Google redirigé et malwarebytes envahi

Est-ce celui-ci :
Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

2010-04-07 22:10:52
mbam-log-2010-04-07 (22-10-52).txt

Scan type: Full Scan (C:\|)
Objects scanned: 261600
Time elapsed: 3 hour(s), 37 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Thuy Doan\My Documents\Downloads\Adobe Photoshop CS4 Extended\Adobe Photoshop CS4 Extended\Adobe CS4 Activation Patch\Adobe CS4 Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\oobe\GetMName.exe (Trojan.VkHost) -> Quarantined and deleted successfully.

J'ai plein de :

09:44:38 Thuy Doan MESSAGE Protection started successfully
09:44:46 Thuy Doan MESSAGE IP Protection started successfully
09:48:03 Thuy Doan IP-BLOCK 93.188.161.83
09:48:35 Thuy Doan IP-BLOCK 95.211.101.132
09:48:47 Thuy Doan IP-BLOCK 95.211.101.132
09:48:56 Thuy Doan IP-BLOCK 93.188.161.83
09:48:58 Thuy Doan IP-BLOCK 93.188.161.83
09:49:02 Thuy Doan IP-BLOCK 93.188.161.83
09:49:11 Thuy Doan IP-BLOCK 95.211.101.132
09:49:35 Thuy Doan IP-BLOCK 95.211.101.132
09:49:59 Thuy Doan IP-BLOCK 95.211.101.132
09:50:23 Thuy Doan IP-BLOCK 95.211.101.132
09:50:51 Thuy Doan IP-BLOCK 95.211.101.132
10:03:25 Thuy Doan IP-BLOCK 78.159.105.36
10:03:28 Thuy Doan IP-BLOCK 78.159.105.36
10:03:35 Thuy Doan IP-BLOCK 78.159.105.36
10:03:47 Thuy Doan IP-BLOCK 78.159.105.36
10:03:50 Thuy Doan IP-BLOCK 78.159.105.36
10:03:56 Thuy Doan IP-BLOCK 78.159.105.36
10:06:21 Thuy Doan IP-BLOCK 93.188.161.83
10:22:17 Thuy Doan IP-BLOCK 93.188.161.83
10:22:20 Thuy Doan IP-BLOCK 93.188.161.83
10:37:33 Thuy Doan IP-BLOCK 93.188.161.83
11:00:56 Thuy Doan IP-BLOCK 93.188.161.83
19:43:10 Thuy Doan IP-BLOCK 93.188.161.83
20:27:17 Thuy Doan IP-BLOCK 93.188.161.83
20:27:31 Thuy Doan IP-BLOCK 93.188.161.83
20:27:32 Thuy Doan IP-BLOCK 93.188.161.83
20:27:34 Thuy Doan IP-BLOCK 93.188.161.83
20:27:38 Thuy Doan IP-BLOCK 93.188.161.83
20:27:49 Thuy Doan IP-BLOCK 93.188.161.83
20:27:50 Thuy Doan IP-BLOCK 93.188.161.83
20:27:52 Thuy Doan IP-BLOCK 93.188.161.83
20:27:56 Thuy Doan IP-BLOCK 93.188.161.83
22:16:56 Thuy Doan IP-BLOCK 93.188.161.83
22:20:12 Thuy Doan IP-BLOCK 93.188.161.83
22:20:14 Thuy Doan IP-BLOCK 93.188.161.83
22:33:18 Thuy Doan IP-BLOCK 93.188.161.83
22:33:54 Thuy Doan IP-BLOCK 93.188.161.83
22:33:56 Thuy Doan IP-BLOCK 93.188.161.83
22:34:00 Thuy Doan IP-BLOCK 93.188.161.83
22:34:57 Thuy Doan IP-BLOCK 93.188.161.83
22:38:15 Thuy Doan IP-BLOCK 93.188.161.83
22:41:10 Thuy Doan IP-BLOCK 78.159.105.36
22:41:13 Thuy Doan IP-BLOCK 78.159.105.36
22:41:19 Thuy Doan IP-BLOCK 78.159.105.36
22:41:31 Thuy Doan IP-BLOCK 78.159.105.36
22:41:34 Thuy Doan IP-BLOCK 78.159.105.36
22:41:40 Thuy Doan IP-BLOCK 78.159.105.36
22:42:28 Thuy Doan MESSAGE IP Protection stopped
22:42:34 Thuy Doan MESSAGE IP Protection started successfully
22:46:39 Thuy Doan IP-BLOCK 93.188.161.83
23:15:58 Thuy Doan IP-BLOCK 93.188.161.83
23:30:40 Thuy Doan IP-BLOCK 93.188.161.83
23:36:11 Thuy Doan IP-BLOCK 93.188.161.83
23:36:13 Thuy Doan IP-BLOCK 93.188.161.83
23:36:17 Thuy Doan IP-BLOCK 93.188.161.83

malwarebytes qui me fait ça souvent avec une petite fenêtre... c'est peut-être un logiciel infecté ?

===== Rapport WareOut Removal Tool =====

version 3.6.2

analyse effectuée le 2010-04-20 à 23:58:45,35

Résultats de l'analyse :
========================

~~~~ Recherche d'infections dans C:\ ~~~~

C:\autorun.inf trouvé!
C:\autorun.inf suppression impossible

~~~~ Recherche d'infections dans C:\Program Files\ ~~~~

~~~~ Recherche d'infections dans C:\WINDOWS\system\ ~~~~

~~~~ Recherche d'infections dans C:\WINDOWS\system32\ ~~~~

~~~~ Recherche d'infections dans C:\WINDOWS\system32\drivers\ ~~~~

~~~~ Recherche d'infections dans C:\Documents and Settings\Thuy Doan\Application Data\ ~~~~

~~~~ Recherche d'infections dans C:\Documents and Settings\Thuy Doan\Bureau\ ~~~~

~~~~ Recherche de détournement de DNS ~~~~

~~~~ Recherche de Rootkits ~~~~

_______________________________________________________________________

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-20 23:59:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden files ...

scan completed successfully
hidden files: 0

_______________________________________________________________________

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
System REG_SZ

~~~~ Recherche d'infections dans C:\DOCUME~1\THUYDO~1\LOCALS~1\Temp\ ~~~~

~~~~ Recherche d'infections dans C:\Documents and Settings\Thuy Doan\Start Menu\Programs\ ~~~~

~~~~ Nettoyage du registre ~~~~

~~~~ Tentative de réparation des entrées suivantes: ~~~~

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] = "System"

[HKLM\SYSTEM\CurrentControlSet\Services\Windows Tribute Service]
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_Windows Tribute Service]

~~~~ Vérification: ~~~~

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
System REG_SZ

_________________________________

développé par http://pc-system.fr
_________________________________

J'ai aussi un problème avec le navigateur que parfois on propose un antivirus qui semble faux au milieu de mon navigateur et je dois choisir accepter ou prohiber pour qu'il disparaisse, je fais prohiber, mais qqun a déjà fait accepter en utilisant mon ordi

une erreur s'affiche lorsque je fais mis-à-jour. De plus, le site officiel pour le télécharger ne fonctionne pas. j'ai donc supprimé mon malwarebytes et je vais en télécharger un démo sur un site.

ok

dans cet ordre

supprimes le
RKILL
puis MBAM

http://www.malwarebytes.org/mbam/program/mbam-setup.exe

je suis toujours incapable de me rendre sur ce site...http://www.malwarebytes.org/mbam/program/mbam-setup.exe

mais je viens de le télécharger d'un autre site

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 4014

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 7.0.5730.13

2010-04-21 01:44:26
mbam-log-2010-04-21 (01-44-26).txt

Scan type: Full scan (C:\|)
Objects scanned: 242457
Time elapsed: 52 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\ROUA3O12PW (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 93.188.164.226,93.188.161.83 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{be5bff9a-23fa-4d30-ab6a-9c377895bcac}\NameServer (Trojan.DNSChanger) -> Data: 93.188.164.226,93.188.161.83 -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

J'ai une fenêtre "XP Defender Pro Firewall Alert" qui apparait et un Windows Security Center, est-ce des vrai ou c'est un faux programme?

et en safe mode, j'ai pas réussi à télécharger le programme malwarebytes du bon site, j'ai du le prendre d'un autre site. le site ne fonctionnait pas encore dans aucun navigateur

ah après un rkill les fenetres ont disparu et j'ai pu me rendre sur le site de malwarebytes

le problème semble être réglé merci beaucoup. je le test pendant une journée et je vous reviens là-dessus

ZHPFix v1.12.3089 by Nicolas Coolman - Rapport de suppression du 2010-04-21 11:29:27
Fichier Registre :
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html

Processus mémoire :
(Néant)

Module mémoire :
(Néant)

Clé du Registre :
(Néant)

Valeur du Registre :
(Néant)

Elément de données du Registre :
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: Modified => Donnée supprimée avec succès
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: Modified => Donnée supprimée avec succès
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: Modified => Donnée supprimée avec succès
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: Modified => Donnée supprimée avec succès
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: Modified => Donnée supprimée avec succès
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Pas de propriétaire - Pas de description.) -- C:\Documents and Settings\Thuy Doan\Local Settings\Application Data\ave.exe => Donnée supprimée avec succès
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Pas de propriétaire - Pas de description.) -- C:\Documents and Settings\Thuy Doan\Local Settings\Application Data\ave.exe => Donnée supprimée avec succès

Dossier :
C:\Program Files\IEToolbar => Supprimé et mis en quarantaine

Fichier :
(Néant)

Logiciel :
(Néant)

Script Registre :
(Néant)

Autre :
(Néant)

Récapitulatif :
Processus mémoire : 0
Module mémoire : 0
Clé du Registre : 0
Valeur du Registre : 0
Elément de données du Registre : 7
Dossier : 1
Fichier : 0
Logiciel : 0
Autre : 0

End of the scan

===== Rapport WareOut Removal Tool =====

version 3.6.2

analyse effectuée le 2010-04-21 à 12:53:39,95

Résultats de l'analyse :
========================

~~~~ Recherche d'infections dans C:\ ~~~~

C:\autorun.inf trouvé!
C:\autorun.inf suppression impossible

~~~~ Recherche d'infections dans C:\Program Files\ ~~~~

~~~~ Recherche d'infections dans C:\WINDOWS\system\ ~~~~

~~~~ Recherche d'infections dans C:\WINDOWS\system32\ ~~~~

~~~~ Recherche d'infections dans C:\WINDOWS\system32\drivers\ ~~~~

~~~~ Recherche d'infections dans C:\Documents and Settings\Thuy Doan\Application Data\ ~~~~

~~~~ Recherche d'infections dans C:\Documents and Settings\Thuy Doan\Bureau\ ~~~~

~~~~ Recherche de détournement de DNS ~~~~

~~~~ Recherche de Rootkits ~~~~

_______________________________________________________________________

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-21 12:53:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden files ...

scan completed successfully
hidden files: 0

_______________________________________________________________________

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
System REG_SZ

~~~~ Recherche d'infections dans C:\DOCUME~1\THUYDO~1\LOCALS~1\Temp\ ~~~~

~~~~ Recherche d'infections dans C:\Documents and Settings\Thuy Doan\Start Menu\Programs\ ~~~~

~~~~ Nettoyage du registre ~~~~

~~~~ Tentative de réparation des entrées suivantes: ~~~~

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] = "System"

[HKLM\SYSTEM\CurrentControlSet\Services\Windows Tribute Service]
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_Windows Tribute Service]

~~~~ Vérification: ~~~~

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
System REG_SZ

_________________________________

développé par http://pc-system.fr
_________________________________

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 4014

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

2010-04-21 13:10:03
mbam-log-2010-04-21 (13-10-03).txt

Scan type: Full scan (C:\|)
Objects scanned: 242546
Time elapsed: 3 hour(s), 6 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Thuy Doan\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Thuy Doan\Local Settings\Application Data\ave.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.

regarde si le mode sans echec fonctionne

il n'a pas apparu comme option. je pouvais qu'aller sur microsoft xp. je réessaye.

https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php

Le mode sans échec a figé lorsque je l'ai sélectionné il avait bcp de lignes de win32 avec drivers. je l'ai donc essayé en mode normal :

SmitFraudFix v2.424

Scan done at 22:48:28,03, 2010-04-21
Run from C:\Documents and Settings\Thuy Doan\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» DNS Before Fix

Description: Broadcom 802.11b/g WLAN - Packet Scheduler Miniport
DNS Server Search Order: 24.200.241.37
DNS Server Search Order: 24.201.245.77
DNS Server Search Order: 24.200.243.189

HKLM\SYSTEM\CCS\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: NameServer=93.188.164.226,93.188.161.83
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=93.188.164.226,93.188.161.83

»»»»»»»»»»»»»»»»»»»»»»»» DNS After Fix

Description: Broadcom 802.11b/g WLAN - Packet Scheduler Miniport
DNS Server Search Order: 24.200.241.37
DNS Server Search Order: 24.201.245.77
DNS Server Search Order: 24.200.243.189

HKLM\SYSTEM\CCS\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: NameServer=93.188.164.226,93.188.161.83
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=93.188.164.226,93.188.161.83

maintenant je suis en safe mode, mais le programme ne peut que fonctionner en mode normal maintenant.

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 10:05:54, on 2010-04-22
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\wdm\STacSV.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\HP\HPBTWD.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.aol.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.myfastwebsearch.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.aol.ca/
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files\MSN\Toolbar\3.0.0560.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0560.0\msneshellx.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HP BTW Detect Program] C:\Program Files\HP\HPBTWD.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
O4 - HKLM\..\Run: [HP] C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Office quick launch] C:\Program Files\Microsoft Office\Office11\OSA.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Thuy Doan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/fr/uno1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 93.188.164.226,93.188.161.83
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Roxio SAIB Service (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) - Unknown owner - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: BOTService - Sonic Solutions - C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\STacSV.exe

merci,
c'est fait, il y avait bcp de choses pour 93.188.161.83, il a qu'un item qui ne veut pas se supprimer.

ça marche pas plus en mode sans échec

je ne sais pas si le fichier est important à supprimer, voici une impression d'écran

https://drive.google.com/file/d/0BymQNKubCfpyN2U3ZDA3YzYtYTkwMy00MjQ2LWJiOWMtYmE0NGRiMzcyY2Q4/view?usp=drive_open&hl=en

Merci beaucoup beaucoup et énormément de ton temps. L'ordi n'a pas de problème visible pour le moment.

tu me dis de demander confirmation à qui?

http://www.cijoint.fr/cjlink.php?file=cj201004/cijEFTKkNX.txt

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 13:00:36, on 2010-04-22
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\wdm\STacSV.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\HP\HPBTWD.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.myfastwebsearch.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.aol.ca/
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files\MSN\Toolbar\3.0.0560.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0560.0\msneshellx.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HP BTW Detect Program] C:\Program Files\HP\HPBTWD.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
O4 - HKLM\..\Run: [HP] C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Office quick launch] C:\Program Files\Microsoft Office\Office11\OSA.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Thuy Doan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/fr/uno1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Roxio SAIB Service (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) - Unknown owner - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: BOTService - Sonic Solutions - C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\STacSV.exe

j'ai pas beaucoup de place dans mon budget, mais est-ce que je devrais acheter la license de malwarebytes?

J'ai encore des mauvaises redirections google

OTL : http://www.cijoint.fr/cjlink.php?file=cj201004/cijAk0Vmk6.txt
Extras : http://www.cijoint.fr/cjlink.php?file=cj201004/cijX6qJGBz.txt

Fichier msconfig32.sys reçu le 2010.04.22 23:50:36 (UTC)
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.04.22 -
AhnLab-V3 5.0.0.2 2010.04.22 -
AntiVir 8.2.1.220 2010.04.22 -
Antiy-AVL 2.0.3.7 2010.04.21 -
Authentium 5.2.0.5 2010.04.22 -
Avast 4.8.1351.0 2010.04.22 -
Avast5 5.0.332.0 2010.04.22 -
AVG 9.0.0.787 2010.04.22 -
BitDefender 7.2 2010.04.23 -
CAT-QuickHeal 10.00 2010.04.22 -
ClamAV 0.96.0.3-git 2010.04.23 -
Comodo 4668 2010.04.23 -
DrWeb 5.0.2.03300 2010.04.23 -
eSafe 7.0.17.0 2010.04.22 -
eTrust-Vet 35.2.7444 2010.04.22 -
F-Prot 4.5.1.85 2010.04.22 -
F-Secure 9.0.15370.0 2010.04.22 -
Fortinet 4.0.14.0 2010.04.21 -
GData 21 2010.04.23 -
Ikarus T3.1.1.80.0 2010.04.22 -
Jiangmin 13.0.900 2010.04.22 -
Kaspersky 7.0.0.125 2010.04.23 -
McAfee 5.400.0.1158 2010.04.23 -
McAfee-GW-Edition 6.8.5 2010.04.22 -
Microsoft 1.5703 2010.04.22 -
NOD32 5051 2010.04.22 -
Norman 6.04.11 2010.04.22 -
nProtect 2010-04-22.01 2010.04.22 -
Panda 10.0.2.7 2010.04.22 -
PCTools 7.0.3.5 2010.04.23 -
Rising 22.44.03.04 2010.04.22 -
Sophos 4.53.0 2010.04.23 -
Sunbelt 6210 2010.04.23 -
Symantec 20091.2.0.41 2010.04.23 -
TheHacker 6.5.2.0.267 2010.04.22 -
TrendMicro 9.120.0.1004 2010.04.22 -
TrendMicro-HouseCall 9.120.0.1004 2010.04.23 -
VBA32 3.12.12.4 2010.04.22 -
ViRobot 2010.4.22.2290 2010.04.22 -
VirusBuster 5.0.27.0 2010.04.22 -
Information additionnelle
File size: 5212 bytes
MD5...: f49b6e81b2343568c026564d9dee59b8
SHA1..: 4c98912128b3bdda23b5307190aec6d33a02b2b3
SHA256: 005ffba3c3e2932bee126a0cba8f40d347cf4a7b2d82374038936e6902ae049a
ssdeep: 96:UGh5q+BgAukYJDH5HJJvIAP5QzsCQtYuUv4wUmy8F3x:75pgAudb5H/vI0OsV<br>YuKUmyA3x<br>
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
trid..: DOS Executable Generic (100.0%)

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.04.22 -
AhnLab-V3 5.0.0.2 2010.04.22 -
AntiVir 8.2.1.220 2010.04.22 -
Antiy-AVL 2.0.3.7 2010.04.21 -
Authentium 5.2.0.5 2010.04.22 -
Avast 4.8.1351.0 2010.04.22 -
Avast5 5.0.332.0 2010.04.22 -
AVG 9.0.0.787 2010.04.22 -
BitDefender 7.2 2010.04.23 -
CAT-QuickHeal 10.00 2010.04.22 -
ClamAV 0.96.0.3-git 2010.04.23 -
Comodo 4668 2010.04.23 -
DrWeb 5.0.2.03300 2010.04.23 -
eSafe 7.0.17.0 2010.04.22 -
eTrust-Vet 35.2.7444 2010.04.22 -
F-Prot 4.5.1.85 2010.04.22 -
F-Secure 9.0.15370.0 2010.04.22 -
Fortinet 4.0.14.0 2010.04.21 -
GData 21 2010.04.23 -
Ikarus T3.1.1.80.0 2010.04.22 -
Jiangmin 13.0.900 2010.04.22 -
Kaspersky 7.0.0.125 2010.04.23 -
McAfee 5.400.0.1158 2010.04.23 -
McAfee-GW-Edition 6.8.5 2010.04.22 -
Microsoft 1.5703 2010.04.22 -
NOD32 5051 2010.04.22 -
Norman 6.04.11 2010.04.22 -
nProtect 2010-04-22.01 2010.04.22 -
Panda 10.0.2.7 2010.04.22 -
PCTools 7.0.3.5 2010.04.23 -
Rising 22.44.03.04 2010.04.22 -
Sophos 4.53.0 2010.04.23 -
Sunbelt 6210 2010.04.23 -
Symantec 20091.2.0.41 2010.04.23 -
TheHacker 6.5.2.0.267 2010.04.22 -
TrendMicro 9.120.0.1004 2010.04.22 -
TrendMicro-HouseCall 9.120.0.1004 2010.04.23 -
VBA32 3.12.12.4 2010.04.22 -
ViRobot 2010.4.22.2290 2010.04.22 -
VirusBuster 5.0.27.0 2010.04.22 -

Information additionnelle
File size: 5212 bytes
MD5...: f49b6e81b2343568c026564d9dee59b8
SHA1..: 4c98912128b3bdda23b5307190aec6d33a02b2b3
SHA256: 005ffba3c3e2932bee126a0cba8f40d347cf4a7b2d82374038936e6902ae049a
ssdeep: 96:UGh5q+BgAukYJDH5HJJvIAP5QzsCQtYuUv4wUmy8F3x:75pgAudb5H/vI0OsV<br>YuKUmyA3x<br>
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
trid..: DOS Executable Generic (100.0%)

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
Process firefox.exe killed successfully!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-154108922-552443303-2849269232-1005\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\snp2uvc deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
========== FILES ==========
C:\Documents and Settings\Thuy Doan\Local Settings\Application Data\RJAhr0NY5OVC moved successfully.
C:\Documents and Settings\All Users\Application Data\RJAhr0NY5OVC moved successfully.
C:\Documents and Settings\Thuy Doan\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#SharedObjects\bin-debug\AppContainer_en_US_prod.swf folder moved successfully.
C:\Documents and Settings\Thuy Doan\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#SharedObjects\bin-debug folder moved successfully.
C:\Documents and Settings\Thuy Doan\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#SharedObjects folder moved successfully.
C:\Documents and Settings\Thuy Doan\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store folder moved successfully.
C:\Documents and Settings\Thuy Doan\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: Administrator.MINH
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1770733 bytes
->Flash cache emptied: 321 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 321 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 50805 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Thuy Doan
->Temp folder emptied: 324086672 bytes
->Temporary Internet Files folder emptied: 77172558 bytes
->Java cache emptied: 31764442 bytes
->FireFox cache emptied: 85380274 bytes
->Google Chrome cache emptied: 94999141 bytes
->Flash cache emptied: 93250 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 76817 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 203392 bytes
Windows Temp folder emptied: 1784924 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 23974710 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 2279020599 bytes

Total Files Cleaned = 2 785,00 mb

OTL by OldTimer - Version 3.2.2.0 log created on 04222010_195828

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

List'em by g3n-h@ckm@n 1.7.2.1

User : Thuy Doan (Administrators)
Update on 22/04/2010 by g3n-h@ckm@n ::::: 16.15
Start at: 20:30:19 | 2010-04-22

Intel(R) Atom(TM) CPU N270 @ 1.60GHz
Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Disabled
AV : avast! Antivirus 5.0.83886587 [ (!) Disabled | Updated ]

C:\ -> Local Fixed Disk | 149,04 Go (76,6 Go free) | NTFS
D:\ -> Removable Disk | 959,97 Mo (122,27 Mo free) | FAT

Boot: Normal

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\wdm\STacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\HP\HPBTWD.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
Microsoft Office quick launch REG_SZ C:\Program Files\Microsoft Office\Office11\OSA.exe
AdobeBridge REG_SZ
Google Update REG_SZ "C:\Documents and Settings\Thuy Doan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\AdobeUpdater

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
IgfxTray REG_SZ C:\WINDOWS\system32\igfxtray.exe
HotKeysCmds REG_SZ C:\WINDOWS\system32\hkcmd.exe
Persistence REG_SZ C:\WINDOWS\system32\igfxpers.exe
HP BTW Detect Program REG_SZ C:\Program Files\HP\HPBTWD.exe
SynTPEnh REG_SZ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
SysTrayApp REG_EXPAND_SZ %ProgramFiles%\IDT\WDM\sttray.exe
AESTFltr REG_EXPAND_SZ %SystemRoot%\system32\AESTFltr.exe /NoDlg
HP REG_SZ C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
WirelessAssistant REG_SZ C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
Adobe ARM REG_SZ "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
avast5 REG_SZ C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
DivXUpdate REG_SZ "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
AdobeCS4ServiceManager REG_SZ "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
EnableLUA REG_DWORD 1 (0x1)

===============

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 145 (0x91)

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 1 (0x1)

===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ MINH
DefaultUserName REG_SZ Thuy Doan
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD 0 (0x0)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 0 (0x0)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 1 (0x1)
AltDefaultUserName REG_SZ Thuy Doan
AltDefaultDomainName REG_SZ MINH
Background REG_SZ 0 0 0
System REG_SZ

===============

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe REG_SZ C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe:*:Disabled:Java(TM) Platform SE binary
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE REG_SZ C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe REG_SZ C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
C:\Program Files\uTorrent\uTorrent.exe REG_SZ C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
C:\Program Files\LimeWire\LimeWire.exe REG_SZ C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
C:\Program Files\Microprose\Risk II\RISKII.EXE REG_SZ C:\Program Files\Microprose\Risk II\RISKII.EXE:*:Enabled:Risk II
C:\WINDOWS\system32\dplaysvr.exe REG_SZ C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper
C:\Program Files\Skype\Plugin Manager\skypePM.exe REG_SZ C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe REG_SZ C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4
C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

===============
ActivX controls
===============

[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{20A60F0D-9AFA-4515-A0FD-83BD84642501}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D6F45B3-9043-443D-A792-115447494D24}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

==============
BHO :
======

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

===
DNS
===

DNS Server Search Order: 24.200.243.189
HKLM\SYSTEM\CCS\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189

================
Internet Explorer :
================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_EXPAND_SZ %SystemRoot%\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.ca/?gws_rd=ssl
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ

========
Services
========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

========
Safemode
========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!

=========
Atapi.sys
=========

C:\WINDOWS\system32\drivers\atapi.sys :
MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

=======
Drive :
=======

Windows Disk Defragmenter
Copyright (c) 2001 Microsoft Corp. and Executive Software International, Inc.

Analysis Report
149 GB Total, 76,59 GB (51%) Free, 24% Fragmented (48% file fragmentation)

You should defragment this volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\1.txt
Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Present !! : C:\WINDOWS\System32\drivers\wudfpf.sys
Present !! : C:\WINDOWS\System32\drivers\wudfrd.sys"
Present !! : C:\WINDOWS\System32\Process.exe
Present !! : C:\WINDOWS\System32\SrchSTS.exe
Present !! : C:\Documents and Settings\Thuy Doan\Application Data\wklnhst.dat
Present !! : C:\Documents and Settings\Thuy Doan\Application Data\wklnhst.dat

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges
Present !! : HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop
Present !! : HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges
Present !! : HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : HKCR\CLSID\{ca3eb689-8f09-4026-aa10-b9534c691ce0}
Present !! : HKCR\Interface\{4897bba6-48d9-468c-8efa-846275d7701b}
Present !! : HKCR\TypeLib\{4509d3cc-b642-4745-b030-645b79522c6d}
Present !! : HKCR\urlsearchhook.toolbarurlsearchhook
Present !! : HKCR\urlsearchhook.toolbarurlsearchhook.1
Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_BHDRVX86
Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_BHDRVX86
Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_BHDRVX86

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-22 21:30:31
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys SahdIa32.sys iaStor.sys >>UNKNOWN [0x865668C8]<<
kernel: MBR read successfully
user & kernel MBR OK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 0 (0x0)
FirewallOverride REG_DWORD 0 (0x0)
UacDisableNotify REG_DWORD 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 21:30:34,42

Kill'em by g3n-h@ckm@n 1.7.2.1

User : Thuy Doan (Administrators)
Update on 22/04/2010 by g3n-h@ckm@n ::::: 16.15
Start at: 22:37:30 | 2010-04-22

Intel(R) Atom(TM) CPU N270 @ 1.60GHz
Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : avast! Antivirus 5.0.83886587 [ Enabled | Updated ]

C:\ -> Local Fixed Disk | 149,04 Go (76,48 Go free) | NTFS
D:\ -> Removable Disk | 959,97 Mo (122,27 Mo free) | FAT

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\wdm\STacSV.exe
C:\Program Files\Alwil Software\Avast5\setup\avast.setup
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\1.txt

Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\WINDOWS\system32\drivers\wudfpf.sys
Quarantined & Deleted !! : C:\WINDOWS\system32\drivers\wudfrd.sys
Quarantined & Deleted !! : C:\WINDOWS\System32\Process.exe
Quarantined & Deleted !! : C:\WINDOWS\System32\SrchSTS.exe
Quarantined & Deleted !! : C:\Documents and Settings\Thuy Doan\Application Data\wklnhst.dat

==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges
Deleted : HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : HKCR\CLSID\{ca3eb689-8f09-4026-aa10-b9534c691ce0}
Deleted : HKCR\Interface\{4897bba6-48d9-468c-8efa-846275d7701b}
Deleted : HKCR\TypeLib\{4509d3cc-b642-4745-b030-645b79522c6d}
Deleted : HKCR\urlsearchhook.toolbarurlsearchhook
Deleted : HKCR\urlsearchhook.toolbarurlsearchhook.1
Deleted : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_BHDRVX86
Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_BHDRVX86
=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/?gws_rd=ssl
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

===============
Security Center
===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 1 (0x1)
FirewallOverride REG_DWORD 1 (0x1)
UacDisableNotify REG_DWORD 0 (0x0)

========
Services
=========

Ndisuio : Start = 3
EapHost : Start = 2
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
================

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 5.0.0.2 2009.02.27 -
AntiVir 7.9.0.107 2009.03.09 -
Authentium 5.1.0.4 2009.03.09 -
Avast 4.8.1335.0 2009.03.09 -
AVG 8.0.0.237 2009.03.09 -
BitDefender 7.2 2009.03.10 -
CAT-QuickHeal 10.00 2009.03.10 -
ClamAV 0.94.1 2009.03.10 -
Comodo 1037 2009.03.09 -
DrWeb 4.44.0.09170 2009.03.10 -
eSafe 7.0.17.0 2009.03.09 -
eTrust-Vet 31.6.6388 2009.03.09 -
F-Prot 4.4.4.56 2009.03.09 -
F-Secure 8.0.14470.0 2009.03.10 -
Fortinet 3.117.0.0 2009.03.10 -
GData 19 2009.03.10 -
Ikarus T3.1.1.45.0 2009.03.10 -
K7AntiVirus 7.10.665 2009.03.10 -
Kaspersky 7.0.0.125 2009.03.10 -
McAfee 5548 2009.03.09 -
McAfee+Artemis 5548 2009.03.09 -
Microsoft 1.4405 2009.03.10 -
NOD32 3922 2009.03.09 -
Norman 2009.03.09 -
nProtect 2009.1.8.0 2009.03.10 -
Panda 10.0.0.10 2009.03.09 -
PCTools 4.4.2.0 2009.03.09 -
Prevx1 V2 2009.03.10 -
Rising 21.20.11.00 2009.03.10 -
SecureWeb-Gateway 6.0.0 2009.03.09 -
Sophos 4.39.0 2009.03.10 -
Sunbelt 3.2.1858.2 2009.03.10 -
Symantec 1.4.4.12 2009.03.10 -
TheHacker 6.3.3.0.278 2009.03.10 -
TrendMicro 8.700.0.1004 2009.03.10 -
VBA32 3.12.10.1 2009.03.10 -
ViRobot 2009.3.10.1642 2009.03.10 -
VirusBuster 4.5.11.0 2009.03.09 -

Information additionnelle
File size: 21488 bytes
MD5   : 0b2d5d2341437d7d7e1a6c7bbce3786a
SHA1  : e80bfc5d04dc75fc66c1707b8a11fc8b15f05060
SHA256: e28f6ff902963cd725ce8deda6a96aeddc108533baec3110380227992bf3c2cf
PEInfo: PE Structure information<br> <br> ( base data )<br> entrypointaddress.: 0x60C2<br> timedatestamp.....: 0x49068D4E (Tue Oct 28 04:55:58 2008)<br> machinetype.......: 0x14C (Intel I386)<br> <br> ( 7 sections )<br> name viradd virsiz rawdsiz ntrpy md5<br> .text 0x1000 0x18AC 0x1A00 6.27 7f859da8b9a0ec177b0d4ce8272d7fb8<br>.rdata 0x3000 0x18C 0x200 4.13 b54c8420853106d4db824abef78b906a<br>.data 0x4000 0x20 0x200 0.31 e56217727bbf173d0f495c367ffc4f17<br>PAGE 0x5000 0xA58 0xC00 5.58 72d357bbc9f31db5c8c168239836c62e<br>INIT 0x6000 0x5FC 0x600 5.55 48091d9da973fb50f1eb098472f7ef0d<br>.rsrc 0x7000 0x300 0x400 2.53 3bcb76c550ad20a357dec90d1a61e1f1<br>.reloc 0x8000 0x1FE 0x200 5.27 aa3cf4503469c957e8dcc6ef9ea9a2f9<br> <br> ( 0 imports )<br> <br> <br> ( 0 exports )<br>
TrID  : File type identification<br>Win64 Executable Generic (95.5%)<br>Generic Win/DOS Executable (2.2%)<br>DOS Executable Generic (2.2%)<br>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: 384:RIbysyLwad/dIk52kLRoJz1dpKaJ7w1JnkhSKYJLWq1bk6jJj:Oes4waLI+ZQhBJckIDL7bkmJj
PEiD  : -
RDS   : NSRL Reference Data Set<br>-

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.04.17 -
AhnLab-V3 5.0.0.2 2010.04.16 -
AntiVir 7.10.6.115 2010.04.16 -
Antiy-AVL 2.0.3.7 2010.04.16 -
Authentium 5.2.0.5 2010.04.16 -
Avast 4.8.1351.0 2010.04.16 -
Avast5 5.0.332.0 2010.04.16 -
AVG 9.0.0.787 2010.04.16 -
BitDefender 7.2 2010.04.17 -
CAT-QuickHeal 10.00 2010.04.17 -
ClamAV 0.96.0.3-git 2010.04.17 -
Comodo 4622 2010.04.17 -
DrWeb 5.0.2.03300 2010.04.17 -
eSafe 7.0.17.0 2010.04.15 -
eTrust-Vet 35.2.7430 2010.04.16 -
F-Prot 4.5.1.85 2010.04.16 -
F-Secure 9.0.15370.0 2010.04.16 -
Fortinet 4.0.14.0 2010.04.16 -
GData 19 2010.04.17 -
Ikarus T3.1.1.80.0 2010.04.17 -
Jiangmin 13.0.900 2010.04.17 -
Kaspersky 7.0.0.125 2010.04.17 -
McAfee 5.400.0.1158 2010.04.17 -
McAfee-GW-Edition 6.8.5 2010.04.17 -
Microsoft 1.5605 2010.04.17 -
NOD32 5035 2010.04.16 -
Norman 6.04.11 2010.04.16 -
nProtect 2010-04-16.01 2010.04.16 -
Panda 10.0.2.7 2010.04.16 -
PCTools 7.0.3.5 2010.04.17 -
Prevx 3.0 2010.04.17 -
Rising 22.43.05.03 2010.04.17 -
Sophos 4.52.0 2010.04.17 -
Sunbelt 6186 2010.04.17 -
Symantec 20091.2.0.41 2010.04.17 -
TheHacker 6.5.2.0.263 2010.04.16 -
TrendMicro 9.120.0.1004 2010.04.15 -
VBA32 3.12.12.4 2010.04.15 -
ViRobot 2010.4.17.2281 2010.04.17 -
VirusBuster 5.0.27.0 2010.04.16 -

Information additionnelle
File size: 737280 bytes
MD5   : 2ee2b4bd9407c19c8e3794f2a1b4a0d0
SHA1  : 5b3fef93f8f1956913485793d9579e1a8d69cb86
SHA256: feba327f2faa3201d69d5660a5118c6cec6b921f104a21aa0d84faa3fd431a1d
PEInfo: PE Structure information<br> <br> ( base data )<br> entrypointaddress.: 0x23886<br> timedatestamp.....: 0x4A524B44 (Mon Jul 6 21:06:44 2009)<br> machinetype.......: 0x14C (Intel I386)<br> <br> ( 4 sections )<br> name viradd virsiz rawdsiz ntrpy md5<br> .text 0x1000 0x3BB05 0x3C000 6.62 7d02f6442493fe6c6a4f3a662385b3af<br>.rdata 0x3D000 0x1338E 0x14000 5.45 ef75cbaf0380d4cf27290e4699652042<br>.data 0x51000 0x6214 0x3000 3.44 686c74a8dbcfdc079f549ed32211dc21<br>.rsrc 0x58000 0x5F648 0x60000 5.69 34b1aae292ff9e7c16c843a75f876898<br> <br> ( 10 imports )<br> <br>> advapi32.dll: RegEnumKeyA, RegDeleteKeyA, RegCreateKeyExA, RegCreateKeyA, RegOpenKeyA, RegSetValueExA, RegQueryValueExA, RegCloseKey, RegDeleteValueA, RegOpenKeyExA, RegQueryValueA<br>> gdi32.dll: SelectObject, CreatePolygonRgn, GetClipBox, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, GetTextExtentPoint32A, DeleteDC, GetStockObject, CreatePen, CreateSolidBrush, CreateFontIndirectA, BitBlt, CreateBitmapIndirect, GetObjectA, GetPixel, CreateCompatibleDC, SetPixel, DeleteObject, GetMapMode, CreateCompatibleBitmap, CreateBitmap, MoveToEx, LineTo, SetMapMode, SetBkMode, RestoreDC, SaveDC, GetDeviceCaps, SetBkColor, SetTextColor<br>> kernel32.dll: LocalReAlloc, DeleteCriticalSection, TlsFree, GlobalFlags, InterlockedIncrement, GetCPInfo, GetOEMCP, GetThreadLocale, GetCurrentDirectoryA, ReadFile, WriteFile, SetFilePointer, FlushFileBuffers, GetFullPathNameA, SetErrorMode, GetSystemTimeAsFileTime, HeapFree, TlsSetValue, HeapReAlloc, VirtualAlloc, GetCommandLineA, GetProcessHeap, GetStartupInfoA, RtlUnwind, RaiseException, ExitProcess, ExitThread, CreateThread, HeapSize, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetACP, IsValidCodePage, LCMapStringA, LCMapStringW, HeapDestroy, HeapCreate, VirtualFree, GetStdHandle, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetTimeZoneInformation, GetDriveTypeA, GetConsoleCP, GetConsoleMode, GetStringTypeA, GetStringTypeW, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetEnvironmentVariableA, TlsAlloc, InitializeCriticalSection, GlobalHandle, GlobalReAlloc, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalAlloc, GetPrivateProfileStringA, WritePrivateProfileStringA, SuspendThread, SetEvent, GetCurrentThread, ConvertDefaultLocale, EnumResourceLanguagesA, GetLocaleInfoA, lstrcmpA, GetCurrentProcessId, InterlockedDecrement, GetModuleFileNameW, GlobalAlloc, FormatMessageA, LocalFree, MulDiv, FindFirstFileA, FileTimeToLocalFileTime, FileTimeToSystemTime, FindNextFileA, FindClose, GlobalLock, GlobalUnlock, GlobalFree, FreeResource, GetCurrentThreadId, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, FreeLibrary, SetLastError, lstrcmpW, MultiByteToWideChar, CompareStringW, InterlockedExchange, CompareStringA, GetVersion, CreateEventA, ResetEvent, SetThreadPriority, WaitForSingleObject, TerminateThread, ResumeThread, Sleep, DeviceIoControl, CloseHandle, CreateFileA, lstrcpyA, GetUserDefaultUILanguage, GetSystemDefaultLangID, EnumUILanguagesA, GetCurrentProcess, IsWow64Process, GetNativeSystemInfo, GetVersionExA, FindResourceExA, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, LoadLibraryA, FindResourceA, LoadResource, LockResource, SizeofResource, WideCharToMultiByte, GetLastError, lstrlenA, CreateProcessA, HeapAlloc<br>> oleaut32.dll: -, -, -<br>> shell32.dll: Shell_NotifyIconA<br>> shlwapi.dll: PathFindExtensionA, PathFindFileNameA<br>> user32.dll: GetWindowDC, BeginPaint, EndPaint, GetWindowThreadProcessId, PostQuitMessage, ValidateRect, TranslateMessage, GetMessageA, SetCursor, DestroyMenu, WindowFromPoint, GetSysColorBrush, LoadCursorA, UnregisterClassA, ReleaseDC, GetDC, GrayStringA, DrawTextExA, TabbedTextOutA, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, ModifyMenuA, GetMenuState, EnableMenuItem, CheckMenuItem, GetDesktopWindow, GetActiveWindow, CreateDialogIndirectParamA, GetNextDlgTabItem, EndDialog, IsWindowEnabled, ShowWindow, SetWindowTextA, IsDialogMessageA, SendDlgItemMessageA, WinHelpA, GetCapture, SetWindowsHookExA, CallNextHookEx, GetClassLongA, GetClassNameA, SetPropA, GetPropA, RemovePropA, GetWindowTextLengthA, GetWindowTextA, GetForegroundWindow, GetLastActivePopup, SetActiveWindow, DispatchMessageA, GetDlgItem, GetTopWindow, DestroyWindow, UnhookWindowsHookEx, GetMessageTime, GetMessagePos, PeekMessageA, MapWindowPoints, TrackPopupMenu, GetKeyState, IsWindowVisible, UpdateWindow, GetMenu, GetMenuItemID, GetMenuItemCount, MessageBoxA, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, AdjustWindowRectEx, GetParent, GetDlgCtrlID, DefWindowProcA, CallWindowProcA, GetWindow, MoveWindow, SetWindowPlacement, GetWindowPlacement, OffsetRect, IsWindow, IsIconic, LoadIconA, SetWindowRgn, SetMenuDefaultItem, GetSubMenu, DrawIcon, GetSystemMetrics, SystemParametersInfoA, IntersectRect, CopyRect, SetTimer, KillTimer, GetSysColor, InflateRect, SetRect, LoadMenuA, LoadMenuIndirectA, FindWindowA, ReleaseCapture, PtInRect, GetCursorPos, GetClientRect, SetCapture, FillRect, DrawFocusRect, DrawTextA, InvalidateRect, ScreenToClient, ClientToScreen, GetFocus, SendMessageA, LoadBitmapA, GetWindowRect, SetWindowLongA, RegisterWindowMessageA, GetWindowLongA, EnableWindow, PostMessageA, BringWindowToTop, SetForegroundWindow, SetFocus, SetWindowPos<br>> version.dll: GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA<br>> winmm.dll: waveOutClose, waveInOpen, waveInStart, waveInStop, waveInClose, waveOutReset, waveInReset, waveInPrepareHeader, waveInUnprepareHeader, waveInAddBuffer, waveOutWrite, waveOutPrepareHeader, waveOutUnprepareHeader, waveOutOpen<br>> winspool.drv: OpenPrinterA, ClosePrinter, DocumentPropertiesA<br> <br> ( 0 exports )<br>
TrID  : File type identification<br>Win64 Executable Generic (59.6%)<br>Win32 Executable MS Visual C++ (generic) (26.2%)<br>Win32 Executable Generic (5.9%)<br>Win32 Dynamic Link Library (generic) (5.2%)<br>Generic Win/DOS Executable (1.3%)
ssdeep: 12288:qOCoI18ZH5N2GrE5+BLBOBjqXflu3G4rHbjAlnMlZgmLI:xvIFGrE5wLBOBjqXflu3G4rHHAOnLI
sigcheck: publisher....: Andrea Electronics Corporation<br>copyright....: Copyright (c) 1999-2009, Andrea Electronics Corporation<br>product......: AEFltrs Application<br>description..: AEFltrs MFC Application<br>original name: AEFltrs.EXE<br>internal name: AEFltrs<br>file version.: 5, 0, 0, 5<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
PEiD  : -
RDS   : NSRL Reference Data Set<br>-