Virus system32 + autre Résolu

Question

Bonjour,

Depuis quelques jours l'antivirus detecte des fichiers contaminés. Voici ce que Spyware Terminator fait apparaitre. 

- Hoax.Renos.bcz.2  : dans WINDOWS\system32\wisdstr.exe 
                                        WINDOWS\system32\braviax.exe
-Liste noire : Local Setting\Temp\BNE8.tmp

De plus en bas dans la barre des elements actifs, un icone representant une croix blanche dans un rond rouge affiche un message Your computer is infected!

J'ai télécharger Hijackthis, mais je n'arrive pas à ouvrir le logiciel. 

Que dois je faire pour retrouver un pc sans virus? ?

MERCI D'avance pour l'aide

plopus · Answer

lu

Télécharge Random's System Information Tool (RSIT) de Random/Random, et enregistre le sur ton Bureau.
http://images.malwareremoval.com/random/RSIT.exe
• Double clique sur RSIT.exe pour lancer l'outil.
• Clique sur "Continue" à l'écran Disclaimer.
• Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu s'il te le demande) et tu devras accepter la licence.
• Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés stp

feshme · Answer

Tout d'abord un grand merci d'avoir répondu et en plus si vite. 
Voici le premier scan apparue en bloc note : 

info.txt logfile of random's system information tool 1.06 2009-08-17 21:20:14

======Uninstall list======

-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2500 Lettres, Contrats et Actes Types-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\The Learning Company\2500 Lettres\Uninst.isu"
ABBYY FineReader 6.0 Sprint-->MsiExec.exe /I{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}
Ad-Aware-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Agere Systems AC'97 Modem-->agrsmdel
ALPS Touch Pad Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}\setup.exe" UNINSTALL
ALUpdate-->"C:\Program Files\ESTsoft\ALUpdate\unins000.exe"
ALZip-->"C:\Program Files\ESTsoft\ALZip\unins000.exe"
a-squared Free 4.5-->"C:\Program Files\a-squared Free\unins000.exe"
Blender (remove only)-->"C:\Program Files\Blender Foundation\Blender\uninstall.exe"
Contextual Tool Snappyads-->C:\WINDOWS\system32\78aa94d1-bfcf-873e-8e60-2ab5cc094f3f.exe
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif Windows XP - KB884575-->C:\WINDOWS\$NtUninstallKB884575$\spuninst\spuninst.exe
Correctif Windows XP - KB885884-->C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe
Correctif Windows XP - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Crawler Toolbar with Web Security Guard-->C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe uninst
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
EPSON Attach To Email-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{20C45B32-5AB6-46A4-94EF-58950CAF05E5} /l1033 ADDREMOVEDLG
EPSON Copy Utility 3-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{67EDD823-135A-4D59-87BD-950616D6E857}\SETUP.EXE" -l0x40c -UnInstall
EPSON Easy Photo Print-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3D78F2A2-C893-4ABD-B5FE-AD7011837755}\SETUP.EXE" -l0x40c UNINST
EPSON File Manager-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2EB81825-E9EE-44F4-8F51-1240C3898DC6}\Setup.exe" -l0x40c UNINST
EPSON Logiciel imprimante-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
EPSON Scan Assistant-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}\Setup.exe" -l0x40c -u
EPSON Scan-->C:\Program Files\epson\escndv\setup\setup.exe /r
EPSON Stylus CX7300_CX8300_DX7400_DX8400 Manuel-->C:\Program Files\EPSON\TPMANUAL\ES_CX_DX\FRA\USE_G\DOCUNINS.EXE
EPSON Web-To-Page-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}\SETUP.EXE" -l0x40c -anything
FAT32 Format-->C:\PROGRAM FILES\FAT32 Format\Uninstall.EXE
Football Manager 2008-->"C:\Program Files\Sports Interactive\Football Manager 2008\Uninstall_Football Manager 2008\Uninstall Football Manager 2008.exe"
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
Hotfix pour Microsoft .NET Framework 2.0 (KB918842)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {5FD48194-AD97-46A1-ABDB-12FC85916742} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
HouseCall 6.6-->"C:\Documents and Settings\Nuno\Application Data\HouseCall 6.6\uninstaller.exe"
HP Image Zone 4.2-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP Image Zone Plus 4.2-->C:\Program Files\HP\Digital Imaging\{5E1494D4-3562-4FFB-B35C-600F80F6934C}\setup\hpzscr01.exe -datfile hpdscr01.dat
HP Software Update-->MsiExec.exe /X{457791C5-D702-4143-A7B2-2744BE9573F2}
HP Wireless Assistant-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}\setup.exe" -l0x40c 
HPIZ402-->MsiExec.exe /X{8D9768AE-DE42-4A04-A461-2361A58C384D}
Intel(R) Graphics Media Accelerator Driver for Mobile-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2792 PCI\VEN_8086&DEV_2592
InterActual Player-->C:\Program Files\InterActual\InterActual Player\inuninst.exe
InterVideo DiscLabel-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C3F058C0-A21C-452D-8D99-95B1A45F417D}\setup.exe"  REMOVEALL
InterVideo WinDVD Creator-->"C:\Program Files\InstallShield Installation Information\{2FCE4FC5-6930-40E7-A4F1-F862207424EF}\setup.exe" REMOVEALL
InterVideo WinDVD-->"C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL
IsoBuster 2.5.5-->"C:\Program Files\Smart Projects\IsoBuster\Uninst\unins000.exe"
J2SE Runtime Environment 5.0-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150000}
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LiveReg (Symantec Corporation)-->C:\Program Files\Fichiers communs\Symantec Shared\LiveReg\VCSetup.exe /REMOVE
Macromedia Flash Player 8-->C:\WINDOWS\system32\Macromed\Flash\UninstFl.exe
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)-->"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB929123)-->"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944338-v2)-->"C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950749)-->"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
MP3 WAV Converter 3.26-->C:\PROGRA~1\MP3WAV~1\UNWISE.EXE C:\PROGRA~1\MP3WAV~1\INSTALL.LOG
MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
Nero 6 Ultra Edition-->C:\Program Files\Ahead
ero\uninstall\UNNERO.exe /UNINSTALL
Norton AntiVirus 2005-->MsiExec.exe /X{C6F5B6CF-609C-428E-876F-CA83176C021B}
PDFCreator-->C:\Program Files\PDFCreator\unins000.exe
Post-it® Software Notes Lite-->"C:\Program Files\3M\PSNLite\Uninstall.exe" -Prog"C:\Program Files\3M\PSNLite\PsnLite.exe" -INI"C:\Program Files\3M\PSNLite\uninst.ini"
Presto! PVR-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BC0DCD27-345B-4013-A6E0-67EC92DF32C8}\setup.exe" -l0x40c -u -removeonly
Python 2.5.2-->MsiExec.exe /I{6B976ADF-8AE8-434E-B282-A06C7F624D2F}
Quick Launch Buttons 5.00 D5-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CEB326EC-8F40-47B2-BA22-BB092565D66F}\setup.exe" -l0x40c  -uninst
QuickTime-->C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
S810-->C:\Program Files\InstallShield Installation Information\{7FF90D04-A60F-42A0-8F78-88623F99DCAC}\setup.exe -runfromtemp -l0x040c -removeonly
SAMSUNG CDMA Modem Driver Set-->C:\WINDOWS\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
SAMSUNG Mobile Composite Device Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\6\SSBCUninstall.exe
Samsung Mobile phone USB driver Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
SFR - Kit de connexion-->C:\Program Files\SFR\Kit\uninstall.exe
Shockwave-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
SoundMAX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe" -l0x40c  -removeonly
Spyware Terminator-->"C:\Program Files\Spyware Terminator\unins000.exe"
SpywareBlaster 4.0-->"C:\Program Files\SpywareBlaster\unins000.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Symantec Script Blocking Installer-->MsiExec.exe /I{D327AFC9-7BAA-473A-8319-6EB7A0D40138}
TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}
UserGuides-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{02E22217-0E96-4C3F-B831-83AA942B7715}\setup.exe" -l0x40c 
Virtual DJ - Atomix Productions-->C:\PROGRA~1\VIRTUA~1\UNWISE.EXE C:\PROGRA~1\VIRTUA~1\INSTALL.LOG
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Zuma Deluxe RA-->C:\PROGRA~1\ZUMADE~1\UNWISE.EXE C:\PROGRA~1\ZUMADE~1\INSTALL.LOG

======Hosts File======

127.0.0.1	localhost

======System event log======

Computer Name: ENS
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service HP WMI Interface.

Record Number: 121297
Source Name: Service Control Manager
Time Written: 20090808121309.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: ENS
Event Code: 7036
Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : arrêté.

Record Number: 121296
Source Name: Service Control Manager
Time Written: 20090808121309.000000+120
Event Type: Informations
User: 

Computer Name: ENS
Event Code: 7036
Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : en cours d'exécution.

Record Number: 121295
Source Name: Service Control Manager
Time Written: 20090808121309.000000+120
Event Type: Informations
User: 

Computer Name: ENS
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service COM de gravage de CD IMAPI.

Record Number: 121294
Source Name: Service Control Manager
Time Written: 20090808121309.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: ENS
Event Code: 7036
Message: Le service Compatibilité avec le Changement rapide d'utilisateur est entré dans l'état : en cours d'exécution.

Record Number: 121293
Source Name: Service Control Manager
Time Written: 20090808121309.000000+120
Event Type: Informations
User: 

=====Application event log=====

Computer Name: ENS
Event Code: 1000
Message: Les compteurs de performances pour le service WmiApRpl (WmiApRpl) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 13524
Source Name: LoadPerf
Time Written: 20081210143745.000000+060
Event Type: Informations
User: 

Computer Name: ENS
Event Code: 1001
Message: Les compteurs de performances pour le service WmiApRpl (WmiApRpl) ont été supprimés.
Les données d'enregistrement contiennent les nouvelles valeurs du dernier compteur système
et les dernières entrées du registre d'aide.

Record Number: 13523
Source Name: LoadPerf
Time Written: 20081210143743.000000+060
Event Type: Informations
User: 

Computer Name: ENS
Event Code: 2002
Message: 
Record Number: 13522
Source Name: EAPOL
Time Written: 20081210143339.000000+060
Event Type: Informations
User: 

Computer Name: ENS
Event Code: 2003
Message: 
Record Number: 13521
Source Name: EAPOL
Time Written: 20081210143339.000000+060
Event Type: Informations
User: 

Computer Name: ENS
Event Code: 4096
Message: 
Record Number: 13520
Source Name: Avira AntiVir
Time Written: 20081210143338.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Samsung\Samsung PC Studio 3;C:\Program Files\ESTsoft\ALZip;C:\Program Files\Smart Projects\IsoBuster
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel
"PROCESSOR_REVISION"=0d08
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

plopus · Answer

re

tu es belle et bien infecté par ceyye salete de braviax

Fait ceci dans l'ordre et poste les rapports :

    *  Telecharge UsbFix de C_XX & Chiquitine29
    http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe
    * Lance l installation avec les parametres par default
    * Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d'avoir été infectés sans les ouvrir
    * Double clic sur le raccourci UsbFix sur ton bureau
    * Choisi l'option 2 Suppression
    * Laisse travailler l'outil
    * Ensuite post le rapport UsbFix.txt qui apparaîtra
    * Note : le rapport UsbFix.txt est sauvegardé a la racine du disque

* Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus


ensuite

clic droit sur le lien ci dessous choisit "enregistré la cible du lien sous" dans la nouvelle fentre tu choisit emplacement sur ton BUREAU et tu RENOMME le fichier en CF
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

ensuite deconnecte toi d'internet (debranche le cable si possible), desactive ton antivirus et toutes tes defence et lance CF et ne touche + a rien et poste le rapport

ensuite tu feras sa :

#  Télécharge ToolbarSD (de Team IDN) sur ton Bureau

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

# Lance l'installation du programme en exécutant le fichier téléchargé.

# Double-clique maintenant sur le raccourci de Toolbar-S&D.

# Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.

# Choisis maintenant l'option 2 suppression. Patiente jusqu'à la fin de la recherche.

# Poste le rapport généré. (C:\TB.txt)



en attente des rapports

plopus · Answer

Passe a combofix en LE RENOMMANT et telecharge le bien sur le bureau, deconnecte toi dinternet ....

tu as une belle salete ur ton PC...

plopus · Answer

re

ne crie pas victoire desuiste car ce virus infecte des fichier système et infecte aussi le cache pour qu'il soit rempcaé aussi par le meme fichier verolé...

as tu le CD de windows ?  allume le moins possible ton PC et ne t'en sert seulement que pour faire la desinfection car a chaque redemarrage, toutes la companie revient

Passe a malwarebyte, Fait un scan rapide sa prend moins 10 min, supprime ce qu'il trouve et poste le rapport on verra si il infecte les meme fichiers que d' habitude (oublie pas de poste le rapport et si malwarebyte ne fonctionne pas, renomme le fichier .exe dans programmefile/mawlarebyte le MBAM en MM par exemple 


puis

et ensuite reposte moi un nouveau RSIt stp

plopus · Answer

oups excuse jte parle de malwarebyte mais ya pas de canned ....

Fait ceci stp :

    *  Télécharge Malwarebytes
   http://www.malwarebytes.org/mbam/program/mbam-setup.exe
    * Fais la mise à jour du logiciel (elle se fait normalement à l'installation)

va renommer le fichier  : C:/programmefile/malwarebyte/ MBAM en MM
et execute ce fichier :

    * Lance une analyse complète en cliquant sur "Exécuter un examen RAPIDE"
    * Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"
    * L'analyse peut durer un bon moment.....
    * Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"
    * Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"
    * Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum


* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC et que le logiciel te demande de redemarré NE LE FAIT PAS. TU REDEMARRE PAS LE PC tu clic sur non.

et après tu relance RSIT et me poste le rapport (toi aussi pour l'instant ne redemarre pas ton PC , si tu t'en sert pas debranche le cable d'internet)


tu n'as pas repondu a ma question :

AS TU LE CD DE WINDOWS ?

plopus · Answer

re

ok tu n'as toujours pas redemarré j'espere ?

essaye ceci si tu peux le scan ne supprime pas les fichiers infecté donc poste moi entierement  le rapport avec les lignes si tu y arrive.

Fais un scan en ligne Kaspersky :

• Désactive ton antivirus
• Fais un scan en ligne ici https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
• Clique sur "Kaspersky Online Scanner Cliquez-ici"
• Lis le texte d'information, puis clique sur « J'accepte »
• Si une fenêtre te demande t'exécuter un programme, accepte
• Une fois la mise à jour téléchargée, choisis "Poste de travail" pour le scan.
• A la fin de l'analyse, clique sur « Enregistrer rapport » et poste le dans ta prochaine réponse.

Tutoriel illustré : https://www.commentcamarche.net/faq/17751-scanner-en-ligne-avec-kaspersky


Pour la troisieme 3fois as tu le CD windows ?

plopus · Answer

ok

Aprés le scan kaspserskytu feras ceci :

desactive ta restauration systeme a l'aide de ce lien :
https://www.informatruc.com

tu la réactiveras en fin de desinfection.

ensuite affiche les dossier caché :
https://www.commentcamarche.net/informatique/windows/185-afficher-les-extensions-et-les-fichiers-caches-sous-windows/

ensuite clic ici https://www.virustotal.com/gui/ et clic sur parcourir et va chercher ces fichier un par un et fait les analyser un rapport va s'etablir, copie colle l'url du rapport a la fin pour chaqu'un des fichier

c:\windows\system32\drivers\beep.sys
c:\windows\system32\dllcache\beep.sys

feshme · Answer

Pour le second fichier : résultat : 

Le fichier a déjà été analysé:
MD5: da1f27d85e0d1525f6621372e7b685e9 
First received: 2008.04.17 05:23:36 UTC 
Date 2009.08.18 05:57:17 UTC [<1D] 
Résultats 1/41 
Permalink: analisis/5a81a46a3bdd19dafc6c87d277267a5d44f3a1b5302f2cc1111d84b7bad5610d-1250575037 

et en cliquant sur le lien (permalink) : 
Fichier beep.sys reçu le 2009.08.18 05:57:17 (UTC)
Situation actuelle: terminé 

Résultat: 1/41 (2.44%)
 Formaté Impression des résultats  
Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.18 - 
AhnLab-V3 5.0.0.2 2009.08.18 - 
AntiVir 7.9.1.1 2009.08.17 - 
Antiy-AVL 2.0.3.7 2009.08.17 - 
Authentium 5.1.2.4 2009.08.18 - 
Avast 4.8.1335.0 2009.08.17 - 
AVG 8.5.0.406 2009.08.17 - 
BitDefender 7.2 2009.08.18 - 
CAT-QuickHeal 10.00 2009.08.17 - 
ClamAV 0.94.1 2009.08.18 - 
Comodo 2008 2009.08.18 - 
DrWeb 5.0.0.12182 2009.08.18 - 
eSafe 7.0.17.0 2009.08.17 Win32.Banker 
eTrust-Vet 31.6.6683 2009.08.18 - 
F-Prot 4.4.4.56 2009.08.16 - 
F-Secure 8.0.14470.0 2009.08.18 - 
Fortinet 3.120.0.0 2009.08.18 - 
GData 19 2009.08.18 - 
Ikarus T3.1.1.68.0 2009.08.18 - 
Jiangmin 11.0.800 2009.08.18 - 
K7AntiVirus 7.10.820 2009.08.17 - 
Kaspersky 7.0.0.125 2009.08.18 - 
McAfee 5712 2009.08.17 - 
McAfee+Artemis 5712 2009.08.17 - 
McAfee-GW-Edition 6.8.5 2009.08.17 - 
Microsoft 1.4903 2009.08.18 - 
NOD32 4343 2009.08.18 - 
Norman 6.01.09 2009.08.17 - 
nProtect 2009.1.8.0 2009.08.17 - 
Panda 10.0.0.14 2009.08.17 - 
PCTools 4.4.2.0 2009.08.17 - 
Prevx 3.0 2009.08.18 - 
Rising 21.43.10.00 2009.08.18 - 
Sophos 4.44.0 2009.08.18 - 
Sunbelt 3.2.1858.2 2009.08.18 - 
Symantec 1.4.4.12 2009.08.18 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.18 - 
VBA32 3.12.10.9 2009.08.18 - 
ViRobot 2009.8.18.1888 2009.08.18 - 
VirusBuster 4.6.5.0 2009.08.17 - 
Information additionnelle 
File size: 4224 bytes 
MD5   : da1f27d85e0d1525f6621372e7b685e9 
SHA1  : e3d2dc5eb273fa701de8af13b60d6baac7629260 
SHA256: 5a81a46a3bdd19dafc6c87d277267a5d44f3a1b5302f2cc1111d84b7bad5610d 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x66C
timedatestamp.....: 0x3B7D82E5 (Fri Aug 17 22:47:33 2001)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x424 0x480 5.77 64f775a399d212649b5b58a280791c2d
.rdata 0x780 0xAD 0x100 2.62 0ace5f365131534c66de4137833221ad
INIT 0x880 0x284 0x300 4.44 13a9d0bea8490140305ffa9291acfd99
.rsrc 0xB80 0x3C8 0x400 3.22 9b654fc1759147ff04b147754f347be4
.reloc 0xF80 0x9A 0x100 2.80 5c4742feb834ca0995d1e806fe06cc57

( 0 imports )


( 0 exports )
 
TrID  : File type identification
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
ThreatExpert: https://www.symantec.com?md5=da1f27d85e0d1525f6621372e7b685e9 
ssdeep: 48:qvsINlblgYeU/DtYrmVimGxIBqOopSDKGV7Co+sjIZWQ7q2ue5WwGD+:ilbd/DKrmLGWBqhev7X+MEWKLu+Ww8 
PEiD  : - 
RDS   : NSRL Reference Data Set

( Topics Entertainment )

Instant Home Design: beep.sys
( Symantec )

Norton SystemWorks 2005: BEEP.SYS
( Compaq )

Compaq Operating System CD: beep.sys
( NewTech Infosystems Inc. )

CD-Maker Plus Edition: beep.sys
( The Learning Company Inc. )

Reader Rabbits Toddler: beep.sys
( Dell )

Reinstallation CD Microsoft Windows XP Professional: beep.sys
( Gateway )

Gateway Operating System Windows XP Pro Edition SP2: BEEP.SYS, beep.sys
( Sony )

Sony VAIO Recover CDs: BEEP.SYS
( Microsoft )

2261A: Supporting Users Running the Microsoft Windows XP Operating System: beep.sys2262A: Supporting Users Running Applications on a Microsoft Windows XP Operating System: beep.sysApplications, Platforms: beep.sysApplications, Platforms: beep.sysApplications, Platforms, Servers: beep.sysApplications, Platforms, Servers: beep.sysDisc 2438.5: beep.sysImplementing and Supporting Microsoft Windows XP Professional: beep.sysInternet Explorer: beep.sysInternet Explorer Versions: beep.sysMDSN Disc 2441.2: beep.sysMicrosoft Security Resource Kit: beep.sysMicrosoft TechNet Trial Software 2002 Volume 1: beep.sysMicrosoft Windows XP Professional: beep.sysMSDN Disc 1550: beep.sysMSDN Disc 2041: beep.sysMSDN Disc 2053: beep.sysMSDN Disc 2307: beep.sysMSDN Disc 2364: beep.sysMSDN disc 2390: beep.sysMSDN Disc 2428: beep.sysMSDN Disc 2428.1: beep.sysMSDN Disc 2428.2: beep.sysMSDN Disc 2428.4: beep.sysMSDN Disc 2428.5: beep.sysMSDN Disc 2428.8: beep.sysMSDN Disc 2438: beep.sysMSDN Disc 2438.1: beep.sysMSDN Disc 2438.2: beep.sysMSDN DISC 2438.3: beep.sysMSDN Disc 2438.7: beep.sysMSDN Disc 2438.8: beep.sysMSDN Disc 2439: beep.sysMSDN Disc 2439.1: beep.sysMSDN Disc 2439.2: beep.sysMSDN Disc 2439.3: beep.sysMSDN Disc 2439.6: beep.sysMSDN Disc 2439.7: beep.sysMSDN Disc 2439.8: beep.sysMSDN Disc 2440.3: beep.sysMSDN Disc 2440.4: beep.sysMSDN Disc 2440.5: beep.sysMSDN Disc 2441: beep.sysMSDN Disc 2441.1: beep.sysMSDN Disc 2441.5: beep.sysMSDN Disc 2441.6: beep.sysMSDN Disc 2441.7: beep.sysMSDN Disc 2442: beep.sysMSDN Disc 2442.1: beep.sysMSDN Disc 2442.2: beep.sysMSDN Disc 2442.3: beep.sysMSDN Disc 2442.4: beep.sysMSDN Disc 2442.6: beep.sysMSDN Disc 2443: beep.sysMSDN Disc 2443.1: beep.sysMSDN Disc 2443.2: beep.sysMSDN Disc 2443.4: beep.sysMSDN Disc 2444: beep.sysMSDN Disc 2444.1: beep.sysMSDN Disc 2444.3: beep.sysMSDN Disc 2444.3: beep.sysMSDN Disc 2444.4: beep.sysMSDN Disc 2444.6: beep.sysMSDN Disc 2455: beep.sysMSDN Disc 2455.1: beep.sysMSDN disc 2455.2: beep.sysMSDN Disc 2455.6: beep.sysMSDN Disc 2464: beep.sysMSDN Disc 2464.1: beep.sysMSDN Disc 2464.5: beep.sysMSDN Disc 2465: beep.sysMSDN Disc 2465.2: beep.sysMSDN disc 2465.3: beep.sysMSDN Disc 2465.4: beep.sysMSDN Disc 2465.5: beep.sysMSDN Disc 2466: beep.sysMSDN Disc 2466.1: beep.sysMSDN Disc 2466.2: beep.sysMSDN Disc 2466.4: beep.sysMSDN Disc 2476: beep.sysMSDN Disc 2476.1: beep.sysMSDN Disc 2476.2: beep.sysMSDN Disc 2476.4: beep.sysMSDN Disc 2477.2: beep.sysMSDN Disc 3264: beep.sysMSDN Disc2365: beep.sysMSDN Disc2389: beep.sysMSDN Disc2428.3: beep.sysMSDN MSIE 6.0, IE 6.0 SP1, Windows 2000 Advanced Server, Windows 2000 Professional, Windows 2000 Server, Windows 98 Second ed., Windows ME, Win XP Pro: beep.sysOffice XP Professional with FrontPage: beep.sysOperating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: beep.sysPlatforms: beep.sysPlatforms SDKs/DDKs: beep.sysPlatforms, SDK/DDK: beep.sysPlatforms, SDK/DDK: beep.sysPlatforms, SDK/DDK, Developer Tools: beep.sysVirtual PC for Mac Windows XP Home Edition: beep.sysVirtual PC for Mac Windows XP Professional Edition: beep.sysWindows 2000 Versions: beep.sysWindows 98 Versions: beep.sysWindows CE .NET Evaluation Software: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP: beep.sysWindows XP eMbedded Evaluation Software: beep.sysWindows XP Home Edition: beep.sysWindows XP Home Edition: beep.sysWindows XP Professional: beep.sysWindows XP Professional: beep.sysWindows XP Professional 2002 Service Pack 1: beep.sysWindows XP Tablet PC Edition: beep.sys

plopus · Answer

ok ta de la chance pour l'instant, il te manque juste une Dl, et pour l'instant les fichiers systeme remplacé ne sont pas infecté, NE REDEMARRE PAS TON PC a part si je te le demande dans une procedure

tu as en ai ou avec le scan kaspersky ?

peut tu faire les memes analyse sur virus total avec les fichier ci dessous :

c:\windows\Sof­twareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\­ntfs.sys
 c:\windows\Sof­twareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\­sp2gdr
tfs.sys
 c:\windows\Sof­twareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\­sp2qfe
tfs.sys
 c:\windows\sys­tem32\dllcache
tfs.sys
 c:\windows\sys­tem32\drivers
tfs.sys

tu as bien desactiver ta restauration systeme comme demandé + haut ?

feshme · Answer

FICHIER : c:\windows\Sof­twareDistribution\Download\44b6174a4a693136d0­2d4a7ecd7cbd54\­ntfs.sys 
Le fichier a déjà été analysé:
MD5: 78a08dd6a8d65e697c18e1db01c5cdca 
First received: 2009.02.11 09:17:52 UTC 
Date 2009.08.18 08:45:26 UTC [<1D] 
Résultats 0/41 
Permalink: analisis/e0e6f3ed05068e32f1d5c2d2b38cdef4536b8656db6756c66cf6b40b60c8f3da-1250585126 

Clic sur le lien (permalink) : 
Fichier ntfs.sys reçu le 2009.08.18 08:45:26 (UTC)
Situation actuelle: terminé 

Résultat: 0/41 (0.00%)
 Formaté Impression des résultats  
Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.18 - 
AhnLab-V3 5.0.0.2 2009.08.18 - 
AntiVir 7.9.1.1 2009.08.18 - 
Antiy-AVL 2.0.3.7 2009.08.18 - 
Authentium 5.1.2.4 2009.08.18 - 
Avast 4.8.1335.0 2009.08.17 - 
AVG 8.5.0.406 2009.08.17 - 
BitDefender 7.2 2009.08.18 - 
CAT-QuickHeal 10.00 2009.08.18 - 
ClamAV 0.94.1 2009.08.18 - 
Comodo 2009 2009.08.18 - 
DrWeb 5.0.0.12182 2009.08.18 - 
eSafe 7.0.17.0 2009.08.17 - 
eTrust-Vet 31.6.6683 2009.08.18 - 
F-Prot 4.4.4.56 2009.08.18 - 
F-Secure 8.0.14470.0 2009.08.18 - 
Fortinet 3.120.0.0 2009.08.18 - 
GData 19 2009.08.18 - 
Ikarus T3.1.1.68.0 2009.08.18 - 
Jiangmin 11.0.800 2009.08.18 - 
K7AntiVirus 7.10.820 2009.08.17 - 
Kaspersky 7.0.0.125 2009.08.18 - 
McAfee 5712 2009.08.17 - 
McAfee+Artemis 5712 2009.08.17 - 
McAfee-GW-Edition 6.8.5 2009.08.18 - 
Microsoft 1.4903 2009.08.18 - 
NOD32 4344 2009.08.18 - 
Norman 6.01.09 2009.08.17 - 
nProtect 2009.1.8.0 2009.08.18 - 
Panda 10.0.0.14 2009.08.17 - 
PCTools 4.4.2.0 2009.08.17 - 
Prevx 3.0 2009.08.18 - 
Rising 21.43.11.00 2009.08.18 - 
Sophos 4.44.0 2009.08.18 - 
Sunbelt 3.2.1858.2 2009.08.18 - 
Symantec 1.4.4.12 2009.08.18 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.18 - 
VBA32 3.12.10.9 2009.08.18 - 
ViRobot 2009.8.18.1888 2009.08.18 - 
VirusBuster 4.6.5.0 2009.08.17 - 
Information additionnelle 
File size: 574976 bytes 
MD5   : 78a08dd6a8d65e697c18e1db01c5cdca 
SHA1  : c40f3c1fcbd8a61ad5f36e16971feb64407bbc66 
SHA256: e0e6f3ed05068e32f1d5c2d2b38cdef4536b8656db6756c66cf6b40b60c8f3da 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x85384
timedatestamp.....: 0x48025BE5 (Sun Apr 13 21:15:49 2008)
machinetype.......: 0x14C (Intel I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x17879 0x17880 6.57 7a0cc809877394dcb00f251125cde1d0
.rdata 0x17B80 0x7078 0x7080 6.30 95baacb27e75d4140da94f3e43c659d6
.data 0x1EC00 0x1B10 0x1B80 0.74 9cb37a38036e823a0152bb209239dffd
PAGE 0x20780 0x64B6B 0x64B80 6.51 7de1f4c3a0a474314fe86e158e01cd73
INIT 0x85300 0x36FE 0x3700 6.07 ded61bc7fa643b884fdf69cc4d48c308
.rsrc 0x88A00 0x3E0 0x400 3.34 7153f5b12fab0213e839e612df3320ab
.reloc 0x88E00 0x37A0 0x3800 6.73 5db2361b4571130ef61ec5a1deac3e22

( 0 imports )


( 0 exports )
 
TrID  : File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
ssdeep: 12288:CosOm5JqnuiIT8j4l7yT68kdUDzAGOjICueFWI0m9:eJ+uiIQ4kTTkdUDEPflFWI0 
PEiD  : - 
RDS   : NSRL Reference Data Set
-

plopus · Answer

ok pour kaspersky desolé j'avais pas vu,

va dans :

demarrer/panneau de configuration/ajouter ou supprimer un programme et desinstalle tout tes version de JAVA UPDATE

ensuite installe la derniere ici  https://www.java.com/fr/download/

et ensuite redemarre ton NAVIGATEUR (internet explorer) et réessaye le scan en ligne en analysant ton poste de travail et poste bien le rapport

plopus · Answer

ATTENTIOn quand on te dit que le fichier a deja ete analyser clic sur réanalyser recommence stp

feshme · Answer

FICHIER : c:\windows\Sof­twareDistribution\Download\e3bd9b90b867ba67af­dd4c29dc49177c\­sp2gdr
tfs.sys 

Le fichier a déjà été analysé:
MD5: 19a811ef5f1ed5c926a028ce107ff1af 
First received: 2009.02.16 07:57:28 UTC 
Date 2009.08.18 10:09:54 UTC [<1D] 
Résultats 0/41 
Permalink: analisis/97606850041de4e568188fb28aa3d5b10a4e96db9551a77bc3a17ed67d5d4474-1250590194 

clic sur le lien (permalink) : 


Fichier ntfs.sys reçu le 2009.08.18 10:09:54 (UTC)
Situation actuelle: terminé 

Résultat: 0/41 (0.00%)
 Formaté Impression des résultats  
Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.18 - 
AhnLab-V3 5.0.0.2 2009.08.18 - 
AntiVir 7.9.1.1 2009.08.18 - 
Antiy-AVL 2.0.3.7 2009.08.18 - 
Authentium 5.1.2.4 2009.08.18 - 
Avast 4.8.1335.0 2009.08.17 - 
AVG 8.5.0.406 2009.08.18 - 
BitDefender 7.2 2009.08.18 - 
CAT-QuickHeal 10.00 2009.08.18 - 
ClamAV 0.94.1 2009.08.18 - 
Comodo 2009 2009.08.18 - 
DrWeb 5.0.0.12182 2009.08.18 - 
eSafe 7.0.17.0 2009.08.17 - 
eTrust-Vet 31.6.6683 2009.08.18 - 
F-Prot 4.4.4.56 2009.08.18 - 
F-Secure 8.0.14470.0 2009.08.18 - 
Fortinet 3.120.0.0 2009.08.18 - 
GData 19 2009.08.18 - 
Ikarus T3.1.1.68.0 2009.08.18 - 
Jiangmin 11.0.800 2009.08.18 - 
K7AntiVirus 7.10.820 2009.08.17 - 
Kaspersky 7.0.0.125 2009.08.18 - 
McAfee 5712 2009.08.17 - 
McAfee+Artemis 5712 2009.08.17 - 
McAfee-GW-Edition 6.8.5 2009.08.18 - 
Microsoft 1.4903 2009.08.18 - 
NOD32 4344 2009.08.18 - 
Norman 6.01.09 2009.08.17 - 
nProtect 2009.1.8.0 2009.08.18 - 
Panda 10.0.0.14 2009.08.17 - 
PCTools 4.4.2.0 2009.08.17 - 
Prevx 3.0 2009.08.18 - 
Rising 21.43.12.00 2009.08.18 - 
Sophos 4.44.0 2009.08.18 - 
Sunbelt 3.2.1858.2 2009.08.18 - 
Symantec 1.4.4.12 2009.08.18 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.18 - 
VBA32 3.12.10.9 2009.08.18 - 
ViRobot 2009.8.18.1889 2009.08.18 - 
VirusBuster 4.6.5.0 2009.08.17 - 
Information additionnelle 
File size: 574464 bytes 
MD5   : 19a811ef5f1ed5c926a028ce107ff1af 
SHA1  : d1efc83a3cb762bc596c1866c163ddae8382a1d5 
SHA256: 97606850041de4e568188fb28aa3d5b10a4e96db9551a77bc3a17ed67d5d4474 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x85184
timedatestamp.....: 0x45CC56A7 (Fri Feb 9 12:10:31 2007)
machinetype.......: 0x14C (Intel I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x17635 0x17680 6.58 17a318eda47d20720342996bcd8cb340
.rdata 0x17980 0x7070 0x7080 6.30 217641f37cbe8ac68ee1aaa6558c9aa5
.data 0x1EA00 0x1B10 0x1B80 0.74 73bf9a9213033aef653058df69fd6fec
PAGE 0x20580 0x64B15 0x64B80 6.52 cbdc150640d5a616f86840d6d94a4a7f
INIT 0x85100 0x36FE 0x3700 6.07 32777522efdf3419a72a859d7c320968
.rsrc 0x88800 0x3F0 0x400 3.38 be6a6a7430b132a2114dfdd2e0783da5
.reloc 0x88C00 0x37B0 0x3800 6.72 2c0acd8938103cc9588a50524fd32634

( 0 imports )


( 0 exports )
 
TrID  : File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
ssdeep: 12288:suclpxNB9qnuw9TZ4v05owQmybWIyeomyzlKD:evB9+uwDw05VQTICslKD 
PEiD  : - 
RDS   : NSRL Reference Data Set
-

feshme · Answer

Parfait pour kaspersky, il est lancé pour le moment la base de données se mets à jour. 
Pour les fichiers analysé par virustotal, je réanalyse les fichier du message n°  19

plopus · Answer

non a voir ce que nous dit kaspsersky et après on feras un script de suppression et on essayera de redemarré le PC voir si tout revient ou pas...

feshme · Answer

Analyse FICHIER : c:\windows\Sof­twareDistribution\Download\44b6174a4a693136d0­2d4a7ecd7cbd54\­ntfs.sys 

Fichier ntfs.sys reçu le 2009.08.18 15:14:18 (UTC)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE 


Résultat: 0/41 (0%)
en train de charger les informations du serveur... 
Votre fichier est dans la file d'attente, en position: 2.
L'heure estimée de démarrage est entre 50 et 71 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse. 
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier. 
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération. 
 Formaté Impression des résultats  
Votre fichier a expiré ou n'existe pas. 
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée. 
 Email:  
  

Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.18 - 
AhnLab-V3 5.0.0.2 2009.08.18 - 
AntiVir 7.9.1.1 2009.08.18 - 
Antiy-AVL 2.0.3.7 2009.08.18 - 
Authentium 5.1.2.4 2009.08.18 - 
Avast 4.8.1335.0 2009.08.17 - 
AVG 8.5.0.406 2009.08.18 - 
BitDefender 7.2 2009.08.18 - 
CAT-QuickHeal 10.00 2009.08.18 - 
ClamAV 0.94.1 2009.08.18 - 
Comodo 2012 2009.08.18 - 
DrWeb 5.0.0.12182 2009.08.18 - 
eSafe 7.0.17.0 2009.08.18 - 
eTrust-Vet 31.6.6685 2009.08.18 - 
F-Prot 4.4.4.56 2009.08.18 - 
F-Secure 8.0.14470.0 2009.08.18 - 
Fortinet 3.120.0.0 2009.08.18 - 
GData 19 2009.08.18 - 
Ikarus T3.1.1.68.0 2009.08.18 - 
Jiangmin 11.0.800 2009.08.18 - 
K7AntiVirus 7.10.821 2009.08.18 - 
Kaspersky 7.0.0.125 2009.08.18 - 
McAfee 5712 2009.08.17 - 
McAfee+Artemis 5712 2009.08.17 - 
McAfee-GW-Edition 6.8.5 2009.08.18 - 
Microsoft 1.4903 2009.08.18 - 
NOD32 4345 2009.08.18 - 
Norman 6.01.09 2009.08.18 - 
nProtect 2009.1.8.0 2009.08.18 - 
Panda 10.0.0.14 2009.08.17 - 
PCTools 4.4.2.0 2009.08.18 - 
Prevx 3.0 2009.08.18 - 
Rising 21.43.14.00 2009.08.18 - 
Sophos 4.44.0 2009.08.18 - 
Sunbelt 3.2.1858.2 2009.08.18 - 
Symantec 1.4.4.12 2009.08.18 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.18 - 
VBA32 3.12.10.9 2009.08.18 - 
ViRobot 2009.8.18.1889 2009.08.18 - 
VirusBuster 4.6.5.0 2009.08.18 - 
Information additionnelle 
File size: 574976 bytes 
MD5...: 78a08dd6a8d65e697c18e1db01c5cdca 
SHA1..: c40f3c1fcbd8a61ad5f36e16971feb64407bbc66 
SHA256: e0e6f3ed05068e32f1d5c2d2b38cdef4536b8656db6756c66cf6b40b60c8f3da 
ssdeep: 12288:CosOm5JqnuiIT8j4l7yT68kdUDzAGOjICueFWI0m9:eJ+uiIQ4kTTkdUDE
PflFWI0
 
PEiD..: - 
TrID..: File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x85384
timedatestamp.....: 0x48025be5 (Sun Apr 13 19:15:49 2008)
machinetype.......: 0x14c (I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x17879 0x17880 6.57 7a0cc809877394dcb00f251125cde1d0
.rdata 0x17b80 0x7078 0x7080 6.30 95baacb27e75d4140da94f3e43c659d6
.data 0x1ec00 0x1b10 0x1b80 0.74 9cb37a38036e823a0152bb209239dffd
PAGE 0x20780 0x64b6b 0x64b80 6.51 7de1f4c3a0a474314fe86e158e01cd73
INIT 0x85300 0x36fe 0x3700 6.07 ded61bc7fa643b884fdf69cc4d48c308
.rsrc 0x88a00 0x3e0 0x400 3.34 7153f5b12fab0213e839e612df3320ab
.reloc 0x88e00 0x37a0 0x3800 6.73 5db2361b4571130ef61ec5a1deac3e22

( 3 imports ) 
> HAL.dll: KeAcquireInStackQueuedSpinLock, ExAcquireFastMutex, KeReleaseQueuedSpinLock, KeAcquireQueuedSpinLock, KfReleaseSpinLock, ExTryToAcquireFastMutex, ExReleaseFastMutex, KeReleaseInStackQueuedSpinLock, KfAcquireSpinLock
> ksecdd.sys: GenerateSessionKey, EfsGenerateKey, GenerateDirEfs, InitSecurityInterfaceW, EfsDecryptFek
> ntoskrnl.exe: ExRaiseStatus, FsRtlNormalizeNtstatus, CcFlushCache, ExIsResourceAcquiredExclusiveLite, RtlInitUnicodeString, InterlockedPopEntrySList, InterlockedPushEntrySList, KeQuerySystemTime, RtlCompareMemory, FsRtlAreNamesEqual, FsRtlCheckLockForWriteAccess, FsRtlOplockIsFastIoPossible, FsRtlCheckOplock, CcSetDirtyPinnedData, MmSetAddressRangeModified, MmCanFileBeTruncated, RtlGenerate8dot3Name, RtlUpcaseUnicodeString, CcCopyWrite, CcCanIWrite, CcMdlWriteComplete, MmMapLockedPagesSpecifyCache, CcPrepareMdlWrite, IoGetTopLevelIrp, _aullshr, _allshl, IoGetStackLimits, RtlSetBits, RtlClearBits, FsRtlGetNextLargeMcbEntry, RtlAreBitsSet, RtlFindLastBackwardRunClear, RtlNumberOfClearBits, _allmul, RtlAreBitsClear, RtlFindClearBits, RtlFindClearRuns, FsRtlRemoveLargeMcbEntry, FsRtlLookupLargeMcbEntry, FsRtlAddLargeMcbEntry, KeReleaseMutant, ObfDereferenceObject, CcUninitializeCacheMap, CcSetLogHandleForFile, CcInitializeCacheMap, IoCreateStreamFileObjectLite, KeWaitForSingleObject, CcMapData, CcPinMappedData, CcPinRead, CcPreparePinWrite, CcMdlReadComplete, KeBugCheckEx, CcZeroData, FsRtlIsNtstatusExpected, DbgBreakPoint, DbgPrint, KdDebuggerEnabled, FsRtlNotifyVolumeEvent, RtlDeleteElementGenericTableAvl, IoRemoveShareAccess, FsRtlAddToTunnelCache, FsRtlFastUnlockAll, IoGetRequestorProcess, FsRtlNotifyFilterReportChange, FsRtlDeleteKeyFromTunnelCache, FsRtlNotifyCleanup, FsRtlNotifyFilterChangeDirectory, MmFlushImageSection, KeLeaveCriticalRegion, IoSetTopLevelIrp, KeEnterCriticalRegion, IofCompleteRequest, ExQueueWorkItem, IoGetCurrentProcess, FsRtlIsNameInExpression, FsRtlDoesNameContainWildCards, IoCheckEaBufferValidity, ExIsResourceAcquiredSharedLite, KeSetEvent, IoSetInformation, FsRtlOplockFsctrl, IoUpdateShareAccess, IoSetShareAccess, IoCheckShareAccess, FsRtlCurrentBatchOplock, ObReleaseObjectSecurity, ObGetObjectSecurity, SePrivilegeCheck, CcWaitForCurrentLazyWriterActivity, RtlGetOwnerSecurityDescriptor, FsRtlFindInTunnelCache, SeSinglePrivilegeCheck, KeClearEvent, FsRtlDissectName, _alloca_probe, IoCancelIrp, KeSetKernelStackSwapEnable, KeInitializeEvent, IoIsOperationSynchronous, IofCallDriver, MmUnmapLockedPages, IoBuildPartialMdl, IoFreeMdl, MmProbeAndLockPages, IoAllocateMdl, KeGetCurrentThread, RtlDecompressBuffer, RtlDecompressFragment, RtlGetCompressionWorkSpaceSize, MmBuildMdlForNonPagedPool, IoFreeIrp, ExReleaseResourceForThreadLite, CcUnpinDataForThread, CcSetBcbOwnerPointer, FsRtlIsTotalDeviceFailure, IoMakeAssociatedIrp, ObfReferenceObject, ExGetExclusiveWaiterCount, KeDelayExecutionThread, ObReferenceObjectByHandle, IoFileObjectType, _local_unwind2, RtlCompressBuffer, MmUnlockPages, IoBuildAsynchronousFsdRequest, RtlLookupElementGenericTableAvl, SeCaptureSubjectContext, RtlUpperString, RtlCompareString, RtlInitString, FsRtlLegalAnsiCharacterArray, NlsOemLeadByteInfo, NlsMbOemCodePageTag, SeDeleteObjectAuditAlarm, ObQueryObjectAuditingByHandle, CcPurgeCacheSection, _allrem, SeAuditHardLinkCreation, SeAuditingHardLinkEventsWithContext, IoBuildDeviceIoControlRequest, CcMdlRead, KeNumberProcessors, CcDeferWrite, ZwClose, ZwCreateFile, ProbeForRead, IoBuildSynchronousFsdRequest, IoGetRelatedDeviceObject, MmPrefetchPages, ProbeForWrite, _alldiv, RtlLengthSid, SeReleaseSubjectContext, SeUnlockSubjectContext, SeAccessCheck, SeLockSubjectContext, RtlMapGenericMask, IoGetFileObjectGenericMapping, CcSetAdditionalCacheAttributes, FsRtlBalanceReads, ObQueryNameString, wcslen, IoCreateDevice, FsRtlIncrementCcFastReadResourceMiss, FsRtlIncrementCcFastReadNotPossible, CcFastCopyRead, FsRtlIncrementCcFastReadNoWait, FsRtlIncrementCcFastReadWait, CcFastCopyWrite, CcFastMdlReadWait, FsRtlUninitializeLargeMcb, FsRtlInitializeLargeMcb, FsRtlPrivateLock, FsRtlFastUnlockSingle, FsRtlFastUnlockAllByKey, FsRtlProcessFileLock, ExDeleteResourceLite, ExInitializeResourceLite, KeInitializeSpinLock, FsRtlResetLargeMcb, KeSetTimer, ExAcquireSharedStarveExclusive, CcGetDirtyPages, KeSetPriorityThread, FsRtlLookupLastLargeMcbEntry, FsRtlNumberOfRunsInLargeMcb, FsRtlSplitLargeMcb, FsRtlTruncateLargeMcb, CcRemapBcb, RtlFreeOemString, RtlUnicodeStringToCountedOemString, FsRtlIsFatDbcsLegal, FsRtlFastCheckLockForWrite, FsRtlFastCheckLockForRead, IoRaiseInformationalHardError, RtlAppendUnicodeStringToString, RtlCopyUnicodeString, IoVolumeDeviceToDosName, IoReleaseCancelSpinLock, IoAcquireCancelSpinLock, CcMdlWriteAbort, IoIsSystemThread, RtlLengthSecurityDescriptor, SeAssignSecurity, RtlSetDaclSecurityDescriptor, RtlCreateSecurityDescriptor, RtlAddAccessAllowedAce, RtlCreateAcl, RtlSubAuthoritySid, RtlInitializeSid, RtlLengthRequiredSid, ExInitializePagedLookasideList, ExInitializeNPagedLookasideList, MmIsThisAnNtAsSystem, MmQuerySystemSize, ZwQueryValueKey, ZwOpenKey, RtlVerifyVersionInfo, VerSetConditionMask, IoRegisterDriverReinitialization, KeInitializeDpc, KeInitializeTimer, IoRegisterFileSystem, KeBugCheck, KeInitializeMutant, FsRtlMdlWriteCompleteDev, FsRtlMdlReadCompleteDev, ExUuidCreate, RtlDelete, RtlSplay, RtlValidSid, RtlInsertElementGenericTableFullAvl, RtlLookupElementGenericTableFullAvl, SeQueryInformationToken, RtlEqualSid, SeExports, IoCheckQuotaBufferValidity, RtlInitializeGenericTableAvl, CcSetReadAheadGranularity, FsRtlCheckLockForReadAccess, ExAcquireSharedWaitForExclusive, FsRtlPostStackOverflow, FsRtlPostPagingFileStackOverflow, IoReleaseVpbSpinLock, IoAcquireVpbSpinLock, SeValidSecurityDescriptor, SeFreePrivileges, SeDeassignSecurity, SeSetSecurityDescriptorInfo, SeQuerySecurityDescriptorInfo, SeOpenObjectAuditAlarm, SeOpenObjectForDeleteAuditAlarm, SeAppendPrivileges, SeAuditingFileEventsWithContext, RtlEnumerateGenericTableWithoutSplayingAvl, FsRtlFreeFileLock, FsRtlAllocateFileLock, ExReinitializeResourceLite, FsRtlNotifyInitializeSync, FsRtlInitializeTunnelCache, RtlInsertElementGenericTableAvl, FsRtlUninitializeOplock, FsRtlInitializeOplock, FsRtlTeardownPerStreamContexts, IoDeleteDevice, FsRtlDeleteTunnelCache, FsRtlNotifyUninitializeSync, RtlEnumerateGenericTableAvl, IoWriteErrorLogEntry, IoAllocateErrorLogEntry, IoSetDeviceToVerify, KeTickCount, _abnormal_termination, _except_handler3, RtlFindNextForwardRunClear, ExAcquireFastMutexUnsafe, ExAllocatePoolWithTag, RtlInitializeBitMap, ExFreePoolWithTag, memmove, ExReleaseFastMutexUnsafe, ExReleaseResourceLite, _allshr, ExAcquireResourceSharedLite, ExAcquireResourceExclusiveLite, CcUnpinData, CcCopyRead, CcSetFileSizes, RtlFillMemoryUlong, IoPageRead, IoFreeErrorLogEntry, IoSynchronousPageWrite, ExDeletePagedLookasideList, ExDeleteNPagedLookasideList, IoGetDeviceObjectPointer, KeUnstackDetachProcess, KeStackAttachProcess, PsLookupProcessByProcessId, ZwWaitForSingleObject, PsCreateSystemThread, ZwCreateEvent, PoQueueShutdownWorkItem, ZwFreeVirtualMemory, PsRevertToSelf, PsDereferenceImpersonationToken, PsImpersonateClient, PsReferenceImpersonationToken, ZwAllocateVirtualMemory, ObReferenceObjectByPointer

( 0 exports ) 
 
PDFiD.: - 
RDS...: NSRL Reference Data Set
-

feshme · Answer

Oki pardon je viens de voir le msg donc  j'attend le resultat de kasperski et je le poste

plopus · Answer

il manque c'est 2 la en analyse les + important et clic bien sur réanalyser

c:\windows\sys­tem32\dllcache
tfs.sys
c:\windows\sys­tem32\drivers
tfs.sys 

en attente du rapport kaspsersky

@+

feshme · Answer

les fichiers sont en cours d'analyse, par contre kaspersky est depuis 20 minutes sur l'état Terminé, la base de données est mise à jour à 100%, cependant la case analyser reste grisée et neutralisée. Est ce normal?

feshme · Answer

FICHIER : c:\windows\system32\dllcache tfs.sys Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.18 Riskware.WinNT.Cutwail!IK AhnLab-V3 5.0.0.2 2009.08.18 - AntiVir 7.9.1.3 2009.08.18 - Antiy-AVL 2.0.3.7 2009.08.18 Virus/Win32.Protector.gen Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.17 - AVG 8.5.0.406 2009.08.18 Rootkit-Pakes.M BitDefender 7.2 2009.08.18 Rootkit.Kobcka.Patched.A CAT-QuickHeal 10.00 2009.08.18 W32.Protector.C ClamAV 0.94.1 2009.08.18 - Comodo 2013 2009.08.18 - DrWeb 5.0.0.12182 2009.08.18 BackDoor.Bulknet.404 eSafe 7.0.17.0 2009.08.18 - eTrust-Vet 31.6.6685 2009.08.18 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.18 Virus.Win32.Protector.c Fortinet 3.120.0.0 2009.08.18 - GData 19 2009.08.18 Rootkit.Kobcka.Patched.A Ikarus T3.1.1.68.0 2009.08.18 VirTool.WinNT.Cutwail Jiangmin 11.0.800 2009.08.18 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.18 Virus.Win32.Protector.c McAfee 5712 2009.08.17 - McAfee+Artemis 5713 2009.08.18 Cutwail.gen.e McAfee-GW-Edition 6.8.5 2009.08.18 - Microsoft 1.4903 2009.08.18 VirTool:WinNT/Cutwail.L NOD32 4345 2009.08.18 Win32/Wigon.LX Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.18 - Panda 10.0.0.14 2009.08.18 - PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.18 Medium Risk Malware Rising 21.43.14.00 2009.08.18 - Sophos 4.44.0 2009.08.18 Troj/NTFSKit-B Sunbelt 3.2.1858.2 2009.08.18 - Symantec 1.4.4.12 2009.08.18 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.18 - VBA32 3.12.10.9 2009.08.18 Rootkit.Win32.8141236 ViRobot 2009.8.18.1889 2009.08.18 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 619200 bytes MD5...: 8dfd93810e8fe310f513842d72b410c2 SHA1..: 753ce4957bfeb796d65662f8df3d016f951a89d2 SHA256: 0a78cd7106a833e4547878e0d30c61ffaea222e054259a71d2ff4ce8b06a4e6e ssdeep: 6144:qYvlJCuNJ3Loj+sr/rwFSrS8yXtiwOxHzlxFR0Pd4s3BSCx4PTaQrkvH0jp d7:bJCC+H+SO8gdoEBRSCyba8Pj PEiD..: - TrID..: File type identification Generic Win/DOS Executable (49.9%) DOS Executable Generic (49.8%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0xe1a timedatestamp.....: 0x4a801be2 (Mon Aug 10 13:08:50 2009) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x280 0xc44 0xc60 5.81 7c66eae0aa185a1d1e23190a98f8975f .rdata 0xee0 0x8 0x20 0.40 53bc69c7adc744494f3d55825e7d5c47 .data 0xf00 0x19 0x20 2.17 09023b0586a11b5dd790a88206791533 INIT 0xf20 0x4c 0x60 2.31 5d563cf002ad3c2ac3b51fb9d4bf721c .reloc 0xf80 0x96322 0x96340 6.73 5dcbe4ae0dc06959341f337dab7c4e0b ( 1 imports ) > hal.dll: KeGetCurrentIrql ( 0 exports ) PDFiD.: - RDS...: NSRL Reference Data Set - Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=50DD053EC0F10BCF7260099B6EFE1E0027E2B411

feshme · Answer

FICHIER : c\windows\system32\drivers tfs.sys Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.18 Riskware.WinNT.Cutwail!IK AhnLab-V3 5.0.0.2 2009.08.18 - AntiVir 7.9.1.3 2009.08.18 - Antiy-AVL 2.0.3.7 2009.08.18 Virus/Win32.Protector.gen Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.17 - AVG 8.5.0.406 2009.08.18 Rootkit-Pakes.M BitDefender 7.2 2009.08.18 Rootkit.Kobcka.Patched.A CAT-QuickHeal 10.00 2009.08.18 W32.Protector.C ClamAV 0.94.1 2009.08.18 - Comodo 2013 2009.08.18 - DrWeb 5.0.0.12182 2009.08.18 BackDoor.Bulknet.404 eSafe 7.0.17.0 2009.08.18 - eTrust-Vet 31.6.6685 2009.08.18 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.18 Virus.Win32.Protector.c Fortinet 3.120.0.0 2009.08.18 - GData 19 2009.08.18 Rootkit.Kobcka.Patched.A Ikarus T3.1.1.68.0 2009.08.18 VirTool.WinNT.Cutwail Jiangmin 11.0.800 2009.08.18 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.18 Virus.Win32.Protector.c McAfee 5713 2009.08.18 Cutwail.gen.e McAfee+Artemis 5713 2009.08.18 Cutwail.gen.e McAfee-GW-Edition 6.8.5 2009.08.18 - Microsoft 1.4903 2009.08.18 VirTool:WinNT/Cutwail.L NOD32 4345 2009.08.18 Win32/Wigon.LX Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.18 - Panda 10.0.0.14 2009.08.18 - PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.18 Medium Risk Malware Rising 21.43.14.00 2009.08.18 - Sophos 4.44.0 2009.08.18 Troj/NTFSKit-B Sunbelt 3.2.1858.2 2009.08.18 - Symantec 1.4.4.12 2009.08.18 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.18 - VBA32 3.12.10.9 2009.08.18 Rootkit.Win32.8141236 ViRobot 2009.8.18.1889 2009.08.18 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 619200 bytes MD5...: 8dfd93810e8fe310f513842d72b410c2 SHA1..: 753ce4957bfeb796d65662f8df3d016f951a89d2 SHA256: 0a78cd7106a833e4547878e0d30c61ffaea222e054259a71d2ff4ce8b06a4e6e ssdeep: 6144:qYvlJCuNJ3Loj+sr/rwFSrS8yXtiwOxHzlxFR0Pd4s3BSCx4PTaQrkvH0jp d7:bJCC+H+SO8gdoEBRSCyba8Pj PEiD..: - TrID..: File type identification Generic Win/DOS Executable (49.9%) DOS Executable Generic (49.8%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0xe1a timedatestamp.....: 0x4a801be2 (Mon Aug 10 13:08:50 2009) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x280 0xc44 0xc60 5.81 7c66eae0aa185a1d1e23190a98f8975f .rdata 0xee0 0x8 0x20 0.40 53bc69c7adc744494f3d55825e7d5c47 .data 0xf00 0x19 0x20 2.17 09023b0586a11b5dd790a88206791533 INIT 0xf20 0x4c 0x60 2.31 5d563cf002ad3c2ac3b51fb9d4bf721c .reloc 0xf80 0x96322 0x96340 6.73 5dcbe4ae0dc06959341f337dab7c4e0b ( 1 imports ) > hal.dll: KeGetCurrentIrql ( 0 exports ) PDFiD.: - RDS...: NSRL Reference Data Set - Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=50DD053EC0F10BCF7260099B6EFE1E0027E2B411

feshme · Answer

Après quelques temps d'attente j'ai relancé kaspersky et un message d'erreur apparait : 

"Echec de la mise à jour Impossible de démarrer le programme. Fermer la fenetre de Kaspersky scanner online et redemarrez le programme sur le site de Kaspersky Lab. 

Pour mettre à jour Kaspersky Online 7.0 et analyser votre ordinateur correctement, une connexion internet permanente est necessaire. Vérifier que votre connexion Internet fonctionne. [Error la licence est périmée]


L'antivirus est desactiver et la connection internet est etat connecté 100,0Mbits/s

plopus · Answer

analyse ces fichier en plus stp et poste bien les rapports comme tu le faisais avec les nom des fichiers et fait les réanalyser si il sont deja ete analysé

C:\WINDOWS\system32\qtmlClient.dll     
C:\WINDOWS\system32\CvoAPI.dll     
C:\WINDOWS\Graffiti5.2Pin.ini     
C:\WINDOWS\HFREP.INI     
C:\WINDOWS\WD.INI    
C:\WINDOWS\orun32.ini     


connait tu ce dossier ?   C:\3dsmax9Trial     

apparament ce serait un jeu ?

plopus · Answer

et  il y a aussi ce fichier tiens

c:\program files\HPQ\Default Settings\cpqset.exe????????2?6?8?9??????? ???B???????????????B? ?????? 

tu ne verras surement pas les ?

feshme · Answer

C:\3dsmax9Trial 
Ce dossier est un dossier concernant un logiciel animation 3D

plopus · Answer

vas y fait les analyse  clic sur réanalyse si deja anlysé et ensuite on essayera la desinfection sachant que jvais virer de fichier legitime infecte et qu'il te manque un fichier systeme, une reparation sera obligatoire on verra plusieurs methode après

feshme · Answer

FICHIER : C:\WINDOWS\system32\qtmlClient.dll 

J'ai mis le rapport et cliquez sur ajouter mais il ne s'ajoute pas au forum, aucun éléments rouge n'est apparu

feshme · Answer

FICHIER : C:\WINDOWS\system32\CvoAPI.dll 


Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.18 - 
AhnLab-V3 5.0.0.2 2009.08.18 - 
AntiVir 7.9.1.3 2009.08.18 - 
Antiy-AVL 2.0.3.7 2009.08.18 - 
Authentium 5.1.2.4 2009.08.18 - 
Avast 4.8.1335.0 2009.08.17 - 
AVG 8.5.0.406 2009.08.18 - 
BitDefender 7.2 2009.08.18 - 
CAT-QuickHeal 10.00 2009.08.18 - 
ClamAV 0.94.1 2009.08.18 - 
Comodo 2013 2009.08.18 - 
DrWeb 5.0.0.12182 2009.08.18 - 
eSafe 7.0.17.0 2009.08.18 - 
eTrust-Vet 31.6.6685 2009.08.18 - 
F-Prot 4.4.4.56 2009.08.18 - 
F-Secure 8.0.14470.0 2009.08.18 - 
Fortinet 3.120.0.0 2009.08.18 - 
GData 19 2009.08.18 - 
Ikarus T3.1.1.68.0 2009.08.18 - 
Jiangmin 11.0.800 2009.08.18 - 
K7AntiVirus 7.10.821 2009.08.18 - 
Kaspersky 7.0.0.125 2009.08.18 - 
McAfee 5713 2009.08.18 - 
McAfee+Artemis 5713 2009.08.18 - 
McAfee-GW-Edition 6.8.5 2009.08.18 - 
Microsoft 1.4903 2009.08.18 - 
NOD32 4346 2009.08.18 - 
Norman 6.01.09 2009.08.18 - 
nProtect 2009.1.8.0 2009.08.18 - 
Panda 10.0.0.14 2009.08.18 - 
PCTools 4.4.2.0 2009.08.18 - 
Prevx 3.0 2009.08.18 - 
Rising 21.43.14.00 2009.08.18 - 
Sophos 4.44.0 2009.08.18 - 
Sunbelt 3.2.1858.2 2009.08.18 - 
Symantec 1.4.4.12 2009.08.18 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.18 - 
VBA32 3.12.10.9 2009.08.18 - 
ViRobot 2009.8.18.1889 2009.08.18 - 
VirusBuster 4.6.5.0 2009.08.18 - 
Information additionnelle 
File size: 49152 bytes 
MD5...: 25b53016fe91de974db5adfd69635c61 
SHA1..: f9d244650d369e6e8b12c8bf36389b704c0b4819 
SHA256: d021830c32896456a683c0fb07b065765074c5c59d8932a5edbe926d1834ed86 
ssdeep: 768:pwcyA6TI/UWRhPM79QCMTvNjWDQ67surlXh:pw1A6TIrnO0LNypvlXh
 
PEiD..: Armadillo v1.xx - v2.xx 
TrID..: File type identification
Win64 Executable Generic (59.6%)
Win32 Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)
Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable (1.3%) 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1882
timedatestamp.....: 0x3e2b3e04 (Mon Jan 20 00:08:36 2003)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x46fa 0x5000 6.20 5e2d5b2b24ee7738536ead1e8fd93480
.rdata 0x6000 0xb06 0x1000 4.09 0d7fa3b7812901bcb895402f88452c13
.data 0x7000 0x32a0 0x3000 0.91 f9b520b2c0707795c2a35d86affc573e
.rsrc 0xb000 0x3e8 0x1000 1.02 716aa8ea68aef5feafcc264995cb6aa0
.reloc 0xc000 0xcd4 0x1000 3.29 51f1e4647b85565d961adf1ef1e5c355

( 1 imports ) 
> KERNEL32.dll: WideCharToMultiByte, GetProcAddress, LoadLibraryA, InterlockedIncrement, DeleteCriticalSection, FreeLibrary, InterlockedDecrement, LeaveCriticalSection, Sleep, EnterCriticalSection, GetCommandLineA, GetVersion, HeapAlloc, HeapFree, ExitProcess, TerminateProcess, GetCurrentProcess, GetCurrentThreadId, TlsSetValue, TlsAlloc, TlsFree, SetLastError, TlsGetValue, GetLastError, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleFileNameA, FreeEnvironmentStringsA, FreeEnvironmentStringsW, InitializeCriticalSection, GetEnvironmentStrings, GetEnvironmentStringsW, GetModuleHandleA, GetEnvironmentVariableA, GetVersionExA, HeapDestroy, HeapCreate, VirtualFree, WriteFile, VirtualAlloc, HeapReAlloc, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW

( 1 exports ) 
CvoTable
 
PDFiD.: - 
RDS...: NSRL Reference Data Set
-

plopus · Answer

ok il n'y a pas eu de detection

passe au autre et au pire si sa passe pas sur le forum clic sur mon pseudo et envoie le moi en Message privé mais le mieux c'est ici si sa passe

feshme · Answer

C:\WINDOWS\Graffiti5.2Pin.ini 

Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.18 - 
AhnLab-V3 5.0.0.2 2009.08.18 - 
AntiVir 7.9.1.3 2009.08.18 - 
Antiy-AVL 2.0.3.7 2009.08.18 - 
Authentium 5.1.2.4 2009.08.18 - 
Avast 4.8.1335.0 2009.08.17 - 
AVG 8.5.0.406 2009.08.18 - 
BitDefender 7.2 2009.08.18 - 
CAT-QuickHeal 10.00 2009.08.18 - 
ClamAV 0.94.1 2009.08.18 - 
Comodo 2013 2009.08.18 - 
DrWeb 5.0.0.12182 2009.08.18 - 
eSafe 7.0.17.0 2009.08.18 - 
eTrust-Vet 31.6.6685 2009.08.18 - 
F-Prot 4.4.4.56 2009.08.18 - 
F-Secure 8.0.14470.0 2009.08.18 - 
Fortinet 3.120.0.0 2009.08.18 - 
GData 19 2009.08.18 - 
Ikarus T3.1.1.68.0 2009.08.18 - 
Jiangmin 11.0.800 2009.08.18 - 
K7AntiVirus 7.10.821 2009.08.18 - 
Kaspersky 7.0.0.125 2009.08.18 - 
McAfee 5713 2009.08.18 - 
McAfee+Artemis 5713 2009.08.18 - 
McAfee-GW-Edition 6.8.5 2009.08.18 - 
Microsoft 1.4903 2009.08.18 - 
NOD32 4346 2009.08.18 - 
Norman 6.01.09 2009.08.18 - 
nProtect 2009.1.8.0 2009.08.18 - 
Panda 10.0.0.14 2009.08.18 - 
PCTools 4.4.2.0 2009.08.18 - 
Prevx 3.0 2009.08.18 - 
Rising 21.43.14.00 2009.08.18 - 
Sophos 4.44.0 2009.08.18 - 
Sunbelt 3.2.1858.2 2009.08.18 - 
Symantec 1.4.4.12 2009.08.18 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.18 - 
VBA32 3.12.10.9 2009.08.18 - 
ViRobot 2009.8.18.1889 2009.08.18 - 
VirusBuster 4.6.5.0 2009.08.18 - 
Information additionnelle 
File size: 2327 bytes 
MD5...: c78dce264d998f32ee46fb434b0f9dd4 
SHA1..: 885bd8883fc13a100cf87ce2c8f03c0782bd36a4 
SHA256: bc586f42ec6e1d964581a267a0a7b8a1d82facb65de73a966f039ca98b53cda5 
ssdeep: 24:25sh5tcpI8sCGEs9LiSW6MHd9WYfcS13DWhDA3DTqqqqFSSSSV:yQtWbGH9eS
WTDz1KhDAVSSSSV
 
PEiD..: - 
TrID..: File type identification
Generic INI configuration (100.0%) 
PEInfo: - 
PDFiD.: - 
RDS...: NSRL Reference Data Set
-

feshme · Answer

FICHIER : C:\WINDOWS\HFREP.INI 

Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.18 - 
AhnLab-V3 5.0.0.2 2009.08.18 - 
AntiVir 7.9.1.3 2009.08.18 - 
Antiy-AVL 2.0.3.7 2009.08.18 - 
Authentium 5.1.2.4 2009.08.18 - 
Avast 4.8.1335.0 2009.08.17 - 
AVG 8.5.0.406 2009.08.18 - 
BitDefender 7.2 2009.08.18 - 
CAT-QuickHeal 10.00 2009.08.18 - 
ClamAV 0.94.1 2009.08.18 - 
Comodo 2013 2009.08.18 - 
DrWeb 5.0.0.12182 2009.08.18 - 
eSafe 7.0.17.0 2009.08.18 - 
eTrust-Vet 31.6.6685 2009.08.18 - 
F-Prot 4.4.4.56 2009.08.18 - 
F-Secure 8.0.14470.0 2009.08.18 - 
Fortinet 3.120.0.0 2009.08.18 - 
GData 19 2009.08.18 - 
Ikarus T3.1.1.68.0 2009.08.18 - 
Jiangmin 11.0.800 2009.08.18 - 
K7AntiVirus 7.10.821 2009.08.18 - 
Kaspersky 7.0.0.125 2009.08.18 - 
McAfee 5713 2009.08.18 - 
McAfee+Artemis 5713 2009.08.18 - 
McAfee-GW-Edition 6.8.5 2009.08.18 - 
Microsoft 1.4903 2009.08.18 - 
NOD32 4346 2009.08.18 - 
Norman 6.01.09 2009.08.18 - 
nProtect 2009.1.8.0 2009.08.18 - 
Panda 10.0.0.14 2009.08.18 - 
PCTools 4.4.2.0 2009.08.18 - 
Prevx 3.0 2009.08.18 - 
Rising 21.43.14.00 2009.08.18 - 
Sophos 4.44.0 2009.08.18 - 
Sunbelt 3.2.1858.2 2009.08.18 - 
Symantec 1.4.4.12 2009.08.18 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.18 - 
VBA32 3.12.10.9 2009.08.18 - 
ViRobot 2009.8.18.1889 2009.08.18 - 
VirusBuster 4.6.5.0 2009.08.18 - 
Information additionnelle 
File size: 77 bytes 
MD5...: 4407f70d8ec13f91f94d533e7edca2ff 
SHA1..: d7595108f59fb87b5460878ee455ff29ac2adfe9 
SHA256: 072df46db660ca05bc391db504afbf612de6714af68e6cf19af2fc88b7a6afc6 
ssdeep: 3:xXVSov3g15/j4guEX42dtGRRzAxDgy:H3G+qGRuDgy
 
PEiD..: - 
TrID..: File type identification
Generic INI configuration (100.0%) 
PEInfo: - 
PDFiD.: - 
RDS...: NSRL Reference Data Set
-

feshme · Answer

FICHIER : C:\WINDOWS\WD.INI

Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.18 - 
AhnLab-V3 5.0.0.2 2009.08.18 - 
AntiVir 7.9.1.3 2009.08.18 - 
Antiy-AVL 2.0.3.7 2009.08.18 - 
Authentium 5.1.2.4 2009.08.18 - 
Avast 4.8.1335.0 2009.08.17 - 
AVG 8.5.0.406 2009.08.18 - 
BitDefender 7.2 2009.08.18 - 
CAT-QuickHeal 10.00 2009.08.18 - 
ClamAV 0.94.1 2009.08.18 - 
Comodo 2013 2009.08.18 - 
DrWeb 5.0.0.12182 2009.08.18 - 
eSafe 7.0.17.0 2009.08.18 - 
eTrust-Vet 31.6.6685 2009.08.18 - 
F-Prot 4.4.4.56 2009.08.18 - 
F-Secure 8.0.14470.0 2009.08.18 - 
Fortinet 3.120.0.0 2009.08.18 - 
GData 19 2009.08.18 - 
Ikarus T3.1.1.68.0 2009.08.18 - 
Jiangmin 11.0.800 2009.08.18 - 
K7AntiVirus 7.10.821 2009.08.18 - 
Kaspersky 7.0.0.125 2009.08.18 - 
McAfee 5713 2009.08.18 - 
McAfee+Artemis 5713 2009.08.18 - 
McAfee-GW-Edition 6.8.5 2009.08.18 - 
Microsoft 1.4903 2009.08.18 - 
NOD32 4346 2009.08.18 - 
Norman 6.01.09 2009.08.18 - 
nProtect 2009.1.8.0 2009.08.18 - 
Panda 10.0.0.14 2009.08.18 - 
PCTools 4.4.2.0 2009.08.18 - 
Prevx 3.0 2009.08.18 - 
Rising 21.43.14.00 2009.08.18 - 
Sophos 4.44.0 2009.08.18 - 
Sunbelt 3.2.1858.2 2009.08.18 - 
Symantec 1.4.4.12 2009.08.18 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.18 - 
VBA32 3.12.10.9 2009.08.18 - 
ViRobot 2009.8.18.1889 2009.08.18 - 
VirusBuster 4.6.5.0 2009.08.18 - 
Information additionnelle 
File size: 26 bytes 
MD5...: 29a63aaf2809063cb14efe9d667dd3e6 
SHA1..: 3f5cfa408cc6aeef0cb078ff226043a558c3afcd 
SHA256: 1bde94222c292bb5a810ace28ea68fedd9f465c112cf905ced0eabe2eb69dd92 
ssdeep: 3:NwIgVgKY:5EY
 
PEiD..: - 
TrID..: File type identification
Generic INI configuration (100.0%) 
PEInfo: - 
PDFiD.: - 
RDS...: NSRL Reference Data Set
-

plopus · Answer

il reste ces 2 la

C:\WINDOWS\orun32.ini 
c:\program files\HPQ\Default Settings\cpqset.exe

feshme · Answer

Les deux analyses sont en cours mais super longue (toujours en cours d'analyse)

feshme · Answer

FICHIER : c:\program files\HPQ\Default Settings\cpqset.exe Antivirus Version Dernière mise à jour Résultat AhnLab-V3 5.0.0.2 2009.08.18 - AntiVir 7.9.1.3 2009.08.18 - Antiy-AVL 2.0.3.7 2009.08.18 - Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.17 - AVG 8.5.0.406 2009.08.18 - BitDefender 7.2 2009.08.18 - CAT-QuickHeal 10.00 2009.08.18 - Comodo 2014 2009.08.18 - DrWeb 5.0.0.12182 2009.08.18 - eSafe 7.0.17.0 2009.08.18 - eTrust-Vet 31.6.6685 2009.08.18 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.18 - Fortinet 3.120.0.0 2009.08.18 - GData 19 2009.08.18 - Ikarus T3.1.1.68.0 2009.08.18 - Jiangmin 11.0.800 2009.08.18 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.18 - McAfee 5713 2009.08.18 - McAfee+Artemis 5713 2009.08.18 - McAfee-GW-Edition 6.8.5 2009.08.18 Heuristic.BehavesLike.Win32.Downloader.L Microsoft 1.4903 2009.08.18 - NOD32 4346 2009.08.18 - Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.18 - PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.18 - Rising 21.43.14.00 2009.08.18 - Sophos 4.44.0 2009.08.18 - Sunbelt 3.2.1858.2 2009.08.18 - Symantec 1.4.4.12 2009.08.18 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.18 - VBA32 3.12.10.9 2009.08.18 - ViRobot 2009.8.18.1889 2009.08.18 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 213054 bytes MD5...: abd44cd38087b0fc2c369b80197a4b9a SHA1..: c56e8d8f926d15765364621a93112d5b6210e188 SHA256: f53c6880c4d5eeea51ea20a4196fda6570886fbb070aab46eef60d76b4f874f3 ssdeep: 1536:TP6oydMdKJwH+74sP5rcT/y/TyMsoy+ySP+k0JfQmo9YFKUpfTIv7kF/lJS gCne:lydFJVssPB4y/WM7ySPS/lJSgCe PEiD..: InstallShield 2000 TrID..: File type identification Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0xe010 timedatestamp.....: 0x413e27f9 (Tue Sep 07 21:28:25 2004) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x2ab20 0x2b000 4.03 0227221b41e4cc32a726cb1d797e4aef .rdata 0x2c000 0x1d51 0x2000 4.55 55f2f4eaab860fc9b15e615124b7c412 .data 0x2e000 0x3218 0x2000 0.73 85fae6c51ef635810df0b024527a082c .idata 0x32000 0xc6e 0x1000 3.68 e0eda5028b879c0a202eb75232784bc1 .reloc 0x33000 0x2dd7 0x3000 6.27 b2bfd323b8b377e8ad849ace5e924fcb ( 4 imports ) > KERNEL32.dll: GlobalFree, GlobalAlloc, DeleteFileA, GetStringTypeW, GetStringTypeA, LCMapStringW, CreateFileA, lstrlenA, WriteFile, CloseHandle, CreateProcessA, SetThreadPriority, GetCurrentThread, GetCurrentProcess, SetPriorityClass, ResumeThread, LoadLibraryA, GetProcAddress, GetLastError, FreeLibrary, GetEnvironmentVariableA, GetVersionExA, Sleep, RemoveDirectoryA, FlushFileBuffers, LCMapStringA, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, GetVersion, ExitProcess, DebugBreak, GetStdHandle, InterlockedDecrement, OutputDebugStringA, InterlockedIncrement, GetModuleFileNameA, TerminateProcess, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetFileType, HeapDestroy, HeapCreate, HeapFree, VirtualFree, RtlUnwind, SetFilePointer, SetConsoleCtrlHandler, IsBadWritePtr, IsBadReadPtr, HeapValidate, GetCPInfo, GetACP, GetOEMCP, HeapAlloc, VirtualAlloc, HeapReAlloc, SetStdHandle, MultiByteToWideChar > USER32.dll: wsprintfA, MessageBoxA > ADVAPI32.dll: GetTokenInformation, AllocateAndInitializeSid, EqualSid, FreeSid, RegCreateKeyExA, RegEnumKeyExA, RegSetValueExA, ControlService, DeleteService, CreateServiceA, OpenServiceA, StartServiceA, OpenSCManagerA, CloseServiceHandle, RegOpenKeyExA, RegQueryValueExA, RegCloseKey, OpenProcessToken > SHELL32.dll: ShellExecuteA ( 0 exports ) PDFiD.: - RDS...: NSRL Reference Data Set - ThreatExpert info: https://www.symantec.com?md5=abd44cd38087b0fc2c369b80197a4b9a

plopus · Answer

C:\WINDOWS\orun32.ini 

toujours en analyse celui ci

feshme · Answer

FICHIER : C:\WINDOWS\system32\qtmlClient.dll 


Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 5.0.0.2 2009.08.18 - 
AntiVir 7.9.1.3 2009.08.18 - 
Authentium 5.1.2.4 2009.08.18 - 
Avast 4.8.1335.0 2009.08.17 - 
AVG 8.5.0.406 2009.08.18 - 
BitDefender 7.2 2009.08.18 - 
ClamAV 0.94.1 2009.08.18 - 
DrWeb 5.0.0.12182 2009.08.18 - 
eSafe 7.0.17.0 2009.08.18 - 
F-Prot 4.4.4.56 2009.08.18 - 
GData 19 2009.08.18 - 
Ikarus T3.1.1.68.0 2009.08.18 - 
K7AntiVirus 7.10.821 2009.08.18 - 
Kaspersky 7.0.0.125 2009.08.18 - 
McAfee 5713 2009.08.18 - 
McAfee+Artemis 5713 2009.08.18 - 
McAfee-GW-Edition 6.8.5 2009.08.18 - 
Microsoft 1.4903 2009.08.18 - 
NOD32 4346 2009.08.18 - 
Norman 6.01.09 2009.08.18 - 
nProtect 2009.1.8.0 2009.08.18 - 
Panda 10.0.0.14 2009.08.18 - 
PCTools 4.4.2.0 2009.08.18 - 
Rising 21.43.14.00 2009.08.18 - 
Sophos 4.44.0 2009.08.18 - 
Sunbelt 3.2.1858.2 2009.08.18 - 
Symantec 1.4.4.12 2009.08.18 - 
VBA32 3.12.10.9 2009.08.18 - 
ViRobot 2009.8.18.1889 2009.08.18 - 
VirusBuster 4.6.5.0 2009.08.18 -

feshme · Answer

FICHIER : C:\WINDOWS\orun32.ini 

L'analyse ne marche pas toujours rien d'afficher

plopus · Answer

re

laisse tomber le fichier arrete l'analyse


on continue

suis bien les consignes stp si tu as des questions tu demandes avant de te lancer
1/

    * Nous allons installer la Console de Récupération sur ton pc. Cela permettra de réparer ton système au cas où le pc ne redémarrerait plus suite à la désinfection.
    * Lorsque tu as cliqué sur le lien correspondant à la version de ton Windows, tu seras dirigé sur une page: clique sur le bouton Télécharger afin de récupérer le package d'installation et enregistre ce fichier sur le bureau. Ne modifie pas le nom du fichier surtout!

      Windows XP Service Pack 2 (SP2) >
http://www.microsoft.com/downloads/details.aspx?displaylang=fr&FamilyID=535d248d-5e10-49b5-b80c-0a0205368124

# Fait un glisser/déposer de ce fichier sur le fichier ComboFix.exe (tu reste clic dessus et le deplace sur combofix)

    * Suis les indications à l'écran pour lancer ComboFix et lorsqu'on te le demande, accepte le Contrat de Licence d'Utilisateur Final pour installer la Console de Récupération Microsoft.
    * Lorsque ce sera terminé, un message te disant que la Console a bien été installée apparait, puis un rapport nommé CF_RC.txt va s'afficher: poste le contenu de ce rapport.
    * Note > à présent lorsque tu démarreras ton pc, tu auras un choix à faire: soit démarrer Windows normalement, ou utiliser la Console de Récupération.


2/
clic ici  https://forum.malekal.com/viewtopic.php?t=19657&start= et suit la 
et suit la manipulation pour remplacer les fichier patché tu devras donc copier dans le bloc note ceci :

c:\windows\system32\drivers\beep.sys
c:\windows\system32\dllcache\beep.sys
c:\windows\system32\drivers
tfs.sys
c:\windows\system32\dllcache
tfs.sys 

Poste le rapport a  la fin

3/
clic ici  http://www.cijoint.fr/cj200908/cijz8aG9Nc.txt

# Copie le texte dans le lien + haut (CTRL+C).
# Ouvre le bloc-note (programme>Accessoire>bloc-note).
# Colle le texte copié dans ce bloc-note (CTRL+V).
# Sauvegarde ce fichier sous le nom de CFScript.txt
# Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe (comme pour la console)

    * Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
    * Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal!
      Ne touche à rien tant que le scan n'est pas terminé.
    * Une fois le scan achevé, un rapport va s'afficher: Poste son contenu.
    * Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

edit : SI combofix te demande de redemarré fait le

Bonne chance

feshme · Answer

FICHIER : C:\WINDOWS\orun32.ini 


Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.18 - 
AhnLab-V3 5.0.0.2 2009.08.18 - 
AntiVir 7.9.1.3 2009.08.18 - 
Antiy-AVL 2.0.3.7 2009.08.18 - 
Authentium 5.1.2.4 2009.08.18 - 
Avast 4.8.1335.0 2009.08.17 - 
AVG 8.5.0.406 2009.08.18 - 
BitDefender 7.2 2009.08.18 - 
CAT-QuickHeal 10.00 2009.08.18 - 
ClamAV 0.94.1 2009.08.18 - 
Comodo 2014 2009.08.18 - 
DrWeb 5.0.0.12182 2009.08.18 - 
eSafe 7.0.17.0 2009.08.18 - 
eTrust-Vet 31.6.6685 2009.08.18 - 
F-Prot 4.4.4.56 2009.08.18 - 
F-Secure 8.0.14470.0 2009.08.18 - 
Fortinet 3.120.0.0 2009.08.18 - 
GData 19 2009.08.18 - 
Ikarus T3.1.1.68.0 2009.08.18 - 
Jiangmin 11.0.800 2009.08.18 - 
K7AntiVirus 7.10.821 2009.08.18 - 
Kaspersky 7.0.0.125 2009.08.18 - 
McAfee 5713 2009.08.18 - 
McAfee+Artemis 5713 2009.08.18 - 
McAfee-GW-Edition 6.8.5 2009.08.18 - 
Microsoft 1.4903 2009.08.18 - 
NOD32 4346 2009.08.18 - 
Norman 6.01.09 2009.08.18 - 
nProtect 2009.1.8.0 2009.08.18 - 
Panda 10.0.0.14 2009.08.18 - 
PCTools 4.4.2.0 2009.08.18 - 
Prevx 3.0 2009.08.18 - 
Rising 21.43.14.00 2009.08.18 - 
Sophos 4.44.0 2009.08.18 - 
Sunbelt 3.2.1858.2 2009.08.18 - 
Symantec 1.4.4.12 2009.08.18 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.18 - 
VBA32 3.12.10.9 2009.08.18 - 
ViRobot 2009.8.18.1889 2009.08.18 - 
VirusBuster 4.6.5.0 2009.08.18 - 
Information additionnelle 
File size: 829 bytes 
MD5...: c37c34c60ee28049f7237d48cce53a0e 
SHA1..: 63d02fb2f8b27c41c3fb894708e91e9a07a13851 
SHA256: 1d41b6ed9ace2be326ec9fedbad902153ec760963004f3f5ab519c384752d57f 
ssdeep: 24:LSQIn3h8H3h82up3h883h8VcSOxcM7M3KC5Twvh8KHw:uTG4plKc5r7M3RmrQ
 
PEiD..: - 
TrID..: File type identification
Generic INI configuration (100.0%) 
PEInfo: - 
PDFiD.: - 
RDS...: NSRL Reference Data Set
-

plopus · Answer

Fait la procedure

feshme · Answer

J'ai lancé l'etape 1 alors que le restaurateur est desativer est ce grave? puisje continuer

feshme · Answer

Pardon la restauration systeme est desactiver

plopus · Answer

laisse comme sa, si tu as un soucis tu as la console de recuperation suit exactement la procedure et bien dans l'ordre surtout

feshme · Answer

lorsque je fait executer, cmd entrée puis ipconfig : 
Resultat : 

Carte Ethernet Connexion réseau sans fil : 
             Statut du média : déconnecté

Carte Ethernet connexion au réseau local : 
             Suffixe DNS propre à la connexion
             Adresse IP 0.0.0.0
             Masque de sous-réseau: 0.0.0.0
             Passerelle par defaut

feshme · Answer

Connexion internet réparée, comme neuve. Ce matin le pc marche super bien, et terminator à juste trouver deux cookies infectés que j'ai tout de suite supprimé. 

voici le log de l'étape 1, maid epuis j'ai fait pas mal de manipulation. 
ComboFix 09-08-10.06 - Nuno 18/08/2009 21:35.2.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.33.1036.18.758.300 [GMT 2:00]
Running from: c:\documents and settings\Nuno\Bureau\CF.exe
Command switches used :: c:\documents and settings\Nuno\Bureau\WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
AV: Spyware Terminator *On-access scanning enabled* (Updated) {55EE49A8-16BE-4601-BBE6-607B7F7317DE}
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Drivers\lkpc.sys
c:\windows\system32\sfcfiles.dll



.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_inbsiev


(((((((((((((((((((((((((   Files Created from 2009-07-18 to 2009-08-18  )))))))))))))))))))))))))))))))
.

2009-08-18 19:44 . 2004-08-05 13:00	1548288	----a-w-	c:\windows\system32\sfcfiles.dll
2009-08-18 19:44 . 2004-08-05 13:00	1548288	----a-w-	c:\windows\system32\dllcache\sfcfiles.dll
2009-08-18 14:53 . 2009-08-18 14:53	152576	----a-w-	c:\documents and settings\Nuno\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-18 11:51 . 2009-08-18 14:54	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-08-18 10:49 . 2009-08-18 10:49	--------	d-----w-	c:\documents and settings\Nuno\Application Data\Malwarebytes
2009-08-18 10:48 . 2009-08-03 11:36	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-18 10:48 . 2009-08-18 10:48	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-18 10:48 . 2009-08-03 11:36	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-08-18 10:48 . 2009-08-18 10:49	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-08-18 06:06 . 2009-08-18 08:27	--------	d-----w-	C:\UsbFix
2009-08-17 19:19 . 2009-08-17 19:20	--------	d-----w-	C:sit
2009-08-17 13:29 . 2009-08-18 11:02	--------	d-----w-	c:\program files\Trend Micro
2009-08-17 11:24 . 2009-08-17 11:36	--------	d-----w-	c:\program files\a-squared Free
2009-08-15 16:22 . 2009-08-15 16:22	--------	d-----w-	c:\program files\The Learning Company
2009-08-15 14:35 . 2009-08-15 14:35	--------	d-----w-	c:\program files\Blender Foundation
2009-08-14 16:34 . 2009-08-14 16:34	--------	d-----w-	C:\Python25
2009-08-13 05:06 . 2009-08-17 08:17	--------	d-----w-	c:\program files\WinClamAVShield
2009-08-13 05:03 . 2009-08-13 05:03	--------	d-----w-	c:\program files\Crawler
2009-08-13 05:03 . 2009-08-13 05:03	6144	----a-w-	c:\documents and settings\All Users\Application Data\Spyware Terminator\sp_rsdel.exe
2009-08-13 05:03 . 2009-08-13 05:03	5632	----a-w-	c:\documents and settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys
2009-08-13 05:03 . 2009-08-13 05:03	142592	------w-	c:\windows\system32\drivers\sp_rsdrv2.sys
2009-08-13 05:03 . 2009-08-18 16:56	--------	d-----w-	c:\documents and settings\Nuno\Application Data\Spyware Terminator
2009-08-13 05:03 . 2009-08-17 13:39	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spyware Terminator
2009-08-13 05:03 . 2009-08-17 12:46	--------	d-----w-	c:\program files\Spyware Terminator
2009-08-12 20:18 . 2009-08-13 04:52	--------	d-----w-	c:\windows\BDOSCAN8
2009-08-12 18:33 . 2003-07-01 14:49	69632	------w-	c:\windows\system32\MtxPreview.dll
2009-08-12 18:33 . 2003-07-01 14:49	49152	------w-	c:\windows\system32\MtxParhBFXPreview.dll
2009-08-12 18:33 . 2003-06-26 08:04	237568	------w-	c:\windows\system32\qtmlClient.dll
2009-08-12 18:33 . 2003-01-20 07:08	49152	------w-	c:\windows\system32\CvoAPI.dll
2009-08-12 18:32 . 2009-08-15 14:34	--------	d-----w-	c:\program files\Boris FX, Inc
2009-08-12 04:56 . 2009-08-15 12:37	--------	d-----w-	c:\program files\Fichiers communs\Reallusion
2009-08-11 19:16 . 2009-08-15 16:02	--------	d-----w-	C:	mp
2009-08-11 18:58 . 2009-08-11 19:11	--------	d-----w-	C:\3dsmax9Trial
2009-08-11 14:31 . 2008-03-30 16:55	1213784	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6\vsapi32.dll
2009-08-11 14:31 . 2006-11-22 15:48	91744	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6\BPMNT.dll
2009-08-11 14:31 . 2007-12-24 15:37	138384	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6	mcomm.sys
2009-08-11 14:31 . 2007-12-24 15:37	138384	------w-	c:\windows\system32\drivers	mcomm.sys
2009-08-11 14:31 . 2006-07-07 14:29	1197584	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6\ssapi32.dll
2009-08-11 14:31 . 2009-03-27 15:38	366344	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6	sc.exe
2009-08-11 14:30 . 2009-08-11 14:34	--------	d-----w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6
2009-08-11 14:30 . 2009-08-11 14:30	--------	d-----w-	c:\windows\system32\HouseCall 6.6
2009-08-09 09:35 . 2009-08-09 09:35	--------	d-----w-	c:\program files\PopCap Games
2009-08-09 09:35 . 2009-08-09 09:36	--------	d-----w-	c:\program files\Zuma Deluxe
2009-08-08 18:42 . 2009-08-18 13:51	10	----a-w-	c:\windows\popcinfo.dat
2009-08-08 17:40 . 2009-08-08 17:40	--------	d-----w-	c:\program files\GameHouse
2009-08-08 17:16 . 2009-08-08 17:16	--------	d-----w-	c:\documents and settings\All Users\Application Data\Zylom
2009-08-08 09:58 . 2009-08-08 09:58	--------	d-----w-	c:\program files\Microsoft Works
2009-08-08 09:58 . 2009-08-08 09:58	--------	d-----w-	c:\program files\MSBuild
2009-08-08 09:55 . 2009-08-08 09:55	--------	d-----w-	c:\program files\Microsoft.NET
2009-08-08 09:48 . 2009-08-08 09:48	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2009-08-08 09:47 . 2009-08-08 09:47	--------	d-----w-	c:\documents and settings\Nuno\Local Settings\Application Data\Microsoft Help
2009-08-08 09:46 . 2009-08-08 10:09	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-08 08:35 . 2009-08-08 08:35	--------	d-----w-	c:\program files\VirtualDJ
2009-08-07 22:47 . 2009-08-07 22:47	--------	d-----w-	c:\documents and settings\Nuno\Application Data\DivX
2009-08-07 22:44 . 2009-08-07 22:44	--------	d-----w-	c:\documents and settings\Nuno\Local Settings\Application Data\Downloaded Installations
2009-08-07 22:44 . 2009-08-07 22:44	--------	d-----w-	c:\documents and settings\All Users\Application Data\Pinnacle Studio Ultimate
2009-08-07 18:10 . 2009-08-07 18:10	--------	d-----w-	c:\program files\Smart Projects
2009-08-07 11:16 . 2009-08-07 11:16	--------	d-----w-	c:\program files\SFR
2009-08-05 20:50 . 2009-08-05 20:50	--------	d-----w-	c:\program files\MSECache

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-18 19:47 . 2008-09-14 12:32	12	----a-w-	c:\windows\bthservsdp.dat
2009-08-18 14:54 . 2005-01-26 21:07	--------	d-----w-	c:\program files\Java
2009-08-17 08:14 . 2005-01-26 21:03	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-08-15 16:55 . 2008-10-20 20:34	--------	d-----w-	c:\documents and settings\Nuno\Application Data\BitTorrent
2009-08-15 14:33 . 2008-01-06 21:57	--------	d-----w-	c:\program files\Pinnacle
2009-08-15 11:42 . 2004-08-17 09:31	76582	------w-	c:\windows\system32\perfc00C.dat
2009-08-15 11:42 . 2004-08-17 09:31	471484	------w-	c:\windows\system32\perfh00C.dat
2009-08-12 18:11 . 2008-05-01 14:17	131744	----a-w-	c:\documents and settings\Nuno\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-12 17:29 . 2004-08-05 08:00	619200	-c----w-	c:\windows\system32\drivers
tfs.sys
2009-08-08 11:17 . 2008-05-17 10:36	--------	d-----w-	c:\documents and settings\Nuno\Application Data\proDAD
2009-08-08 11:12 . 2008-08-31 18:23	--------	d-----w-	c:\program files\palmOne
2009-08-08 11:10 . 2005-07-24 01:07	--------	d-----w-	c:\program files\Fichiers communs\Adobe
2009-08-05 20:39 . 2008-05-01 17:12	--------	d-----w-	c:\documents and settings\Nuno\Application Data\LimeWire
2009-06-01 08:27 . 2009-06-01 08:27	603904	------w-	c:\windows\system32\TUProgSt.exe
2009-06-01 08:27 . 2009-06-01 08:27	362240	------w-	c:\windows\system32\TuneUpDefragService.exe
.

------- Sigcheck -------

[-] 2008-04-14 02:34	14336	E4BDF223CD75478BF44567B4D5C2634D	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\svchost.exe
[-] 2004-08-05 08:00	14336	1BD6C2F707A275CB7C16FD99FE0F31CA	c:\windows\system32\svchost.exe
[-] 2004-08-05 08:00	14336	1BD6C2F707A275CB7C16FD99FE0F31CA	c:\windows\system32\dllcache\cache\svchost.exe

[-] 2008-04-14 02:33	579584	E853F84D3CE2FAA2A802E33CF89AC023	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\user32.dll
[-] 2005-03-02 18:10	578048	0DF75FB73F705B011630159A43D7C354	c:\windows\SoftwareDistribution\Download\46faa4cd5c82200be099d1b1e8a12eed\sp2gdr\user32.dll
[-] 2005-03-02 18:20	578048	C34920EB988CE98910BD6B0417F334EB	c:\windows\SoftwareDistribution\Download\46faa4cd5c82200be099d1b1e8a12eed\sp2qfe\user32.dll
[-] 2004-08-05 08:00	578048	E46FB493E3B33704F0715020CF52106B	c:\windows\system32\user32.dll
[-] 2004-08-05 08:00	578048	E46FB493E3B33704F0715020CF52106B	c:\windows\system32\dllcache\cache\user32.dll

[-] 2008-04-14 02:33	82432	FB836F9E62D82904C983AD21296A5D9C	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\ws2_32.dll
[-] 2004-08-05 08:00	82944	BC41F51A39D3B255805FDB759B7814AE	c:\windows\system32\ws2_32.dll
[-] 2004-08-05 08:00	82944	BC41F51A39D3B255805FDB759B7814AE	c:\windows\system32\dllcache\cache\ws2_32.dll

[-] 2008-06-23 16:15	671232	8CA18FD7CCCABFF7E84702BC1BBF5DCB	c:\windows\$hf_mig$\KB953838\SP2QFE\wininet.dll
[-] 2008-06-23 15:10	670208	D2177655BC338A07B99913F6A4BED52D	c:\windows\$hf_mig$\KB953838\SP3GDR\wininet.dll
[-] 2008-06-23 14:56	670720	4E00327DA458BEFFEA8F4B222F466B20	c:\windows\$hf_mig$\KB953838\SP3QFE\wininet.dll
[-] 2008-08-20 05:33	671744	AEF39AC3BCBAFE971155D0073191B5A6	c:\windows\$hf_mig$\KB956390\SP2QFE\wininet.dll
[-] 2008-08-20 05:10	670208	50D19E569C83A9C1AE7EFAEF6A93BC50	c:\windows\$hf_mig$\KB956390\SP3GDR\wininet.dll
[-] 2008-08-20 05:07	670720	96D50ACA60DA22ADBD253F2825C98D1A	c:\windows\$hf_mig$\KB956390\SP3QFE\wininet.dll
[-] 2004-08-05 08:00	660480	58FE94EF42E074F4CAD8BF02E70E6478	c:\windows\$NtUninstallKB953838$\wininet.dll
[-] 2008-06-23 15:40	663552	95D92788889B847309C63E2EC287D1C0	c:\windows\$NtUninstallKB956390$\wininet.dll
[-] 2008-04-14 02:33	670208	4A6E04EA20F48D750D9BFED8600D516B	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\wininet.dll
[-] 2008-08-20 05:37	663552	ADBB0BDB81EB0013942D907E9418AB8B	c:\windows\system32\wininet.dll
[-] 2008-08-20 05:37	663552	ADBB0BDB81EB0013942D907E9418AB8B	c:\windows\system32\dllcache\wininet.dll
[-] 2008-08-20 05:37	663552	ADBB0BDB81EB0013942D907E9418AB8B	c:\windows\system32\dllcache\cache\wininet.dll

[-] 2008-06-20 10:44	360960	744E57C99232201AE98C49168B918F48	c:\windows\$hf_mig$\KB951748\SP2QFE	cpip.sys
[-] 2008-06-20 11:51	361600	9AEFA14BD6B182D61E3119FA5F436D3D	c:\windows\$hf_mig$\KB951748\SP3GDR	cpip.sys
[-] 2008-06-20 11:59	361600	AD978A1B783B5719720CFF204B666C8E	c:\windows\$hf_mig$\KB951748\SP3QFE	cpip.sys
[-] 2004-08-05 08:00	359040	9F4B36614A0FC234525BA224957DE55C	c:\windows\$NtUninstallKB951748$	cpip.sys
[-] 2008-04-13 19:20	361344	93EA8D04EC73A85DB02EB8805988F733	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54	cpip.sys
[-] 2008-06-20 10:45	360320	2A5554FC5B1E04E131230E3CE035C3F9	c:\windows\system32\dllcache	cpip.sys
[-] 2008-06-20 10:45	360320	2A5554FC5B1E04E131230E3CE035C3F9	c:\windows\system32\dllcache\cache	cpip.sys
[-] 2008-06-20 10:45	360320	2A5554FC5B1E04E131230E3CE035C3F9	c:\windows\system32\drivers	cpip.sys

[-] 2008-04-14 02:34	512000	DD73D6B9F6B4CB630CF35B438B540174	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\winlogon.exe
[-] 2004-08-05 08:00	506368	D2DE785AEAB0BB8CA4C14A8A199DBE4E	c:\windows\system32\winlogon.exe
[-] 2004-08-05 08:00	506368	D2DE785AEAB0BB8CA4C14A8A199DBE4E	c:\windows\system32\dllcache\cache\winlogon.exe

[-] 2008-04-13 19:20	182656	1DF7F42665C94B825322FAE71721130D	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54
dis.sys
[-] 2004-08-05 08:00	182912	558635D3AF1C7546D26067D5D9B6959E	c:\windows\system32\dllcache
dis.sys
[-] 2004-08-05 08:00	182912	558635D3AF1C7546D26067D5D9B6959E	c:\windows\system32\dllcache\cache
dis.sys
[-] 2004-08-05 08:00	182912	558635D3AF1C7546D26067D5D9B6959E	c:\windows\system32\drivers
dis.sys

[-] 2008-04-13 18:53	36608	3BB22519A194418D5FEC05D800A19AD0	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\ip6fw.sys
[-] 2004-08-05 08:00	29056	4448006B6BC60E6C027932CFC38D6855	c:\windows\system32\dllcache\ip6fw.sys
[-] 2004-08-05 08:00	29056	4448006B6BC60E6C027932CFC38D6855	c:\windows\system32\dllcache\cache\ip6fw.sys
[-] 2004-08-05 08:00	29056	4448006B6BC60E6C027932CFC38D6855	c:\windows\system32\drivers\ip6fw.sys

[-] 2008-08-14 13:39	2065024	DCBC1A6D150B5EE1BD6257186157B0F3	c:\windows\$hf_mig$\KB956841\SP2QFE
tkrnlpa.exe
[-] 2008-08-14 13:23	2068096	8DA71F1900721E1E4FCB5B02D55FB771	c:\windows\$hf_mig$\KB956841\SP3GDR
tkrnlpa.exe
[-] 2008-08-14 17:26	2068096	755B50949D0DBC0F0136B0DB58765331	c:\windows\$hf_mig$\KB956841\SP3QFE
tkrnlpa.exe
[-] 2004-08-05 08:00	2058880	F252FAE094C54572ECE38A039F2103C4	c:\windows\$NtUninstallKB956841$
tkrnlpa.exe
[-] 2008-08-14 13:44	2059776	F9720D61DF1E3E47614C4FC891F3FE44	c:\windows\Driver Cache\i386
tkrnlpa.exe
[-] 2008-04-14 02:07	2067968	B71A8F101CEFAF82FC5EC16130A54A3F	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54
tkrnlpa.exe
[-] 2005-03-02 18:13	2059008	5311776074B6C13F983DC75BAEAC9C0C	c:\windows\SoftwareDistribution\Download\46faa4cd5c82200be099d1b1e8a12eed\sp2qfe
tkrnlpa.exe
[-] 2008-08-14 13:44	2059776	F9720D61DF1E3E47614C4FC891F3FE44	c:\windows\system32
tkrnlpa.exe
[-] 2008-08-14 13:44	2059776	F9720D61DF1E3E47614C4FC891F3FE44	c:\windows\system32\dllcache
tkrnlpa.exe
[-] 2008-08-14 13:44	2059776	F9720D61DF1E3E47614C4FC891F3FE44	c:\windows\system32\dllcache\cache
tkrnlpa.exe

[-] 2008-08-14 13:39	2188032	C6649255E51F145B6E15C505AB68E459	c:\windows\$hf_mig$\KB956841\SP2QFE
toskrnl.exe
[-] 2008-08-14 13:23	2191232	C8D4D5974F9671DA0A37175650912960	c:\windows\$hf_mig$\KB956841\SP3GDR
toskrnl.exe
[-] 2008-08-14 17:26	2191232	D79210549BBF09B7638E860440504299	c:\windows\$hf_mig$\KB956841\SP3QFE
toskrnl.exe
[-] 2004-08-05 08:00	2183040	7D38CE4398E6AA6339B4644FEADCC0D8	c:\windows\$NtUninstallKB956841$
toskrnl.exe
[-] 2008-08-14 13:44	2182400	449566D74B5C261A3A54AA216F0C532B	c:\windows\Driver Cache\i386
toskrnl.exe
[-] 2008-04-14 02:08	2191104	099D639DA1EF6968D4E41795BB507E6B	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54
toskrnl.exe
[-] 2005-03-02 18:13	2181632	3E2A0A4A0C0B19FC113618A9562A3B2A	c:\windows\SoftwareDistribution\Download\46faa4cd5c82200be099d1b1e8a12eed\sp2qfe
toskrnl.exe
[-] 2008-08-14 13:44	2182400	449566D74B5C261A3A54AA216F0C532B	c:\windows\system32
toskrnl.exe
[-] 2008-08-14 13:44	2182400	449566D74B5C261A3A54AA216F0C532B	c:\windows\system32\dllcache
toskrnl.exe
[-] 2008-08-14 13:44	2182400	449566D74B5C261A3A54AA216F0C532B	c:\windows\system32\dllcache\cache
toskrnl.exe

[-] 2004-08-05 08:00	1036288	4C33E5B9A6197B6ED215F6CFBA0A2DAA	c:\windows\explorer.exe
[-] 2008-04-14 02:34	1037824	F2317622D29F9FF0F88AEECD5F60F0DD	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\explorer.exe
[-] 2004-08-05 08:00	1036288	4C33E5B9A6197B6ED215F6CFBA0A2DAA	c:\windows\SoftwareDistribution\Download\813a989071c1720c8fca52f421b7b9e5\backup\sp2gdr\explorer.exe
[-] 2004-08-05 08:00	1036288	4C33E5B9A6197B6ED215F6CFBA0A2DAA	c:\windows\system32\dllcache\cache\explorer.exe

[-] 2008-04-14 02:34	109056	54CB50058851D95E56EC70D09F70857F	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\services.exe
[-] 2004-08-05 08:00	108544	732E0B1ABAACE15D80EC19056B0A2AF9	c:\windows\system32\services.exe
[-] 2004-08-05 08:00	108544	732E0B1ABAACE15D80EC19056B0A2AF9	c:\windows\system32\dllcache\cache\services.exe

[-] 2008-04-14 02:34	13312	91E6024D6D4DCDECDB36C43ECF9BBECB	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\lsass.exe
[-] 2004-08-05 08:00	13312	9F3744A5C6F49291A7A685040A013399	c:\windows\system32\lsass.exe
[-] 2004-08-05 08:00	13312	9F3744A5C6F49291A7A685040A013399	c:\windows\system32\dllcache\cache\lsass.exe

[-] 2008-04-14 02:33	15360	59DC5BB82E4C8E0B3EADCFDBC44BA6E4	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\ctfmon.exe
[-] 2004-08-05 08:00	15360	5584247B568C2E53934873F4B655FE6A	c:\windows\system32\ctfmon.exe
[-] 2004-08-05 08:00	15360	5584247B568C2E53934873F4B655FE6A	c:\windows\system32\dllcache\cache\ctfmon.exe

[-] 2005-06-10 23:53	57856	DA81EC57ACD4CDC3D4C51CF3D409AF9F	c:\windows\SoftwareDistribution\Download\4088a68d0a8934555c37417459b6507e\sp2gdr\spoolsv.exe
[-] 2005-06-11 00:17	57856	AD3D9D191AEA7B5445FE1D82FFBB4788	c:\windows\SoftwareDistribution\Download\4088a68d0a8934555c37417459b6507e\sp2qfe\spoolsv.exe
[-] 2008-04-14 02:34	57856	460E4CE148BD07218DA0B6A3D31885A9	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\spoolsv.exe
[-] 2004-08-05 08:00	57856	B4EF928E4FAD79364A80ACBA6D999934	c:\windows\system32\spoolsv.exe
[-] 2004-08-05 08:00	57856	B4EF928E4FAD79364A80ACBA6D999934	c:\windows\system32\dllcache\cache\spoolsv.exe

[-] 2008-04-14 02:34	26624	E74DDB12188C2FF57A78624DBF7332FC	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\userinit.exe
[-] 2004-08-05 08:00	25088	D6D65EA32B190401B57EDB6706F29669	c:\windows\system32\userinit.exe
[-] 2004-08-05 08:00	25088	D6D65EA32B190401B57EDB6706F29669	c:\windows\system32\dllcache\cache\userinit.exe

[-] 2008-04-14 02:33	297984	710BC85A8C22626EE094439E3EA0D38C	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54	ermsrv.dll
[-] 2004-08-05 08:00	297984	7D521B8CF926459E270D18C559323815	c:\windows\system32	ermsrv.dll
[-] 2004-08-05 08:00	297984	7D521B8CF926459E270D18C559323815	c:\windows\system32\dllcache\cache	ermsrv.dll

[-] 2008-04-14 02:33	1054720	3AC8886DFA5AB641417DF4D3B7F5512E	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\kernel32.dll
[-] 2007-04-16 15:53	1049600	6F1FE2AE7B22EB9CED1BFF533C9455EA	c:\windows\SoftwareDistribution\Download\4a30d9e5adbf7a3398756dd0ea6f4e72\sp2gdr\kernel32.dll
[-] 2007-04-16 16:11	1051136	62E3F0E9ABFCBCEE62C51546F622C455	c:\windows\SoftwareDistribution\Download\4a30d9e5adbf7a3398756dd0ea6f4e72\sp2qfe\kernel32.dll
[-] 2004-08-05 08:00	1048576	7830E20C74611281B1BDAE5888CD50F5	c:\windows\system32\kernel32.dll
[-] 2004-08-05 08:00	1048576	7830E20C74611281B1BDAE5888CD50F5	c:\windows\system32\dllcache\cache\kernel32.dll

[-] 2008-04-14 02:33	17408	9F2C862E39BF8E8FC51C3F6A6BCEB415	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\powrprof.dll
[-] 2004-08-05 08:00	17408	B02E4DDBE0E98F42F3B61292DDB3A104	c:\windows\system32\powrprof.dll
[-] 2004-08-05 08:00	17408	B02E4DDBE0E98F42F3B61292DDB3A104	c:\windows\system32\dllcache\cache\powrprof.dll

[-] 2008-04-14 02:33	110080	0469B73DB32E5520F342C5E163AA3CCA	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\imm32.dll
[-] 2004-08-05 08:00	110080	39EE5FAF56260EBB8D77A08F525EBBB4	c:\windows\system32\imm32.dll
[-] 2004-08-05 08:00	110080	39EE5FAF56260EBB8D77A08F525EBBB4	c:\windows\system32\dllcache\cache\imm32.dll


[-] 2008-06-23 16:15	3088384	A9D7198AAAC327D413D7941B2C0046A4	c:\windows\$hf_mig$\KB953838\SP2QFE\mshtml.dll
[-] 2008-06-23 15:10	3088384	DB0D7FB7B08ED1A861ACDD3A684049DD	c:\windows\$hf_mig$\KB953838\SP3GDR\mshtml.dll
[-] 2008-06-25 07:56	3088896	8758CE41A129C23B1A1BD7C9FEE2CCCB	c:\windows\$hf_mig$\KB953838\SP3QFE\mshtml.dll
[-] 2008-08-20 05:33	3088384	EB2B003122AA714FE93979CFA4EEAA55	c:\windows\$hf_mig$\KB956390\SP2QFE\mshtml.dll
[-] 2008-08-20 05:10	3088896	E1772442035064C97BA6B4D60BDA1BB9	c:\windows\$hf_mig$\KB956390\SP3GDR\mshtml.dll
[-] 2008-08-20 05:07	3088896	4229C8960DE4DC5B6C326E2B65175E9F	c:\windows\$hf_mig$\KB956390\SP3QFE\mshtml.dll
[-] 2004-08-05 08:00	3003392	3FE8D0C4C2F3B928192BD06DCEE34B32	c:\windows\$NtUninstallKB953838$\mshtml.dll
[-] 2008-06-23 15:40	3080704	FAA707F1143B2CB58ED7BD4F0758BADE	c:\windows\$NtUninstallKB956390$\mshtml.dll
[-] 2008-04-14 02:33	3066880	C4153F037157C7BE7C54FD88887F027D	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\mshtml.dll
[-] 2008-08-20 05:37	3081216	7CCBC169EFCB0284781139ADB7E26F51	c:\windows\system32\mshtml.dll
[-] 2008-08-20 05:37	3081216	7CCBC169EFCB0284781139ADB7E26F51	c:\windows\system32\dllcache\mshtml.dll
[-] 2008-08-20 05:37	3081216	7CCBC169EFCB0284781139ADB7E26F51	c:\windows\system32\dllcache\cache\mshtml.dll

[-] 2008-04-14 02:05	25216	16813155807C6881F4BFBF6657424659	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\kbdclass.sys
[-] 2004-08-03 23:45	25216	E798705E8DC7FAB596EF6BFDF167E007	c:\windows\system32\dllcache\kbdclass.sys
[-] 2004-08-03 23:45	25216	E798705E8DC7FAB596EF6BFDF167E007	c:\windows\system32\dllcache\cache\kbdclass.sys
[-] 2004-08-03 23:45	25216	E798705E8DC7FAB596EF6BFDF167E007	c:\windows\system32\drivers\kbdclass.sys
[-] 2004-08-05 08:00	25216	E798705E8DC7FAB596EF6BFDF167E007	c:\windows\system32\ReinstallBackups\0011\DriverFiles\i386\kbdclass.sys

[-] 2008-04-14 02:33	851968	F4B7146C7EED6C4E158DCD9B5266C25A	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\comres.dll
[-] 2004-08-05 08:00	851968	19428638D8F4440F67519BD03A623BBB	c:\windows\system32\comres.dll
[-] 2004-08-05 08:00	851968	19428638D8F4440F67519BD03A623BBB	c:\windows\system32\dllcache\cache\comres.dll

[-] 2008-04-14 02:33	22016	982B2C204337C3B12211E1E1D9BA8C9C	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\lpk.dll
[-] 2004-08-05 08:00	22016	8C97E0E3DAA99659D4F4B44CC1F282A6	c:\windows\system32\lpk.dll
[-] 2004-08-05 08:00	22016	8C97E0E3DAA99659D4F4B44CC1F282A6	c:\windows\system32\dllcache\cache\lpk.dll

[-] 2004-08-05 13:00	4224	DA1F27D85E0D1525F6621372E7B685E9	c:\windows\system32\dllcache\beep.sys
[-] 2004-08-05 13:00	4224	DA1F27D85E0D1525F6621372E7B685E9	c:\windows\system32\dllcache\cache\beep.sys
[-] 2004-08-05 13:00	4224	DA1F27D85E0D1525F6621372E7B685E9	c:\windows\system32\drivers\beep.sys

[-] 2004-08-05 08:00	2944	73C1E1F395918BC2C6DD67AF7591A3AD	c:\windows\system32\dllcache\cache
ull.sys
[-] 2004-08-05 08:00	2944	73C1E1F395918BC2C6DD67AF7591A3AD	c:\windows\system32\drivers
ull.sys

[-] 2008-04-13 16:39	142592	8BED39E3C35D6A489438B8141717A557	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\aec.sys
[-] 2004-08-03 21:39	142464	841F385C6CFAF66B58FBD898722BB4F0	c:\windows\SoftwareDistribution\Download\ef76b58e91ae8084bf0833c90d4b9382\backup\sp2gdr\aec.sys
[-] 2004-08-03 20:39	142464	841F385C6CFAF66B58FBD898722BB4F0	c:\windows\SoftwareDistribution\Download\ef76b58e91ae8084bf0833c90d4b9382\backup\sp2qfe\aec.sys
[-] 2004-08-03 21:39	142464	841F385C6CFAF66B58FBD898722BB4F0	c:\windows\system32\dllcache\cache\aec.sys
[-] 2004-08-03 21:39	142464	841F385C6CFAF66B58FBD898722BB4F0	c:\windows\system32\drivers\aec.sys

[-] 2008-04-14 02:33	927504	CE21FE79AD3B913A79E0C742BED6BF85	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\mfc40u.dll
[-] 2006-11-01 19:18	927504	FCD58951B3B2392007E0EE34D2CF944F	c:\windows\SoftwareDistribution\Download\514c80746ae952e9ebadfb936253a166\sp2qfe\mfc40u.dll
[-] 2004-08-05 08:00	924432	E1A34560BF6CE7C703BB67EC4FA70F43	c:\windows\system32\mfc40u.dll
[-] 2004-08-05 08:00	924432	E1A34560BF6CE7C703BB67EC4FA70F43	c:\windows\system32\dllcache\cache\mfc40u.dll

[-] 2008-04-14 02:33	399360	3D65EB82E1FA6DB15A33E024C9E03CAB	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54pcss.dll
[-] 2005-07-26 04:40	397824	CB7D37602638369A516757E994CBB31D	c:\windows\SoftwareDistribution\Download\520cbe0ea5d1df1dc8d5c0c4548a90f7\sp2gdrpcss.dll
[-] 2005-07-26 04:29	398336	B38D431ACE730452CD1FEE4FB7ECD6E2	c:\windows\SoftwareDistribution\Download\520cbe0ea5d1df1dc8d5c0c4548a90f7\sp2qfepcss.dll
[-] 2005-04-28 19:32	395776	D0F724BDF4A0647F1A52985FD629EFCE	c:\windows\SoftwareDistribution\Download\7c43cf31471ac5c8600409a70e40c22f\sp2gdrpcss.dll
[-] 2005-04-28 19:36	396288	FD292BFE003558F4C39AA3D44F420AC7	c:\windows\SoftwareDistribution\Download\7c43cf31471ac5c8600409a70e40c22f\sp2qfepcss.dll
[-] 2004-08-05 08:00	395776	2477917B158327410E615C582A3A4C0B	c:\windows\system32pcss.dll
[-] 2004-08-05 08:00	395776	2477917B158327410E615C582A3A4C0B	c:\windows\system32\dllcache\cachepcss.dll

[-] 2008-04-14 02:33	33792	E67A66A3781C1A483F0F8992664CBE0D	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\msgsvc.dll
[-] 2004-08-05 08:00	33792	97939358ED4487CBB4A0D743CE958266	c:\windows\system32\msgsvc.dll
[-] 2004-08-05 08:00	33792	97939358ED4487CBB4A0D743CE958266	c:\windows\system32\dllcache\cache\msgsvc.dll

[-] 2006-08-25 15:54	925184	9724ECD4529AF317DD5BD6194EB6428C	c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\sp1qfe\asms\60\msft\windows\common\controls\comctl32.dll
[-] 2006-08-25 15:51	617472	5BBCD65CFD7610F36BCA96B72BBAED4B	c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\sp2qfe\comctl32.dll
[-] 2006-08-25 15:51	1054208	47ABF878B9AEC81B23BA5F89DE597B3A	c:\windows\SoftwareDistribution\Download\3b9bbc7d361970b826a6eb88174757a3\sp2qfe\asms\60\msft\windows\common\controls\comctl32.dll
[-] 2008-04-14 02:33	617472	B4AA331468315B6A174C3F0D5B3BC135	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\comctl32.dll
[-] 2008-04-14 02:30	1054208	F92E6BEA9349D49341383F8403B4DFE5	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\asms\60\msft\windows\common\controls\comctl32.dll
[-] 2006-03-17 05:04	925184	83F339913E0DC8CC16566D48C8310B13	c:\windows\SoftwareDistribution\Download\a124f301bc107cfa919de4d98c0ac25b\sp1qfe\asms\60\msft\windows\common\controls\comctl32.dll
[-] 2005-08-31 16:50	925184	7BCD276EEE605DF05B160DBD265DEB05	c:\windows\SoftwareDistribution\Download\a20dc986c94132560aec16a0ce3c192a\sp1qfe\asms\60\msft\windows\common\controls\comctl32.dll
[-] 2004-08-05 08:00	611328	A53B48B5AB9A5DA76ED247D61B0B0ADD	c:\windows\system32\comctl32.dll
[-] 2004-08-05 08:00	611328	A53B48B5AB9A5DA76ED247D61B0B0ADD	c:\windows\system32\dllcache\cache\comctl32.dll
[-] 2004-08-05 08:00	921088	AEF3D788DBF40C7C4D204EA45EB0C505	c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[-] 2004-08-05 08:00	1050624	97668958194B82F5B88EABC88ACA5AE1	c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

[-] 2004-08-05 08:00	12032	E4ABC1212B70BB03D35E60681C447210	c:\windows\system32\dllcache\acpiec.sys
[-] 2004-08-05 08:00	12032	E4ABC1212B70BB03D35E60681C447210	c:\windows\system32\dllcache\cache\acpiec.sys
[-] 2004-08-05 08:00	12032	E4ABC1212B70BB03D35E60681C447210	c:\windows\system32\drivers\acpiec.sys

[-] 2008-04-14 02:33	5120	9A4E7ECBB5B7FB86F3B926AB039F4FEC	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\sfc.dll
[-] 2004-08-05 08:00	5120	94559DE281DADCB58E6A3919C7EAC0B4	c:\windows\system32\sfc.dll
[-] 2004-08-05 08:00	5120	94559DE281DADCB58E6A3919C7EAC0B4	c:\windows\system32\dllcache\cache\sfc.dll

[-] 2008-04-14 02:33	407040	04821179C3171554C1BD1F9888A113E2	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54
etlogon.dll
[-] 2004-08-05 08:00	407040	FAF07FDCDE76000621A28D19F8E2E8EB	c:\windows\system32
etlogon.dll
[-] 2004-08-05 08:00	407040	FAF07FDCDE76000621A28D19F8E2E8EB	c:\windows\system32\dllcache\cache
etlogon.dll

[-] 2008-04-14 02:33	409088	BAA0B6E647C1AD593E9BAE5CC31BCFFB	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\qmgr.dll
[-] 2004-08-05 08:00	382464	87424817F82CF6A7F55DAC01A20111A3	c:\windows\system32\qmgr.dll
[-] 2004-08-05 08:00	382464	87424817F82CF6A7F55DAC01A20111A3	c:\windows\system32\dllcache\cache\qmgr.dll

[-] 2008-04-14 02:33	187392	973B36634C544948C663E8269AA1B3A3	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\scecli.dll
[-] 2004-08-05 08:00	186368	DEC0397F35D027874804EC72979D03CC	c:\windows\system32\scecli.dll
[-] 2004-08-05 08:00	186368	DEC0397F35D027874804EC72979D03CC	c:\windows\system32\dllcache\cache\scecli.dll

[-] 2008-04-13 18:57	14336	B153AFFAC761E7F5FCFA822B9C4E97BC	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\asyncmac.sys
[-] 2004-08-05 08:00	14336	02000ABF34AF4C218C35D257024807D6	c:\windows\system32\dllcache\asyncmac.sys
[-] 2004-08-05 08:00	14336	02000ABF34AF4C218C35D257024807D6	c:\windows\system32\dllcache\cache\asyncmac.sys
[-] 2004-08-05 08:00	14336	02000ABF34AF4C218C35D257024807D6	c:\windows\system32\drivers\asyncmac.sys

[-] 2008-04-13 19:15	574976	78A08DD6A8D65E697C18E1DB01C5CDCA	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54
tfs.sys
[-] 2007-02-09 11:10	574464	19A811EF5F1ED5C926A028CE107FF1AF	c:\windows\SoftwareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\sp2gdr
tfs.sys
[-] 2007-02-09 11:23	574976	05AB81909514BFD69CBB1F2C147CF6B9	c:\windows\SoftwareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\sp2qfe
tfs.sys
[-] 2009-08-12 17:29	619200	8DFD93810E8FE310F513842D72B410C2	c:\windows\system32\dllcache
tfs.sys
[-] 2009-08-12 17:29	619200	8DFD93810E8FE310F513842D72B410C2	c:\windows\system32\drivers
tfs.sys

[-] 2008-04-14 02:33	171520	6ED29124A1C83BD0CF6B26BD01CA6F6F	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\srsvc.dll
[-] 2004-08-05 08:00	171008	6469C53F4D16FA6055CCA265BC03DB66	c:\windows\system32\srsvc.dll
[-] 2004-08-05 08:00	171008	6469C53F4D16FA6055CCA265BC03DB66	c:\windows\system32\dllcache\cache\srsvc.dll

[-] 2008-04-14 02:34	13824	02DA31AB433A6C1110A736C85701DECA	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\wscntfy.exe
[-] 2004-08-05 08:00	13824	54CDDAD404557ED98433D6ECBFC92691	c:\windows\system32\wscntfy.exe
[-] 2004-08-05 08:00	13824	54CDDAD404557ED98433D6ECBFC92691	c:\windows\system32\dllcache\cache\wscntfy.exe

c:\windows\system32\appmgmts.dll ... is missing !!
.
(((((((((((((((((((((((((((((   SnapShot@2009-08-18_09.22.55   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-18 19:51 . 2009-08-18 19:51	16384              c:\windows	emp\Perflib_Perfdata_15c.dat
+ 2009-08-18 19:46 . 2009-08-18 19:46	8192              c:\windows\ERDNT\subs\Users\00000004\UsrClass.dat
+ 2009-08-18 19:46 . 2009-08-18 19:46	8192              c:\windows\ERDNT\subs\Users\00000002\UsrClass.dat
+ 2009-08-18 14:54 . 2009-08-18 14:54	149280              c:\windows\system32\javaws.exe
+ 2009-08-18 14:54 . 2009-08-18 14:54	145184              c:\windows\system32\javaw.exe
+ 2009-08-18 14:54 . 2009-08-18 14:54	145184              c:\windows\system32\java.exe
+ 2009-08-18 14:54 . 2009-08-18 14:54	537600              c:\windows\Installer\12c5bb6.msi
+ 2009-08-18 19:46 . 2009-08-18 19:46	737280              c:\windows\ERDNT\subs\Users\00000006\UsrClass.dat
+ 2009-08-18 19:46 . 2009-08-18 19:46	233472              c:\windows\ERDNT\subs\Users\00000003\NTUSER.DAT
+ 2009-08-18 19:46 . 2009-08-18 19:46	229376              c:\windows\ERDNT\subs\Users\00000001\NTUSER.DAT
+ 2009-08-18 19:46 . 2009-08-18 19:46	5570560              c:\windows\ERDNT\subs\Users\00000005\NTUSER.DAT
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PMCRemote"="c:\program files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe" [2007-02-12 253000]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"SpywareTerminatorUpdate"="c:\progra~1\SPYWAR~2\SpywareTerminatorUpdate.exe" [2009-08-13 3055616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-11-23 163840]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-01-26 98304]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-11-01 290816]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"hpWirelessAssistant"="c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 790528]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
"ChangeFilterMerit"="c:\program files\NewSoft\Presto! PVR\ChangeFilterMerit.exe" [2007-06-08 51280]
"Presto! PVR Monitor"="c:\program files\NewSoft\Presto! PVR\Monitor.exe" [2007-07-02 149328]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SpywareTerminator"="c:\progra~1\SPYWAR~2\SpywareTerminatorShield.exe" [2009-08-13 2171904]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-18 149280]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-08-24 88363]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-05 110592]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\BitTorrent\bittorrent.exe"=
"c:\WINDOWS\system32\dplaysvr.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"= %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP"= 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP"= 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP"= 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP"= 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"DoNotAllowExceptions"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"= %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
"c:\Program Files\Messenger\msmsgs.exe"= c:\program files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
"c:\Program Files\BitTorrent\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
"c:\WINDOWS\system32\dplaysvr.exe"= c:\windows\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"= c:\program files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP"= 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP"= 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP"= 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP"= 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP"= 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP"= 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"3389:TCP"= 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

R1 FNETDEVI;FNETDEVI;c:\windows\system32\drivers\FNETDEVI.SYS [25/10/2008 14:15 19572]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [13/08/2009 07:03 142592]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [01/06/2009 10:27 603904]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe --> c:\program files\MAGIX\Common\Database\bin\fbserver.exe [?]
S3 MODRC;DiBcom Infrared Receiver;c:\windows\system32\drivers\modrc.sys [06/09/2008 19:58 13056]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalService
Alerter
LmHosts

.
Contents of the 'Scheduled Tasks' folder

2009-08-18 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-20 14:28]

2009-08-07 c:\windows\Tasks\Norton AntiVirus - Analyser mon ordinateur - MANUE.job
- c:\progra~1\NORTON~1\Navw32.exe [2004-08-24 23:13]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q105&bd=pavilion&pf=laptop
IE: Crawler Search - tbr:iemenu
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-18 21:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe??????????,????|?P???? ???B???????????????B? ?????? 

scanning hidden files ...  


**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\WINDOWS\system32\Macromed\Flash\FlashUtil10a.exe,-101"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\WINDOWS\system32\Macromed\Flash\FlashUtil10a.exe"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:2e,e8,e1,00,eb,16,2b,de,22,6a,97,f2,46,
   7c,75,95,c8,28,51,af,b0,29,a3,98,e7,22,de,bc,86,cd,8e,d8,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,1e,22,a1,5b,80,
   eb,a2,de,71,3b,04,66,8b,46,0d,96,28,99,e4,d6,fa,4b,49,6e,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,93,ea,e3,1b,ed,
   f6,49,e9,25,da,ec,7e,55,20,c9,26,e1,bf,0f,a6,c6,cd,09,f6,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,ea,45,38,a8,70,
   5e,13,69,3e,1e,9e,e0,57,5a,93,61,ec,e7,c7,64,44,3c,8b,1e,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,be,6e,c7,8f,1a,
   c4,e8,ea,cd,44,cd,b9,a6,33,6c,cd,dd,6b,d4,fb,df,29,68,e3,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{8D8763AB-E93B-4812-964E-F04E0008FD50}\Version]
@Denied: (A) (Everyone)
"GlobalState"=hex:05,88,a4,a3,4f,8e,77,a8,30,37,90,38,f2,28,e4,d2,62,5b,7d,59

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,bb,55,8a,54,dc,
   b7,64,f5,b0,18,ed,a7,3f,8d,37,a4,12,5e,3d,20,22,04,7a,09,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,51,d9,d1,b3,68,
   0f,28,55,31,77,e1,ba,b1,f8,68,02,3d,ac,52,8f,7c,e1,9e,1c,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx, 1"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx, 1"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,34,8b,93,e6,d4,
   e8,f9,47,83,6c,56,8b,a0,85,96,ab,35,ea,a3,9b,7c,03,03,31,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,a5,77,cc,8b,a4,
   a5,c7,79,51,fa,6e,91,28,9e,14,cc,a0,fc,2b,a7,da,8a,f0,aa,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,d9,63,51,07,22,
   8c,b6,7f,b1,cd,45,5a,a8,c4,f8,b9,63,77,4e,71,4c,e9,6f,3c,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,fd,c5,85,22,6a,
   ef,53,25,e3,0e,66,d5,eb,bc,2f,6b,57,0e,fa,8f,5b,24,44,00,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,22,de,d6,8e,19,
   a3,35,90,fa,ea,66,7f,d4,3b,6b,70,3f,8e,e6,09,c3,c6,a5,9b,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"

[HKEY_LOCAL_MACHINE\softwareSoftware\Microsoft\Windows NT\CurrentVersion\Windows]
@Denied: (Full) (Everyone)
@Denied: (Full) (Everyone)
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32undll32.exe
c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe
c:\program files\Apoint2K\ApntEx.exe
c:\program files\a-squared Free\a2service.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Norton AntiVirus
avapsvc.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\HPQ\Shared\hpqwmi.exe
.
**************************************************************************
.
Completion time: 2009-08-18 21:58 - machine was rebooted
ComboFix-quarantined-files.txt  2009-08-18 19:58
ComboFix2.txt  2009-08-18 09:27

Pre-Run: 19 359 109 120 octets libres
Post-Run: 19 365 269 504 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

562	--- E O F ---	2008-10-23 17:32

plopus · Answer

c'est combofix qui a fait sa, tu doit redemarré ton PC, sa reviendra tout seul (internet)

par contre tu me postera un RSIT AVANT de faire l'etape 3 pour voir si le virus s'est recrée, j'avais pas pensé que combfix t'aurai demandé de redemarré pour la console

plopus · Answer

TU NE DOIT PAS FAIRE DE MANIPULATION A PART CE QUE JE TE DEMANDE STP

attends la suite

plopus · Answer

tu referas la manip des remplacement de fichier avec cette fois ci ceci copier coller dans le blocnote

c:\windows\system32\appmgmts.dll 

ensuite si sa te demande de redemarré ton PC fait le et poste moi un RSIt après


Fait analyser ces fichiers pour voir si ils sont de nouveau infecté:

c:\windows\system32\sfcfiles.dll     
c:\windows\system32\dllcache\sfcfiles­.dll     
c:\windows\sys­tem32\dllcache
tfs.sys     
c:\windows\sys­tem32\drivers
tfs.sys     
c:\windows\sys­tem32\dllcache\beep.sys     
c:\windows\sys­tem32\drivers\beep.sys     

ensuite: 

refait un scan avec malwarebyte et poste le rapport et réessaye un scan en ligne

je suis de retour en milieu d'aprés midi

feshme · Answer

Pour internet, j'ai du réinstaler le protocole. Donc là c'est bon,je lance l'etape 2?

plopus · Answer

tu as fait ou pas le poste 51 avec les 3 etapes ou juste tu as fait juste la premiere ?

feshme · Answer

Pour le 51, j'ai réaliser l'étape une, le pc c éteint automatiquement et a redemarrer, ensuite j'avais le probleme de connection donc hier j'avais redemarrer une deuxieme fois le pc et j'ai laisser tomber, ce matin j'ai allumer le pc et j'ai fait le truc avec le protocole TCP/IP ou un truc comme ca et maintenant c bon, mais hier soir je ne pouvais pas acceder au lien c pour cela que j'ai pas continuer l'etape 2 du posté 51. 

QUe faire : l'étape 2 du posté 51 je pense????A me confirmer

plopus · Answer

ok bien tant mieux alors  :)

ne redemarre pas ton PC de la journée et fait ceci le teps que je rentre :

Fait analyser ces fichiers pour voir si ils sont de nouveau infecté:

c:\windows\system32\sfcfiles.dll
c:\windows\system32\dllcache\sfcfiles­.dll
c:\windows\sys­tem32\dllcache
tfs.sys
c:\windows\sys­tem32\drivers
tfs.sys
c:\windows\sys­tem32\dllcache\beep.sys
c:\windows\sys­tem32\drivers\beep.sys

ensuite:

refait un scan avec malwarebyte et poste le rapport et réessaye un scan en ligne

je suis de retour en milieu d'aprés midi

feshme · Answer

oki ca marche, je fais ca 
a toute a lheure merci beaucoup

feshme · Answer

FICHIER : c:\windows\system32\sfcfiles.dll 


Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.19 - 
AhnLab-V3 5.0.0.2 2009.08.19 - 
AntiVir 7.9.1.3 2009.08.18 - 
Antiy-AVL 2.0.3.7 2009.08.18 - 
Authentium 5.1.2.4 2009.08.18 - 
Avast 4.8.1335.0 2009.08.18 - 
AVG 8.5.0.406 2009.08.18 - 
BitDefender 7.2 2009.08.19 - 
CAT-QuickHeal 10.00 2009.08.18 - 
ClamAV 0.94.1 2009.08.19 - 
Comodo 2019 2009.08.19 - 
DrWeb 5.0.0.12182 2009.08.19 - 
eSafe 7.0.17.0 2009.08.18 - 
eTrust-Vet 31.6.6686 2009.08.19 - 
F-Prot 4.4.4.56 2009.08.18 - 
F-Secure 8.0.14470.0 2009.08.19 - 
Fortinet 3.120.0.0 2009.08.19 - 
GData 19 2009.08.19 - 
Ikarus T3.1.1.68.0 2009.08.19 - 
Jiangmin 11.0.800 2009.08.19 - 
K7AntiVirus 7.10.821 2009.08.18 - 
Kaspersky 7.0.0.125 2009.08.19 - 
McAfee 5713 2009.08.18 - 
McAfee+Artemis 5713 2009.08.18 - 
McAfee-GW-Edition 6.8.5 2009.08.19 - 
Microsoft 1.4903 2009.08.19 - 
NOD32 4346 2009.08.18 - 
Norman 6.01.09 2009.08.18 - 
nProtect 2009.1.8.0 2009.08.18 - 
Panda 10.0.0.14 2009.08.18 - 
PCTools 4.4.2.0 2009.08.18 - 
Prevx 3.0 2009.08.19 - 
Rising 21.43.21.00 2009.08.19 - 
Sophos 4.44.0 2009.08.19 - 
Sunbelt 3.2.1858.2 2009.08.19 - 
Symantec 1.4.4.12 2009.08.19 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.19 - 
VBA32 3.12.10.9 2009.08.19 - 
ViRobot 2009.8.19.1890 2009.08.19 - 
VirusBuster 4.6.5.0 2009.08.18 - 
Information additionnelle 
File size: 1548288 bytes 
MD5...: acf04fb3448d2c2cd3a851c138ec8ab6 
SHA1..: 6ed1cd55f58adbae1acb497fd51119f31bd4c554 
SHA256: cf839371596e69085c61d7470f9662a689472dd3087dda4927c96f22d579c1b5 
ssdeep: 3072:LG98o8gaaP3ZeRduqCC/ziAR8z4yDx8wawRd5X+diU9uXh2vWFDe:LabaE6
Lzi9DxT5yb
 
PEiD..: - 
TrID..: File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x120d
timedatestamp.....: 0x41107c30 (Wed Aug 04 06:03:28 2004)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xcbf 0xe00 5.90 62996122096364362b8bbbbb76ba9d44
.data 0x2000 0x16ebe0 0x16ec00 3.27 1d0ff0ef6df15dad76688431ef90c012
.rsrc 0x171000 0x418 0x600 2.54 c123fdd41b8b0efeb7beb0a0084a77f0
.reloc 0x172000 0x9a6c 0x9c00 5.76 1a3c3f7a1bcfc6f766599709205664f2

( 1 imports ) 
> ntdll.dll: LdrDisableThreadCalloutsForDll, NtClose, NtQueryValueKey, NtOpenKey, RtlInitUnicodeString, RtlGetVersion, NtTerminateProcess, RtlUnhandledExceptionFilter, RtlUnwind, NtQueryVirtualMemory

( 1 exports ) 
SfcGetFiles
 
PDFiD.: - 
RDS...: NSRL Reference Data Set

( Microsoft )

> MSDN Disc 2439.8: sfcfiles.dll
> MSDN Disc 2439.7: sfcfiles.dll
> MSDN Disc 2439.6: sfcfiles.dll

feshme · Answer

c:\windows\system32\dllcache\sfcfiles­.dll 

Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.19 - 
AhnLab-V3 5.0.0.2 2009.08.19 - 
AntiVir 7.9.1.3 2009.08.18 - 
Antiy-AVL 2.0.3.7 2009.08.18 - 
Authentium 5.1.2.4 2009.08.18 - 
Avast 4.8.1335.0 2009.08.18 - 
AVG 8.5.0.406 2009.08.18 - 
BitDefender 7.2 2009.08.19 - 
CAT-QuickHeal 10.00 2009.08.18 - 
ClamAV 0.94.1 2009.08.19 - 
Comodo 2019 2009.08.19 - 
DrWeb 5.0.0.12182 2009.08.19 - 
eSafe 7.0.17.0 2009.08.18 - 
eTrust-Vet 31.6.6686 2009.08.19 - 
F-Prot 4.4.4.56 2009.08.18 - 
F-Secure 8.0.14470.0 2009.08.19 - 
Fortinet 3.120.0.0 2009.08.19 - 
GData 19 2009.08.19 - 
Ikarus T3.1.1.68.0 2009.08.19 - 
Jiangmin 11.0.800 2009.08.19 - 
K7AntiVirus 7.10.821 2009.08.18 - 
Kaspersky 7.0.0.125 2009.08.19 - 
McAfee 5713 2009.08.18 - 
McAfee+Artemis 5713 2009.08.18 - 
McAfee-GW-Edition 6.8.5 2009.08.19 - 
Microsoft 1.4903 2009.08.19 - 
NOD32 4346 2009.08.18 - 
Norman 6.01.09 2009.08.18 - 
nProtect 2009.1.8.0 2009.08.18 - 
Panda 10.0.0.14 2009.08.18 - 
PCTools 4.4.2.0 2009.08.18 - 
Prevx 3.0 2009.08.19 - 
Rising 21.43.21.00 2009.08.19 - 
Sophos 4.44.0 2009.08.19 - 
Sunbelt 3.2.1858.2 2009.08.19 - 
Symantec 1.4.4.12 2009.08.19 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.19 - 
VBA32 3.12.10.9 2009.08.19 - 
ViRobot 2009.8.19.1890 2009.08.19 - 
VirusBuster 4.6.5.0 2009.08.18 - 
Information additionnelle 
File size: 1548288 bytes 
MD5...: acf04fb3448d2c2cd3a851c138ec8ab6 
SHA1..: 6ed1cd55f58adbae1acb497fd51119f31bd4c554 
SHA256: cf839371596e69085c61d7470f9662a689472dd3087dda4927c96f22d579c1b5 
ssdeep: 3072:LG98o8gaaP3ZeRduqCC/ziAR8z4yDx8wawRd5X+diU9uXh2vWFDe:LabaE6
Lzi9DxT5yb
 
PEiD..: - 
TrID..: File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x120d
timedatestamp.....: 0x41107c30 (Wed Aug 04 06:03:28 2004)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xcbf 0xe00 5.90 62996122096364362b8bbbbb76ba9d44
.data 0x2000 0x16ebe0 0x16ec00 3.27 1d0ff0ef6df15dad76688431ef90c012
.rsrc 0x171000 0x418 0x600 2.54 c123fdd41b8b0efeb7beb0a0084a77f0
.reloc 0x172000 0x9a6c 0x9c00 5.76 1a3c3f7a1bcfc6f766599709205664f2

( 1 imports ) 
> ntdll.dll: LdrDisableThreadCalloutsForDll, NtClose, NtQueryValueKey, NtOpenKey, RtlInitUnicodeString, RtlGetVersion, NtTerminateProcess, RtlUnhandledExceptionFilter, RtlUnwind, NtQueryVirtualMemory

( 1 exports ) 
SfcGetFiles
 
PDFiD.: - 
RDS...: NSRL Reference Data Set

( Microsoft )

> MSDN Disc 2439.8: sfcfiles.dll
> MSDN Disc 2439.7: sfcfiles.dll
> MSDN Disc 2439.6: sfcfiles.dll

feshme · Answer

FICHIER : c:\windows\system32\dllcache tfs.sys Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.19 Riskware.WinNT.Cutwail!IK AhnLab-V3 5.0.0.2 2009.08.19 - AntiVir 7.9.1.3 2009.08.18 - Antiy-AVL 2.0.3.7 2009.08.18 Virus/Win32.Protector.gen Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.18 - AVG 8.5.0.406 2009.08.18 Rootkit-Pakes.M BitDefender 7.2 2009.08.19 Rootkit.Kobcka.Patched.Gen CAT-QuickHeal 10.00 2009.08.18 W32.Protector.C ClamAV 0.94.1 2009.08.19 - Comodo 2019 2009.08.19 - DrWeb 5.0.0.12182 2009.08.19 BackDoor.Bulknet.404 eSafe 7.0.17.0 2009.08.18 - eTrust-Vet 31.6.6686 2009.08.19 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.19 Virus.Win32.Protector.c Fortinet 3.120.0.0 2009.08.19 - GData 19 2009.08.19 Rootkit.Kobcka.Patched.Gen Ikarus T3.1.1.68.0 2009.08.19 VirTool.WinNT.Cutwail Jiangmin 11.0.800 2009.08.19 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.19 Virus.Win32.Protector.c McAfee 5713 2009.08.18 Cutwail.gen.e McAfee+Artemis 5713 2009.08.18 Cutwail.gen.e McAfee-GW-Edition 6.8.5 2009.08.19 - Microsoft 1.4903 2009.08.19 VirTool:WinNT/Cutwail.L NOD32 4346 2009.08.18 Win32/Wigon.LX Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.19 - Panda 10.0.0.14 2009.08.18 Suspicious file PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.19 Medium Risk Malware Rising 21.43.21.00 2009.08.19 - Sophos 4.44.0 2009.08.19 Troj/NTFSKit-B Sunbelt 3.2.1858.2 2009.08.19 - Symantec 1.4.4.12 2009.08.19 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.19 - VBA32 3.12.10.9 2009.08.19 Rootkit.Win32.8141236 ViRobot 2009.8.19.1890 2009.08.19 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 619200 bytes MD5...: 8dfd93810e8fe310f513842d72b410c2 SHA1..: 753ce4957bfeb796d65662f8df3d016f951a89d2 SHA256: 0a78cd7106a833e4547878e0d30c61ffaea222e054259a71d2ff4ce8b06a4e6e ssdeep: 6144:qYvlJCuNJ3Loj+sr/rwFSrS8yXtiwOxHzlxFR0Pd4s3BSCx4PTaQrkvH0jp d7:bJCC+H+SO8gdoEBRSCyba8Pj PEiD..: - TrID..: File type identification Generic Win/DOS Executable (49.9%) DOS Executable Generic (49.8%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0xe1a timedatestamp.....: 0x4a801be2 (Mon Aug 10 13:08:50 2009) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x280 0xc44 0xc60 5.81 7c66eae0aa185a1d1e23190a98f8975f .rdata 0xee0 0x8 0x20 0.40 53bc69c7adc744494f3d55825e7d5c47 .data 0xf00 0x19 0x20 2.17 09023b0586a11b5dd790a88206791533 INIT 0xf20 0x4c 0x60 2.31 5d563cf002ad3c2ac3b51fb9d4bf721c .reloc 0xf80 0x96322 0x96340 6.73 5dcbe4ae0dc06959341f337dab7c4e0b ( 1 imports ) > hal.dll: KeGetCurrentIrql ( 0 exports ) PDFiD.: - RDS...: NSRL Reference Data Set - Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=50DD053EC0F10BCF7260099B6EFE1E0027E2B411

feshme · Answer

FICHIER : c:\windows\system32\drivers tfs.sys Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.19 Riskware.WinNT.Cutwail!IK AhnLab-V3 5.0.0.2 2009.08.19 - AntiVir 7.9.1.3 2009.08.18 - Antiy-AVL 2.0.3.7 2009.08.18 Virus/Win32.Protector.gen Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.18 - AVG 8.5.0.406 2009.08.18 Rootkit-Pakes.M BitDefender 7.2 2009.08.19 Rootkit.Kobcka.Patched.Gen CAT-QuickHeal 10.00 2009.08.18 W32.Protector.C ClamAV 0.94.1 2009.08.19 - Comodo 2019 2009.08.19 - DrWeb 5.0.0.12182 2009.08.19 BackDoor.Bulknet.404 eSafe 7.0.17.0 2009.08.18 - eTrust-Vet 31.6.6686 2009.08.19 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.19 Virus.Win32.Protector.c Fortinet 3.120.0.0 2009.08.19 - GData 19 2009.08.19 Rootkit.Kobcka.Patched.Gen Ikarus T3.1.1.68.0 2009.08.19 VirTool.WinNT.Cutwail Jiangmin 11.0.800 2009.08.19 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.19 Virus.Win32.Protector.c McAfee 5713 2009.08.18 Cutwail.gen.e McAfee+Artemis 5713 2009.08.18 Cutwail.gen.e McAfee-GW-Edition 6.8.5 2009.08.19 - Microsoft 1.4903 2009.08.19 VirTool:WinNT/Cutwail.L NOD32 4346 2009.08.18 Win32/Wigon.LX Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.19 - Panda 10.0.0.14 2009.08.18 Suspicious file PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.19 Medium Risk Malware Rising 21.43.21.00 2009.08.19 - Sophos 4.44.0 2009.08.19 Troj/NTFSKit-B Sunbelt 3.2.1858.2 2009.08.19 - Symantec 1.4.4.12 2009.08.19 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.19 - VBA32 3.12.10.9 2009.08.19 Rootkit.Win32.8141236 ViRobot 2009.8.19.1890 2009.08.19 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 619200 bytes MD5...: 8dfd93810e8fe310f513842d72b410c2 SHA1..: 753ce4957bfeb796d65662f8df3d016f951a89d2 SHA256: 0a78cd7106a833e4547878e0d30c61ffaea222e054259a71d2ff4ce8b06a4e6e ssdeep: 6144:qYvlJCuNJ3Loj+sr/rwFSrS8yXtiwOxHzlxFR0Pd4s3BSCx4PTaQrkvH0jp d7:bJCC+H+SO8gdoEBRSCyba8Pj PEiD..: - TrID..: File type identification Generic Win/DOS Executable (49.9%) DOS Executable Generic (49.8%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0xe1a timedatestamp.....: 0x4a801be2 (Mon Aug 10 13:08:50 2009) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x280 0xc44 0xc60 5.81 7c66eae0aa185a1d1e23190a98f8975f .rdata 0xee0 0x8 0x20 0.40 53bc69c7adc744494f3d55825e7d5c47 .data 0xf00 0x19 0x20 2.17 09023b0586a11b5dd790a88206791533 INIT 0xf20 0x4c 0x60 2.31 5d563cf002ad3c2ac3b51fb9d4bf721c .reloc 0xf80 0x96322 0x96340 6.73 5dcbe4ae0dc06959341f337dab7c4e0b ( 1 imports ) > hal.dll: KeGetCurrentIrql ( 0 exports ) PDFiD.: - RDS...: NSRL Reference Data Set - Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=50DD053EC0F10BCF7260099B6EFE1E0027E2B411

feshme · Answer

FICHIER : c:\windows\system32\dllcache\beep.sys Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.19 - AhnLab-V3 5.0.0.2 2009.08.19 - AntiVir 7.9.1.3 2009.08.18 - Antiy-AVL 2.0.3.7 2009.08.18 - Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.18 - AVG 8.5.0.406 2009.08.18 - BitDefender 7.2 2009.08.19 - CAT-QuickHeal 10.00 2009.08.18 - ClamAV 0.94.1 2009.08.19 - Comodo 2019 2009.08.19 - DrWeb 5.0.0.12182 2009.08.19 - eSafe 7.0.17.0 2009.08.18 Win32.Banker eTrust-Vet 31.6.6686 2009.08.19 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.19 - Fortinet 3.120.0.0 2009.08.19 - GData 19 2009.08.19 - Ikarus T3.1.1.68.0 2009.08.19 - Jiangmin 11.0.800 2009.08.19 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.19 - McAfee 5713 2009.08.18 - McAfee+Artemis 5713 2009.08.18 - McAfee-GW-Edition 6.8.5 2009.08.19 - Microsoft 1.4903 2009.08.19 - NOD32 4346 2009.08.18 - Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.19 - Panda 10.0.0.14 2009.08.18 - PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.19 - Rising 21.43.21.00 2009.08.19 - Sophos 4.44.0 2009.08.19 - Sunbelt 3.2.1858.2 2009.08.19 - Symantec 1.4.4.12 2009.08.19 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.19 - VBA32 3.12.10.9 2009.08.19 - ViRobot 2009.8.19.1890 2009.08.19 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 4224 bytes MD5...: da1f27d85e0d1525f6621372e7b685e9 SHA1..: e3d2dc5eb273fa701de8af13b60d6baac7629260 SHA256: 5a81a46a3bdd19dafc6c87d277267a5d44f3a1b5302f2cc1111d84b7bad5610d ssdeep: 48:qvsINlblgYeU/DtYrmVimGxIBqOopSDKGV7Co+sjIZWQ7q2ue5WwGD+:ilbd/ DKrmLGWBqhev7X+MEWKLu+Ww8 PEiD..: - TrID..: File type identification Win64 Executable Generic (95.5%) Generic Win/DOS Executable (2.2%) DOS Executable Generic (2.2%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x66c timedatestamp.....: 0x3b7d82e5 (Fri Aug 17 20:47:33 2001) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x300 0x424 0x480 5.77 64f775a399d212649b5b58a280791c2d .rdata 0x780 0xad 0x100 2.62 0ace5f365131534c66de4137833221ad INIT 0x880 0x284 0x300 4.44 13a9d0bea8490140305ffa9291acfd99 .rsrc 0xb80 0x3c8 0x400 3.22 9b654fc1759147ff04b147754f347be4 .reloc 0xf80 0x9a 0x100 2.80 5c4742feb834ca0995d1e806fe06cc57 ( 2 imports ) > ntoskrnl.exe: MmLockPagableDataSection, KeCancelTimer, MmUnlockPagableImageSection, IoStartNextPacket, KeSetTimer, _allmul, IoStartPacket, KeInitializeEvent, KeInitializeTimer, KeInitializeDpc, IoCreateDevice, RtlInitUnicodeString, IoAcquireCancelSpinLock, KeRemoveDeviceQueue, KeRemoveEntryDeviceQueue, IoReleaseCancelSpinLock, IoDeleteDevice, IofCompleteRequest > HAL.dll: ExReleaseFastMutex, KfRaiseIrql, KfLowerIrql, HalMakeBeep, ExAcquireFastMutex ( 0 exports ) PDFiD.: - RDS...: NSRL Reference Data Set ( Topics Entertainment ) > Instant Home Design: beep.sys ( Symantec ) > Norton SystemWorks 2005: BEEP.SYS ( Compaq ) > Compaq Operating System CD: beep.sys ( NewTech Infosystems Inc. ) > CD-Maker Plus Edition: beep.sys ( The Learning Company Inc. ) > Reader Rabbits Toddler: beep.sys ( Dell ) > Reinstallation CD Microsoft Windows XP Professional: beep.sys ( Microsoft ) > Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: beep.sys > MSDN Disc 2466.2: beep.sys > MSDN Disc 2466.1: beep.sys > MSDN Disc 2466.4: beep.sys > MSDN Disc 2465: beep.sys > MSDN Disc 2464: beep.sys > MSDN Disc 2466: beep.sys > Windows XP: beep.sys > Microsoft TechNet Trial Software 2002 Volume 1: beep.sys > MSDN Disc2389: beep.sys > MSDN disc 2455.2: beep.sys > Windows 98 Versions: beep.sys > MSDN MSIE 6.0, IE 6.0 SP1, Windows 2000 Advanced Server, Windows 2000 Professional, Windows 2000 Server, Windows 98 Second ed., Windows ME, Win XP Pro: beep.sys > MSDN Disc 2438.7: beep.sys > MSDN Disc 2438.2: beep.sys > MSDN Disc 2438.1: beep.sys > MSDN Disc 3264: beep.sys > MSDN Disc 2455: beep.sys > MSDN Disc 2438.8: beep.sys > MSDN Disc 2428.1: beep.sys > MSDN Disc 2428.2: beep.sys > MSDN Disc 2428.5: beep.sys > MSDN Disc 2428.4: beep.sys > MSDN Disc 2428.8: beep.sys > Platforms, SDK/DDK: beep.sys > Internet Explorer Versions: beep.sys > Virtual PC for Mac Windows XP Professional Edition: beep.sys > Platforms: beep.sys > MSDN DISC 2438.3: beep.sys > Platforms SDKs/DDKs: beep.sys > MSDN Disc 2053: beep.sys > MSDN Disc 2444: beep.sys > MSDN Disc 2443: beep.sys > MSDN Disc 2442: beep.sys > MSDN Disc 2441: beep.sys > Internet Explorer: beep.sys > MSDN Disc2428.3: beep.sys > MSDN Disc 1550: beep.sys > MSDN Disc 2455.6: beep.sys > MSDN Disc 2455.1: beep.sys > MSDN Disc 2476.1: beep.sys > MSDN Disc 2476.2: beep.sys > 2262A: Supporting Users Running Applications on a Microsoft Windows XP Operating System: beep.sys > Disc 2438.5: beep.sys > 2261A: Supporting Users Running the Microsoft Windows XP Operating System: beep.sys > MSDN Disc 2041: beep.sys > MSDN Disc 2439.3: beep.sys > MSDN Disc 2439.2: beep.sys > MSDN Disc 2439.1: beep.sys > MSDN Disc 2439.7: beep.sys > MSDN Disc 2439.6: beep.sys > MSDN Disc 2438: beep.sys > MSDN Disc 2439: beep.sys > MSDN Disc 2465.4: beep.sys > MSDN Disc 2465.5: beep.sys > MSDN Disc 2465.2: beep.sys > Windows XP Professional: beep.sys > MSDN Disc 2364: beep.sys > Office XP Professional with FrontPage: beep.sys > Microsoft Windows XP Professional: beep.sys > Windows XP Professional 2002 Service Pack 1: beep.sys > MSDN Disc 2443.1: beep.sys > MSDN Disc 2443.2: beep.sys > MSDN Disc 2443.4: beep.sys > MSDN disc 2465.3: beep.sys > MSDN Disc 2441.1: beep.sys > MSDN Disc 2441.6: beep.sys > MSDN Disc 2441.7: beep.sys > MSDN Disc 2441.5: beep.sys > MSDN Disc 2428: beep.sys > MSDN Disc 2477.2: beep.sys > Windows XP Home Edition: beep.sys > Windows CE .NET Evaluation Software: beep.sys > MSDN Disc 2307: beep.sys > Implementing and Supporting Microsoft Windows XP Professional: beep.sys > MSDN Disc 2464.1: beep.sys > MSDN Disc 2464.5: beep.sys > MSDN Disc 2439.8: beep.sys > MSDN Disc 2440.5: beep.sys > MSDN Disc 2440.4: beep.sys > MSDN Disc 2440.3: beep.sys > MSDN Disc2365: beep.sys > MDSN Disc 2441.2: beep.sys > Platforms, SDK/DDK, Developer Tools: beep.sys > MSDN disc 2390: beep.sys > MSDN Disc 2476.4: beep.sys > Microsoft Security Resource Kit: beep.sys > Windows 2000 Versions: beep.sys > MSDN Disc 2444.3: beep.sys > MSDN Disc 2444.1: beep.sys > MSDN Disc 2444.6: beep.sys > MSDN Disc 2444.4: beep.sys > Virtual PC for Mac Windows XP Home Edition: beep.sys > Windows XP eMbedded Evaluation Software: beep.sys > MSDN Disc 2476: beep.sys > MSDN Disc 2442.4: beep.sys > MSDN Disc 2442.6: beep.sys > MSDN Disc 2442.1: beep.sys > Applications, Platforms, Servers: beep.sys > MSDN Disc 2442.3: beep.sys > MSDN Disc 2442.2: beep.sys > Windows XP Tablet PC Edition: beep.sys > Applications, Platforms: beep.sys ( Sony ) > Sony VAIO Recover CDs: BEEP.SYS ( Gateway ) > Gateway Operating System Windows XP Pro Edition SP2: BEEP.SYS,beep.sys ThreatExpert info: https://www.symantec.com?md5=da1f27d85e0d1525f6621372e7b685e9

feshme · Answer

FICHIER : c:\windows\system32\drivers\beep.sys Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.19 - AhnLab-V3 5.0.0.2 2009.08.19 - AntiVir 7.9.1.3 2009.08.18 - Antiy-AVL 2.0.3.7 2009.08.18 - Authentium 5.1.2.4 2009.08.18 - Avast 4.8.1335.0 2009.08.18 - AVG 8.5.0.406 2009.08.18 - BitDefender 7.2 2009.08.19 - CAT-QuickHeal 10.00 2009.08.18 - ClamAV 0.94.1 2009.08.19 - Comodo 2019 2009.08.19 - DrWeb 5.0.0.12182 2009.08.19 - eSafe 7.0.17.0 2009.08.18 Win32.Banker eTrust-Vet 31.6.6686 2009.08.19 - F-Prot 4.4.4.56 2009.08.18 - F-Secure 8.0.14470.0 2009.08.19 - Fortinet 3.120.0.0 2009.08.19 - GData 19 2009.08.19 - Ikarus T3.1.1.68.0 2009.08.19 - Jiangmin 11.0.800 2009.08.19 - K7AntiVirus 7.10.821 2009.08.18 - Kaspersky 7.0.0.125 2009.08.19 - McAfee 5713 2009.08.18 - McAfee+Artemis 5713 2009.08.18 - McAfee-GW-Edition 6.8.5 2009.08.19 - Microsoft 1.4903 2009.08.19 - NOD32 4346 2009.08.18 - Norman 6.01.09 2009.08.18 - nProtect 2009.1.8.0 2009.08.19 - Panda 10.0.0.14 2009.08.18 - PCTools 4.4.2.0 2009.08.18 - Prevx 3.0 2009.08.19 - Rising 21.43.21.00 2009.08.19 - Sophos 4.44.0 2009.08.19 - Sunbelt 3.2.1858.2 2009.08.19 - Symantec 1.4.4.12 2009.08.19 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.19 - VBA32 3.12.10.9 2009.08.19 - ViRobot 2009.8.19.1890 2009.08.19 - VirusBuster 4.6.5.0 2009.08.18 - Information additionnelle File size: 4224 bytes MD5...: da1f27d85e0d1525f6621372e7b685e9 SHA1..: e3d2dc5eb273fa701de8af13b60d6baac7629260 SHA256: 5a81a46a3bdd19dafc6c87d277267a5d44f3a1b5302f2cc1111d84b7bad5610d ssdeep: 48:qvsINlblgYeU/DtYrmVimGxIBqOopSDKGV7Co+sjIZWQ7q2ue5WwGD+:ilbd/ DKrmLGWBqhev7X+MEWKLu+Ww8 PEiD..: - TrID..: File type identification Win64 Executable Generic (95.5%) Generic Win/DOS Executable (2.2%) DOS Executable Generic (2.2%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x66c timedatestamp.....: 0x3b7d82e5 (Fri Aug 17 20:47:33 2001) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x300 0x424 0x480 5.77 64f775a399d212649b5b58a280791c2d .rdata 0x780 0xad 0x100 2.62 0ace5f365131534c66de4137833221ad INIT 0x880 0x284 0x300 4.44 13a9d0bea8490140305ffa9291acfd99 .rsrc 0xb80 0x3c8 0x400 3.22 9b654fc1759147ff04b147754f347be4 .reloc 0xf80 0x9a 0x100 2.80 5c4742feb834ca0995d1e806fe06cc57 ( 2 imports ) > ntoskrnl.exe: MmLockPagableDataSection, KeCancelTimer, MmUnlockPagableImageSection, IoStartNextPacket, KeSetTimer, _allmul, IoStartPacket, KeInitializeEvent, KeInitializeTimer, KeInitializeDpc, IoCreateDevice, RtlInitUnicodeString, IoAcquireCancelSpinLock, KeRemoveDeviceQueue, KeRemoveEntryDeviceQueue, IoReleaseCancelSpinLock, IoDeleteDevice, IofCompleteRequest > HAL.dll: ExReleaseFastMutex, KfRaiseIrql, KfLowerIrql, HalMakeBeep, ExAcquireFastMutex ( 0 exports ) PDFiD.: - RDS...: NSRL Reference Data Set ( Topics Entertainment ) > Instant Home Design: beep.sys ( Symantec ) > Norton SystemWorks 2005: BEEP.SYS ( Compaq ) > Compaq Operating System CD: beep.sys ( NewTech Infosystems Inc. ) > CD-Maker Plus Edition: beep.sys ( The Learning Company Inc. ) > Reader Rabbits Toddler: beep.sys ( Dell ) > Reinstallation CD Microsoft Windows XP Professional: beep.sys ( Microsoft ) > Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: beep.sys > MSDN Disc 2466.2: beep.sys > MSDN Disc 2466.1: beep.sys > MSDN Disc 2466.4: beep.sys > MSDN Disc 2465: beep.sys > MSDN Disc 2464: beep.sys > MSDN Disc 2466: beep.sys > Windows XP: beep.sys > Microsoft TechNet Trial Software 2002 Volume 1: beep.sys > MSDN Disc2389: beep.sys > MSDN disc 2455.2: beep.sys > Windows 98 Versions: beep.sys > MSDN MSIE 6.0, IE 6.0 SP1, Windows 2000 Advanced Server, Windows 2000 Professional, Windows 2000 Server, Windows 98 Second ed., Windows ME, Win XP Pro: beep.sys > MSDN Disc 2438.7: beep.sys > MSDN Disc 2438.2: beep.sys > MSDN Disc 2438.1: beep.sys > MSDN Disc 3264: beep.sys > MSDN Disc 2455: beep.sys > MSDN Disc 2438.8: beep.sys > MSDN Disc 2428.1: beep.sys > MSDN Disc 2428.2: beep.sys > MSDN Disc 2428.5: beep.sys > MSDN Disc 2428.4: beep.sys > MSDN Disc 2428.8: beep.sys > Platforms, SDK/DDK: beep.sys > Internet Explorer Versions: beep.sys > Virtual PC for Mac Windows XP Professional Edition: beep.sys > Platforms: beep.sys > MSDN DISC 2438.3: beep.sys > Platforms SDKs/DDKs: beep.sys > MSDN Disc 2053: beep.sys > MSDN Disc 2444: beep.sys > MSDN Disc 2443: beep.sys > MSDN Disc 2442: beep.sys > MSDN Disc 2441: beep.sys > Internet Explorer: beep.sys > MSDN Disc2428.3: beep.sys > MSDN Disc 1550: beep.sys > MSDN Disc 2455.6: beep.sys > MSDN Disc 2455.1: beep.sys > MSDN Disc 2476.1: beep.sys > MSDN Disc 2476.2: beep.sys > 2262A: Supporting Users Running Applications on a Microsoft Windows XP Operating System: beep.sys > Disc 2438.5: beep.sys > 2261A: Supporting Users Running the Microsoft Windows XP Operating System: beep.sys > MSDN Disc 2041: beep.sys > MSDN Disc 2439.3: beep.sys > MSDN Disc 2439.2: beep.sys > MSDN Disc 2439.1: beep.sys > MSDN Disc 2439.7: beep.sys > MSDN Disc 2439.6: beep.sys > MSDN Disc 2438: beep.sys > MSDN Disc 2439: beep.sys > MSDN Disc 2465.4: beep.sys > MSDN Disc 2465.5: beep.sys > MSDN Disc 2465.2: beep.sys > Windows XP Professional: beep.sys > MSDN Disc 2364: beep.sys > Office XP Professional with FrontPage: beep.sys > Microsoft Windows XP Professional: beep.sys > Windows XP Professional 2002 Service Pack 1: beep.sys > MSDN Disc 2443.1: beep.sys > MSDN Disc 2443.2: beep.sys > MSDN Disc 2443.4: beep.sys > MSDN disc 2465.3: beep.sys > MSDN Disc 2441.1: beep.sys > MSDN Disc 2441.6: beep.sys > MSDN Disc 2441.7: beep.sys > MSDN Disc 2441.5: beep.sys > MSDN Disc 2428: beep.sys > MSDN Disc 2477.2: beep.sys > Windows XP Home Edition: beep.sys > Windows CE .NET Evaluation Software: beep.sys > MSDN Disc 2307: beep.sys > Implementing and Supporting Microsoft Windows XP Professional: beep.sys > MSDN Disc 2464.1: beep.sys > MSDN Disc 2464.5: beep.sys > MSDN Disc 2439.8: beep.sys > MSDN Disc 2440.5: beep.sys > MSDN Disc 2440.4: beep.sys > MSDN Disc 2440.3: beep.sys > MSDN Disc2365: beep.sys > MDSN Disc 2441.2: beep.sys > Platforms, SDK/DDK, Developer Tools: beep.sys > MSDN disc 2390: beep.sys > MSDN Disc 2476.4: beep.sys > Microsoft Security Resource Kit: beep.sys > Windows 2000 Versions: beep.sys > MSDN Disc 2444.3: beep.sys > MSDN Disc 2444.1: beep.sys > MSDN Disc 2444.6: beep.sys > MSDN Disc 2444.4: beep.sys > Virtual PC for Mac Windows XP Home Edition: beep.sys > Windows XP eMbedded Evaluation Software: beep.sys > MSDN Disc 2476: beep.sys > MSDN Disc 2442.4: beep.sys > MSDN Disc 2442.6: beep.sys > MSDN Disc 2442.1: beep.sys > Applications, Platforms, Servers: beep.sys > MSDN Disc 2442.3: beep.sys > MSDN Disc 2442.2: beep.sys > Windows XP Tablet PC Edition: beep.sys > Applications, Platforms: beep.sys ( Sony ) > Sony VAIO Recover CDs: BEEP.SYS ( Gateway ) > Gateway Operating System Windows XP Pro Edition SP2: BEEP.SYS,beep.sys ThreatExpert info: https://www.symantec.com?md5=da1f27d85e0d1525f6621372e7b685e9

feshme · Answer

Voici le rapport Malwarebytes

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2647
Windows 5.1.2600 Service Pack 2

19/08/2009 09:56:22
mbam-log-2009-08-19 (09-56-21).txt

Type de recherche: Examen rapide
Eléments examinés: 93662
Temps écoulé: 7 minute(s), 15 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

plopus · Answer

ok 

reprend mon poste vaec les 3 procedures et attaque a la procedure 2/ vu que tu as deja fait la 1

mais dans le blocnote tu rajoute cette ligne en + des autres 

c:\windows\system32\appmgmts.dll 

et ensuite suit exactement ce que j'ai mit

feshme · Answer

resalut, ok jme lance

feshme · Answer

Voila etape 2 ok, par contre il a remplacé un seule fichier, les autre non present dans le pack. L'ordi à redemarrer et c ok

WinFileReplace - ver : 1.1.0 - by Loup blanc

---------------------------
 Microsoft Windows XP
 Service Pack 2
 Fran‡ais
---------------------------
Contrôle du fichier téléchargé : 
MD5 recherchée : 	3d69b05e454ff7fce91670d4e3e9f473 
sp2.000 	MD5 : 3d69b05e454ff7fce91670d4e3e9f473 
---------------------------
 
============ Comparaison des fichiers avant remplacement ============
 
---------
Les fichiers 
et 
"C:\FR-files\appmgmts.dll" 	MD5 : 7e9d138dc991bcce6e6026cd74e69cc4 
"C:\FR-files\appmgmts.dll" 	MD5 : 7e9d138dc991bcce6e6026cd74e69cc4 
sont différents... 
-----------


============ Comparaison des fichiers après remplacement ============

-----------
Les fichiers 
et 
"C:\FR-files\appmgmts.dll"    MD5 = 7e9d138dc991bcce6e6026cd74e69cc4 
sont différents... 

Echec du remplacement 
-----------

======= Fin du rapport =======

plopus · Answer

il y a qu'un fichier la

tu as bien copier les autres qui etait present dans le poste en 3etape dans l'etape 2 ?

ne continue pas pour l'instant la derniere procedure

feshme · Answer

pour les autres il ya eut un message impossible de remplacé, non present dans le pack

plopus · Answer

ok

je dit deja merci a ske69 pour ceci une astuce que je lui prends pour t'aider

va ici  c:\windows\ServicePackFiles\i386
tfs.sys 

et copie colle le fichier ntfs.sys

ensuite tu va ici  c:\windows\sys­tem32\drivers
tfs.sys  et tu clic droit dans le dossier et choisit coller sa ve te demander de remplacer le fichier du meme non accepte

et tu fait la meme chose ici   c:\windows\sys­tem32\dllcache
tfs.sys 

et ensuite si tu n'as pas de probleme pour ceci passe a l'etape 3

feshme · Answer

Je suis désolée, mais je ne trouve pas le dossier ServicePackFiles dans windows

c:\windows\ServicePackFiles\i386
tfs.sys ???

plopus · Answer

erff

sa doit etre parce que tu as pas le SP3...

telecharge le fichier ici  http://www.cijoint.fr/cj200908/cijbXpYU1F.zip

et copie colle le au endroit indiqué garde le bien de de coté celui la pour l'instant, remplace les 2 fichier verolé par celui la

et passe a l'etape 3

feshme · Answer

Jai extrait le fichier, maintenant, il faut quoi ? 

Je dois le copier et le coller à la place : - c:\windows\sys­tem32\drivers
tfs.sys  
                                                         - c:\windows\sys­tem32\dllcache
tfs.sys 

C bien ca? j'attend ta validation pour le faire

plopus · Answer

oui c'est sa tu clic droit dessus et choisit "copier"

ensuite tu va dans les 2emplacements que tu as donné et tu clic droit coller, sa va te dire qu'il existe le meme fichier , IL FAUT QUE TU ECRASE L'AUTRE FICHIER que tu le remplacae quoi PAS QUE TU GARDE LES 2

feshme · Answer

c bon c oki remplacé les anciens ont été écraser.

feshme · Answer

Est ce que je peux étreindre mon pc et faire l'étape 3  demain matin ou dois-je la faire ce soir?

plopus · Answer

Franchement fait la ce soir si tu as fait l'etape 2 sa prends 20 min au max

Debranche bien ton cable internet et desactive ton antivirus et toutes tes defence et ton parefeu si autre que windows et tu lance le fichier combofix qui doit etre RENOMME c'est trés important en CF par exemple

enfin jdit sa mais si tu peux pas je comprends

@+

feshme · Answer

Ok je me lance, je suis le posté 51 c bien ca ? Je commence a fatigué lol longue journée

feshme · Answer

apres avoir fait le glisser, un message de combo me dit qu'il y a un nouvelle version, dois je lancer la mise a jour?

plopus · Answer

non a ce moment supprime l'icone de combofix present sur ton bureau et supprime aussi ce dosser :
C:/combofix
et c:/Qobox  un truc copmme sa

supprime ceux que tu trouve

telecharge la nouvelle version en renommant le fichier en clic droit et enregistré la cible du lien sous

renomme le fish par exemple et telecharge le bien sur ton bureau et coupe tout après antivirus , internet etc...

et fait la procedure
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

feshme · Answer

ou trouvé la nouvelle version de ComboFix?

feshme · Answer

ah non pardon c bon, j'ai vu le lien

feshme · Answer

RESULTAT LOG COMBOFIX


ComboFix 09-08-18.04 - Nuno 19/08/2009 22:48.3.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.33.1036.18.758.401 [GMT 2:00]
Running from: c:\documents and settings\Nuno\Bureau\Fish.exe
Command switches used :: c:\documents and settings\Nuno\Bureau\CFScript.txt
 * Created a new restore point

FILE ::
"c:\windows\braviax.exe"
"c:\windows\cru629.dat"
"c:\windows\orun32.ini"
"c:\windows\system32\braviax.exe"
"c:\windows\system32\cru629.dat"
"c:\windows\system32\drivers\sp_rsdrv2.­sys"
"c:\windows\system32\drivers	mcomm.sys"
"c:\windows\system32\MtxParhBFXPreview.dll"
"c:\windows\system32\MtxPreview.dll"
"c:\windows\system32\wisdstr.exe"
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:	mp
c:	mp\0001.jpg
c:	mp\0001_0250.wav
c:	mp\0002.jpg
c:	mp\0003.jpg
c:	mp\0004.jpg
c:	mp\0005.jpg
c:	mp\0006.jpg
c:	mp\0007.jpg
c:	mp\0008.jpg
c:	mp\0009.jpg
c:	mp\0010.jpg
c:	mp\0011.jpg
c:	mp\0012.jpg
c:	mp\0013.jpg
c:	mp\0014.jpg
c:	mp\0015.jpg
c:	mp\0016.jpg
c:	mp\0017.jpg
c:	mp\0018.jpg
c:	mp\0019.jpg
c:	mp\0020.jpg
c:	mp\0021.jpg
c:	mp\0022.jpg
c:	mp\0023.jpg
c:	mp\0024.jpg
c:	mp\0025.jpg
c:	mp\0026.jpg
c:	mp\0027.jpg
c:	mp\0028.jpg
c:	mp\0029.jpg
c:	mp\0030.jpg
c:	mp\0031.jpg
c:	mp\0032.jpg
c:	mp\0033.jpg
c:	mp\0034.jpg
c:	mp\0035.jpg
c:	mp\0036.jpg
c:	mp\0037.jpg
c:	mp\0038.jpg
c:	mp\0039.jpg
c:	mp\0040.jpg
c:	mp\0041.jpg
c:	mp\0042.jpg
c:	mp\0043.jpg
c:	mp\0044.jpg
c:	mp\0045.jpg
c:	mp\0046.jpg
c:	mp\0047.jpg
c:	mp\0048.jpg
c:	mp\0049.jpg
c:	mp\0050.jpg
c:	mp\0051.jpg
c:	mp\0052.jpg
c:	mp\0053.jpg
c:	mp\0054.jpg
c:	mp\0055.jpg
c:	mp\0056.jpg
c:	mp\0057.jpg
c:	mp\0058.jpg
c:	mp\0059.jpg
c:	mp\0060.jpg
c:	mp\0061.jpg
c:	mp\0062.jpg
c:	mp\0063.jpg
c:	mp\0064.jpg
c:	mp\0065.jpg
c:	mp\0066.jpg
c:	mp\0067.jpg
c:	mp\0068.jpg
c:	mp\0069.jpg
c:	mp\0070.jpg
c:	mp\0071.jpg
c:	mp\0072.jpg
c:	mp\0073.jpg
c:	mp\0074.jpg
c:	mp\0075.jpg
c:	mp\0076.jpg
c:	mp\3476.blend
c:	mp\3736.blend
c:	mp\3968.blend
c:	mp\7760.blend
c:	mp\quit.blend
c:\windows\Fonts\img hearts.ttf
c:\windows\Fonts\img travel.ttf
c:\windows\orun32.ini
c:\windows\system32\drivers	mcomm.sys
c:\windows\system32\MtxParhBFXPreview.dll
c:\windows\system32\MtxPreview.dll

Infected copy of c:\windows\system32\mspmsnsv.dll was found and disinfected 
Restored copy from - c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll 

.
(((((((((((((((((((((((((   Files Created from 2009-07-19 to 2009-08-19  )))))))))))))))))))))))))))))))
.

2009-08-19 15:45 . 2009-08-19 15:57	--------	d-----w-	C:\FR-files
2009-08-19 15:34 . 2009-08-19 15:55	--------	d-----w-	C:\WinFileReplace
2009-08-18 19:44 . 2004-08-05 13:00	1548288	----a-w-	c:\windows\system32\sfcfiles.dll
2009-08-18 19:44 . 2004-08-05 13:00	1548288	----a-w-	c:\windows\system32\dllcache\sfcfiles.dll
2009-08-18 14:53 . 2009-08-18 14:53	152576	----a-w-	c:\documents and settings\Nuno\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-18 11:51 . 2009-08-18 14:54	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-08-18 10:49 . 2009-08-18 10:49	--------	d-----w-	c:\documents and settings\Nuno\Application Data\Malwarebytes
2009-08-18 10:48 . 2009-08-03 11:36	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-18 10:48 . 2009-08-18 10:48	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-18 10:48 . 2009-08-03 11:36	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-08-18 10:48 . 2009-08-18 10:49	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-08-18 06:06 . 2009-08-18 08:27	--------	d-----w-	C:\UsbFix
2009-08-17 19:19 . 2009-08-17 19:20	--------	d-----w-	C:sit
2009-08-17 13:29 . 2009-08-18 11:02	--------	d-----w-	c:\program files\Trend Micro
2009-08-17 11:24 . 2009-08-17 11:36	--------	d-----w-	c:\program files\a-squared Free
2009-08-15 16:22 . 2009-08-15 16:22	--------	d-----w-	c:\program files\The Learning Company
2009-08-15 14:35 . 2009-08-15 14:35	--------	d-----w-	c:\program files\Blender Foundation
2009-08-14 16:34 . 2009-08-14 16:34	--------	d-----w-	C:\Python25
2009-08-13 05:06 . 2009-08-19 09:40	--------	d-----w-	c:\program files\WinClamAVShield
2009-08-13 05:03 . 2009-08-13 05:03	--------	d-----w-	c:\program files\Crawler
2009-08-13 05:03 . 2009-08-13 05:03	6144	----a-w-	c:\documents and settings\All Users\Application Data\Spyware Terminator\sp_rsdel.exe
2009-08-13 05:03 . 2009-08-13 05:03	5632	----a-w-	c:\documents and settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys
2009-08-13 05:03 . 2009-08-13 05:03	142592	------w-	c:\windows\system32\drivers\sp_rsdrv2.sys
2009-08-13 05:03 . 2009-08-19 20:46	--------	d-----w-	c:\documents and settings\Nuno\Application Data\Spyware Terminator
2009-08-13 05:03 . 2009-08-19 09:40	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spyware Terminator
2009-08-13 05:03 . 2009-08-17 12:46	--------	d-----w-	c:\program files\Spyware Terminator
2009-08-12 20:18 . 2009-08-13 04:52	--------	d-----w-	c:\windows\BDOSCAN8
2009-08-12 18:33 . 2003-06-26 08:04	237568	------w-	c:\windows\system32\qtmlClient.dll
2009-08-12 18:33 . 2003-01-20 07:08	49152	------w-	c:\windows\system32\CvoAPI.dll
2009-08-12 18:32 . 2009-08-15 14:34	--------	d-----w-	c:\program files\Boris FX, Inc
2009-08-12 04:56 . 2009-08-15 12:37	--------	d-----w-	c:\program files\Fichiers communs\Reallusion
2009-08-11 18:58 . 2009-08-11 19:11	--------	d-----w-	C:\3dsmax9Trial
2009-08-11 14:31 . 2008-03-30 16:55	1213784	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6\vsapi32.dll
2009-08-11 14:31 . 2006-11-22 15:48	91744	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6\BPMNT.dll
2009-08-11 14:31 . 2007-12-24 15:37	138384	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6	mcomm.sys
2009-08-11 14:31 . 2006-07-07 14:29	1197584	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6\ssapi32.dll
2009-08-11 14:31 . 2009-03-27 15:38	366344	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6	sc.exe
2009-08-11 14:30 . 2009-08-11 14:34	--------	d-----w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6
2009-08-11 14:30 . 2009-08-11 14:30	--------	d-----w-	c:\windows\system32\HouseCall 6.6
2009-08-09 09:35 . 2009-08-09 09:35	--------	d-----w-	c:\program files\PopCap Games
2009-08-09 09:35 . 2009-08-09 09:36	--------	d-----w-	c:\program files\Zuma Deluxe
2009-08-08 18:42 . 2009-08-18 13:51	10	----a-w-	c:\windows\popcinfo.dat
2009-08-08 17:40 . 2009-08-08 17:40	--------	d-----w-	c:\program files\GameHouse
2009-08-08 17:16 . 2009-08-08 17:16	--------	d-----w-	c:\documents and settings\All Users\Application Data\Zylom
2009-08-08 09:58 . 2009-08-08 09:58	--------	d-----w-	c:\program files\Microsoft Works
2009-08-08 09:58 . 2009-08-08 09:58	--------	d-----w-	c:\program files\MSBuild
2009-08-08 09:55 . 2009-08-08 09:55	--------	d-----w-	c:\program files\Microsoft.NET
2009-08-08 09:48 . 2009-08-08 09:48	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2009-08-08 09:47 . 2009-08-08 09:47	--------	d-----w-	c:\documents and settings\Nuno\Local Settings\Application Data\Microsoft Help
2009-08-08 09:46 . 2009-08-08 10:09	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-08 08:35 . 2009-08-08 08:35	--------	d-----w-	c:\program files\VirtualDJ
2009-08-07 22:47 . 2009-08-07 22:47	--------	d-----w-	c:\documents and settings\Nuno\Application Data\DivX
2009-08-07 22:44 . 2009-08-07 22:44	--------	d-----w-	c:\documents and settings\Nuno\Local Settings\Application Data\Downloaded Installations
2009-08-07 22:44 . 2009-08-07 22:44	--------	d-----w-	c:\documents and settings\All Users\Application Data\Pinnacle Studio Ultimate
2009-08-07 18:10 . 2009-08-07 18:10	--------	d-----w-	c:\program files\Smart Projects
2009-08-07 11:16 . 2009-08-07 11:16	--------	d-----w-	c:\program files\SFR
2009-08-05 20:50 . 2009-08-05 20:50	--------	d-----w-	c:\program files\MSECache

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-19 20:54 . 2008-09-14 12:32	12	----a-w-	c:\windows\bthservsdp.dat
2009-08-18 14:54 . 2005-01-26 21:07	--------	d-----w-	c:\program files\Java
2009-08-17 08:14 . 2005-01-26 21:03	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-08-15 16:55 . 2008-10-20 20:34	--------	d-----w-	c:\documents and settings\Nuno\Application Data\BitTorrent
2009-08-15 14:33 . 2008-01-06 21:57	--------	d-----w-	c:\program files\Pinnacle
2009-08-15 11:42 . 2004-08-17 09:31	76582	------w-	c:\windows\system32\perfc00C.dat
2009-08-15 11:42 . 2004-08-17 09:31	471484	------w-	c:\windows\system32\perfh00C.dat
2009-08-15 09:41 . 2008-05-19 10:28	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP
2009-08-12 18:11 . 2008-05-01 14:17	131744	----a-w-	c:\documents and settings\Nuno\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-08 11:17 . 2008-05-17 10:36	--------	d-----w-	c:\documents and settings\Nuno\Application Data\proDAD
2009-08-08 11:12 . 2008-08-31 18:23	--------	d-----w-	c:\program files\palmOne
2009-08-08 11:10 . 2005-07-24 01:07	--------	d-----w-	c:\program files\Fichiers communs\Adobe
2009-08-05 20:39 . 2008-05-01 17:12	--------	d-----w-	c:\documents and settings\Nuno\Application Data\LimeWire
2009-06-01 08:27 . 2009-06-01 08:27	603904	------w-	c:\windows\system32\TUProgSt.exe
2009-06-01 08:27 . 2009-06-01 08:27	362240	------w-	c:\windows\system32\TuneUpDefragService.exe
.

------- Sigcheck -------

[-] 2008-04-13 19:15	574976	78A08DD6A8D65E697C18E1DB01C5CDCA	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54
tfs.sys
[7] 2007-02-09 11:10	574464	19A811EF5F1ED5C926A028CE107FF1AF	c:\windows\SoftwareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\sp2gdr
tfs.sys
[7] 2007-02-09 11:23	574976	05AB81909514BFD69CBB1F2C147CF6B9	c:\windows\SoftwareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\sp2qfe
tfs.sys
[-] 2008-04-13 19:15	574976	78A08DD6A8D65E697C18E1DB01C5CDCA	c:\windows\system32\dllcache
tfs.sys
[-] 2008-04-13 19:15	574976	78A08DD6A8D65E697C18E1DB01C5CDCA	c:\windows\system32\drivers
tfs.sys
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PMCRemote"="c:\program files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe" [2007-02-12 253000]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"SpywareTerminatorUpdate"="c:\progra~1\SPYWAR~2\SpywareTerminatorUpdate.exe" [2009-08-13 3055616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-11-23 163840]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-01-26 98304]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-11-01 290816]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"hpWirelessAssistant"="c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 790528]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
"ChangeFilterMerit"="c:\program files\NewSoft\Presto! PVR\ChangeFilterMerit.exe" [2007-06-08 51280]
"Presto! PVR Monitor"="c:\program files\NewSoft\Presto! PVR\Monitor.exe" [2007-07-02 149328]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SpywareTerminator"="c:\progra~1\SPYWAR~2\SpywareTerminatorShield.exe" [2009-08-13 2171904]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-18 149280]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-08-24 88363]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-05 110592]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\BitTorrent\bittorrent.exe"=
"c:\WINDOWS\system32\dplaysvr.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 FNETDEVI;FNETDEVI;c:\windows\system32\drivers\FNETDEVI.SYS [25/10/2008 14:15 19572]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [13/08/2009 07:03 142592]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [01/06/2009 10:27 603904]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe --> c:\program files\MAGIX\Common\Database\bin\fbserver.exe [?]
S3 MODRC;DiBcom Infrared Receiver;c:\windows\system32\drivers\modrc.sys [06/09/2008 19:58 13056]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-08-19 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-20 14:28]

2009-08-07 c:\windows\Tasks\Norton AntiVirus - Analyser mon ordinateur - MANUE.job
- c:\progra~1\NORTON~1\Navw32.exe [2004-08-24 23:13]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q105&bd=pavilion&pf=laptop
IE: Crawler Search - tbr:iemenu
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-19 22:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe??????????+????|?????? ???B???????????????B? ?????? 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:2e,e8,e1,00,eb,16,2b,de,22,6a,97,f2,46,
   7c,75,95,c8,28,51,af,b0,29,a3,98,e7,22,de,bc,86,cd,8e,d8,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,1e,22,a1,5b,80,
   eb,a2,de,71,3b,04,66,8b,46,0d,96,28,99,e4,d6,fa,4b,49,6e,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,93,ea,e3,1b,ed,
   f6,49,e9,25,da,ec,7e,55,20,c9,26,e1,bf,0f,a6,c6,cd,09,f6,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,ea,45,38,a8,70,
   5e,13,69,3e,1e,9e,e0,57,5a,93,61,ec,e7,c7,64,44,3c,8b,1e,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,be,6e,c7,8f,1a,
   c4,e8,ea,cd,44,cd,b9,a6,33,6c,cd,dd,6b,d4,fb,df,29,68,e3,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,bb,55,8a,54,dc,
   b7,64,f5,b0,18,ed,a7,3f,8d,37,a4,12,5e,3d,20,22,04,7a,09,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,51,d9,d1,b3,68,
   0f,28,55,31,77,e1,ba,b1,f8,68,02,3d,ac,52,8f,7c,e1,9e,1c,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,34,8b,93,e6,d4,
   e8,f9,47,83,6c,56,8b,a0,85,96,ab,35,ea,a3,9b,7c,03,03,31,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,a5,77,cc,8b,a4,
   a5,c7,79,51,fa,6e,91,28,9e,14,cc,a0,fc,2b,a7,da,8a,f0,aa,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,d9,63,51,07,22,
   8c,b6,7f,b1,cd,45,5a,a8,c4,f8,b9,63,77,4e,71,4c,e9,6f,3c,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,fd,c5,85,22,6a,
   ef,53,25,e3,0e,66,d5,eb,bc,2f,6b,57,0e,fa,8f,5b,24,44,00,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,22,de,d6,8e,19,
   a3,35,90,fa,ea,66,7f,d4,3b,6b,70,3f,8e,e6,09,c3,c6,a5,9b,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3380)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\a-squared Free\a2service.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Norton AntiVirus
avapsvc.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32undll32.exe
c:\program files\Apoint2K\ApntEx.exe
c:\program files\HPQ\Shared\hpqwmi.exe
.
**************************************************************************
.
Completion time: 2009-08-19 23:02 - machine was rebooted
ComboFix-quarantined-files.txt  2009-08-19 21:02

Pre-Run: 20 305 174 528 octets libres
Post-Run: 20 367 757 312 octets libres

364	--- E O F ---	2008-10-23 17:32

plopus · Answer

bon ok

il avait infecté un autre fichier systeme, j'espere qu'il n'as pas ete remplacé par le meme fichier verolé..


tu feras quand tu peux :

==> Télécharger et enregistre sur ton bureau SDfix (créé par AndyManchesta)

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

==> Double cliquer sur SDFix.exe et choisir Install pour l'extraire dans un dossier dédié sur ton disque C:.

/!\ Démarre en mode sans échec : après le bip et avant le logo windows tapoter sur la touche F8 (ou F5): menu M.S.E..

==> Choisir son compte, pas celui de l'Administrateur ou autre.

==> Dérouler la liste des instructions ci-dessous :

• Ouvrir le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuyer sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuyer sur une touche pour redémarrer le PC.
• Le système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuyer sur une touche pour finir l'exécution du script et charger les icônes du Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copier/coller le contenu du fichier Report.txt dans la prochaine réponse sur le forum

tu me dira comment va le PC ?

a demain

feshme · Answer

VOICI le rapport, finalement je l'ai fait ce soir A demain 


[b]SDFix: Version 1.240 [/b]
Run by Nuno on 19/08/2009 at 23:33

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-19 23:48:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000b0d822149]
"001df6106923"=hex:25,b7,14,10,f1,f3,13,84,01,18,32,39,c4,c3,2c,2b
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:7d,ad,4f,fc,dd,e8,29,9f,8d,17,5c,20,c3,1d,dd,97,a9,cd,5d,f9,b3,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,7e,8c,ff,8d,d7,ac,9a,06,a2,7d,4e,fb,fe,44,cc,0f,f0,..
"khjeh"=hex:50,3e,79,44,c6,47,bc,f8,72,48,44,b2,80,37,30,d4,d7,fe,f5,d5,68,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:48,30,81,02,3b,21,bc,0c,08,fd,96,3c,41,1b,23,16,9b,11,df,aa,f8,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000b0d822149]
"001df6106923"=hex:25,b7,14,10,f1,f3,13,84,01,18,32,39,c4,c3,2c,2b
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:7d,ad,4f,fc,dd,e8,29,9f,8d,17,5c,20,c3,1d,dd,97,a9,cd,5d,f9,b3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,7e,8c,ff,8d,d7,ac,9a,06,a2,7d,4e,fb,fe,44,cc,0f,f0,..
"khjeh"=hex:50,3e,79,44,c6,47,bc,f8,72,48,44,b2,80,37,30,d4,d7,fe,f5,d5,68,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:48,30,81,02,3b,21,bc,0c,08,fd,96,3c,41,1b,23,16,9b,11,df,aa,f8,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000015b

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Sat 17 May 2008         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 16 Mar 2007         4,558 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti9.tmp"
Thu  1 May 2008             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 23 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\06119f7f007fbf3388fb7f012fd2ce49\download\BIT2C.tmp"
Thu 23 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2b0ec6af95107cd747155f214801a1de\download\BIT2F.tmp"
Thu 23 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\457af15380631760d255c46e3ce4c508\download\BIT2D.tmp"
Thu 23 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4ad242756613df3e539d49e3db7fff27\download\BIT43.tmp"
Thu 23 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\813a989071c1720c8fca52f421b7b9e5\download\BIT34.tmp"
Thu 23 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\84db8362c64a1369b93bd1a60a67cb01\download\BIT2B.tmp"
Thu 23 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a957c596efa7d0ec1b4b7fdc1e1c5705\download\BIT3A.tmp"
Thu 23 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c8f95ed251aedea843abb9ea5b1a52d3\download\BIT40.tmp"
Thu 23 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d8cfedd5cfd3f0881276825d82978e5d\download\BIT39.tmp"
Thu 23 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e8ac11bc9e4687d6c2a32699ff0541d6\download\BIT38.tmp"
Thu 23 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ec9dc63e53c8bf9a1e80cf1489c682bd\download\BIT2A.tmp"
Thu 23 Oct 2008     1,756,266 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\edf770ea565c428bca41a4befcabb97b\download\BIT29.tmp"
Thu 23 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ef76b58e91ae8084bf0833c90d4b9382\download\BIT31.tmp"
Thu 23 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fde0566446f6dd640c536f419fe1216a\download\BIT2E.tmp"

[b]Finished![/b]

plopus · Answer

salut

poste moi un nouveau RSIt stp

feshme · Answer

RESULTAT RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by Nuno at 2009-08-20 10:20:04
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 19 GB (20%) free of 95 GB
Total RAM: 758 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:20:20, on 20/08/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
C:\PROGRA~1\SPYWAR~2\SpywareTerminatorShield.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\PROGRA~1\SPYWAR~2\SpywareTerminatorUpdate.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton AntiVirus
avapsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
C:\Documents and Settings\Nuno\Bureau\RSIT.exe
C:\Program Files	rend micro\Nuno.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] "%ProgramFiles%\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ChangeFilterMerit] C:\Program Files\NewSoft\Presto! PVR\ChangeFilterMerit.exe
O4 - HKLM\..\Run: [Presto! PVR Monitor] C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~2\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\PROGRA~1\SPYWAR~2\SpywareTerminatorUpdate.exe"
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader5.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe (file missing)
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

plopus · Answer

On est reparti pour les analyses si tout ce passe bien poste moi les rapports de ces fichiers avec bien leur nom :  

le site :  https://www.virustotal.com/gui/

si tu veux pas t'embeter, tu marque le nom et tu copie colle l'url de ton navigatreur quand tu es sur la page du rapport

c:\windows\system32\drivers
tfs.sys 
c:\windows\system32\dllcache
tfs.sys 
c:\windows\system32\dllcache\Beep.sys
c:\windows\system32\drivers\beep.sys 
c:\windows\system32\mspmsnsv.dll

C:\WINDOWS\SoftwareDistribution\Download\c8f95ed251aedea843abb9ea5b1a52d3\download\BIT40.tmp
C:\WINDOWS\SoftwareDistribution\Download\ec9dc63e53c8bf9a1e80cf1489c682bd\download\BIT2A.tmp
C:\Documents and Settings\All Users\DRM\DRMv1.bak"
C:\Program Files\InterActual\InterActual Player\iti9.tmp"
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp

feshme · Answer

FICHIER : c:\windows\system32\dllcache
tfs.sys 


Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.20 - 
AhnLab-V3 5.0.0.2 2009.08.20 - 
AntiVir 7.9.1.3 2009.08.20 - 
Antiy-AVL 2.0.3.7 2009.08.20 - 
Authentium 5.1.2.4 2009.08.19 - 
Avast 4.8.1335.0 2009.08.19 - 
AVG 8.5.0.406 2009.08.19 - 
BitDefender 7.2 2009.08.20 - 
CAT-QuickHeal 10.00 2009.08.19 - 
ClamAV 0.94.1 2009.08.20 - 
Comodo 2032 2009.08.20 - 
DrWeb 5.0.0.12182 2009.08.20 - 
eSafe 7.0.17.0 2009.08.19 - 
eTrust-Vet 31.6.6688 2009.08.19 - 
F-Prot 4.4.4.56 2009.08.19 - 
F-Secure 8.0.14470.0 2009.08.20 - 
Fortinet 3.120.0.0 2009.08.20 - 
GData 19 2009.08.20 - 
Ikarus T3.1.1.68.0 2009.08.20 - 
Jiangmin 11.0.800 2009.08.20 - 
K7AntiVirus 7.10.822 2009.08.19 - 
Kaspersky 7.0.0.125 2009.08.20 - 
McAfee 5714 2009.08.19 - 
McAfee+Artemis 5714 2009.08.19 - 
McAfee-GW-Edition 6.8.5 2009.08.20 - 
Microsoft 1.4903 2009.08.20 - 
NOD32 4349 2009.08.19 - 
Norman 6.01.09 2009.08.19 - 
nProtect 2009.1.8.0 2009.08.20 - 
Panda 10.0.0.14 2009.08.20 - 
PCTools 4.4.2.0 2009.08.19 - 
Prevx 3.0 2009.08.20 - 
Rising 21.43.30.00 2009.08.20 - 
Sophos 4.44.0 2009.08.20 - 
Sunbelt 3.2.1858.2 2009.08.20 - 
Symantec 1.4.4.12 2009.08.20 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.20 - 
VBA32 3.12.10.9 2009.08.20 - 
ViRobot 2009.8.20.1892 2009.08.20 - 
VirusBuster 4.6.5.0 2009.08.19 - 
Information additionnelle 
File size: 574976 bytes 
MD5...: 78a08dd6a8d65e697c18e1db01c5cdca 
SHA1..: c40f3c1fcbd8a61ad5f36e16971feb64407bbc66 
SHA256: e0e6f3ed05068e32f1d5c2d2b38cdef4536b8656db6756c66cf6b40b60c8f3da 
ssdeep: 12288:CosOm5JqnuiIT8j4l7yT68kdUDzAGOjICueFWI0m9:eJ+uiIQ4kTTkdUDE
PflFWI0
 
PEiD..: - 
TrID..: File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x85384
timedatestamp.....: 0x48025be5 (Sun Apr 13 19:15:49 2008)
machinetype.......: 0x14c (I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x17879 0x17880 6.57 7a0cc809877394dcb00f251125cde1d0
.rdata 0x17b80 0x7078 0x7080 6.30 95baacb27e75d4140da94f3e43c659d6
.data 0x1ec00 0x1b10 0x1b80 0.74 9cb37a38036e823a0152bb209239dffd
PAGE 0x20780 0x64b6b 0x64b80 6.51 7de1f4c3a0a474314fe86e158e01cd73
INIT 0x85300 0x36fe 0x3700 6.07 ded61bc7fa643b884fdf69cc4d48c308
.rsrc 0x88a00 0x3e0 0x400 3.34 7153f5b12fab0213e839e612df3320ab
.reloc 0x88e00 0x37a0 0x3800 6.73 5db2361b4571130ef61ec5a1deac3e22

( 3 imports ) 
> HAL.dll: KeAcquireInStackQueuedSpinLock, ExAcquireFastMutex, KeReleaseQueuedSpinLock, KeAcquireQueuedSpinLock, KfReleaseSpinLock, ExTryToAcquireFastMutex, ExReleaseFastMutex, KeReleaseInStackQueuedSpinLock, KfAcquireSpinLock
> ksecdd.sys: GenerateSessionKey, EfsGenerateKey, GenerateDirEfs, InitSecurityInterfaceW, EfsDecryptFek
> ntoskrnl.exe: ExRaiseStatus, FsRtlNormalizeNtstatus, CcFlushCache, ExIsResourceAcquiredExclusiveLite, RtlInitUnicodeString, InterlockedPopEntrySList, InterlockedPushEntrySList, KeQuerySystemTime, RtlCompareMemory, FsRtlAreNamesEqual, FsRtlCheckLockForWriteAccess, FsRtlOplockIsFastIoPossible, FsRtlCheckOplock, CcSetDirtyPinnedData, MmSetAddressRangeModified, MmCanFileBeTruncated, RtlGenerate8dot3Name, RtlUpcaseUnicodeString, CcCopyWrite, CcCanIWrite, CcMdlWriteComplete, MmMapLockedPagesSpecifyCache, CcPrepareMdlWrite, IoGetTopLevelIrp, _aullshr, _allshl, IoGetStackLimits, RtlSetBits, RtlClearBits, FsRtlGetNextLargeMcbEntry, RtlAreBitsSet, RtlFindLastBackwardRunClear, RtlNumberOfClearBits, _allmul, RtlAreBitsClear, RtlFindClearBits, RtlFindClearRuns, FsRtlRemoveLargeMcbEntry, FsRtlLookupLargeMcbEntry, FsRtlAddLargeMcbEntry, KeReleaseMutant, ObfDereferenceObject, CcUninitializeCacheMap, CcSetLogHandleForFile, CcInitializeCacheMap, IoCreateStreamFileObjectLite, KeWaitForSingleObject, CcMapData, CcPinMappedData, CcPinRead, CcPreparePinWrite, CcMdlReadComplete, KeBugCheckEx, CcZeroData, FsRtlIsNtstatusExpected, DbgBreakPoint, DbgPrint, KdDebuggerEnabled, FsRtlNotifyVolumeEvent, RtlDeleteElementGenericTableAvl, IoRemoveShareAccess, FsRtlAddToTunnelCache, FsRtlFastUnlockAll, IoGetRequestorProcess, FsRtlNotifyFilterReportChange, FsRtlDeleteKeyFromTunnelCache, FsRtlNotifyCleanup, FsRtlNotifyFilterChangeDirectory, MmFlushImageSection, KeLeaveCriticalRegion, IoSetTopLevelIrp, KeEnterCriticalRegion, IofCompleteRequest, ExQueueWorkItem, IoGetCurrentProcess, FsRtlIsNameInExpression, FsRtlDoesNameContainWildCards, IoCheckEaBufferValidity, ExIsResourceAcquiredSharedLite, KeSetEvent, IoSetInformation, FsRtlOplockFsctrl, IoUpdateShareAccess, IoSetShareAccess, IoCheckShareAccess, FsRtlCurrentBatchOplock, ObReleaseObjectSecurity, ObGetObjectSecurity, SePrivilegeCheck, CcWaitForCurrentLazyWriterActivity, RtlGetOwnerSecurityDescriptor, FsRtlFindInTunnelCache, SeSinglePrivilegeCheck, KeClearEvent, FsRtlDissectName, _alloca_probe, IoCancelIrp, KeSetKernelStackSwapEnable, KeInitializeEvent, IoIsOperationSynchronous, IofCallDriver, MmUnmapLockedPages, IoBuildPartialMdl, IoFreeMdl, MmProbeAndLockPages, IoAllocateMdl, KeGetCurrentThread, RtlDecompressBuffer, RtlDecompressFragment, RtlGetCompressionWorkSpaceSize, MmBuildMdlForNonPagedPool, IoFreeIrp, ExReleaseResourceForThreadLite, CcUnpinDataForThread, CcSetBcbOwnerPointer, FsRtlIsTotalDeviceFailure, IoMakeAssociatedIrp, ObfReferenceObject, ExGetExclusiveWaiterCount, KeDelayExecutionThread, ObReferenceObjectByHandle, IoFileObjectType, _local_unwind2, RtlCompressBuffer, MmUnlockPages, IoBuildAsynchronousFsdRequest, RtlLookupElementGenericTableAvl, SeCaptureSubjectContext, RtlUpperString, RtlCompareString, RtlInitString, FsRtlLegalAnsiCharacterArray, NlsOemLeadByteInfo, NlsMbOemCodePageTag, SeDeleteObjectAuditAlarm, ObQueryObjectAuditingByHandle, CcPurgeCacheSection, _allrem, SeAuditHardLinkCreation, SeAuditingHardLinkEventsWithContext, IoBuildDeviceIoControlRequest, CcMdlRead, KeNumberProcessors, CcDeferWrite, ZwClose, ZwCreateFile, ProbeForRead, IoBuildSynchronousFsdRequest, IoGetRelatedDeviceObject, MmPrefetchPages, ProbeForWrite, _alldiv, RtlLengthSid, SeReleaseSubjectContext, SeUnlockSubjectContext, SeAccessCheck, SeLockSubjectContext, RtlMapGenericMask, IoGetFileObjectGenericMapping, CcSetAdditionalCacheAttributes, FsRtlBalanceReads, ObQueryNameString, wcslen, IoCreateDevice, FsRtlIncrementCcFastReadResourceMiss, FsRtlIncrementCcFastReadNotPossible, CcFastCopyRead, FsRtlIncrementCcFastReadNoWait, FsRtlIncrementCcFastReadWait, CcFastCopyWrite, CcFastMdlReadWait, FsRtlUninitializeLargeMcb, FsRtlInitializeLargeMcb, FsRtlPrivateLock, FsRtlFastUnlockSingle, FsRtlFastUnlockAllByKey, FsRtlProcessFileLock, ExDeleteResourceLite, ExInitializeResourceLite, KeInitializeSpinLock, FsRtlResetLargeMcb, KeSetTimer, ExAcquireSharedStarveExclusive, CcGetDirtyPages, KeSetPriorityThread, FsRtlLookupLastLargeMcbEntry, FsRtlNumberOfRunsInLargeMcb, FsRtlSplitLargeMcb, FsRtlTruncateLargeMcb, CcRemapBcb, RtlFreeOemString, RtlUnicodeStringToCountedOemString, FsRtlIsFatDbcsLegal, FsRtlFastCheckLockForWrite, FsRtlFastCheckLockForRead, IoRaiseInformationalHardError, RtlAppendUnicodeStringToString, RtlCopyUnicodeString, IoVolumeDeviceToDosName, IoReleaseCancelSpinLock, IoAcquireCancelSpinLock, CcMdlWriteAbort, IoIsSystemThread, RtlLengthSecurityDescriptor, SeAssignSecurity, RtlSetDaclSecurityDescriptor, RtlCreateSecurityDescriptor, RtlAddAccessAllowedAce, RtlCreateAcl, RtlSubAuthoritySid, RtlInitializeSid, RtlLengthRequiredSid, ExInitializePagedLookasideList, ExInitializeNPagedLookasideList, MmIsThisAnNtAsSystem, MmQuerySystemSize, ZwQueryValueKey, ZwOpenKey, RtlVerifyVersionInfo, VerSetConditionMask, IoRegisterDriverReinitialization, KeInitializeDpc, KeInitializeTimer, IoRegisterFileSystem, KeBugCheck, KeInitializeMutant, FsRtlMdlWriteCompleteDev, FsRtlMdlReadCompleteDev, ExUuidCreate, RtlDelete, RtlSplay, RtlValidSid, RtlInsertElementGenericTableFullAvl, RtlLookupElementGenericTableFullAvl, SeQueryInformationToken, RtlEqualSid, SeExports, IoCheckQuotaBufferValidity, RtlInitializeGenericTableAvl, CcSetReadAheadGranularity, FsRtlCheckLockForReadAccess, ExAcquireSharedWaitForExclusive, FsRtlPostStackOverflow, FsRtlPostPagingFileStackOverflow, IoReleaseVpbSpinLock, IoAcquireVpbSpinLock, SeValidSecurityDescriptor, SeFreePrivileges, SeDeassignSecurity, SeSetSecurityDescriptorInfo, SeQuerySecurityDescriptorInfo, SeOpenObjectAuditAlarm, SeOpenObjectForDeleteAuditAlarm, SeAppendPrivileges, SeAuditingFileEventsWithContext, RtlEnumerateGenericTableWithoutSplayingAvl, FsRtlFreeFileLock, FsRtlAllocateFileLock, ExReinitializeResourceLite, FsRtlNotifyInitializeSync, FsRtlInitializeTunnelCache, RtlInsertElementGenericTableAvl, FsRtlUninitializeOplock, FsRtlInitializeOplock, FsRtlTeardownPerStreamContexts, IoDeleteDevice, FsRtlDeleteTunnelCache, FsRtlNotifyUninitializeSync, RtlEnumerateGenericTableAvl, IoWriteErrorLogEntry, IoAllocateErrorLogEntry, IoSetDeviceToVerify, KeTickCount, _abnormal_termination, _except_handler3, RtlFindNextForwardRunClear, ExAcquireFastMutexUnsafe, ExAllocatePoolWithTag, RtlInitializeBitMap, ExFreePoolWithTag, memmove, ExReleaseFastMutexUnsafe, ExReleaseResourceLite, _allshr, ExAcquireResourceSharedLite, ExAcquireResourceExclusiveLite, CcUnpinData, CcCopyRead, CcSetFileSizes, RtlFillMemoryUlong, IoPageRead, IoFreeErrorLogEntry, IoSynchronousPageWrite, ExDeletePagedLookasideList, ExDeleteNPagedLookasideList, IoGetDeviceObjectPointer, KeUnstackDetachProcess, KeStackAttachProcess, PsLookupProcessByProcessId, ZwWaitForSingleObject, PsCreateSystemThread, ZwCreateEvent, PoQueueShutdownWorkItem, ZwFreeVirtualMemory, PsRevertToSelf, PsDereferenceImpersonationToken, PsImpersonateClient, PsReferenceImpersonationToken, ZwAllocateVirtualMemory, ObReferenceObjectByPointer

( 0 exports ) 
 
PDFiD.: - 
RDS...: NSRL Reference Data Set
-

feshme · Answer

c:\windows\system32\drivers
tfs.sys 



Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.20 - 
AhnLab-V3 5.0.0.2 2009.08.20 - 
AntiVir 7.9.1.3 2009.08.20 - 
Antiy-AVL 2.0.3.7 2009.08.20 - 
Authentium 5.1.2.4 2009.08.19 - 
Avast 4.8.1335.0 2009.08.19 - 
AVG 8.5.0.406 2009.08.19 - 
BitDefender 7.2 2009.08.20 - 
CAT-QuickHeal 10.00 2009.08.19 - 
ClamAV 0.94.1 2009.08.20 - 
Comodo 2032 2009.08.20 - 
DrWeb 5.0.0.12182 2009.08.20 - 
eSafe 7.0.17.0 2009.08.19 - 
eTrust-Vet 31.6.6688 2009.08.19 - 
F-Prot 4.4.4.56 2009.08.19 - 
F-Secure 8.0.14470.0 2009.08.20 - 
Fortinet 3.120.0.0 2009.08.20 - 
GData 19 2009.08.20 - 
Ikarus T3.1.1.68.0 2009.08.20 - 
Jiangmin 11.0.800 2009.08.20 - 
K7AntiVirus 7.10.822 2009.08.19 - 
Kaspersky 7.0.0.125 2009.08.20 - 
McAfee 5714 2009.08.19 - 
McAfee+Artemis 5714 2009.08.19 - 
McAfee-GW-Edition 6.8.5 2009.08.20 - 
Microsoft 1.4903 2009.08.20 - 
NOD32 4350 2009.08.20 - 
Norman 6.01.09 2009.08.19 - 
nProtect 2009.1.8.0 2009.08.20 - 
Panda 10.0.0.14 2009.08.20 - 
PCTools 4.4.2.0 2009.08.19 - 
Prevx 3.0 2009.08.20 - 
Rising 21.43.31.00 2009.08.20 - 
Sophos 4.44.0 2009.08.20 - 
Sunbelt 3.2.1858.2 2009.08.20 - 
Symantec 1.4.4.12 2009.08.20 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.20 - 
VBA32 3.12.10.9 2009.08.20 - 
ViRobot 2009.8.20.1892 2009.08.20 - 
VirusBuster 4.6.5.0 2009.08.19 - 
Information additionnelle 
File size: 574976 bytes 
MD5...: 78a08dd6a8d65e697c18e1db01c5cdca 
SHA1..: c40f3c1fcbd8a61ad5f36e16971feb64407bbc66 
SHA256: e0e6f3ed05068e32f1d5c2d2b38cdef4536b8656db6756c66cf6b40b60c8f3da 
ssdeep: 12288:CosOm5JqnuiIT8j4l7yT68kdUDzAGOjICueFWI0m9:eJ+uiIQ4kTTkdUDE
PflFWI0
 
PEiD..: - 
TrID..: File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x85384
timedatestamp.....: 0x48025be5 (Sun Apr 13 19:15:49 2008)
machinetype.......: 0x14c (I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x17879 0x17880 6.57 7a0cc809877394dcb00f251125cde1d0
.rdata 0x17b80 0x7078 0x7080 6.30 95baacb27e75d4140da94f3e43c659d6
.data 0x1ec00 0x1b10 0x1b80 0.74 9cb37a38036e823a0152bb209239dffd
PAGE 0x20780 0x64b6b 0x64b80 6.51 7de1f4c3a0a474314fe86e158e01cd73
INIT 0x85300 0x36fe 0x3700 6.07 ded61bc7fa643b884fdf69cc4d48c308
.rsrc 0x88a00 0x3e0 0x400 3.34 7153f5b12fab0213e839e612df3320ab
.reloc 0x88e00 0x37a0 0x3800 6.73 5db2361b4571130ef61ec5a1deac3e22

( 3 imports ) 
> HAL.dll: KeAcquireInStackQueuedSpinLock, ExAcquireFastMutex, KeReleaseQueuedSpinLock, KeAcquireQueuedSpinLock, KfReleaseSpinLock, ExTryToAcquireFastMutex, ExReleaseFastMutex, KeReleaseInStackQueuedSpinLock, KfAcquireSpinLock
> ksecdd.sys: GenerateSessionKey, EfsGenerateKey, GenerateDirEfs, InitSecurityInterfaceW, EfsDecryptFek
> ntoskrnl.exe: ExRaiseStatus, FsRtlNormalizeNtstatus, CcFlushCache, ExIsResourceAcquiredExclusiveLite, RtlInitUnicodeString, InterlockedPopEntrySList, InterlockedPushEntrySList, KeQuerySystemTime, RtlCompareMemory, FsRtlAreNamesEqual, FsRtlCheckLockForWriteAccess, FsRtlOplockIsFastIoPossible, FsRtlCheckOplock, CcSetDirtyPinnedData, MmSetAddressRangeModified, MmCanFileBeTruncated, RtlGenerate8dot3Name, RtlUpcaseUnicodeString, CcCopyWrite, CcCanIWrite, CcMdlWriteComplete, MmMapLockedPagesSpecifyCache, CcPrepareMdlWrite, IoGetTopLevelIrp, _aullshr, _allshl, IoGetStackLimits, RtlSetBits, RtlClearBits, FsRtlGetNextLargeMcbEntry, RtlAreBitsSet, RtlFindLastBackwardRunClear, RtlNumberOfClearBits, _allmul, RtlAreBitsClear, RtlFindClearBits, RtlFindClearRuns, FsRtlRemoveLargeMcbEntry, FsRtlLookupLargeMcbEntry, FsRtlAddLargeMcbEntry, KeReleaseMutant, ObfDereferenceObject, CcUninitializeCacheMap, CcSetLogHandleForFile, CcInitializeCacheMap, IoCreateStreamFileObjectLite, KeWaitForSingleObject, CcMapData, CcPinMappedData, CcPinRead, CcPreparePinWrite, CcMdlReadComplete, KeBugCheckEx, CcZeroData, FsRtlIsNtstatusExpected, DbgBreakPoint, DbgPrint, KdDebuggerEnabled, FsRtlNotifyVolumeEvent, RtlDeleteElementGenericTableAvl, IoRemoveShareAccess, FsRtlAddToTunnelCache, FsRtlFastUnlockAll, IoGetRequestorProcess, FsRtlNotifyFilterReportChange, FsRtlDeleteKeyFromTunnelCache, FsRtlNotifyCleanup, FsRtlNotifyFilterChangeDirectory, MmFlushImageSection, KeLeaveCriticalRegion, IoSetTopLevelIrp, KeEnterCriticalRegion, IofCompleteRequest, ExQueueWorkItem, IoGetCurrentProcess, FsRtlIsNameInExpression, FsRtlDoesNameContainWildCards, IoCheckEaBufferValidity, ExIsResourceAcquiredSharedLite, KeSetEvent, IoSetInformation, FsRtlOplockFsctrl, IoUpdateShareAccess, IoSetShareAccess, IoCheckShareAccess, FsRtlCurrentBatchOplock, ObReleaseObjectSecurity, ObGetObjectSecurity, SePrivilegeCheck, CcWaitForCurrentLazyWriterActivity, RtlGetOwnerSecurityDescriptor, FsRtlFindInTunnelCache, SeSinglePrivilegeCheck, KeClearEvent, FsRtlDissectName, _alloca_probe, IoCancelIrp, KeSetKernelStackSwapEnable, KeInitializeEvent, IoIsOperationSynchronous, IofCallDriver, MmUnmapLockedPages, IoBuildPartialMdl, IoFreeMdl, MmProbeAndLockPages, IoAllocateMdl, KeGetCurrentThread, RtlDecompressBuffer, RtlDecompressFragment, RtlGetCompressionWorkSpaceSize, MmBuildMdlForNonPagedPool, IoFreeIrp, ExReleaseResourceForThreadLite, CcUnpinDataForThread, CcSetBcbOwnerPointer, FsRtlIsTotalDeviceFailure, IoMakeAssociatedIrp, ObfReferenceObject, ExGetExclusiveWaiterCount, KeDelayExecutionThread, ObReferenceObjectByHandle, IoFileObjectType, _local_unwind2, RtlCompressBuffer, MmUnlockPages, IoBuildAsynchronousFsdRequest, RtlLookupElementGenericTableAvl, SeCaptureSubjectContext, RtlUpperString, RtlCompareString, RtlInitString, FsRtlLegalAnsiCharacterArray, NlsOemLeadByteInfo, NlsMbOemCodePageTag, SeDeleteObjectAuditAlarm, ObQueryObjectAuditingByHandle, CcPurgeCacheSection, _allrem, SeAuditHardLinkCreation, SeAuditingHardLinkEventsWithContext, IoBuildDeviceIoControlRequest, CcMdlRead, KeNumberProcessors, CcDeferWrite, ZwClose, ZwCreateFile, ProbeForRead, IoBuildSynchronousFsdRequest, IoGetRelatedDeviceObject, MmPrefetchPages, ProbeForWrite, _alldiv, RtlLengthSid, SeReleaseSubjectContext, SeUnlockSubjectContext, SeAccessCheck, SeLockSubjectContext, RtlMapGenericMask, IoGetFileObjectGenericMapping, CcSetAdditionalCacheAttributes, FsRtlBalanceReads, ObQueryNameString, wcslen, IoCreateDevice, FsRtlIncrementCcFastReadResourceMiss, FsRtlIncrementCcFastReadNotPossible, CcFastCopyRead, FsRtlIncrementCcFastReadNoWait, FsRtlIncrementCcFastReadWait, CcFastCopyWrite, CcFastMdlReadWait, FsRtlUninitializeLargeMcb, FsRtlInitializeLargeMcb, FsRtlPrivateLock, FsRtlFastUnlockSingle, FsRtlFastUnlockAllByKey, FsRtlProcessFileLock, ExDeleteResourceLite, ExInitializeResourceLite, KeInitializeSpinLock, FsRtlResetLargeMcb, KeSetTimer, ExAcquireSharedStarveExclusive, CcGetDirtyPages, KeSetPriorityThread, FsRtlLookupLastLargeMcbEntry, FsRtlNumberOfRunsInLargeMcb, FsRtlSplitLargeMcb, FsRtlTruncateLargeMcb, CcRemapBcb, RtlFreeOemString, RtlUnicodeStringToCountedOemString, FsRtlIsFatDbcsLegal, FsRtlFastCheckLockForWrite, FsRtlFastCheckLockForRead, IoRaiseInformationalHardError, RtlAppendUnicodeStringToString, RtlCopyUnicodeString, IoVolumeDeviceToDosName, IoReleaseCancelSpinLock, IoAcquireCancelSpinLock, CcMdlWriteAbort, IoIsSystemThread, RtlLengthSecurityDescriptor, SeAssignSecurity, RtlSetDaclSecurityDescriptor, RtlCreateSecurityDescriptor, RtlAddAccessAllowedAce, RtlCreateAcl, RtlSubAuthoritySid, RtlInitializeSid, RtlLengthRequiredSid, ExInitializePagedLookasideList, ExInitializeNPagedLookasideList, MmIsThisAnNtAsSystem, MmQuerySystemSize, ZwQueryValueKey, ZwOpenKey, RtlVerifyVersionInfo, VerSetConditionMask, IoRegisterDriverReinitialization, KeInitializeDpc, KeInitializeTimer, IoRegisterFileSystem, KeBugCheck, KeInitializeMutant, FsRtlMdlWriteCompleteDev, FsRtlMdlReadCompleteDev, ExUuidCreate, RtlDelete, RtlSplay, RtlValidSid, RtlInsertElementGenericTableFullAvl, RtlLookupElementGenericTableFullAvl, SeQueryInformationToken, RtlEqualSid, SeExports, IoCheckQuotaBufferValidity, RtlInitializeGenericTableAvl, CcSetReadAheadGranularity, FsRtlCheckLockForReadAccess, ExAcquireSharedWaitForExclusive, FsRtlPostStackOverflow, FsRtlPostPagingFileStackOverflow, IoReleaseVpbSpinLock, IoAcquireVpbSpinLock, SeValidSecurityDescriptor, SeFreePrivileges, SeDeassignSecurity, SeSetSecurityDescriptorInfo, SeQuerySecurityDescriptorInfo, SeOpenObjectAuditAlarm, SeOpenObjectForDeleteAuditAlarm, SeAppendPrivileges, SeAuditingFileEventsWithContext, RtlEnumerateGenericTableWithoutSplayingAvl, FsRtlFreeFileLock, FsRtlAllocateFileLock, ExReinitializeResourceLite, FsRtlNotifyInitializeSync, FsRtlInitializeTunnelCache, RtlInsertElementGenericTableAvl, FsRtlUninitializeOplock, FsRtlInitializeOplock, FsRtlTeardownPerStreamContexts, IoDeleteDevice, FsRtlDeleteTunnelCache, FsRtlNotifyUninitializeSync, RtlEnumerateGenericTableAvl, IoWriteErrorLogEntry, IoAllocateErrorLogEntry, IoSetDeviceToVerify, KeTickCount, _abnormal_termination, _except_handler3, RtlFindNextForwardRunClear, ExAcquireFastMutexUnsafe, ExAllocatePoolWithTag, RtlInitializeBitMap, ExFreePoolWithTag, memmove, ExReleaseFastMutexUnsafe, ExReleaseResourceLite, _allshr, ExAcquireResourceSharedLite, ExAcquireResourceExclusiveLite, CcUnpinData, CcCopyRead, CcSetFileSizes, RtlFillMemoryUlong, IoPageRead, IoFreeErrorLogEntry, IoSynchronousPageWrite, ExDeletePagedLookasideList, ExDeleteNPagedLookasideList, IoGetDeviceObjectPointer, KeUnstackDetachProcess, KeStackAttachProcess, PsLookupProcessByProcessId, ZwWaitForSingleObject, PsCreateSystemThread, ZwCreateEvent, PoQueueShutdownWorkItem, ZwFreeVirtualMemory, PsRevertToSelf, PsDereferenceImpersonationToken, PsImpersonateClient, PsReferenceImpersonationToken, ZwAllocateVirtualMemory, ObReferenceObjectByPointer

( 0 exports ) 
 
PDFiD.: - 
RDS...: NSRL Reference Data Set
-

feshme · Answer

c:\windows\system32\dllcache\Beep.sys Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.20 - AhnLab-V3 5.0.0.2 2009.08.20 - AntiVir 7.9.1.3 2009.08.20 - Antiy-AVL 2.0.3.7 2009.08.20 - Authentium 5.1.2.4 2009.08.19 - Avast 4.8.1335.0 2009.08.19 - AVG 8.5.0.406 2009.08.19 - BitDefender 7.2 2009.08.20 - CAT-QuickHeal 10.00 2009.08.19 - ClamAV 0.94.1 2009.08.20 - Comodo 2032 2009.08.20 - DrWeb 5.0.0.12182 2009.08.20 - eSafe 7.0.17.0 2009.08.19 Win32.Banker eTrust-Vet 31.6.6688 2009.08.19 - F-Prot 4.4.4.56 2009.08.19 - F-Secure 8.0.14470.0 2009.08.20 - Fortinet 3.120.0.0 2009.08.20 - GData 19 2009.08.20 - Ikarus T3.1.1.68.0 2009.08.20 - Jiangmin 11.0.800 2009.08.20 - K7AntiVirus 7.10.822 2009.08.19 - Kaspersky 7.0.0.125 2009.08.20 - McAfee 5714 2009.08.19 - McAfee+Artemis 5714 2009.08.19 - McAfee-GW-Edition 6.8.5 2009.08.20 - Microsoft 1.4903 2009.08.20 - NOD32 4350 2009.08.20 - Norman 6.01.09 2009.08.19 - nProtect 2009.1.8.0 2009.08.20 - Panda 10.0.0.14 2009.08.20 - PCTools 4.4.2.0 2009.08.19 - Prevx 3.0 2009.08.20 - Rising 21.43.31.00 2009.08.20 - Sophos 4.44.0 2009.08.20 - Sunbelt 3.2.1858.2 2009.08.20 - Symantec 1.4.4.12 2009.08.20 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.20 - VBA32 3.12.10.9 2009.08.20 - ViRobot 2009.8.20.1892 2009.08.20 - VirusBuster 4.6.5.0 2009.08.19 - Information additionnelle File size: 4224 bytes MD5...: da1f27d85e0d1525f6621372e7b685e9 SHA1..: e3d2dc5eb273fa701de8af13b60d6baac7629260 SHA256: 5a81a46a3bdd19dafc6c87d277267a5d44f3a1b5302f2cc1111d84b7bad5610d ssdeep: 48:qvsINlblgYeU/DtYrmVimGxIBqOopSDKGV7Co+sjIZWQ7q2ue5WwGD+:ilbd/ DKrmLGWBqhev7X+MEWKLu+Ww8 PEiD..: - TrID..: File type identification Win64 Executable Generic (95.5%) Generic Win/DOS Executable (2.2%) DOS Executable Generic (2.2%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x66c timedatestamp.....: 0x3b7d82e5 (Fri Aug 17 20:47:33 2001) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x300 0x424 0x480 5.77 64f775a399d212649b5b58a280791c2d .rdata 0x780 0xad 0x100 2.62 0ace5f365131534c66de4137833221ad INIT 0x880 0x284 0x300 4.44 13a9d0bea8490140305ffa9291acfd99 .rsrc 0xb80 0x3c8 0x400 3.22 9b654fc1759147ff04b147754f347be4 .reloc 0xf80 0x9a 0x100 2.80 5c4742feb834ca0995d1e806fe06cc57 ( 2 imports ) > ntoskrnl.exe: MmLockPagableDataSection, KeCancelTimer, MmUnlockPagableImageSection, IoStartNextPacket, KeSetTimer, _allmul, IoStartPacket, KeInitializeEvent, KeInitializeTimer, KeInitializeDpc, IoCreateDevice, RtlInitUnicodeString, IoAcquireCancelSpinLock, KeRemoveDeviceQueue, KeRemoveEntryDeviceQueue, IoReleaseCancelSpinLock, IoDeleteDevice, IofCompleteRequest > HAL.dll: ExReleaseFastMutex, KfRaiseIrql, KfLowerIrql, HalMakeBeep, ExAcquireFastMutex ( 0 exports ) PDFiD.: - RDS...: NSRL Reference Data Set ( Topics Entertainment ) > Instant Home Design: beep.sys ( Symantec ) > Norton SystemWorks 2005: BEEP.SYS ( Compaq ) > Compaq Operating System CD: beep.sys ( NewTech Infosystems Inc. ) > CD-Maker Plus Edition: beep.sys ( The Learning Company Inc. ) > Reader Rabbits Toddler: beep.sys ( Dell ) > Reinstallation CD Microsoft Windows XP Professional: beep.sys ( Microsoft ) > Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: beep.sys > MSDN Disc 2466.2: beep.sys > MSDN Disc 2466.1: beep.sys > MSDN Disc 2466.4: beep.sys > MSDN Disc 2465: beep.sys > MSDN Disc 2464: beep.sys > MSDN Disc 2466: beep.sys > Windows XP: beep.sys > Microsoft TechNet Trial Software 2002 Volume 1: beep.sys > MSDN Disc2389: beep.sys > MSDN disc 2455.2: beep.sys > Windows 98 Versions: beep.sys > MSDN MSIE 6.0, IE 6.0 SP1, Windows 2000 Advanced Server, Windows 2000 Professional, Windows 2000 Server, Windows 98 Second ed., Windows ME, Win XP Pro: beep.sys > MSDN Disc 2438.7: beep.sys > MSDN Disc 2438.2: beep.sys > MSDN Disc 2438.1: beep.sys > MSDN Disc 3264: beep.sys > MSDN Disc 2455: beep.sys > MSDN Disc 2438.8: beep.sys > MSDN Disc 2428.1: beep.sys > MSDN Disc 2428.2: beep.sys > MSDN Disc 2428.5: beep.sys > MSDN Disc 2428.4: beep.sys > MSDN Disc 2428.8: beep.sys > Platforms, SDK/DDK: beep.sys > Internet Explorer Versions: beep.sys > Virtual PC for Mac Windows XP Professional Edition: beep.sys > Platforms: beep.sys > MSDN DISC 2438.3: beep.sys > Platforms SDKs/DDKs: beep.sys > MSDN Disc 2053: beep.sys > MSDN Disc 2444: beep.sys > MSDN Disc 2443: beep.sys > MSDN Disc 2442: beep.sys > MSDN Disc 2441: beep.sys > Internet Explorer: beep.sys > MSDN Disc2428.3: beep.sys > MSDN Disc 1550: beep.sys > MSDN Disc 2455.6: beep.sys > MSDN Disc 2455.1: beep.sys > MSDN Disc 2476.1: beep.sys > MSDN Disc 2476.2: beep.sys > 2262A: Supporting Users Running Applications on a Microsoft Windows XP Operating System: beep.sys > Disc 2438.5: beep.sys > 2261A: Supporting Users Running the Microsoft Windows XP Operating System: beep.sys > MSDN Disc 2041: beep.sys > MSDN Disc 2439.3: beep.sys > MSDN Disc 2439.2: beep.sys > MSDN Disc 2439.1: beep.sys > MSDN Disc 2439.7: beep.sys > MSDN Disc 2439.6: beep.sys > MSDN Disc 2438: beep.sys > MSDN Disc 2439: beep.sys > MSDN Disc 2465.4: beep.sys > MSDN Disc 2465.5: beep.sys > MSDN Disc 2465.2: beep.sys > Windows XP Professional: beep.sys > MSDN Disc 2364: beep.sys > Office XP Professional with FrontPage: beep.sys > Microsoft Windows XP Professional: beep.sys > Windows XP Professional 2002 Service Pack 1: beep.sys > MSDN Disc 2443.1: beep.sys > MSDN Disc 2443.2: beep.sys > MSDN Disc 2443.4: beep.sys > MSDN disc 2465.3: beep.sys > MSDN Disc 2441.1: beep.sys > MSDN Disc 2441.6: beep.sys > MSDN Disc 2441.7: beep.sys > MSDN Disc 2441.5: beep.sys > MSDN Disc 2428: beep.sys > MSDN Disc 2477.2: beep.sys > Windows XP Home Edition: beep.sys > Windows CE .NET Evaluation Software: beep.sys > MSDN Disc 2307: beep.sys > Implementing and Supporting Microsoft Windows XP Professional: beep.sys > MSDN Disc 2464.1: beep.sys > MSDN Disc 2464.5: beep.sys > MSDN Disc 2439.8: beep.sys > MSDN Disc 2440.5: beep.sys > MSDN Disc 2440.4: beep.sys > MSDN Disc 2440.3: beep.sys > MSDN Disc2365: beep.sys > MDSN Disc 2441.2: beep.sys > Platforms, SDK/DDK, Developer Tools: beep.sys > MSDN disc 2390: beep.sys > MSDN Disc 2476.4: beep.sys > Microsoft Security Resource Kit: beep.sys > Windows 2000 Versions: beep.sys > MSDN Disc 2444.3: beep.sys > MSDN Disc 2444.1: beep.sys > MSDN Disc 2444.6: beep.sys > MSDN Disc 2444.4: beep.sys > Virtual PC for Mac Windows XP Home Edition: beep.sys > Windows XP eMbedded Evaluation Software: beep.sys > MSDN Disc 2476: beep.sys > MSDN Disc 2442.4: beep.sys > MSDN Disc 2442.6: beep.sys > MSDN Disc 2442.1: beep.sys > Applications, Platforms, Servers: beep.sys > MSDN Disc 2442.3: beep.sys > MSDN Disc 2442.2: beep.sys > Windows XP Tablet PC Edition: beep.sys > Applications, Platforms: beep.sys ( Sony ) > Sony VAIO Recover CDs: BEEP.SYS ( Gateway ) > Gateway Operating System Windows XP Pro Edition SP2: BEEP.SYS,beep.sys ThreatExpert info: https://www.symantec.com?md5=da1f27d85e0d1525f6621372e7b685e9

feshme · Answer

c:\windows\system32\drivers\beep.sys Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.24 2009.08.20 - AhnLab-V3 5.0.0.2 2009.08.20 - AntiVir 7.9.1.3 2009.08.20 - Antiy-AVL 2.0.3.7 2009.08.20 - Authentium 5.1.2.4 2009.08.19 - Avast 4.8.1335.0 2009.08.19 - AVG 8.5.0.406 2009.08.19 - BitDefender 7.2 2009.08.20 - CAT-QuickHeal 10.00 2009.08.19 - ClamAV 0.94.1 2009.08.20 - Comodo 2032 2009.08.20 - DrWeb 5.0.0.12182 2009.08.20 - eSafe 7.0.17.0 2009.08.19 Win32.Banker eTrust-Vet 31.6.6688 2009.08.19 - F-Prot 4.4.4.56 2009.08.19 - F-Secure 8.0.14470.0 2009.08.20 - Fortinet 3.120.0.0 2009.08.20 - GData 19 2009.08.20 - Ikarus T3.1.1.68.0 2009.08.20 - Jiangmin 11.0.800 2009.08.20 - K7AntiVirus 7.10.822 2009.08.19 - Kaspersky 7.0.0.125 2009.08.20 - McAfee 5714 2009.08.19 - McAfee+Artemis 5714 2009.08.19 - McAfee-GW-Edition 6.8.5 2009.08.20 - Microsoft 1.4903 2009.08.20 - NOD32 4350 2009.08.20 - Norman 6.01.09 2009.08.19 - nProtect 2009.1.8.0 2009.08.20 - Panda 10.0.0.14 2009.08.20 - PCTools 4.4.2.0 2009.08.19 - Prevx 3.0 2009.08.20 - Rising 21.43.31.00 2009.08.20 - Sophos 4.44.0 2009.08.20 - Sunbelt 3.2.1858.2 2009.08.20 - Symantec 1.4.4.12 2009.08.20 - TheHacker 6.3.4.3.383 2009.08.13 - TrendMicro 8.950.0.1094 2009.08.20 - VBA32 3.12.10.9 2009.08.20 - ViRobot 2009.8.20.1892 2009.08.20 - VirusBuster 4.6.5.0 2009.08.19 - Information additionnelle File size: 4224 bytes MD5...: da1f27d85e0d1525f6621372e7b685e9 SHA1..: e3d2dc5eb273fa701de8af13b60d6baac7629260 SHA256: 5a81a46a3bdd19dafc6c87d277267a5d44f3a1b5302f2cc1111d84b7bad5610d ssdeep: 48:qvsINlblgYeU/DtYrmVimGxIBqOopSDKGV7Co+sjIZWQ7q2ue5WwGD+:ilbd/ DKrmLGWBqhev7X+MEWKLu+Ww8 PEiD..: - TrID..: File type identification Win64 Executable Generic (95.5%) Generic Win/DOS Executable (2.2%) DOS Executable Generic (2.2%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x66c timedatestamp.....: 0x3b7d82e5 (Fri Aug 17 20:47:33 2001) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x300 0x424 0x480 5.77 64f775a399d212649b5b58a280791c2d .rdata 0x780 0xad 0x100 2.62 0ace5f365131534c66de4137833221ad INIT 0x880 0x284 0x300 4.44 13a9d0bea8490140305ffa9291acfd99 .rsrc 0xb80 0x3c8 0x400 3.22 9b654fc1759147ff04b147754f347be4 .reloc 0xf80 0x9a 0x100 2.80 5c4742feb834ca0995d1e806fe06cc57 ( 2 imports ) > ntoskrnl.exe: MmLockPagableDataSection, KeCancelTimer, MmUnlockPagableImageSection, IoStartNextPacket, KeSetTimer, _allmul, IoStartPacket, KeInitializeEvent, KeInitializeTimer, KeInitializeDpc, IoCreateDevice, RtlInitUnicodeString, IoAcquireCancelSpinLock, KeRemoveDeviceQueue, KeRemoveEntryDeviceQueue, IoReleaseCancelSpinLock, IoDeleteDevice, IofCompleteRequest > HAL.dll: ExReleaseFastMutex, KfRaiseIrql, KfLowerIrql, HalMakeBeep, ExAcquireFastMutex ( 0 exports ) PDFiD.: - RDS...: NSRL Reference Data Set ( Topics Entertainment ) > Instant Home Design: beep.sys ( Symantec ) > Norton SystemWorks 2005: BEEP.SYS ( Compaq ) > Compaq Operating System CD: beep.sys ( NewTech Infosystems Inc. ) > CD-Maker Plus Edition: beep.sys ( The Learning Company Inc. ) > Reader Rabbits Toddler: beep.sys ( Dell ) > Reinstallation CD Microsoft Windows XP Professional: beep.sys ( Microsoft ) > Operating System Reinstallation CD Microsoft Windows XP Professional Service Pack 2: beep.sys > MSDN Disc 2466.2: beep.sys > MSDN Disc 2466.1: beep.sys > MSDN Disc 2466.4: beep.sys > MSDN Disc 2465: beep.sys > MSDN Disc 2464: beep.sys > MSDN Disc 2466: beep.sys > Windows XP: beep.sys > Microsoft TechNet Trial Software 2002 Volume 1: beep.sys > MSDN Disc2389: beep.sys > MSDN disc 2455.2: beep.sys > Windows 98 Versions: beep.sys > MSDN MSIE 6.0, IE 6.0 SP1, Windows 2000 Advanced Server, Windows 2000 Professional, Windows 2000 Server, Windows 98 Second ed., Windows ME, Win XP Pro: beep.sys > MSDN Disc 2438.7: beep.sys > MSDN Disc 2438.2: beep.sys > MSDN Disc 2438.1: beep.sys > MSDN Disc 3264: beep.sys > MSDN Disc 2455: beep.sys > MSDN Disc 2438.8: beep.sys > MSDN Disc 2428.1: beep.sys > MSDN Disc 2428.2: beep.sys > MSDN Disc 2428.5: beep.sys > MSDN Disc 2428.4: beep.sys > MSDN Disc 2428.8: beep.sys > Platforms, SDK/DDK: beep.sys > Internet Explorer Versions: beep.sys > Virtual PC for Mac Windows XP Professional Edition: beep.sys > Platforms: beep.sys > MSDN DISC 2438.3: beep.sys > Platforms SDKs/DDKs: beep.sys > MSDN Disc 2053: beep.sys > MSDN Disc 2444: beep.sys > MSDN Disc 2443: beep.sys > MSDN Disc 2442: beep.sys > MSDN Disc 2441: beep.sys > Internet Explorer: beep.sys > MSDN Disc2428.3: beep.sys > MSDN Disc 1550: beep.sys > MSDN Disc 2455.6: beep.sys > MSDN Disc 2455.1: beep.sys > MSDN Disc 2476.1: beep.sys > MSDN Disc 2476.2: beep.sys > 2262A: Supporting Users Running Applications on a Microsoft Windows XP Operating System: beep.sys > Disc 2438.5: beep.sys > 2261A: Supporting Users Running the Microsoft Windows XP Operating System: beep.sys > MSDN Disc 2041: beep.sys > MSDN Disc 2439.3: beep.sys > MSDN Disc 2439.2: beep.sys > MSDN Disc 2439.1: beep.sys > MSDN Disc 2439.7: beep.sys > MSDN Disc 2439.6: beep.sys > MSDN Disc 2438: beep.sys > MSDN Disc 2439: beep.sys > MSDN Disc 2465.4: beep.sys > MSDN Disc 2465.5: beep.sys > MSDN Disc 2465.2: beep.sys > Windows XP Professional: beep.sys > MSDN Disc 2364: beep.sys > Office XP Professional with FrontPage: beep.sys > Microsoft Windows XP Professional: beep.sys > Windows XP Professional 2002 Service Pack 1: beep.sys > MSDN Disc 2443.1: beep.sys > MSDN Disc 2443.2: beep.sys > MSDN Disc 2443.4: beep.sys > MSDN disc 2465.3: beep.sys > MSDN Disc 2441.1: beep.sys > MSDN Disc 2441.6: beep.sys > MSDN Disc 2441.7: beep.sys > MSDN Disc 2441.5: beep.sys > MSDN Disc 2428: beep.sys > MSDN Disc 2477.2: beep.sys > Windows XP Home Edition: beep.sys > Windows CE .NET Evaluation Software: beep.sys > MSDN Disc 2307: beep.sys > Implementing and Supporting Microsoft Windows XP Professional: beep.sys > MSDN Disc 2464.1: beep.sys > MSDN Disc 2464.5: beep.sys > MSDN Disc 2439.8: beep.sys > MSDN Disc 2440.5: beep.sys > MSDN Disc 2440.4: beep.sys > MSDN Disc 2440.3: beep.sys > MSDN Disc2365: beep.sys > MDSN Disc 2441.2: beep.sys > Platforms, SDK/DDK, Developer Tools: beep.sys > MSDN disc 2390: beep.sys > MSDN Disc 2476.4: beep.sys > Microsoft Security Resource Kit: beep.sys > Windows 2000 Versions: beep.sys > MSDN Disc 2444.3: beep.sys > MSDN Disc 2444.1: beep.sys > MSDN Disc 2444.6: beep.sys > MSDN Disc 2444.4: beep.sys > Virtual PC for Mac Windows XP Home Edition: beep.sys > Windows XP eMbedded Evaluation Software: beep.sys > MSDN Disc 2476: beep.sys > MSDN Disc 2442.4: beep.sys > MSDN Disc 2442.6: beep.sys > MSDN Disc 2442.1: beep.sys > Applications, Platforms, Servers: beep.sys > MSDN Disc 2442.3: beep.sys > MSDN Disc 2442.2: beep.sys > Windows XP Tablet PC Edition: beep.sys > Applications, Platforms: beep.sys ( Sony ) > Sony VAIO Recover CDs: BEEP.SYS ( Gateway ) > Gateway Operating System Windows XP Pro Edition SP2: BEEP.SYS,beep.sys ThreatExpert info: https://www.symantec.com?md5=da1f27d85e0d1525f6621372e7b685e9

feshme · Answer

c:\windows\system32\mspmsnsv.dll 


Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.20 - 
AhnLab-V3 5.0.0.2 2009.08.20 - 
AntiVir 7.9.1.3 2009.08.20 - 
Antiy-AVL 2.0.3.7 2009.08.20 - 
Authentium 5.1.2.4 2009.08.19 - 
Avast 4.8.1335.0 2009.08.19 - 
AVG 8.5.0.406 2009.08.19 - 
BitDefender 7.2 2009.08.20 - 
CAT-QuickHeal 10.00 2009.08.19 - 
ClamAV 0.94.1 2009.08.20 - 
Comodo 2032 2009.08.20 - 
DrWeb 5.0.0.12182 2009.08.20 - 
eSafe 7.0.17.0 2009.08.19 - 
eTrust-Vet 31.6.6688 2009.08.19 - 
F-Prot 4.4.4.56 2009.08.19 - 
F-Secure 8.0.14470.0 2009.08.20 - 
Fortinet 3.120.0.0 2009.08.20 - 
GData 19 2009.08.20 - 
Ikarus T3.1.1.68.0 2009.08.20 - 
Jiangmin 11.0.800 2009.08.20 - 
K7AntiVirus 7.10.822 2009.08.19 - 
Kaspersky 7.0.0.125 2009.08.20 - 
McAfee 5714 2009.08.19 - 
McAfee+Artemis 5714 2009.08.19 - 
McAfee-GW-Edition 6.8.5 2009.08.20 - 
Microsoft 1.4903 2009.08.20 - 
NOD32 4350 2009.08.20 - 
Norman 6.01.09 2009.08.19 - 
nProtect 2009.1.8.0 2009.08.20 - 
Panda 10.0.0.14 2009.08.20 - 
PCTools 4.4.2.0 2009.08.19 - 
Prevx 3.0 2009.08.20 - 
Rising 21.43.31.00 2009.08.20 - 
Sophos 4.44.0 2009.08.20 - 
Sunbelt 3.2.1858.2 2009.08.20 - 
Symantec 1.4.4.12 2009.08.20 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.20 - 
VBA32 3.12.10.9 2009.08.20 - 
ViRobot 2009.8.20.1892 2009.08.20 - 
VirusBuster 4.6.5.0 2009.08.19 - 
Information additionnelle 
File size: 52736 bytes 
MD5...: 762b2a5f0e8b0164a5db6741959dfb0c 
SHA1..: 724560d7bb92b09bb511af884b99c80fd41b0a89 
SHA256: 110575bb00fe3ab09376401e72d2012fc97eb213ce1fdeccd4ade83a1b21e722 
ssdeep: 1536:4ggtgoQrdsm8fmDwegYsbmsoTGI91zt4qegMQ1a2k0n5L:4ggtg0eDwaswx
egMKa2k0n5
 
PEiD..: - 
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%) 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x3f57
timedatestamp.....: 0x4110968b (Wed Aug 04 07:55:55 2004)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xa5b7 0xa600 6.61 84358aa56d7c354951ea4f5fbcdb4d8d
.data 0xc000 0x6b8 0x600 4.51 ddfe7f007dd8189312fa111594da482b
.rsrc 0xd000 0x8a0 0xa00 3.84 7a8463a2d27d60007a3c7f7b692ac54c
.reloc 0xe000 0x12e0 0x1400 4.92 94d2e71202ad9efc050244b7ef326e4d

( 4 imports ) 
> KERNEL32.dll: QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, FlushFileBuffers, GetFileAttributesA, SetFileAttributesA, GetVolumeInformationA, SetErrorMode, GetCurrentDirectoryA, GetModuleHandleA, QueryDosDeviceA, GetSystemDirectoryA, LoadLibraryA, WideCharToMultiByte, WaitNamedPipeW, CreateFileA, CreateFileW, DeviceIoControl, CompareStringA, GetDriveTypeA, GetCurrentProcess, TerminateProcess, GetModuleFileNameA, FormatMessageA, LoadLibraryExA, GetProcAddress, FormatMessageW, FreeLibrary, GetTickCount, Sleep, SetLastError, InitializeCriticalSection, DisableThreadLibraryCalls, LeaveCriticalSection, DeleteCriticalSection, LocalAlloc, CreateNamedPipeA, LocalFree, ResetEvent, GetOverlappedResult, WaitForMultipleObjects, WriteFile, ReadFile, ConnectNamedPipe, SetEvent, CloseHandle, CancelIo, WaitForSingleObject, DisconnectNamedPipe, CreateEventA, GetLastError, GetDriveTypeW, EnterCriticalSection, SetCurrentDirectoryA, GetVersionExA
> msvcrt.dll: malloc, _onexit, __dllonexit, _adjust_fdiv, _initterm, free, wcslen, wcscmp, wcscpy, __2@YAPAXI@Z, memmove, __3@YAXPAX@Z, _except_handler3, _purecall, __CxxFrameHandler, _CxxThrowException, strstr, strcpy, strncpy, memset, atoi, memcpy, isdigit, strcmp, strncmp, strlen, strcat, time, _memccpy, sscanf, sprintf, _strupr, _stricmp, _strnicmp, _ultoa, __1type_info@@UAE@XZ, _terminate@@YAXXZ
> ADVAPI32.dll: AllocateAndInitializeSid, RegOpenKeyA, RegEnumKeyA, RegOpenKeyExA, RegEnumKeyExA, RegQueryValueExA, StartServiceA, CreateServiceA, RegSetValueExA, QueryServiceStatus, ControlService, DeleteService, RegDeleteKeyA, RegCreateKeyA, RegQueryValueExW, RegSetValueExW, RegCloseKey, GetSecurityInfo, SetSecurityInfo, RegisterServiceCtrlHandlerA, SetEntriesInAclA, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, FreeSid, ImpersonateNamedPipeClient, RevertToSelf, SetServiceStatus, RegisterEventSourceA, ReportEventA, DeregisterEventSource, OpenSCManagerA, OpenServiceA, CloseServiceHandle
> USER32.dll: LoadImageA, LoadIconA, CharLowerA, CharUpperA, wsprintfA

( 4 exports ) 
DllMain, DllRegisterServer, DllUnregisterServer, ServiceMain
 
PDFiD.: - 
RDS...: NSRL Reference Data Set

( Microsoft )

> MSDN Disc 2439.8: mspmsnsv.dll
> MSDN Disc 2439.7: mspmsnsv.dll
> MSDN Disc 2439.6: mspmsnsv.dll

feshme · Answer

C:\WINDOWS\SoftwareDistribution\Download\c8f95ed251aedea843a­bb9ea5b1a52d3\download\BIT40.tmp 

Je ne l'est pas trouve dans windows donc j'ai coller le nom directement dans virustotal et voici le resultat : 0 bytes size received / Se ha recibido un archivo vacio

feshme · Answer

IDEM pour C:\WINDOWS\SoftwareDistribution\Download\ec9dc63e53c8bf9a1e8­0cf1489c682bd\download\BIT2A.tmp

feshme · Answer

C:\Documents and Settings\All Users\DRM\DRMv1.bak"  IDEM

feshme · Answer

C:\Program Files\InterActual\InterActual Player\iti9.tmp"

Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.20 - 
AhnLab-V3 5.0.0.2 2009.08.20 - 
AntiVir 7.9.1.3 2009.08.20 - 
Antiy-AVL 2.0.3.7 2009.08.20 - 
Authentium 5.1.2.4 2009.08.19 - 
Avast 4.8.1335.0 2009.08.19 - 
AVG 8.5.0.406 2009.08.19 - 
BitDefender 7.2 2009.08.20 - 
CAT-QuickHeal 10.00 2009.08.19 - 
ClamAV 0.94.1 2009.08.20 - 
Comodo 2032 2009.08.20 - 
DrWeb 5.0.0.12182 2009.08.20 - 
eSafe 7.0.17.0 2009.08.19 - 
eTrust-Vet 31.6.6688 2009.08.19 - 
F-Prot 4.4.4.56 2009.08.19 - 
F-Secure 8.0.14470.0 2009.08.20 - 
Fortinet 3.120.0.0 2009.08.20 - 
GData 19 2009.08.20 - 
Ikarus T3.1.1.68.0 2009.08.20 - 
Jiangmin 11.0.800 2009.08.20 - 
K7AntiVirus 7.10.822 2009.08.19 - 
Kaspersky 7.0.0.125 2009.08.20 - 
McAfee 5714 2009.08.19 - 
McAfee+Artemis 5714 2009.08.19 - 
McAfee-GW-Edition 6.8.5 2009.08.20 - 
Microsoft 1.4903 2009.08.20 - 
NOD32 4350 2009.08.20 - 
Norman 6.01.09 2009.08.19 - 
nProtect 2009.1.8.0 2009.08.20 - 
Panda 10.0.0.14 2009.08.20 - 
PCTools 4.4.2.0 2009.08.19 - 
Prevx 3.0 2009.08.20 - 
Rising 21.43.31.00 2009.08.20 - 
Sophos 4.44.0 2009.08.20 - 
Sunbelt 3.2.1858.2 2009.08.20 - 
Symantec 1.4.4.12 2009.08.20 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.20 - 
VBA32 3.12.10.9 2009.08.20 - 
ViRobot 2009.8.20.1892 2009.08.20 - 
VirusBuster 4.6.5.0 2009.08.19 - 
Information additionnelle 
File size: 4558 bytes 
MD5...: 078ad289bca9b4ce1a18506ef1a76dcd 
SHA1..: de8ee1fa264a0a5befe77921da45a78bdcc56fac 
SHA256: acb381165020cbdc813f433fbeb2d263da57c50bb31ff9d8e3224d91b4e19ae0 
ssdeep: 96:ms39jmFuWSA8gPmP1ahL1BQgdTkv13cEjfuH/4Ho9efOYNVPiz9:4gcx
 
PEiD..: - 
TrID..: File type identification
Unknown! 
PEInfo: - 
PDFiD.: - 
RDS...: NSRL Reference Data Set
-

plopus · Answer

as tu afficher les dossier caché comme ceci reverifie un fix a pu anulé ton action

https://www.commentcamarche.net/informatique/windows/185-afficher-les-extensions-et-les-fichiers-caches-sous-windows/

et oublie pas de decocher AUSSI "masquer les extension de fichier connu...."

et reverifie si tu les vois

feshme · Answer

C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp

0 bytes size received / Se ha recibido un archivo vacio

plopus · Answer

https://forums.commentcamarche.net/forum/affich-13923017-virus-system32-autre?page=5#108

feshme · Answer

C:\WINDOWS\SoftwareDistribution\Download\c8f95ed251aedea843a­­bb9ea5b1a52d3\download\BIT40.tmp 

J'ai reussi a le trouvé dans la hierarchie des fichiers, mais le resultat Virus total est le meme

feshme · Answer

C:\WINDOWS\SoftwareDistribution\Download\ec9dc63e53c8bf9a1e8­­0cf1489c682bd\download\BIT2A.tmp

jai reessayer mais pareil je le trouve cependant virustotal affiche 0 bytes size received / Se ha recibido un archivo vacio

feshme · Answer

C:\Documents and Settings\All Users\DRM\DRMv1.bak je le trouve toujours pas mais en collant, voici le resultat

Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.24 2009.08.20 - 
AhnLab-V3 5.0.0.2 2009.08.20 - 
AntiVir 7.9.1.3 2009.08.20 - 
Antiy-AVL 2.0.3.7 2009.08.20 - 
Authentium 5.1.2.4 2009.08.19 - 
Avast 4.8.1335.0 2009.08.19 - 
AVG 8.5.0.406 2009.08.19 - 
BitDefender 7.2 2009.08.20 - 
CAT-QuickHeal 10.00 2009.08.19 - 
ClamAV 0.94.1 2009.08.20 - 
Comodo 2032 2009.08.20 - 
DrWeb 5.0.0.12182 2009.08.20 - 
eSafe 7.0.17.0 2009.08.19 - 
eTrust-Vet 31.6.6688 2009.08.19 - 
F-Prot 4.4.4.56 2009.08.19 - 
F-Secure 8.0.14470.0 2009.08.20 - 
Fortinet 3.120.0.0 2009.08.20 - 
GData 19 2009.08.20 - 
Ikarus T3.1.1.68.0 2009.08.20 - 
Jiangmin 11.0.800 2009.08.20 - 
K7AntiVirus 7.10.822 2009.08.19 - 
Kaspersky 7.0.0.125 2009.08.20 - 
McAfee 5714 2009.08.19 - 
McAfee+Artemis 5714 2009.08.19 - 
McAfee-GW-Edition 6.8.5 2009.08.20 - 
Microsoft 1.4903 2009.08.20 - 
NOD32 4350 2009.08.20 - 
Norman 6.01.09 2009.08.19 - 
nProtect 2009.1.8.0 2009.08.20 - 
Panda 10.0.0.14 2009.08.20 - 
PCTools 4.4.2.0 2009.08.19 - 
Prevx 3.0 2009.08.20 - 
Rising 21.43.31.00 2009.08.20 - 
Sophos 4.44.0 2009.08.20 - 
Sunbelt 3.2.1858.2 2009.08.20 - 
Symantec 1.4.4.12 2009.08.20 - 
TheHacker 6.3.4.3.383 2009.08.13 - 
TrendMicro 8.950.0.1094 2009.08.20 - 
VBA32 3.12.10.9 2009.08.20 - 
ViRobot 2009.8.20.1892 2009.08.20 - 
VirusBuster 4.6.5.0 2009.08.19 - 
Information additionnelle 
File size: 4348 bytes 
MD5...: b52f303de014b81b95d1819580d4bd2d 
SHA1..: f6f2d2f0109e22c7fc946dfd0dfc135e4ad4fd7f 
SHA256: 53714e19599f1d811c19d35b22ef950102a51df3548954e621e27a6fdf083be8 
ssdeep: 48:C4WuKKKKKKKKKKKKOlEXxg7aNfbnKeAlXm4pgjM:C4RKKKKKKKKKKKKOlEXxg
7aNfbnKewXR
 
PEiD..: - 
TrID..: File type identification
Unknown! 
PEInfo: - 
PDFiD.: - 
RDS...: NSRL Reference Data Set
-

feshme · Answer

C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp 

jai essayer plusieurs fois en collant le chemin, mais toujours le meme resultat : 0 bytes size received / Se ha recibido un archivo vacio

plopus · Answer

re

refait un fichier document appele CFscript  et copie colle ceci dedans :



killall::

file::
C:\WINDOWS\SoftwareDistribution\Download\06119f7f007fbf3388fb7f012fd2ce49\download\BIT2C.tmp
C:\WINDOWS\SoftwareDistribution\Download\2b0ec6af95107cd747155f214801a1de\download\BIT2F.tmp
C:\WINDOWS\SoftwareDistribution\Download\457af15380631760d255c46e3ce4c508\download\BIT2D.tmp
C:\WINDOWS\SoftwareDistribution\Download\4ad242756613df3e539d49e3db7fff27\download\BIT43.tmp
C:\WINDOWS\SoftwareDistribution\Download\813a989071c1720c8fca52f421b7b9e5\download\BIT34.tmp
C:\WINDOWS\SoftwareDistribution\Download\84db8362c64a1369b93bd1a60a67cb01\download\BIT2B.tmp
C:\WINDOWS\SoftwareDistribution\Download\a957c596efa7d0ec1b4b7fdc1e1c5705\download\BIT3A.tmp
C:\WINDOWS\SoftwareDistribution\Download\c8f95ed251aedea843abb9ea5b1a52d3\download\BIT40.tmp
C:\WINDOWS\SoftwareDistribution\Download\d8cfedd5cfd3f0881276825d82978e5d\download\BIT39.tmp
C:\WINDOWS\SoftwareDistribution\Download\e8ac11bc9e4687d6c2a32699ff0541d6\download\BIT38.tmp
C:\WINDOWS\SoftwareDistribution\Download\ec9dc63e53c8bf9a1e80cf1489c682bd\download\BIT2A.tmp
C:\WINDOWS\SoftwareDistribution\Download\edf770ea565c428bca41a4befcabb97b\download\BIT29.tmp
C:\WINDOWS\SoftwareDistribution\Download\ef76b58e91ae8084bf0833c90d4b9382\download\BIT31.tmp
C:\WINDOWS\SoftwareDistribution\Download\fde0566446f6dd640c536f419fe1216a\download\BIT2E.tmp 

driver::
ayfgwlxg



et fait glisser le CFscript sur combofix comme tu l'as deja fait 
et ensuite poste le rapport


Aprés Fais un scan en ligne Kaspersky :

• Désactive ton antivirus
• Fais un scan en ligne ici https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
• Clique sur "Kaspersky Online Scanner Cliquez-ici"
• Lis le texte d'information, puis clique sur « J'accepte »
• Si une fenêtre te demande t'exécuter un programme, accepte
• Une fois la mise à jour téléchargée, choisis "Poste de travail" pour le scan.
• A la fin de l'analyse, clique sur « Enregistrer rapport » et poste le dans ta prochaine réponse.

Tutoriel illustré : https://www.commentcamarche.net/faq/17751-scanner-en-ligne-avec-kaspersky


puis

relance malwarebyte , va dans l'onglet mise a jour, recherche des mises a jour
puis lance une analyse COMPLET et selectionne tout tes disques et poste le rapports en supprimant si des elements trouvés

feshme · Answer

ComboFix 09-08-18.04 - Nuno 20/08/2009 11:38.4.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.33.1036.18.758.405 [GMT 2:00]
Running from: c:\documents and settings\Nuno\Bureau\Fish.exe
Command switches used :: c:\documents and settings\Nuno\Bureau\CFscript.txt
 * Created a new restore point

FILE ::
"c:\windows\SoftwareDistribution\Download\06119f7f007fbf3388f­b7f012fd2ce49\download\BIT2C.tmp"
"c:\windows\SoftwareDistribution\Download\2b0ec6af95107cd7471­55f214801a1de\download\BIT2F.tmp"
"c:\windows\SoftwareDistribution\Download\457af15380631760d25­5c46e3ce4c508\download\BIT2D.tmp"
"c:\windows\SoftwareDistribution\Download\4ad242756613df3e539­d49e3db7fff27\download\BIT43.tmp"
"c:\windows\SoftwareDistribution\Download\813a989071c1720c8fc­a52f421b7b9e5\download\BIT34.tmp"
"c:\windows\SoftwareDistribution\Download\84db8362c64a1369b93­bd1a60a67cb01\download\BIT2B.tmp"
"c:\windows\SoftwareDistribution\Download\a957c596efa7d0ec1b4­b7fdc1e1c5705\download\BIT3A.tmp"
"c:\windows\SoftwareDistribution\Download\c8f95ed251aedea843a­bb9ea5b1a52d3\download\BIT40.tmp"
"c:\windows\SoftwareDistribution\Download\d8cfedd5cfd3f088127­6825d82978e5d\download\BIT39.tmp"
"c:\windows\SoftwareDistribution\Download\e8ac11bc9e4687d6c2a­32699ff0541d6\download\BIT38.tmp"
"c:\windows\SoftwareDistribution\Download\ec9dc63e53c8bf9a1e8­0cf1489c682bd\download\BIT2A.tmp"
"c:\windows\SoftwareDistribution\Download\edf770ea565c428bca4­1a4befcabb97b\download\BIT29.tmp"
"c:\windows\SoftwareDistribution\Download\ef76b58e91ae8084bf0­833c90d4b9382\download\BIT31.tmp"
"c:\windows\SoftwareDistribution\Download\fde0566446f6dd640c5­36f419fe1216a\download\BIT2E.tmp"
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ayfgwlxg


(((((((((((((((((((((((((   Files Created from 2009-07-20 to 2009-08-20  )))))))))))))))))))))))))))))))
.

2009-08-19 21:32 . 2009-08-19 21:32	578048	----a-w-	c:\windows\system32\dllcache\user32.dll
2009-08-19 21:27 . 2009-08-19 21:27	--------	d-----w-	c:\windows\ERUNT
2009-08-19 21:20 . 2009-08-19 21:50	--------	d-----w-	C:\SDFix
2009-08-19 15:45 . 2009-08-19 15:57	--------	d-----w-	C:\FR-files
2009-08-19 15:34 . 2009-08-19 15:55	--------	d-----w-	C:\WinFileReplace
2009-08-18 19:44 . 2004-08-05 13:00	1548288	----a-w-	c:\windows\system32\sfcfiles.dll
2009-08-18 19:44 . 2004-08-05 13:00	1548288	----a-w-	c:\windows\system32\dllcache\sfcfiles.dll
2009-08-18 14:53 . 2009-08-18 14:53	152576	----a-w-	c:\documents and settings\Nuno\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-18 11:51 . 2009-08-18 14:54	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-08-18 10:49 . 2009-08-18 10:49	--------	d-----w-	c:\documents and settings\Nuno\Application Data\Malwarebytes
2009-08-18 10:48 . 2009-08-03 11:36	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-18 10:48 . 2009-08-18 10:48	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-18 10:48 . 2009-08-03 11:36	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-08-18 10:48 . 2009-08-18 10:49	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-08-18 06:06 . 2009-08-18 08:27	--------	d-----w-	C:\UsbFix
2009-08-17 19:19 . 2009-08-17 19:20	--------	d-----w-	C:sit
2009-08-17 13:29 . 2009-08-20 08:20	--------	d-----w-	c:\program files\Trend Micro
2009-08-17 11:24 . 2009-08-17 11:36	--------	d-----w-	c:\program files\a-squared Free
2009-08-15 16:22 . 2009-08-15 16:22	--------	d-----w-	c:\program files\The Learning Company
2009-08-15 14:35 . 2009-08-15 14:35	--------	d-----w-	c:\program files\Blender Foundation
2009-08-14 16:34 . 2009-08-14 16:34	--------	d-----w-	C:\Python25
2009-08-13 05:06 . 2009-08-19 09:40	--------	d-----w-	c:\program files\WinClamAVShield
2009-08-13 05:03 . 2009-08-13 05:03	--------	d-----w-	c:\program files\Crawler
2009-08-13 05:03 . 2009-08-13 05:03	6144	----a-w-	c:\documents and settings\All Users\Application Data\Spyware Terminator\sp_rsdel.exe
2009-08-13 05:03 . 2009-08-13 05:03	5632	----a-w-	c:\documents and settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys
2009-08-13 05:03 . 2009-08-13 05:03	142592	------w-	c:\windows\system32\drivers\sp_rsdrv2.sys
2009-08-13 05:03 . 2009-08-20 09:36	--------	d-----w-	c:\documents and settings\Nuno\Application Data\Spyware Terminator
2009-08-13 05:03 . 2009-08-19 09:40	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spyware Terminator
2009-08-13 05:03 . 2009-08-17 12:46	--------	d-----w-	c:\program files\Spyware Terminator
2009-08-12 20:18 . 2009-08-13 04:52	--------	d-----w-	c:\windows\BDOSCAN8
2009-08-12 18:33 . 2003-06-26 08:04	237568	------w-	c:\windows\system32\qtmlClient.dll
2009-08-12 18:33 . 2003-01-20 07:08	49152	------w-	c:\windows\system32\CvoAPI.dll
2009-08-12 18:32 . 2009-08-15 14:34	--------	d-----w-	c:\program files\Boris FX, Inc
2009-08-12 04:56 . 2009-08-15 12:37	--------	d-----w-	c:\program files\Fichiers communs\Reallusion
2009-08-11 18:58 . 2009-08-11 19:11	--------	d-----w-	C:\3dsmax9Trial
2009-08-11 14:31 . 2008-03-30 16:55	1213784	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6\vsapi32.dll
2009-08-11 14:31 . 2006-11-22 15:48	91744	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6\BPMNT.dll
2009-08-11 14:31 . 2007-12-24 15:37	138384	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6	mcomm.sys
2009-08-11 14:31 . 2006-07-07 14:29	1197584	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6\ssapi32.dll
2009-08-11 14:31 . 2009-03-27 15:38	366344	----a-w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6	sc.exe
2009-08-11 14:30 . 2009-08-11 14:34	--------	d-----w-	c:\documents and settings\Nuno\Application Data\HouseCall 6.6
2009-08-11 14:30 . 2009-08-11 14:30	--------	d-----w-	c:\windows\system32\HouseCall 6.6
2009-08-09 09:35 . 2009-08-09 09:35	--------	d-----w-	c:\program files\PopCap Games
2009-08-09 09:35 . 2009-08-09 09:36	--------	d-----w-	c:\program files\Zuma Deluxe
2009-08-08 18:42 . 2009-08-18 13:51	10	----a-w-	c:\windows\popcinfo.dat
2009-08-08 17:40 . 2009-08-08 17:40	--------	d-----w-	c:\program files\GameHouse
2009-08-08 17:16 . 2009-08-08 17:16	--------	d-----w-	c:\documents and settings\All Users\Application Data\Zylom
2009-08-08 09:58 . 2009-08-08 09:58	--------	d-----w-	c:\program files\Microsoft Works
2009-08-08 09:58 . 2009-08-08 09:58	--------	d-----w-	c:\program files\MSBuild
2009-08-08 09:55 . 2009-08-08 09:55	--------	d-----w-	c:\program files\Microsoft.NET
2009-08-08 09:48 . 2009-08-08 09:48	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2009-08-08 09:47 . 2009-08-08 09:47	--------	d-----w-	c:\documents and settings\Nuno\Local Settings\Application Data\Microsoft Help
2009-08-08 09:46 . 2009-08-08 10:09	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-08 08:35 . 2009-08-08 08:35	--------	d-----w-	c:\program files\VirtualDJ
2009-08-07 22:47 . 2009-08-07 22:47	--------	d-----w-	c:\documents and settings\Nuno\Application Data\DivX
2009-08-07 22:44 . 2009-08-07 22:44	--------	d-----w-	c:\documents and settings\Nuno\Local Settings\Application Data\Downloaded Installations
2009-08-07 22:44 . 2009-08-07 22:44	--------	d-----w-	c:\documents and settings\All Users\Application Data\Pinnacle Studio Ultimate
2009-08-07 18:10 . 2009-08-07 18:10	--------	d-----w-	c:\program files\Smart Projects
2009-08-07 11:16 . 2009-08-07 11:16	--------	d-----w-	c:\program files\SFR
2009-08-05 20:50 . 2009-08-05 20:50	--------	d-----w-	c:\program files\MSECache

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-20 09:44 . 2008-09-14 12:32	12	----a-w-	c:\windows\bthservsdp.dat
2009-08-18 14:54 . 2005-01-26 21:07	--------	d-----w-	c:\program files\Java
2009-08-17 08:14 . 2005-01-26 21:03	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-08-15 16:55 . 2008-10-20 20:34	--------	d-----w-	c:\documents and settings\Nuno\Application Data\BitTorrent
2009-08-15 14:33 . 2008-01-06 21:57	--------	d-----w-	c:\program files\Pinnacle
2009-08-15 11:42 . 2004-08-17 09:31	76582	------w-	c:\windows\system32\perfc00C.dat
2009-08-15 11:42 . 2004-08-17 09:31	471484	------w-	c:\windows\system32\perfh00C.dat
2009-08-15 09:41 . 2008-05-19 10:28	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP
2009-08-12 18:11 . 2008-05-01 14:17	131744	----a-w-	c:\documents and settings\Nuno\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-08 11:17 . 2008-05-17 10:36	--------	d-----w-	c:\documents and settings\Nuno\Application Data\proDAD
2009-08-08 11:12 . 2008-08-31 18:23	--------	d-----w-	c:\program files\palmOne
2009-08-08 11:10 . 2005-07-24 01:07	--------	d-----w-	c:\program files\Fichiers communs\Adobe
2009-08-05 20:39 . 2008-05-01 17:12	--------	d-----w-	c:\documents and settings\Nuno\Application Data\LimeWire
2009-06-01 08:27 . 2009-06-01 08:27	603904	------w-	c:\windows\system32\TUProgSt.exe
2009-06-01 08:27 . 2009-06-01 08:27	362240	------w-	c:\windows\system32\TuneUpDefragService.exe
.

------- Sigcheck -------

[-] 2008-04-13 19:15	574976	78A08DD6A8D65E697C18E1DB01C5CDCA	c:\windows\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54
tfs.sys
[7] 2007-02-09 11:10	574464	19A811EF5F1ED5C926A028CE107FF1AF	c:\windows\SoftwareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\sp2gdr
tfs.sys
[7] 2007-02-09 11:23	574976	05AB81909514BFD69CBB1F2C147CF6B9	c:\windows\SoftwareDistribution\Download\e3bd9b90b867ba67afdd4c29dc49177c\sp2qfe
tfs.sys
[-] 2008-04-13 19:15	574976	78A08DD6A8D65E697C18E1DB01C5CDCA	c:\windows\system32\dllcache
tfs.sys
[-] 2008-04-13 19:15	574976	78A08DD6A8D65E697C18E1DB01C5CDCA	c:\windows\system32\drivers
tfs.sys
.
(((((((((((((((((((((((((((((   SnapShot@2009-08-19_20.58.08   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-20 09:46 . 2009-08-20 09:46	16384              c:\windows	emp\Perflib_Perfdata_750.dat
+ 2009-08-19 21:27 . 2009-08-19 21:27	737280              c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2009-08-19 21:27 . 2008-08-07 13:27	163328              c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-08-19 21:27 . 2009-08-19 21:27	737280              c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2009-08-19 21:27 . 2008-08-07 13:27	163328              c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2009-08-19 21:27 . 2009-08-19 21:27	5570560              c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2009-08-19 21:27 . 2009-08-19 21:27	5570560              c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PMCRemote"="c:\program files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe" [2007-02-12 253000]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"SpywareTerminatorUpdate"="c:\progra~1\SPYWAR~2\SpywareTerminatorUpdate.exe" [2009-08-13 3055616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-11-23 163840]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-01-26 98304]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-11-01 290816]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"hpWirelessAssistant"="c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 790528]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
"ChangeFilterMerit"="c:\program files\NewSoft\Presto! PVR\ChangeFilterMerit.exe" [2007-06-08 51280]
"Presto! PVR Monitor"="c:\program files\NewSoft\Presto! PVR\Monitor.exe" [2007-07-02 149328]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SpywareTerminator"="c:\progra~1\SPYWAR~2\SpywareTerminatorShield.exe" [2009-08-13 2171904]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-18 149280]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-08-24 88363]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-05 110592]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\BitTorrent\bittorrent.exe"=
"c:\WINDOWS\system32\dplaysvr.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 FNETDEVI;FNETDEVI;c:\windows\system32\drivers\FNETDEVI.SYS [25/10/2008 14:15 19572]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [13/08/2009 07:03 142592]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [01/06/2009 10:27 603904]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe --> c:\program files\MAGIX\Common\Database\bin\fbserver.exe [?]
S3 MODRC;DiBcom Infrared Receiver;c:\windows\system32\drivers\modrc.sys [06/09/2008 19:58 13056]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-08-20 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-20 14:28]

2009-08-07 c:\windows\Tasks\Norton AntiVirus - Analyser mon ordinateur - MANUE.job
- c:\progra~1\NORTON~1\Navw32.exe [2004-08-24 23:13]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q105&bd=pavilion&pf=laptop
IE: Crawler Search - tbr:iemenu
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-20 11:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????2?6?8?9??P???? ???B???????????????B? ?????? 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:2e,e8,e1,00,eb,16,2b,de,22,6a,97,f2,46,
   7c,75,95,c8,28,51,af,b0,29,a3,98,e7,22,de,bc,86,cd,8e,d8,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,1e,22,a1,5b,80,
   eb,a2,de,71,3b,04,66,8b,46,0d,96,28,99,e4,d6,fa,4b,49,6e,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,93,ea,e3,1b,ed,
   f6,49,e9,25,da,ec,7e,55,20,c9,26,e1,bf,0f,a6,c6,cd,09,f6,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,ea,45,38,a8,70,
   5e,13,69,3e,1e,9e,e0,57,5a,93,61,ec,e7,c7,64,44,3c,8b,1e,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,be,6e,c7,8f,1a,
   c4,e8,ea,cd,44,cd,b9,a6,33,6c,cd,dd,6b,d4,fb,df,29,68,e3,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,bb,55,8a,54,dc,
   b7,64,f5,b0,18,ed,a7,3f,8d,37,a4,12,5e,3d,20,22,04,7a,09,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,51,d9,d1,b3,68,
   0f,28,55,31,77,e1,ba,b1,f8,68,02,3d,ac,52,8f,7c,e1,9e,1c,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,34,8b,93,e6,d4,
   e8,f9,47,83,6c,56,8b,a0,85,96,ab,35,ea,a3,9b,7c,03,03,31,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,a5,77,cc,8b,a4,
   a5,c7,79,51,fa,6e,91,28,9e,14,cc,a0,fc,2b,a7,da,8a,f0,aa,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,d9,63,51,07,22,
   8c,b6,7f,b1,cd,45,5a,a8,c4,f8,b9,63,77,4e,71,4c,e9,6f,3c,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,fd,c5,85,22,6a,
   ef,53,25,e3,0e,66,d5,eb,bc,2f,6b,57,0e,fa,8f,5b,24,44,00,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,22,de,d6,8e,19,
   a3,35,90,fa,ea,66,7f,d4,3b,6b,70,3f,8e,e6,09,c3,c6,a5,9b,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3316)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\a-squared Free\a2service.exe
c:\windows\system32undll32.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Apoint2K\ApntEx.exe
c:\program files\Norton AntiVirus
avapsvc.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wscntfy.exe
c:\program files\HPQ\Shared\hpqwmi.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Completion time: 2009-08-20 11:50 - machine was rebooted
ComboFix-quarantined-files.txt  2009-08-20 09:50
ComboFix2.txt  2009-08-19 21:02

Pre-Run: 20 257 566 720 octets libres
Post-Run: 20 229 046 272 octets libres

290	--- E O F ---	2008-10-23 17:32

feshme · Answer

kaspersky ne ce lance pas, après la mise a jour apparait : impossible de vérifier la licence puis Terminé

plopus · Answer

ok continue

feshme · Answer

Je fais malwarebyte alors?

plopus · Answer

Fait le scan en ligne ici
https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan

et ensuite tu fais un scan complet avec malwarebyte

feshme · Answer

Resultat scan en ligne


;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-08-20 19:08:06
PROTECTIONS: 1
MALWARE: 6
SUSPECTS: 4
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Norton Antivirus 2005                        11.0.1                        No        No
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Nuno\Cookies
uno@xiti[1].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Nuno\Cookies
uno@weborama[1].txt
00590315  Rootkit/Agent.LNB                  HackTools           No        0         Yes            No           C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP291\A0115676.sys
00862760  Generic Trojan                     Virus/Trojan        No        0         No             No           C:\Documents and Settings\Nuno\Bureau	elechargement\Virtual DJ 5.2 Pro With Add-On Pack.rar[Virtual DJ 5.2 Pro With Add-On Pack\Virtual DJ Ultimate Add-on Pack\VirtualDJ.Best.Skins.by.mickyz.rar][Sonique-Visual-Effects.exe][Cosmic-Nebulae.svp]
02885963  Rootkit/Booto.C                    Virus/Worm          No        0         Yes            No           C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP292\A0115959.sys
02885963  Rootkit/Booto.C                    Virus/Worm          No        0         Yes            No           C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP293\A0116158.sys
03074964  Trj/CI.A                           Virus/Trojan        No        0         No             No           C:\Documents and Settings\Nuno\Bureau\ESSAIedac\Bureautique\Babylon3.2fr\babylon3.2.exe[C:\Documents and Settings\Nuno\Bureau\ESSAIedac\Bureautique\Babylon3.2fr\babylon3.2.exe][cd_install_247.exe]
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
;===================================================================================================================================================================================
No        C:\3dsmax9Trial\Installs\3dsmax\max9keygen.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                        
No        C:\Documents and Settings\Nuno\Bureau\3D STUDIO MAX\Crack\3dsmax9-keygen.zip[max9keygen.exe]                                                                                                                                                                                                                                                                                                                                                                                                                          
No        C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP291\A0115847.sys                                                                                                                                                                                                                                                                                                                                                                                                                        
No        C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP291\A0115848.sys                                                                                                                                                                                                                                                                                                                                                                                                                        
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                
;===================================================================================================================================================================================
  211784  HIGH       MS09-032                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  211781  HIGH       MS09-029                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  210625  HIGH       MS09-026                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  210624  HIGH       MS09-025                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  210621  HIGH       MS09-022                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  210618  HIGH       MS09-019                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  208380  HIGH       MS09-015                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  208379  HIGH       MS09-014                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  208378  HIGH       MS09-013                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  208377  HIGH       MS09-012                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  206981  HIGH       MS09-007                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  206980  HIGH       MS09-006                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  204670  HIGH       MS09-001                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  203806  HIGH       MS08-078                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  203508  HIGH       MS08-073                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  203505  HIGH       MS08-071                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  202465  HIGH       MS08-068                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  201683  HIGH       MS08-067                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  194862  HIGH       MS08-032                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  191616  HIGH       MS08-023                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  191614  HIGH       MS08-021                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  191613  HIGH       MS08-020                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  187733  HIGH       MS08-008                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  184380  MEDIUM     MS08-002                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  182046  HIGH       MS07-067                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  179553  HIGH       MS07-061                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  176383  HIGH       MS07-058                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  170907  HIGH       MS07-046                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  170904  HIGH       MS07-043                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  164915  HIGH       MS07-035                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  164911  HIGH       MS07-031                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  157261  HIGH       MS07-021                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  157260  HIGH       MS07-020                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  157259  HIGH       MS07-019                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  156477  HIGH       MS07-017                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  150249  HIGH       MS07-013                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  150248  HIGH       MS07-012                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  150247  HIGH       MS07-011                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  150243  HIGH       MS07-008                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  150242  HIGH       MS07-007                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  150241  MEDIUM     MS07-006                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  141033  MEDIUM     MS06-075                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  137571  HIGH       MS06-070                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  133379  HIGH       MS06-057                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  129977  MEDIUM     MS06-053                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  129976  MEDIUM     MS06-052                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  126093  HIGH       MS06-051                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  126092  MEDIUM     MS06-050                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  126087  HIGH       MS06-046                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  108738  HIGH       MS06-004                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  126082  HIGH       MS06-041                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  126081  HIGH       MS06-040                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  123421  HIGH       MS06-036                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  120823  MEDIUM     MS06-030                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  120818  HIGH       MS06-025                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  120815  HIGH       MS06-022                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  117384  MEDIUM     MS06-018                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  114666  HIGH       MS06-015                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  108738  HIGH       MS06-004                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  108738  HIGH       MS06-004                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  104567  HIGH       MS06-002                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
  104237  HIGH       MS06-001                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
   96574  HIGH       MS05-053                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
   93395  HIGH       MS05-051                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
   93454  MEDIUM     MS05-049                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
;===================================================================================================================================================================================

feshme · Answer

excuse j'ai deugué et je l'ai collé deux fois dont une fois plus haut, ne pas en tenir compte. Que faire?

plopus · Answer

allez supprime vite sa 

C:\3dsmax9Trial (le dossier complet avec tout ce qu'il contient)
Bureau\3D STUDIO MAX\Crack\3dsmax9-keygen.zip[max9keygen.exe] 

et arrete les cracks et keygen la tu evite le formatage de peu...

concernant les truc critique c'est les mises a jour


va dans demarrer/tout les programme et windows update et recherche et installe toutes les mises a jour redemarre et recomence jusqu'a que tu n'ai plus de mise  ajour a faire

ensuite utilise ces 2sites pour combler tes autres failles de logiciels, il faut que tu desinstalle les ancien logiciels avant c'est trés important

on peut aussi verfier la vulnerabilité de windows et aussi d'autre produits

-
Soit par le biais de ce site internet il faut installer l'active X puis
clic start scan et le site montre d'une croix rouge les faille de
sécurité pour quelques produits important installé sur le PC comme
java, IE, windows, flashplayer, adobe...les + importantes
https://www.flexera.com/products/operations/software-vulnerability-management.html

-
Soit on peut aussi passer par un logiciel a installer qui scan le PC et
affiche TOUTES les mises a jour des logiciels et produits installé sur
le PC
https://filehippo.com/windows/tuning-utilities/

ensuite trés important aussi telecharge CCleaner
https://www.malekal.com/tutoriel-ccleaner/
va dans option/avancé et decoche la 1er ligne et nettoie ton regsitre et l'onglet nettoyeur plusieurs fois jusqu' a trouver 0erreur

et teste un peu tout ton PC, redemarre le plein de fois maintenant  :D
et dit moi comment il va ?

et une fois que tu as fait tout sa poste un RSIt que je controle les mises a jour si ta rien oublié et si ya rien de nouveau on finira proporement

feshme · Answer

Quels sont les logiciels a desinstaller? Ceux que l'on a telecharger ensemble genre Hijackthis, comboFix...?

plopus · Answer

non sa jte erai passer un utilitaire pour les supprimer pour l'instant laisse comme sa concernant les liens de de :

secunia et de update cheker ce sont des logiciel qui mette en evidence des faille de logiciels installé sur ton PC comme ADOBE reader, JAVA, internet explorer et les faille windows donc toi ta deja tous sa utilise les 2 logiciels tu verras c'est important pour contrer ce genre d'infection qui ne te serait peut etre pas arriver si tu etait a jour....

de + fait analyser ce fichier sur virus total

C:\3dsmax9Trial\Installs\3dsmax\max9keygen.exe

feshme · Answer

Je comprend pas trop ce que tu veux dire par desinstalle les anciens logiciels? lesquels? 
Pour les mises a jour windows, je vérifirais plus souvent a vrai dire je ne connaissais pas

"ensuite utilise ces 2sites pour combler tes autres failles de logiciels, il faut que tu desinstalle les ancien logiciels avant c'est trés important"

plopus · Answer

exemple de mise a jour que pourra t'indiquer :

dans demarrer/panneau de configuration/ajout et suppression de programme c'est le lieu pour desinstaller les logiciels :

exemple JAVA : tu selectionne tout les JAVA update et tu clic sur desinstallé et ensuite tu installe la derniere evrsion ici  https://www.java.com/fr/download/

mais AVANt de faire le scan avec ces logiciels INSTALLE TOUTES les mise s ajour windows sinon tu va te retrouver avec 3 page de faille....

donc deja windows update  jusqu' a que tu es + de mise a  jour

feshme · Answer

Resultat RSIT, le vérificateur de vulnerabilité me dit que Java est a mettre a jour mais les mises a jour demande a chaque fois de s'identifier sur le site java, sur lequel je suis transferé . 

Logfile of random's system information tool 1.06 (written by random/random)
Run by Nuno at 2009-08-21 01:19:25
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 16 GB (17%) free of 95 GB
Total RAM: 758 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:19:38, on 21/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
C:\PROGRA~1\SPYWAR~2\SpywareTerminatorShield.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\PROGRA~1\SPYWAR~2\SpywareTerminatorUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton AntiVirus
avapsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Documents and Settings\Nuno\Bureau\RSIT.exe
C:\Program Files	rend micro\Nuno.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] "%ProgramFiles%\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ChangeFilterMerit] C:\Program Files\NewSoft\Presto! PVR\ChangeFilterMerit.exe
O4 - HKLM\..\Run: [Presto! PVR Monitor] C:\Program Files\NewSoft\Presto! PVR\Monitor.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~2\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\PROGRA~1\SPYWAR~2\SpywareTerminatorUpdate.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader5.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

feshme · Answer

C:\3dsmax9Trial\Installs\3dsmax\max9keygen.exe   FICHIER introuvable

plopus · Answer

salut

supprime directement le dossier  C:\3dsmax9Trial

et pareil pour lui   Bureau\3D STUDIO MAX\Crack\3dsmax9-keygen.zip[max9keygen.exe] 

sous peine de relancer l'infection...


va chercher ce fichier lance le choisit do a scan only et coche les cases a gauche des lignes :
C:\Program Files	rend micro\Nuno.exe     


 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341 
 R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll     
 O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll     
 O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll     
 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime     
 O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe     
 O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"     
 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe     
 O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start     
 O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"     
 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe     
 O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe     
 O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')     
 O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/ 
 O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab 
  O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll     

puis clic surfix checked


ensuite fait ceci :

#  Télécharge ToolbarSD (de Team IDN) sur ton Bureau

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2
# Lance l'installation du programme en exécutant le fichier téléchargé.

# Double-clique maintenant sur le raccourci de Toolbar-S&D.

# Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.

# Choisis maintenant l'option 2 SUPPRESSION. Patiente jusqu'à la fin de la recherche.

# Poste le rapport généré. (C:\TB.txt)


ensuite je te conseille VIVEMENT de retourner AJOUT ET SUPPRESSION de propgramme et de desinstallé :

- AD AWARE
- A squared
- spyware terminator

et si tu paye pas NORTOn desinstalle le et installe antivir a la place  http://www.commentcamarche.net/telecharger/telecharger-55-antivir

et tu garde malwarebyte qui est trés bien

passe un coup de CCleaner  si tu l'as pas   https://www.malekal.com/tutoriel-ccleaner/

ensuite converant la mise a jour JAVA, tu dois deja DESINSTALLE TOUTES CE QUI COMPORTE JAVA, tu as les JAVA UPDATE et les JAVA RUNTIME et ensuite tu clic sur le lien que jté donné + haut et tu clic sur telechargé et c'est bon

as tu encore des problemes ?

feshme · Answer

rapport Toolbar


   -----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free :         Intel(R) Pentium(R) M processor 1.73GHz )
   BIOS : Ver 1.00PARTTBLX
   USER : Nuno ( Administrator )
   BOOT : Normal boot
   Antivirus : Spyware Terminator 2.5.9.223 (Activated)
   C:\ (Local Disk) - NTFS - Total:93 Go (Free:18 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [2] ( 21/08/2009|10:55 )

   -----------\ SUPPRESSION

   Supprime! - C:\Program Files\Crawler\Download
   Supprime! - C:\Program Files\Crawler\Toolbar
   Supprime! - C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Barre d'outils Crawler
   Supprime! - C:\DOCUME~1\Nuno\Favoris\Studio Max  Torrent Finder  Torrent Search Engine.url
   Supprime! - C:\Program Files\Crawler

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.google.com/?gws_rd=ssl"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/"
   "CustomizeSearch"="http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Nuno\Application Data\BitTorrent\3D Studio Max 9 + Tutorials and Keygen.1.torrent
   C:\DOCUME~1\Nuno\Application Data\BitTorrent\3D Studio Max 9 + Tutorials and Keygen.2.torrent
   C:\DOCUME~1\Nuno\Application Data\BitTorrent\3D Studio Max 9 + Tutorials and Keygen.torrent
   C:\DOCUME~1\Nuno\Application Data\BitTorrent\3D Studio Max 9 crack.zip.torrent
   C:\DOCUME~1\Nuno\Application Data\BitTorrent\Autodesk 3D Studio Max 2009 (v.11) +CRACK + EXTRA Utilities.torrent
   C:\DOCUME~1\Nuno\Application Data\BitTorrent\Autodesk 3D Studio Max v2008 Incl Crack.torrent
   C:\DOCUME~1\Nuno\Application Data\BitTorrent\Football Manager 2009 Crack+Patch.zip.torrent
   C:\DOCUME~1\Nuno\Application Data\BitTorrent\football manager 2009 crack.exe.torrent
   C:\DOCUME~1\Nuno\Application Data\BitTorrent\IsoBuster.v2.5.5.1.Final.Incl.Keygen-AGAiN.torrent
   C:\DOCUME~1\Nuno\Application Data\BitTorrent\[CRACK].vray.1.50.sp2.for.3d.studio.max.2009.x64-patch [Made & Released by DarK AvengeR].zip.torrent
   C:\DOCUME~1\Nuno\Application Data\BitTorrent\[PC Game] Zuma deluxe FULL Game + Crack (GREAT solitaire game).zip.torrent
   C:\DOCUME~1\Nuno\Bureau\telechargement\3D Studio Max 9 + Tutorials and Keygen
   C:\DOCUME~1\Nuno\Bureau\telechargement\IsoBuster.v2.5.5.1.Final.Incl.Keygen-AGAiN
   C:\DOCUME~1\Nuno\Bureau\telechargement\3D Studio Max 9 + Tutorials and Keygen\3D Studio Max 9 + Tutorials and Keygen.uif
   C:\DOCUME~1\Nuno\Bureau\telechargement\3D Studio Max 9 + Tutorials and Keygen\Readme.txt
   C:\DOCUME~1\Nuno\Bureau\telechargement\IsoBuster.v2.5.5.1.Final.Incl.Keygen-AGAiN\IsoBuster.v2.5.5.1.Final.Incl.Keygen-AGAiN.rar
   C:\DOCUME~1\Nuno\Bureau\telechargement\Studio12U\Crack
   C:\DOCUME~1\Nuno\Bureau\telechargement\Studio12U\Crack\Crack.rar



   1 - "C:\ToolBar SD\TB_1.txt" - 21/08/2009|10:57 - Option : [2]

   -----------\  Fin du rapport a 10:57:57,98

feshme · Answer

Pour supprimer le NORTON, il est sous quel nom dans la liste des programmes? car je ne le trouve pas sous NORTON ou un truc du genre.

feshme · Answer

Puisje supprimer les programmes suivants : 
- Hijackthis, 
- RSIT, 
- UsbFix, 
- Fish (combofix), 
- WinFileReplace, 
- SD fix, 
- ToolbarSD, 
- WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe, 
- Panda active scan, 

Et peux tu me dire a quoi correspond ce logiciel : HauseCall 6.6 ? Et Steam ? 
Est ce que Spyware Blaster est utile, doisje le conservé meme si j'ai installer avira?

plopus · Answer

Housecall c'est un scan en ligne trendmicro

FAit ceci : pour supprimer les logiciels qui ont servit et supprime manuelleme,nt APR7S les traces qui reste 

concernat NORTON, tu desinstalle tout ce qui a un rapport avec SYMANTEC aussi et utilise bien l'outils de desinstallation apres  http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924

concerant les logiciel tu garde ANTIVIr+ malwarebyte + UN seul autre antispyware de ton choix + un parefeu comme zone alarm (simple) ou mieux mais + compliqué kerio, online armor


humm.....

C:\DOCUME~1\Nuno\Application Data\BitTorrent\3D Studio Max 9 + Tutorials and Keygen.1.torrent
C:\DOCUME~1\Nuno\Application Data\BitTorrent\3D Studio Max 9 + Tutorials and Keygen.2.torrent
C:\DOCUME~1\Nuno\Application Data\BitTorrent\3D Studio Max 9 + Tutorials and Keygen.torrent
C:\DOCUME~1\Nuno\Application Data\BitTorrent\3D Studio Max 9 crack.zip.torrent
C:\DOCUME~1\Nuno\Application Data\BitTorrent\Autodesk 3D Studio Max 2009 (v.11) +CRACK + EXTRA Utilities.torrent
C:\DOCUME~1\Nuno\Application Data\BitTorrent\Autodesk 3D Studio Max v2008 Incl Crack.torrent
C:\DOCUME~1\Nuno\Application Data\BitTorrent\Football Manager 2009 Crack+Patch.zip.torrent
C:\DOCUME~1\Nuno\Application Data\BitTorrent\football manager 2009 crack.exe.torrent
C:\DOCUME~1\Nuno\Application Data\BitTorrent\IsoBuster.v2.5.5.1.Final.Incl.Keygen-AGAiN.torrent
C:\DOCUME~1\Nuno\Application Data\BitTorrent\[CRACK].vray.1.50.sp2.for.3d.studio.max.2009.x64-patch [Made & Released by DarK AvengeR].zip.torrent
C:\DOCUME~1\Nuno\Application Data\BitTorrent\[PC Game] Zuma deluxe FULL Game + Crack (GREAT solitaire game).zip.torrent
C:\DOCUME~1\Nuno\Bureau\telechargement\3D Studio Max 9 + Tutorials and Keygen
C:\DOCUME~1\Nuno\Bureau\telechargement\IsoBuster.v2.5.5.1.Final.Incl.Keygen-AGAiN
C:\DOCUME~1\Nuno\Bureau\telechargement\3D Studio Max 9 + Tutorials and Keygen\3D Studio Max 9 + Tutorials and Keygen.uif
C:\DOCUME~1\Nuno\Bureau\telechargement\3D Studio Max 9 + Tutorials and Keygen\Readme.txt
C:\DOCUME~1\Nuno\Bureau\telechargement\IsoBuster.v2.5.5.1.Final.Incl.Keygen-AGAiN\IsoBuster.v2.5.5.1.Final.Incl.Keygen-AGAiN.rar
C:\DOCUME~1\Nuno\Bureau\telechargement\Studio12U\Crack
C:\DOCUME~1\Nuno\Bureau\telechargement\Studio12U\Crack\Crack.rar 

il est la dedant ton rootkit abandonne les craks surtout pour des logiciels aussi bidon sa sert a rien...

a lire  https://forum.malekal.com/viewtopic.php?t=893&start=

feshme · Answer

Jai supprimer tout les fichiers ou le rookit pouvait etre. 

Quel est le meilleur anti-spyware?

feshme · Answer

ccleaner, je peut le grader et le faire regulierement?

plopus · Answer

fait sa :

Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques (uniquement les fix) :


    * Télécharge Toolscleaner sur ton Bureau

      https://www.commentcamarche.net/telecharger/securite/22061-toolscleaner/
    * Double-clique sur ToolsCleaner2.exe et laisse le travailler
    * Clique sur Recherche et laisse le scan se terminer.
    * Clique sur Suppression pour finaliser.
    * Tu peux, si tu le souhaites, te servir des Options facultatives.
    * Clique sur Quitter, pour que le rapport puisse se créer.
    * Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta prochaine réponse


ensuite jté dit tu garde 

antivir + malwarebyte+ 1 autte antispyware que tu veux par exemple super antispyware il n'ont pas de garde ne temps réel sa ne fait pas ramé le PC mais il faut lancer des analyse reguliere

et maintenant si + de probleme :

REACTIVE ta restauration avec sa https://www.commentcamarche.net/faq/5097-virus-system-volume-information
puis creer un point de restauration sain avec sa https://www.commentcamarche.net/informatique/windows/147-restaurer-windows-avec-les-points-de-restauration/

et teste un peu tout ton PC et si + de probleme mets en resolu

feshme · Answer

[ Rapport ToolsCleaner version 2.3.10 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\TB.txt: trouvé !
C:\SDFIX: trouvé !
C:\Qoobox: trouvé !
C:\Rsit: trouvé !
C:\Backups\catchme.log: trouvé !
C:\Program Files\Trend Micro\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\hijackthis.log: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\SDFix\catchme.exe: trouvé !

---------------------------------
--> Suppression: 

C:\Program Files\Trend Micro\HijackThis.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\SDFix\catchme.exe: supprimé !
C:\TB.txt: supprimé !
C:\Backups\catchme.log: supprimé !
C:\Program Files\Trend Micro\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\SDFIX: supprimé !
C:\Qoobox: supprimé !
C:\Rsit: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

feshme · Answer

Voila je pense avoir tout fait. 

Franchement un enorme MERCI pour tout le temps que tu as consacré a mon probleme et de mavoir remis l'ordinateur comme neuf, le pc a l'air de marcher super bien, je pars pour une semaine et en cas de probleme, je te recontact à mon retour mais franchement vraiment merci et félicitation pour la maitrise dont tu as fait preuve. 

Bonne continuation. 
Super mon pc est tout propre et promis fini les cracks et autres betises.

plopus · Answer

de rien bonne vacance

Virus system32 + autre

128 réponses

Votre réponse

Discussions similaires

Newsletters