-QuickHeal 10.00 2009.08.18 - ClamAV 0.94.1 2009.08.18 - Comodo 2013 2009.08.18 - DrWeb 5.0.0.12182 2009.08.18 - eSafe 7.0.17.0 2009.08.18 - eTrust-Vet 31.6.6685 2009.08.18 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.18 - Fortinet 3.120.0.0 2009.08.18 - GData 19 2009.08.18 - Ikarus T3.1.1.68.0 2009.08.18 - Jiangmin 11.0.800 2009.08.18 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.18 - McAfee 5713 2009.08.18 - McAfee+Artemis 5713 2009.08.18 - McAfee-GW-Edition 6.8.5 2009.08.18 - Microsoft 1.4903 2009.08.18 - NOD32 4346 2009.08.18 - Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.18 - Panda 10.0.0.14 2009.08.18 - PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.18 - Rising 21.43.14.00 2009.08.18 - Sophos 4.44.0 2009.08.18 - Sunbelt 3.2.1858.2 2009.08.18 - Symantec 1.4.4.12 2009.08.18 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.18 - VBA32 3.12.10.9 2009.08.18 - ViRobot 2009.8.18.1889 2009.08.18 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 13824 bytes MD5...: d80a8f6c0a717446496c3a06d33b0d9c SHA1..: c79a0db42f5d0bbcb7ed85e78578025179123080 SHA256: 0e3025a38f060b643914c099792f3e5d2c80c3d039af07fb71e33b678fcee15d ssdeep: 192:bq9O6kUX9yI4hStJpNqEMgGxDMCLMCViviiHexNGYYshf:b5/69hvN9sNdXy
+dYshf
PEiD..: - TrID..: File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x16b3
timedatestamp.....: 0x4078749c (Sat Apr 10 22:26:36 2004)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1860 0x1a00 6.30 e723576cc001e80a0fb6055f359170f1
.rdata 0x3000 0x896 0xa00 3.66 eb8a1ef19e143e3191bd57f659470e4f
.data 0x4000 0x29c0 0x400 3.12 bf3d146f65e46ad39ad3218cea1242bb
.rsrc 0x7000 0x638 0x800 2.80 91983aa4359b28b3a4f68a40c31e5fd4
.reloc 0x8000 0x162 0x200 4.39 03f121f28732ec37b185e80288d1023a

( 3 imports )
> STREAM.SYS: StreamClassRegisterAdapter, StreamClassDeviceNotification, StreamClassStreamNotification
> HAL.dll: KeQueryPerformanceCounter
> ntoskrnl.exe: PoStartNextPowerIrp, IofCompleteRequest, IoCreateSymbolicLink, RtlInitUnicodeString, _allmul, _aulldiv, InterlockedExchange, ZwClose, ZwOpenKey, IoOpenDeviceRegistryKey, ExFreePool, ZwQueryValueKey, ExAllocatePoolWithTag, ZwSetValueKey, strchr, RtlUnicodeStringToAnsiString, RtlInitAnsiString, wcsncmp, ZwCreateKey

( 0 exports )
PDFiD.: - RDS...: NSRL Reference Data Set

( Microsoft )

> MSDN Disc 2443.2: atinttxx.sys
> MSDN Disc 2443.4: atinttxx.sys
> MSDN Disc 2440.5: atinttxx.sys
> Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: atinttxx.sys
> MSDN Disc 2440.3: atinttxx.sys
> MSDN Disc 2466.2: atinttxx.sys
> Virtual PC for Mac Windows XP Home Edition: atinttxx.sys
> MSDN Disc 2441.6: atinttxx.sys
> MSDN Disc 2441.7: atinttxx.sys
> MSDN Disc 2466.4: atinttxx.sys
> MSDN Disc 2476.4: atinttxx.sys
> MSDN Disc 2455.6: atinttxx.sys
> MSDN Disc 2476.2: atinttxx.sys
> Disc 2438.5: atinttxx.sys
> MSDN Disc 2440.4: atinttxx.sys
> MSDN Disc 2444.3: atinttxx.sys
> MSDN Disc 2444.6: atinttxx.sys
> MSDN Disc 2444.4: atinttxx.sys
> MSDN Disc 2438.7: atinttxx.sys
> MSDN Disc 2477.2: atinttxx.sys
> MSDN Disc 2439.7: atinttxx.sys
> MSDN Disc 2439.6: atinttxx.sys
> MSDN Disc 2442.4: atinttxx.sys
> MSDN Disc 2442.6: atinttxx.sys
> MSDN Disc 2438.8: atinttxx.sys
> MSDN Disc 2465.4: atinttxx.sys
> MSDN Disc 2465.5: atinttxx.sys
> MSDN Disc 2464.5: atinttxx.sys
> MSDN Disc 2428.4: atinttxx.sys
> MSDN Disc 2439.8: atinttxx.sys
> MSDN Disc 2428.8: atinttxx.sys
> Virtual PC for Mac Windows XP Professional Edition: atinttxx.sys
> MSDN Disc 2428.5: atinttxx.sys
> MSDN Disc 2441.5: atinttxx.sys

( Gateway )

> Gateway Operating System Windows XP Pro Edition SP2: atinttxx.sys

Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.18 - AhnLab-V3 5.0.0.2 2009.08.18 - AntiVir 7.9.1.3 2009.08.18 - Antiy-AVL 2.0.3.7 2009.08.18 - Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.17 - AVG 8.5.0.406 2009.08.18 - BitDefender 7.2 2009.08.18 - CAT-QuickHeal 10.00 2009.08.18 - ClamAV 0.94.1 2009.08.18 - Comodo 2013 2009.08.18 - DrWeb 5.0.0.12182 2009.08.18 - eSafe 7.0.17.0 2009.08.18 - eTrust-Vet 31.6.6685 2009.08.18 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.18 - Fortinet 3.120.0.0 2009.08.18 - GData 19 2009.08.18 - Ikarus T3.1.1.68.0 2009.08.18 - Jiangmin 11.0.800 2009.08.18 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.18 - McAfee 5713 2009.08.18 - McAfee+Artemis 5713 2009.08.18 - McAfee-GW-Edition 6.8.5 2009.08.18 - Microsoft 1.4903 2009.08.18 - NOD32 4346 2009.08.18 - Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.18 - Panda 10.0.0.14 2009.08.18 - PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.18 - Rising 21.43.14.00 2009.08.18 - Sophos 4.44.0 2009.08.18 - Sunbelt 3.2.1858.2 2009.08.18 - Symantec 1.4.4.12 2009.08.18 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.18 - VBA32 3.12.10.9 2009.08.18 - ViRobot 2009.8.18.1889 2009.08.18 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 13824 bytes MD5...: d80a8f6c0a717446496c3a06d33b0d9c SHA1..: c79a0db42f5d0bbcb7ed85e78578025179123080 SHA256: 0e3025a38f060b643914c099792f3e5d2c80c3d039af07fb71e33b678fcee15d ssdeep: 192:bq9O6kUX9yI4hStJpNqEMgGxDMCLMCViviiHexNGYYshf:b5/69hvN9sNdXy
+dYshf
PEiD..: - TrID..: File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x16b3
timedatestamp.....: 0x4078749c (Sat Apr 10 22:26:36 2004)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1860 0x1a00 6.30 e723576cc001e80a0fb6055f359170f1
.rdata 0x3000 0x896 0xa00 3.66 eb8a1ef19e143e3191bd57f659470e4f
.data 0x4000 0x29c0 0x400 3.12 bf3d146f65e46ad39ad3218cea1242bb
.rsrc 0x7000 0x638 0x800 2.80 91983aa4359b28b3a4f68a40c31e5fd4
.reloc 0x8000 0x162 0x200 4.39 03f121f28732ec37b185e80288d1023a

( 3 imports )
> STREAM.SYS: StreamClassRegisterAdapter, StreamClassDeviceNotification, StreamClassStreamNotification
> HAL.dll: KeQueryPerformanceCounter
> ntoskrnl.exe: PoStartNextPowerIrp, IofCompleteRequest, IoCreateSymbolicLink, RtlInitUnicodeString, _allmul, _aulldiv, InterlockedExchange, ZwClose, ZwOpenKey, IoOpenDeviceRegistryKey, ExFreePool, ZwQueryValueKey, ExAllocatePoolWithTag, ZwSetValueKey, strchr, RtlUnicodeStringToAnsiString, RtlInitAnsiString, wcsncmp, ZwCreateKey

( 0 exports )
PDFiD.: - RDS...: NSRL Reference Data Set

( Microsoft )

> MSDN Disc 2443.2: atinttxx.sys
> MSDN Disc 2443.4: atinttxx.sys
> MSDN Disc 2440.5: atinttxx.sys
> Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: atinttxx.sys
> MSDN Disc 2440.3: atinttxx.sys
> MSDN Disc 2466.2: atinttxx.sys
> Virtual PC for Mac Windows XP Home Edition: atinttxx.sys
> MSDN Disc 2441.6: atinttxx.sys
> MSDN Disc 2441.7: atinttxx.sys
> MSDN Disc 2466.4: atinttxx.sys
> MSDN Disc 2476.4: atinttxx.sys
> MSDN Disc 2455.6: atinttxx.sys
> MSDN Disc 2476.2: atinttxx.sys
> Disc 2438.5: atinttxx.sys
> MSDN Disc 2440.4: atinttxx.sys
> MSDN Disc 2444.3: atinttxx.sys
> MSDN Disc 2444.6: atinttxx.sys
> MSDN Disc 2444.4: atinttxx.sys
> MSDN Disc 2438.7: atinttxx.sys
> MSDN Disc 2477.2: atinttxx.sys
> MSDN Disc 2439.7: atinttxx.sys
> MSDN Disc 2439.6: atinttxx.sys
> MSDN Disc 2442.4: atinttxx.sys
> MSDN Disc 2442.6: atinttxx.sys
> MSDN Disc 2438.8: atinttxx.sys
> MSDN Disc 2465.4: atinttxx.sys
> MSDN Disc 2465.5: atinttxx.sys
> MSDN Disc 2464.5: atinttxx.sys
> MSDN Disc 2428.4: atinttxx.sys
> MSDN Disc 2439.8: atinttxx.sys
> MSDN Disc 2428.8: atinttxx.sys
> Virtual PC for Mac Windows XP Professional Edition: atinttxx.sys
> MSDN Disc 2428.5: atinttxx.sys
> MSDN Disc 2441.5: atinttxx.sys

( Gateway )

> Gateway Operating System Windows XP Pro Edition SP2: atinttxx.sys

gen-hackman · Answer

fais un scan compler avec malwarebytes apres mise à  jour

Thomas · Answer

Pendant la première analyse, le pc s'est bloqué. J'ai dû éteindre 2 fois (une fois écran noir, l'autre un message d'erreur). Maintenant il s'est redémarré avec une taille de police plus grande ce qui l'empêche de planter app. Tout du moins ce n'est jamais arrivé lorsqu'il se met dans cet état. Une seconde analyse de Malwarebyte est relancée. C'est quand même assez spécial, il ne semblait plus rien avoir.

Thomas · Answer

AVG a détecté en plus du cheval de troie d'hier :

Infection  Virus identifié Worm/Generic.WGA      

Lien cijoint : AVG print screen : 

http://www.cijoint.fr/cjlink.php?file=cj200908/cijUJDXnaZ.jpg 

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2654
Windows 5.1.2600 Service Pack 3

19/08/2009 17:36:52
mbam-log-2009-08-19 (17-36-52).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|)
Eléments examinés: 166266
Temps écoulé: 1 hour(s), 25 minute(s), 14 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

gen-hackman · Answer

quel age le pc ?

Thomas · Answer

C'est un Sony Vaio VGN-FS315M ... Il a 4 ou 5ans. Je n'sais pas pq mais je pense que c'est mauvais signe :(

gen-hackman · Answer

je pense que tu devrais le faire verifier materiellement

Thomas · Answer

Ah bon... D'accord. Les erreurs seraient à chercher de ce côté alors... Je vais tenter de me renseigner. Je devrais donc demander conseil à un informaticien ou demander à Sony un devis ?

Pour le dernier virus, je peux juste vider la quarantaine ? 

Merci beaucoup en tout cas :)

gen-hackman · Answer

oui

Infections Malwarebyte - Page 6

Discussions similaires

Newsletters