Win32 rootkit gen.tkt

Merci gen-hakman pour ta réponse rapide mais un compte à rebours s'affiche et mon ordi ne réponds plus. J'ai juste une fenetre rouge qui s'affiche comme quoi mon ordi est infecté et en cliquant rien ne se passe je suis obligé de l'éteindre via la bouton sur la tour.
D'avance, merci de ton aide.

compte rebours autorite nt system ?

Oui c'est le compte a rebours Autorite NT/system.
et en le rallumant hier soir un message nouveau est apparu : WormWIN32.netsky
et une fenêtre s'ouvre C/Windows/system32/helpers32.dll
J'ai essayé de le démarrer en mode sans echec ça fonctionne, que dois-je faire ensuite ?
Merci mercissss

J'ai essayé de le démarrer en mode sans echec ça fonctionne, que dois-je faire ensuite ?
merci bcp

ok je fais ça ce soir en rentrant du boulot. C'est vraiment cool de m'aider.

bonjour,
j'ai réussi à trouver un pc pour pouvoir vous répondre et faire les manipulations que vous m'avez recommandés.
Voici le rapport de combofix :
ComboFix 10-05-13.04 - Acer 14/05/2010 20:09:50.1.2 - x86 NETWORK
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.767.483 [GMT 2:00]
Lancé depuis: J:\ComboFix.exe

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Acer\Application Data\avdrn.dat
c:\program files\Winsudate
c:\program files\Winsudate\gibidl.dll
c:\windows\system32\18467.exe
c:\windows\system32\41.exe
c:\windows\system32\6334.exe
c:\windows\system32\ES15.exe
c:\windows\system32\helpers32.dll
c:\windows\system32\smss32.exe
c:\windows\system32\warnings.html
c:\windows\system32\winlogon32.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-14 au 2010-05-14 ))))))))))))))))))))))))))))))))))))
.

2010-05-14 17:27 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-05-14 17:26 . 2010-05-14 17:26 -------- d-----w- c:\program files\Avira
2010-05-14 06:51 . 2010-05-14 06:51 -------- d-sh--w- c:\documents and settings\Administrateur\PrivacIE
2010-05-14 06:51 . 2010-05-14 06:51 -------- d-sh--w- c:\documents and settings\Administrateur\IETldCache
2010-05-10 11:45 . 2010-05-10 11:45 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Threat Expert
2010-05-10 11:43 . 2010-05-10 11:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-05-10 11:38 . 2010-05-10 11:38 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-05-10 11:38 . 2010-05-10 11:45 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Google
2010-05-10 11:37 . 2010-01-22 07:55 767952 ----a-w- c:\windows\BDTSupport.dll
2010-05-10 11:35 . 2010-05-10 11:35 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2010-05-10 11:35 . 2010-05-10 11:35 -------- d-----w- c:\documents and settings\Acer\Application Data\PC Tools
2010-05-10 11:34 . 2010-05-14 17:31 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-10 10:41 . 2010-05-10 10:41 -------- d-----w- c:\documents and settings\Acer\Application Data\Malwarebytes
2010-05-10 10:41 . 2010-05-10 10:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-10 10:41 . 2008-06-10 17:02 34296 ----a-w- c:\windows\system32\drivers\mbamcatchme.sys
2010-05-10 10:41 . 2008-06-10 17:02 15864 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-10 10:41 . 2010-05-10 10:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-10 10:11 . 2007-01-18 12:00 3968 ----a-w- c:\windows\system32\drivers\AvgArCln.sys
2010-05-10 10:00 . 2008-04-14 01:53 30336 -c--a-w- c:\windows\system32\dllcache\modem.sys
2010-05-10 10:00 . 2008-04-13 18:40 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-05-03 13:20 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-05-03 13:20 . 2008-04-13 18:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-05-03 13:20 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-04-20 20:42 . 2010-04-20 20:42 -------- d-----w- c:\program files\MSECache
2010-04-20 20:17 . 2010-04-23 20:28 -------- d-----w- c:\documents and settings\Acer\Application Data\Apple Computer
2010-04-20 20:16 . 2009-05-18 11:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-04-20 20:14 . 2010-04-20 20:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-04-20 20:13 . 2010-04-20 20:17 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Apple Computer
2010-04-20 19:52 . 2010-04-20 19:52 -------- d-----w- c:\program files\Audacity

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-14 17:32 . 2010-05-10 11:35 -------- d-----w- c:\program files\Spyware Doctor
2010-05-10 11:38 . 2010-05-10 11:37 -------- d-----w- c:\program files\Google
2010-05-10 11:37 . 2010-05-10 11:35 -------- d-----w- c:\program files\Fichiers communs\PC Tools
2010-05-10 09:54 . 2010-05-10 09:54 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\qvjsge.dat
2010-05-03 13:19 . 2010-05-03 13:19 16 ----a-w- c:\documents and settings\NetworkService\Application Data\qvjsge.dat
2010-05-03 11:02 . 2009-10-04 18:30 -------- d-----w- c:\documents and settings\Acer\Application Data\vlc
2010-04-20 21:13 . 2010-04-20 20:16 -------- d-----w- c:\program files\iTunes
2010-04-20 20:28 . 2009-09-25 10:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-20 20:16 . 2010-04-20 20:16 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-20 20:16 . 2010-04-20 20:16 -------- d-----w- c:\program files\iPod
2010-04-20 20:16 . 2010-04-20 20:14 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-04-20 20:16 . 2010-04-20 20:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-04-20 20:15 . 2010-04-20 20:15 -------- d-----w- c:\program files\QuickTime
2010-04-20 20:14 . 2010-04-20 20:14 -------- d-----w- c:\program files\Apple Software Update
2010-04-20 20:14 . 2010-04-20 20:14 -------- d-----w- c:\program files\Bonjour
2010-04-14 20:57 . 2009-12-21 14:52 79488 ----a-w- c:\documents and settings\Acer\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-04-08 12:29 . 2010-05-10 11:35 63360 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2010-03-29 16:53 . 2001-08-28 12:00 49494 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-29 16:53 . 2001-08-28 12:00 370414 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-29 08:06 . 2010-05-10 11:35 218592 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2010-03-25 23:48 . 2010-03-25 23:48 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-10 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-22 14854144]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-20 148888]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-25 142120]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2010-03-09 1286608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Acer\Menu D'marrer\Programmes\D'marrage\
wwwzuc32.exe [2008-4-14 16896]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [25/09/2009 11:44 76544]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [10/05/2010 13:35 218592]
S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [10/05/2010 13:37 112592]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10/05/2010 13:38 135664]
S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [10/05/2010 13:35 366840]
.
Contenu du dossier 'Tâches planifiées'

2010-04-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]

2010-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-10 11:38]

2010-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-10 11:38]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
LSP: c:\program files\Fichiers communs\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: buy-security-essentials.com
Trusted Zone: download-soft-package.com
Trusted Zone: download-software-package.com
Trusted Zone: get-key-se10.com
Trusted Zone: is-software-download.com
Trusted Zone: buy-security-essentials.com
Trusted Zone: get-key-se10.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-WinUsr - c:\program files\Winsudate\gibusr.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-14 20:14
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(644)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2010-05-14 20:16:23
ComboFix-quarantined-files.txt 2010-05-14 18:16

Avant-CF: 100 224 274 432 octets libres
Après-CF: 100 492 853 248 octets libres

- - End Of File - - 13BFF66D87F0CFBA6B4298F818349CE4

bonjour,
j'ai réussi à trouver un pc pour pouvoir vous répondre et faire les manipulations que vous m'avez recommandés.
Voici le rapport de combofix :
ComboFix 10-05-13.04 - Acer 14/05/2010 20:09:50.1.2 - x86 NETWORK
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.767.483 [GMT 2:00]
Lancé depuis: J:\ComboFix.exe

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Acer\Application Data\avdrn.dat
c:\program files\Winsudate
c:\program files\Winsudate\gibidl.dll
c:\windows\system32\18467.exe
c:\windows\system32\41.exe
c:\windows\system32\6334.exe
c:\windows\system32\ES15.exe
c:\windows\system32\helpers32.dll
c:\windows\system32\smss32.exe
c:\windows\system32\warnings.html
c:\windows\system32\winlogon32.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-14 au 2010-05-14 ))))))))))))))))))))))))))))))))))))
.

2010-05-14 17:27 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-05-14 17:26 . 2010-05-14 17:26 -------- d-----w- c:\program files\Avira
2010-05-14 06:51 . 2010-05-14 06:51 -------- d-sh--w- c:\documents and settings\Administrateur\PrivacIE
2010-05-14 06:51 . 2010-05-14 06:51 -------- d-sh--w- c:\documents and settings\Administrateur\IETldCache
2010-05-10 11:45 . 2010-05-10 11:45 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Threat Expert
2010-05-10 11:43 . 2010-05-10 11:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-05-10 11:38 . 2010-05-10 11:38 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-05-10 11:38 . 2010-05-10 11:45 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Google
2010-05-10 11:37 . 2010-01-22 07:55 767952 ----a-w- c:\windows\BDTSupport.dll
2010-05-10 11:35 . 2010-05-10 11:35 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2010-05-10 11:35 . 2010-05-10 11:35 -------- d-----w- c:\documents and settings\Acer\Application Data\PC Tools
2010-05-10 11:34 . 2010-05-14 17:31 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-10 10:41 . 2010-05-10 10:41 -------- d-----w- c:\documents and settings\Acer\Application Data\Malwarebytes
2010-05-10 10:41 . 2010-05-10 10:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-10 10:41 . 2008-06-10 17:02 34296 ----a-w- c:\windows\system32\drivers\mbamcatchme.sys
2010-05-10 10:41 . 2008-06-10 17:02 15864 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-10 10:41 . 2010-05-10 10:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-10 10:11 . 2007-01-18 12:00 3968 ----a-w- c:\windows\system32\drivers\AvgArCln.sys
2010-05-10 10:00 . 2008-04-14 01:53 30336 -c--a-w- c:\windows\system32\dllcache\modem.sys
2010-05-10 10:00 . 2008-04-13 18:40 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-05-03 13:20 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-05-03 13:20 . 2008-04-13 18:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-05-03 13:20 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-04-20 20:42 . 2010-04-20 20:42 -------- d-----w- c:\program files\MSECache
2010-04-20 20:17 . 2010-04-23 20:28 -------- d-----w- c:\documents and settings\Acer\Application Data\Apple Computer
2010-04-20 20:16 . 2009-05-18 11:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-04-20 20:14 . 2010-04-20 20:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-04-20 20:13 . 2010-04-20 20:17 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Apple Computer
2010-04-20 19:52 . 2010-04-20 19:52 -------- d-----w- c:\program files\Audacity

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-14 17:32 . 2010-05-10 11:35 -------- d-----w- c:\program files\Spyware Doctor
2010-05-10 11:38 . 2010-05-10 11:37 -------- d-----w- c:\program files\Google
2010-05-10 11:37 . 2010-05-10 11:35 -------- d-----w- c:\program files\Fichiers communs\PC Tools
2010-05-10 09:54 . 2010-05-10 09:54 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\qvjsge.dat
2010-05-03 13:19 . 2010-05-03 13:19 16 ----a-w- c:\documents and settings\NetworkService\Application Data\qvjsge.dat
2010-05-03 11:02 . 2009-10-04 18:30 -------- d-----w- c:\documents and settings\Acer\Application Data\vlc
2010-04-20 21:13 . 2010-04-20 20:16 -------- d-----w- c:\program files\iTunes
2010-04-20 20:28 . 2009-09-25 10:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-20 20:16 . 2010-04-20 20:16 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-20 20:16 . 2010-04-20 20:16 -------- d-----w- c:\program files\iPod
2010-04-20 20:16 . 2010-04-20 20:14 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-04-20 20:16 . 2010-04-20 20:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-04-20 20:15 . 2010-04-20 20:15 -------- d-----w- c:\program files\QuickTime
2010-04-20 20:14 . 2010-04-20 20:14 -------- d-----w- c:\program files\Apple Software Update
2010-04-20 20:14 . 2010-04-20 20:14 -------- d-----w- c:\program files\Bonjour
2010-04-14 20:57 . 2009-12-21 14:52 79488 ----a-w- c:\documents and settings\Acer\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-04-08 12:29 . 2010-05-10 11:35 63360 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2010-03-29 16:53 . 2001-08-28 12:00 49494 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-29 16:53 . 2001-08-28 12:00 370414 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-29 08:06 . 2010-05-10 11:35 218592 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2010-03-25 23:48 . 2010-03-25 23:48 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-10 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-22 14854144]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-20 148888]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-25 142120]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2010-03-09 1286608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Acer\Menu D'marrer\Programmes\D'marrage\
wwwzuc32.exe [2008-4-14 16896]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [25/09/2009 11:44 76544]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [10/05/2010 13:35 218592]
S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [10/05/2010 13:37 112592]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10/05/2010 13:38 135664]
S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [10/05/2010 13:35 366840]
.
Contenu du dossier 'Tâches planifiées'

2010-04-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]

2010-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-10 11:38]

2010-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-10 11:38]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
LSP: c:\program files\Fichiers communs\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: buy-security-essentials.com
Trusted Zone: download-soft-package.com
Trusted Zone: download-software-package.com
Trusted Zone: get-key-se10.com
Trusted Zone: is-software-download.com
Trusted Zone: buy-security-essentials.com
Trusted Zone: get-key-se10.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-WinUsr - c:\program files\Winsudate\gibusr.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-14 20:14
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(644)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2010-05-14 20:16:23
ComboFix-quarantined-files.txt 2010-05-14 18:16

Avant-CF: 100 224 274 432 octets libres
Après-CF: 100 492 853 248 octets libres

- - End Of File - - 13BFF66D87F0CFBA6B4298F818349CE4

Attends Gen Hackman, c'est lui qui s'occupe de toi.

Salut gen-hackman,
Merci pour tes conseils mais je m'impatientais le week-end dernier (un long week-end sans ordi c'était pas possible) alors j'ai désinstallé Avast en mode sans échec et j'ai installé antivir et après un scan minutieux le virus a disparu ! du moins la fenêtre rouge qui indiquait "your computeur is INFECTED!!!". J'ai supprimer des programmes inutiles dont un qui s'appelait "bonjour" j'espère que j'ai bien fait). Bref depuis mon ordi refonctionne normalement sauf que le ventilateur ne cesse de tourner et c'est pas mal bruyant. Et ce depuis l'installation d'antivir....
Question : faut-il que je fasse les manip ci-dessus quand meme ? ai-je bien fait de faire tout cela ? et pour le ventilateur que faire ??? merci infiniment pour ton aide.

j'ai effectué la manip demandée mais quand il fallait glisser et déposer le fichier CFScript sur combofix, le scan etait lancé, j'ignore si ça l'a pris en compte. En tout cas voici le contenu du poste :
ComboFix 10-05-19.02 - Acer 19/05/2010 22:46:32.2.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.767.400 [GMT 2:00]
Lancé depuis: c:\documents and settings\Acer\Mes documents\Téléchargements\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

((((((((((((((((((((((((((((( Fichiers créés du 2010-04-19 au 2010-05-19 ))))))))))))))))))))))))))))))))))))
.

2010-05-14 19:18 . 2010-05-14 19:18 0 ----a-w- c:\windows\nsreg.dat
2010-05-14 19:18 . 2010-05-14 19:18 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Mozilla
2010-05-14 19:08 . 2010-05-14 19:09 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2010-05-14 18:43 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-05-14 18:43 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-05-14 18:43 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-05-14 18:43 . 2010-05-14 18:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-05-14 17:27 . 2010-05-14 19:16 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-05-14 17:26 . 2010-05-14 17:26 -------- d-----w- c:\program files\Avira
2010-05-14 06:51 . 2010-05-14 06:51 -------- d-sh--w- c:\documents and settings\Administrateur\PrivacIE
2010-05-14 06:51 . 2010-05-14 06:51 -------- d-sh--w- c:\documents and settings\Administrateur\IETldCache
2010-05-10 11:45 . 2010-05-10 11:45 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Threat Expert
2010-05-10 11:43 . 2010-05-10 11:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-05-10 11:38 . 2010-05-10 11:38 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-05-10 11:38 . 2010-05-10 11:45 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Google
2010-05-10 11:37 . 2010-05-10 11:38 -------- d-----w- c:\program files\Google
2010-05-10 11:34 . 2010-05-15 17:02 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-10 10:41 . 2010-05-10 10:41 -------- d-----w- c:\documents and settings\Acer\Application Data\Malwarebytes
2010-05-10 10:41 . 2010-05-15 17:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-10 10:00 . 2008-04-14 01:53 30336 -c--a-w- c:\windows\system32\dllcache\modem.sys
2010-05-10 10:00 . 2008-04-13 18:40 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-05-03 13:20 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-05-03 13:20 . 2008-04-13 18:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-05-03 13:20 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-04-20 20:42 . 2010-04-20 20:42 -------- d-----w- c:\program files\MSECache
2010-04-20 20:17 . 2010-04-23 20:28 -------- d-----w- c:\documents and settings\Acer\Application Data\Apple Computer
2010-04-20 20:14 . 2010-04-20 20:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-04-20 20:13 . 2010-04-20 20:17 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-15 16:59 . 2009-11-15 17:52 -------- d-----w- c:\program files\IKEA HomePlanner
2010-05-10 09:54 . 2010-05-10 09:54 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\qvjsge.dat
2010-05-03 13:19 . 2010-05-03 13:19 16 ----a-w- c:\documents and settings\NetworkService\Application Data\qvjsge.dat
2010-05-03 11:02 . 2009-10-04 18:30 -------- d-----w- c:\documents and settings\Acer\Application Data\vlc
2010-04-20 21:13 . 2010-04-20 20:16 -------- d-----w- c:\program files\iTunes
2010-04-20 20:28 . 2009-09-25 10:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-20 20:16 . 2010-04-20 20:16 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-20 20:16 . 2010-04-20 20:16 -------- d-----w- c:\program files\iPod
2010-04-20 20:16 . 2010-04-20 20:14 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-04-20 20:16 . 2010-04-20 20:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-04-20 20:15 . 2010-04-20 20:15 -------- d-----w- c:\program files\QuickTime
2010-04-20 20:14 . 2010-04-20 20:14 -------- d-----w- c:\program files\Apple Software Update
2010-04-14 20:57 . 2009-12-21 14:52 79488 ----a-w- c:\documents and settings\Acer\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-29 16:53 . 2001-08-28 12:00 49494 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-29 16:53 . 2001-08-28 12:00 370414 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-25 23:48 . 2010-03-25 23:48 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-05-14_18.14.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-19 20:18 . 2010-05-19 20:18 16384 c:\windows\temp\Perflib_Perfdata_1f8.dat
+ 2010-05-14 18:43 . 2010-05-14 19:16 28520 c:\windows\system32\drivers\ssmdrv.sys
+ 2010-05-14 19:10 . 2010-05-14 19:10 22528 c:\windows\Installer\21db4.msi
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-10 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-22 14854144]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-20 148888]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-25 142120]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Acer\Menu D'marrer\Programmes\D'marrage\
wwwzuc32.exe [2008-4-14 16896]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [25/09/2009 11:44 76544]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [14/05/2010 20:43 108289]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10/05/2010 13:38 135664]
.
Contenu du dossier 'Tâches planifiées'

2010-04-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]

2010-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-10 11:38]

2010-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-10 11:38]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
Trusted Zone: buy-security-essentials.com
Trusted Zone: download-soft-package.com
Trusted Zone: download-software-package.com
Trusted Zone: get-key-se10.com
Trusted Zone: is-software-download.com
Trusted Zone: buy-security-essentials.com
Trusted Zone: get-key-se10.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Acer\Application Data\Mozilla\Firefox\Profiles\hfj6g6fe.default\
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-19 22:50
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(708)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1480)
c:\windows\system32\msls31.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
Heure de fin: 2010-05-19 22:53:01
ComboFix-quarantined-files.txt 2010-05-19 20:52
ComboFix2.txt 2010-05-14 18:16

Avant-CF: 100 388 294 656 octets libres
Après-CF: 100 355 178 496 octets libres

- - End Of File - - A9BA0CC9D5D802D63BD31A199B1A1F03

Ok mais alors à quel moment il faut le glisser dans combofix ? quand je télécharge combofix il lance le scan automatiquement sans que j'ai le temps de faire quoi que ce soit. Merci de ton aide.

oui mais à quel moment tu le glisses c'est ma question.

En plus je me suis rendue compte que je n'avais plus de son sur mon ordi grrrrrrrrr

bonjour
voici un exemple animé
https://www.bleepstatic.com/combofix/usage/rc.gif

bonne journée

Merci à vous 2 je n'avais pas compris qu'il fallait le glisser dans "l'icone".. j'avais d'abord ouvert combofix et glissé ensuite CFScript. ;-)
Je fais ça ce soir merci.

Pendant le scan de combofix, antivir désactivé, j'avais plein de message de virus et cheval de troie détectés dont un qui revenait sans cesse alors que je faisais "supprimer" il s'appelle TR/crypt/^pack.gen
ensuite mon ordi s'est mis tout seul en mode sans echec et a redémmarrer automatiquement à la fin du scan, ensuite il s'est rallumé avec la page noir (alors que j'ai pas fais F8) et en cliquant sur démarrage en mode normal ça ne marchait pas..
Bref voici le contenu du rapport combofix j'espère que ça résoudra mes pb :

ComboFix 10-05-19.02 - Acer 21/05/2010 8:31.5.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.767.330 [GMT 2:00]
Lancé depuis: c:\documents and settings\Acer\Mes documents\Téléchargements\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Acer\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

FILE ::
"c:\documents and settings\Acer\Menu D'marrer\Programmes\D'marrage\"
"c:\documents and settings\NetworkService\Application Data\qvjsge.dat"
"c:\windows\system32\config\systemprofile\Application Data\qvjsge.dat"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\config\systemprofile\Application Data\qvjsge.dat
c:\windows\system32\helpers32.dll
.
---- Exécution préalable -------
.
c:\documents and settings\NetworkService\Application Data\qvjsge.dat
c:\windows\system32\config\systemprofile\Application Data\qvjsge.dat

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-21 au 2010-05-21 ))))))))))))))))))))))))))))))))))))
.

2010-05-21 06:22 . 2010-05-21 06:35 859648 ----a-w- c:\windows\system32\drivers\eydpncdi.sys
2010-05-14 19:18 . 2010-05-14 19:18 0 ----a-w- c:\windows\nsreg.dat
2010-05-14 19:18 . 2010-05-14 19:18 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Mozilla
2010-05-14 19:08 . 2010-05-14 19:09 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2010-05-14 18:43 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-05-14 18:43 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-05-14 18:43 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-05-14 18:43 . 2010-05-14 18:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-05-14 17:27 . 2010-05-14 19:16 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-05-14 17:26 . 2010-05-14 17:26 -------- d-----w- c:\program files\Avira
2010-05-14 06:51 . 2010-05-14 06:51 -------- d-sh--w- c:\documents and settings\Administrateur\PrivacIE
2010-05-14 06:51 . 2010-05-14 06:51 -------- d-sh--w- c:\documents and settings\Administrateur\IETldCache
2010-05-10 11:45 . 2010-05-10 11:45 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Threat Expert
2010-05-10 11:43 . 2010-05-10 11:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-05-10 11:38 . 2010-05-10 11:38 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-05-10 11:38 . 2010-05-10 11:45 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Google
2010-05-10 11:37 . 2010-05-10 11:38 -------- d-----w- c:\program files\Google
2010-05-10 11:34 . 2010-05-15 17:02 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-10 10:41 . 2010-05-10 10:41 -------- d-----w- c:\documents and settings\Acer\Application Data\Malwarebytes
2010-05-10 10:41 . 2010-05-15 17:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-10 10:00 . 2008-04-14 01:53 30336 -c--a-w- c:\windows\system32\dllcache\modem.sys
2010-05-10 10:00 . 2008-04-13 18:40 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-05-03 13:20 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-05-03 13:20 . 2008-04-13 18:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-05-03 13:20 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-21 06:39 . 2010-05-21 06:38 859648 ----a-w- c:\windows\system32\drivers\wjvfmmdq.sys
2010-05-21 06:38 . 2010-05-21 06:38 96256 ----a-w- c:\windows\system32\41.exe
2010-05-21 06:38 . 2010-05-21 06:38 54272 ----a-w- c:\windows\system32\helpers32.dll
2010-05-21 06:37 . 2010-05-21 06:38 57856 ----a-w- c:\windows\system32\winlogon32.exe
2010-05-21 06:37 . 2010-05-21 06:38 57856 ----a-w- c:\windows\system32\smss32.exe
2010-05-21 06:37 . 2010-05-21 06:37 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\qvjsge.dat
2010-05-15 16:59 . 2009-11-15 17:52 -------- d-----w- c:\program files\IKEA HomePlanner
2010-05-03 11:02 . 2009-10-04 18:30 -------- d-----w- c:\documents and settings\Acer\Application Data\vlc
2010-04-23 20:28 . 2010-04-20 20:17 -------- d-----w- c:\documents and settings\Acer\Application Data\Apple Computer
2010-04-20 21:13 . 2010-04-20 20:16 -------- d-----w- c:\program files\iTunes
2010-04-20 20:42 . 2010-04-20 20:42 -------- d-----w- c:\program files\MSECache
2010-04-20 20:28 . 2009-09-25 10:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-20 20:16 . 2010-04-20 20:16 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-20 20:16 . 2010-04-20 20:16 -------- d-----w- c:\program files\iPod
2010-04-20 20:16 . 2010-04-20 20:14 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-04-20 20:16 . 2010-04-20 20:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-04-20 20:15 . 2010-04-20 20:15 -------- d-----w- c:\program files\QuickTime
2010-04-20 20:14 . 2010-04-20 20:14 -------- d-----w- c:\program files\Apple Software Update
2010-04-20 20:14 . 2010-04-20 20:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-04-14 20:57 . 2009-12-21 14:52 79488 ----a-w- c:\documents and settings\Acer\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-29 16:53 . 2001-08-28 12:00 49494 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-29 16:53 . 2001-08-28 12:00 370414 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-25 23:48 . 2010-03-25 23:48 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-05-14_18.14.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 1601-01-01 00:00 . 1601-01-01 00:00 0 c:\windows\system32\ES15.exe
+ 1601-01-01 00:00 . 1601-01-01 00:00 0 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WR7FY0NN\SetupSE2010[1].exe
+ 2010-05-21 06:37 . 2010-05-21 06:37 16384 c:\windows\temp\Perflib_Perfdata_3d4.dat
+ 2010-05-19 21:38 . 2010-05-19 21:38 85173 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2010-05-14 18:43 . 2010-05-14 19:16 28520 c:\windows\system32\drivers\ssmdrv.sys
+ 2010-05-21 06:38 . 2010-05-21 06:38 54272 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OLR2IIJK\firewall[1].dll
+ 2009-09-25 08:38 . 2010-05-21 06:38 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-09-25 08:38 . 2010-05-10 09:54 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-09-25 08:38 . 2010-05-21 06:38 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2009-09-25 08:38 . 2010-05-10 09:54 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2009-09-25 08:38 . 2010-05-10 09:54 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-05-21 06:21 . 2010-05-21 06:38 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-05-14 19:10 . 2010-05-14 19:10 22528 c:\windows\Installer\21db4.msi
+ 2010-01-27 01:07 . 2010-01-27 01:07 256280 c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2010-01-27 01:07 . 2010-01-27 01:07 3884312 c:\windows\system32\Macromed\Flash\NPSWF32.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-10 39408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"smss32.exe"="c:\windows\system32\smss32.exe" [2010-05-21 57856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-22 14854144]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-20 148888]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-25 142120]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"smss32.exe"="c:\windows\system32\smss32.exe" [2010-05-21 57856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Acer\Menu D'marrer\Programmes\D'marrage\
wwwzuc32.exe [2008-4-14 16896]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\winlogon32.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [25/09/2009 11:44 76544]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [14/05/2010 20:43 108289]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10/05/2010 13:38 135664]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - WJVFMMDQ
*Deregistered* - wjvfmmdq
.
Contenu du dossier 'Tâches planifiées'

2010-04-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]

2010-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-10 11:38]

2010-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-10 11:38]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
LSP: c:\windows\system32\helpers32.dll
Trusted Zone: buy-security-essentials.com
Trusted Zone: digital-supply.com
Trusted Zone: download-soft-package.com
Trusted Zone: download-software-package.com
Trusted Zone: get-key-se10.com
Trusted Zone: is-software-download.com
Trusted Zone: buy-security-essentials.com
Trusted Zone: digital-supply.com
Trusted Zone: get-key-se10.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Acer\Application Data\Mozilla\Firefox\Profiles\hfj6g6fe.default\
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-21 08:38
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\wjvfmmdq]

.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(708)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1828)
c:\windows\system32\webcheck.dll
c:\windows\system32\msls31.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2010-05-21 08:41:23 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-05-21 06:41
ComboFix2.txt 2010-05-19 21:07
ComboFix3.txt 2010-05-19 20:53
ComboFix4.txt 2010-05-14 18:16

Avant-CF: 100 260 917 248 octets libres
Après-CF: 100 217 688 064 octets libres

- - End Of File - - 9EE0622937A8F3B21BDCE707BC2A6516

bonjour, voici le contenu du post (le ventilateur fait bcp moins de bruit) :
ComboFix 10-05-19.02 - Acer 22/05/2010 12:18:58.6.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.767.451 [GMT 2:00]
Lancé depuis: c:\documents and settings\Acer\Mes documents\Téléchargements\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Acer\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\documents and settings\Acer\Menu D'marrer\Programmes\D'marrage\wwwzuc32.exe"
"c:\documents and settings\Acer\Menu Démarrer\Programmes\Démarrage\wwwzuc32.exe"
"c:\windows\system32\41.exe"
"c:\windows\system32\config\systemprofile\Application Data\qvjsge.dat"
"c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OLR2IIJK\firewall[1].dll"
"c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WR7FY0NN\SetupSE2010[1].exe"
"c:\windows\system32\ES15.exe"
"c:\windows\system32\helpers32.dll"
"c:\windows\system32\smss32.exe"
"c:\windows\system32\winlogon32.exe"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Acer\Menu Démarrer\Programmes\Démarrage\wwwzuc32.exe
c:\windows\system32\config\systemprofile\Application Data\qvjsge.dat
c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OLR2IIJK\firewall[1].dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-22 au 2010-05-22 ))))))))))))))))))))))))))))))))))))
.

2010-05-14 19:18 . 2010-05-14 19:18 0 ----a-w- c:\windows\nsreg.dat
2010-05-14 19:18 . 2010-05-14 19:18 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Mozilla
2010-05-14 19:08 . 2010-05-14 19:09 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2010-05-14 18:43 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-05-14 18:43 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-05-14 18:43 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-05-14 18:43 . 2010-05-14 18:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-05-14 17:27 . 2010-05-14 19:16 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-05-14 17:26 . 2010-05-14 17:26 -------- d-----w- c:\program files\Avira
2010-05-14 06:51 . 2010-05-14 06:51 -------- d-sh--w- c:\documents and settings\Administrateur\PrivacIE
2010-05-14 06:51 . 2010-05-14 06:51 -------- d-sh--w- c:\documents and settings\Administrateur\IETldCache
2010-05-10 11:45 . 2010-05-10 11:45 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Threat Expert
2010-05-10 11:43 . 2010-05-10 11:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-05-10 11:38 . 2010-05-10 11:38 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-05-10 11:38 . 2010-05-10 11:45 -------- d-----w- c:\documents and settings\Acer\Local Settings\Application Data\Google
2010-05-10 11:37 . 2010-05-10 11:38 -------- d-----w- c:\program files\Google
2010-05-10 11:34 . 2010-05-15 17:02 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-10 10:41 . 2010-05-10 10:41 -------- d-----w- c:\documents and settings\Acer\Application Data\Malwarebytes
2010-05-10 10:41 . 2010-05-15 17:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-10 10:00 . 2008-04-14 01:53 30336 -c--a-w- c:\windows\system32\dllcache\modem.sys
2010-05-10 10:00 . 2008-04-13 18:40 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-05-03 13:20 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-05-03 13:20 . 2008-04-13 18:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-05-03 13:20 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-15 16:59 . 2009-11-15 17:52 -------- d-----w- c:\program files\IKEA HomePlanner
2010-05-03 11:02 . 2009-10-04 18:30 -------- d-----w- c:\documents and settings\Acer\Application Data\vlc
2010-04-23 20:28 . 2010-04-20 20:17 -------- d-----w- c:\documents and settings\Acer\Application Data\Apple Computer
2010-04-20 21:13 . 2010-04-20 20:16 -------- d-----w- c:\program files\iTunes
2010-04-20 20:42 . 2010-04-20 20:42 -------- d-----w- c:\program files\MSECache
2010-04-20 20:28 . 2009-09-25 10:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-20 20:16 . 2010-04-20 20:16 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-20 20:16 . 2010-04-20 20:16 -------- d-----w- c:\program files\iPod
2010-04-20 20:16 . 2010-04-20 20:14 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-04-20 20:16 . 2010-04-20 20:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-04-20 20:15 . 2010-04-20 20:15 -------- d-----w- c:\program files\QuickTime
2010-04-20 20:14 . 2010-04-20 20:14 -------- d-----w- c:\program files\Apple Software Update
2010-04-20 20:14 . 2010-04-20 20:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-04-14 20:57 . 2009-12-21 14:52 79488 ----a-w- c:\documents and settings\Acer\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-29 16:53 . 2001-08-28 12:00 49494 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-29 16:53 . 2001-08-28 12:00 370414 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-25 23:48 . 2010-03-25 23:48 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-05-14_18.14.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-22 10:25 . 2010-05-22 10:25 16384 c:\windows\temp\Perflib_Perfdata_73c.dat
+ 2010-05-19 21:38 . 2010-05-19 21:38 85173 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2010-05-14 18:43 . 2010-05-14 19:16 28520 c:\windows\system32\drivers\ssmdrv.sys
+ 2009-09-25 08:38 . 2010-05-21 06:38 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-09-25 08:38 . 2010-05-10 09:54 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-09-25 08:38 . 2010-05-21 06:38 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2009-09-25 08:38 . 2010-05-10 09:54 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2009-09-25 08:38 . 2010-05-10 09:54 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-05-21 06:21 . 2010-05-21 06:38 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-05-14 19:10 . 2010-05-14 19:10 22528 c:\windows\Installer\21db4.msi
+ 2010-01-27 01:07 . 2010-01-27 01:07 256280 c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2010-01-27 01:07 . 2010-01-27 01:07 3884312 c:\windows\system32\Macromed\Flash\NPSWF32.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-10 39408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-22 14854144]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-20 148888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [25/09/2009 11:44 76544]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [14/05/2010 20:43 108289]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10/05/2010 13:38 135664]
.
Contenu du dossier 'Tâches planifiées'

2010-04-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]

2010-05-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-10 11:38]

2010-05-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-10 11:38]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Acer\Application Data\Mozilla\Firefox\Profiles\hfj6g6fe.default\
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-22 12:25
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(712)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2984)
c:\windows\system32\webcheck.dll
c:\windows\system32\msls31.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\RTHDCPL.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Heure de fin: 2010-05-22 12:27:37 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-05-22 10:27
ComboFix2.txt 2010-05-21 06:41
ComboFix3.txt 2010-05-19 21:07
ComboFix4.txt 2010-05-19 20:53
ComboFix5.txt 2010-05-22 10:16

Avant-CF: 100 205 445 120 octets libres
Après-CF: 100 170 760 192 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
h:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professionnel" /fastdetect /NoExecute=OptIn

- - End Of File - - FD0995BA740D08FA33BBF67A99A83AF9

bonjour gen-hackman,
voici le rapport de Melwarebytes :
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4155

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

29/05/2010 23:28:44
mbam-log-2010-05-29 (23-28-44).txt

Type d'examen: Examen complet (C:\|D:\|H:\|I:\|)
Elément(s) analysé(s): 158344
Temps écoulé: 29 minute(s), 5 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 31

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\Program Files\Winsudate\gibidl.dll.vir (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\helpers32.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\smss32.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\winlogon32.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0011859.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0011878.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0011894.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0011902.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0012924.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0014924.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0012902.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0012914.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0013924.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0015923.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0015925.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0015932.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0016931.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0016944.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0017940.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0018940.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0019939.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0019952.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0019961.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0020961.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0021094.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0021103.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0022103.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0022241.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP118\A0022243.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A14247C4-FA31-4E45-9AE4-6478207AD26C}\RP122\A0024618.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\ANBH1F6X\firewall[1].dll (Trojan.Agent) -> Quarantined and deleted successfully.

PS : j'attends tes prochaines instructions. Je n'ai toujours pas de son..
merci

salut,
semaine de vacances aussi pour moi. On continue c'est parti !

salut,
j'ai téléchargé List_Kill'em mais quand je lance executer en tant qu'administrateur il me dit "accès refusé".

ok je vais essayer. Entre temps peux tu m'aider à récuperer le son ? merci

voici le contenu :
¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.0.0.6 ¤¤¤¤¤¤¤¤¤¤

User : Acer ()
Update on 07/06/2010 by g3n-h@ckm@n ::::: 10.55
Start at: 13:05:45 | 12/06/2010

Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Spyware Doctor with AntiVirus 7.0.0.102 [ Enabled | Updated ]
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

C:\ -> Disque fixe local | 113,76 Go (92,52 Go free) | NTFS
D:\ -> Disque amovible
E:\ -> Disque amovible
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque fixe local | 114,22 Go (114,14 Go free) [ACERDATA] | FAT32
I:\ -> Disque CD-ROM

Boot: Safeboot
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
High Definition Audio Property Page Shortcut REG_SZ HDAShCut.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
QuickTime Task REG_SZ "C:\Program Files\QuickTime\QTTask.exe" -atboottime
ISTray REG_SZ "C:\Program Files\Spyware Doctor\pctsTray.exe"
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
RTHDCPL REG_SZ RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
DisableRegistryTools REG_DWORD 0 (0x0)

===============

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
NoDrives REG_DWORD 0 (0x0)

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 1 (0x1)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDrives REG_DWORD 0 (0x0)

===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ PC-ACER
DefaultUserName REG_SZ Acer
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ Acer
AltDefaultDomainName REG_SZ PC-ACER
ChangePasswordUseKerberos REG_DWORD 1 (0x1)

===============

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE REG_SZ C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook
C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Service Bonjour
C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
C:\Program Files\ma-config.com\maconfservice.exe REG_SZ C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000

===============
ActivX controls
===============

[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\DirectAnimation Java Classes]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\Microsoft XML Parser for Java]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6414512B-B978-451D-A0D8-FCFDF33E833C}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608555}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5056b317-8d4c-43ee-8543-b9d1e234b8f4}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

==============
BHO :
======

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241

================
Internet Explorer :
================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.fr/?gws_rd=ssl
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

========
Services
========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

========
Safemode
========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!

=========
Atapi.sys
=========

C:\WINDOWS\$NtServicePackUninstall$\atapi.sys :
MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]

C:\WINDOWS\ERDNT\cache\atapi.sys :
MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

C:\WINDOWS\ServicePackFiles\i386\atapi.sys :
MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

C:\WINDOWS\system32\drivers\atapi.sys :
MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

=======
Drive :
=======

D'fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
114 Go total, 92,52 Go libre (81%), 7% fragment' (fragmentation du fichier 15%)

Il ne vous est pas n'cessaire de d'fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Program Files\WindowsUpdate
Present !! : C:\WINDOWS\002294_.tmp
Present !! : C:\WINDOWS\005250_.tmp
Present !! : C:\WINDOWS\SET3.tmp
Present !! : C:\WINDOWS\SETA.tmp
Present !! : C:\WINDOWS\inf\nt5java.inf
Present !! : C:\Documents and Settings\Acer\LOCAL Settings\Temp\jre-6u20-windows-i586-iftw-rv.exe

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Present !! : HKEY_USERS\S-1-5-21-1004336348-839522115-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-12 13:17:38
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys PCTCore.sys SCSIPORT.SYS hal.dll m5287.sys
kernel: MBR read successfully
user & kernel MBR OK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 0 (0x0)
FirewallOverride REG_DWORD 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 13:17:39,42


Tu peux me dire si on a bientot terminé ? et m'expliquer brievement ce qu'on fait.
en tout cas merci pour ton aide.

Oui j'en ai

j'ai fait ça, j'ai téléchargé les 6 fichiers mais toujours pas son.
J'ai un point d'interrogation jaune devant :
-filtre decodeur
-melangeur audio wave
-suppression d'echo accoustique

j'ai récupérer le son ! j'ai supprimé tous les fichiers ci-dessus et redemmaré mon pc c'est tout ! ouf

voici le rapport :
¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.0.0.6 ¤¤¤¤¤¤¤¤¤¤

User : Acer (Administrateurs)
Update on 07/06/2010 by g3n-h@ckm@n ::::: 10.55
Start at: 16:57:22 | 12/06/2010

Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Spyware Doctor with AntiVirus 7.0.0.102 [ Enabled | Updated ]
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 113,76 Go (91,13 Go free) | NTFS
D:\ -> Disque amovible
E:\ -> Disque amovible
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque fixe local | 114,22 Go (114,14 Go free) [ACERDATA] | FAT32
I:\ -> Disque CD-ROM


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Avira\AntiVir Desktop\avwsc.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\Program Files\WindowsUpdate
Quarantined & Deleted !! : C:\WINDOWS\002294_.tmp
Quarantined & Deleted !! : C:\WINDOWS\005250_.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET3.tmp
Quarantined & Deleted !! : C:\WINDOWS\SETA.tmp
Quarantined & Deleted !! : C:\WINDOWS\inf\nt5java.inf

Quarantined & Deleted !! : C:\Documents and Settings\Acer\LOCAL Settings\Temp\jre-6u20-windows-i586-iftw-rv.exe

=======
Hosts :
=======

127.0.0.1 localhost

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/?gws_rd=ssl
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

===============
Security Center
===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 1 (0x1)
FirewallOverride REG_DWORD 1 (0x1)
FirstRunDisabled REG_DWORD 1 (0x1)

========
Services
=========

Ndisuio : Start = 3
EapHost : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
================

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys SCSIPORT.SYS hal.dll m5287.sys
kernel: MBR read successfully
user & kernel MBR OK




¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

voici les liens

http://www.cijoint.fr/cjlink.php?file=cj201006/cijNcL6ydG.txt

http://www.cijoint.fr/cjlink.php?file=cj201006/cijVSG8xU3.txt

pour C:\WINDOWS\System32\unM5287.exe, voici le rapport :
Fichier unM5287.exe reçu le 2010.06.12 19:15:42 (UTC)
Antivirus Version Dernière mise à jour Résultat
a-squared 5.0.0.26 2010.06.12 -
AhnLab-V3 2010.06.13.00 2010.06.12 -
AntiVir 8.2.2.6 2010.06.11 -
Antiy-AVL 2.0.3.7 2010.06.11 -
Authentium 5.2.0.5 2010.06.12 -
Avast 4.8.1351.0 2010.06.12 -
Avast5 5.0.332.0 2010.06.12 -
AVG 9.0.0.787 2010.06.11 -
BitDefender 7.2 2010.06.12 -
CAT-QuickHeal 10.00 2010.06.12 -
ClamAV 0.96.0.3-git 2010.06.12 -
Comodo 5077 2010.06.12 -
DrWeb 5.0.2.03300 2010.06.12 -
eSafe 7.0.17.0 2010.06.10 -
eTrust-Vet 36.1.7629 2010.06.11 -
F-Prot 4.6.0.103 2010.06.12 -
F-Secure 9.0.15370.0 2010.06.12 -
Fortinet 4.1.133.0 2010.06.12 -
GData 21 2010.06.12 -
Ikarus T3.1.1.84.0 2010.06.12 -
Jiangmin 13.0.900 2010.06.12 -
Kaspersky 7.0.0.125 2010.06.12 -
McAfee 5.400.0.1158 2010.06.12 -
McAfee-GW-Edition 2010.1 2010.06.12 -
Microsoft 1.5802 2010.06.12 -
NOD32 5192 2010.06.12 -
Norman 6.04.12 2010.06.12 -
nProtect 2010-06-12.01 2010.06.12 -
Panda 10.0.2.7 2010.06.12 -
PCTools 7.0.3.5 2010.06.12 -
Prevx 3.0 2010.06.12 -
Rising 22.51.05.02 2010.06.12 -
Sophos 4.54.0 2010.06.12 -
Sunbelt 6441 2010.06.12 -
Symantec 20101.1.0.89 2010.06.12 -
TheHacker 6.5.2.0.298 2010.06.12 -
TrendMicro 9.120.0.1004 2010.06.12 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.12 -
VBA32 3.12.12.5 2010.06.11 -
ViRobot 2010.6.12.3882 2010.06.12 -
VirusBuster 5.0.27.0 2010.06.12 -
Information additionnelle
File size: 24887 bytes
MD5...: fd6ee27e8410095ed5a0ad17bd3d822f
SHA1..: d033bc34764d161e3cc6b4ae4a172438fd487fc4
SHA256: fa309cb4d47a456018b988f831c8e9a7f4a11cde288844fdfd1402d21b64c3bb
ssdeep: 384:Yp0ClLNxcZl0LYo+zjuzuveowzp6FwCd8b7SiP40Y:YBlLNuZl00NjuqvDwz<br>MwCuq0Y<br>
PEiD..: -
PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0x1000<br>timedatestamp.....: 0x43ff1c6a (Fri Feb 24 14:47:06 2006)<br>machinetype.......: 0x14c (I386)<br><br>( 4 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0x17f4 0x1800 5.91 bfb49765216386e25d89035f99d7f21b<br>.data 0x3000 0x70 0x200 0.24 fdf0cd9e150a42068df4083d8e72142e<br>.bss 0x4000 0x70 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<br>.idata 0x5000 0x578 0x600 4.09 285e72b5084d40fda8208bfefddc9d08<br><br>( 5 imports ) <br>> ADVAPI32.DLL: RegCloseKey, RegDeleteKeyA, RegDeleteValueA, RegEnumKeyA, RegOpenKeyA<br>> KERNEL32.dll: AddAtomA, DeleteFileA, ExitProcess, FindAtomA, FindClose, FindFirstFileA, FindNextFileA, GetAtomNameA, GetCommandLineA, GetModuleHandleA, GetPrivateProfileStringA, GetStartupInfoA, GetSystemDirectoryA, GetVersion, GetWindowsDirectoryA, SetUnhandledExceptionFilter, WinExec<br>> msvcrt.dll: _stricmp<br>> msvcrt.dll: __getmainargs, __p__environ, __p__fmode, __set_app_type, _cexit, _iob, _onexit, _setmode, abort, atexit, free, malloc, signal, strcat, strcpy, strlen, strstr<br>> USER32.dll: MessageBoxA<br><br>( 0 exports ) <br>
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
trid..: Win32 Executable Generic (38.3%)<br>Win32 Dynamic Link Library (generic) (34.1%)<br>Win16/32 Executable Delphi generic (9.3%)<br>Generic Win/DOS Executable (9.0%)<br>DOS Executable Generic (9.0%)

Antivirus Version Dernière mise à jour Résultat
a-squared 5.0.0.26 2010.06.12 -
AhnLab-V3 2010.06.13.00 2010.06.12 -
AntiVir 8.2.2.6 2010.06.11 -
Antiy-AVL 2.0.3.7 2010.06.11 -
Authentium 5.2.0.5 2010.06.12 -
Avast 4.8.1351.0 2010.06.12 -
Avast5 5.0.332.0 2010.06.12 -
AVG 9.0.0.787 2010.06.11 -
BitDefender 7.2 2010.06.12 -
CAT-QuickHeal 10.00 2010.06.12 -
ClamAV 0.96.0.3-git 2010.06.12 -
Comodo 5077 2010.06.12 -
DrWeb 5.0.2.03300 2010.06.12 -
eSafe 7.0.17.0 2010.06.10 -
eTrust-Vet 36.1.7629 2010.06.11 -
F-Prot 4.6.0.103 2010.06.12 -
F-Secure 9.0.15370.0 2010.06.12 -
Fortinet 4.1.133.0 2010.06.12 -
GData 21 2010.06.12 -
Ikarus T3.1.1.84.0 2010.06.12 -
Jiangmin 13.0.900 2010.06.12 -
Kaspersky 7.0.0.125 2010.06.12 -
McAfee 5.400.0.1158 2010.06.12 -
McAfee-GW-Edition 2010.1 2010.06.12 -
Microsoft 1.5802 2010.06.12 -
NOD32 5192 2010.06.12 -
Norman 6.04.12 2010.06.12 -
nProtect 2010-06-12.01 2010.06.12 -
Panda 10.0.2.7 2010.06.12 -
PCTools 7.0.3.5 2010.06.12 -
Prevx 3.0 2010.06.12 -
Rising 22.51.05.02 2010.06.12 -
Sophos 4.54.0 2010.06.12 -
Sunbelt 6441 2010.06.12 -
Symantec 20101.1.0.89 2010.06.12 -
TheHacker 6.5.2.0.298 2010.06.12 -
TrendMicro 9.120.0.1004 2010.06.12 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.12 -
VBA32 3.12.12.5 2010.06.11 -
ViRobot 2010.6.12.3882 2010.06.12 -
VirusBuster 5.0.27.0 2010.06.12 -

Information additionnelle
File size: 24887 bytes
MD5...: fd6ee27e8410095ed5a0ad17bd3d822f
SHA1..: d033bc34764d161e3cc6b4ae4a172438fd487fc4
SHA256: fa309cb4d47a456018b988f831c8e9a7f4a11cde288844fdfd1402d21b64c3bb
ssdeep: 384:Yp0ClLNxcZl0LYo+zjuzuveowzp6FwCd8b7SiP40Y:YBlLNuZl00NjuqvDwz<br>MwCuq0Y<br>
PEiD..: -
PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0x1000<br>timedatestamp.....: 0x43ff1c6a (Fri Feb 24 14:47:06 2006)<br>machinetype.......: 0x14c (I386)<br><br>( 4 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0x17f4 0x1800 5.91 bfb49765216386e25d89035f99d7f21b<br>.data 0x3000 0x70 0x200 0.24 fdf0cd9e150a42068df4083d8e72142e<br>.bss 0x4000 0x70 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<br>.idata 0x5000 0x578 0x600 4.09 285e72b5084d40fda8208bfefddc9d08<br><br>( 5 imports ) <br>> ADVAPI32.DLL: RegCloseKey, RegDeleteKeyA, RegDeleteValueA, RegEnumKeyA, RegOpenKeyA<br>> KERNEL32.dll: AddAtomA, DeleteFileA, ExitProcess, FindAtomA, FindClose, FindFirstFileA, FindNextFileA, GetAtomNameA, GetCommandLineA, GetModuleHandleA, GetPrivateProfileStringA, GetStartupInfoA, GetSystemDirectoryA, GetVersion, GetWindowsDirectoryA, SetUnhandledExceptionFilter, WinExec<br>> msvcrt.dll: _stricmp<br>> msvcrt.dll: __getmainargs, __p__environ, __p__fmode, __set_app_type, _cexit, _iob, _onexit, _setmode, abort, atexit, free, malloc, signal, strcat, strcpy, strlen, strstr<br>> USER32.dll: MessageBoxA<br><br>( 0 exports ) <br>
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
trid..: Win32 Executable Generic (38.3%)<br>Win32 Dynamic Link Library (generic) (34.1%)<br>Win16/32 Executable Delphi generic (9.3%)<br>Generic Win/DOS Executable (9.0%)<br>DOS Executable Generic (9.0%)

pour C:\WINDOWS\System32\drivers\ulisata.cat, voici le rapport :
Fichier ulisata.cat reçu le 2010.06.12 19:20:54 (UTC)
Antivirus Version Dernière mise à jour Résultat
a-squared 5.0.0.26 2010.06.12 -
AhnLab-V3 2010.06.13.00 2010.06.12 -
AntiVir 8.2.2.6 2010.06.11 -
Antiy-AVL 2.0.3.7 2010.06.11 -
Authentium 5.2.0.5 2010.06.12 -
Avast 4.8.1351.0 2010.06.12 -
Avast5 5.0.332.0 2010.06.12 -
AVG 9.0.0.787 2010.06.11 -
BitDefender 7.2 2010.06.12 -
CAT-QuickHeal 10.00 2010.06.12 -
ClamAV 0.96.0.3-git 2010.06.12 -
Comodo 5077 2010.06.12 -
DrWeb 5.0.2.03300 2010.06.12 -
eSafe 7.0.17.0 2010.06.10 -
eTrust-Vet 36.1.7629 2010.06.11 -
F-Prot 4.6.0.103 2010.06.12 -
F-Secure 9.0.15370.0 2010.06.12 -
Fortinet 4.1.133.0 2010.06.12 -
GData 21 2010.06.12 -
Ikarus T3.1.1.84.0 2010.06.12 -
Jiangmin 13.0.900 2010.06.12 -
Kaspersky 7.0.0.125 2010.06.12 -
McAfee 5.400.0.1158 2010.06.12 -
McAfee-GW-Edition 2010.1 2010.06.12 -
Microsoft 1.5802 2010.06.12 -
NOD32 5192 2010.06.12 -
Norman 6.04.12 2010.06.12 -
nProtect 2010-06-12.01 2010.06.12 -
Panda 10.0.2.7 2010.06.12 -
PCTools 7.0.3.5 2010.06.12 -
Prevx 3.0 2010.06.12 -
Rising 22.51.05.02 2010.06.12 -
Sophos 4.54.0 2010.06.12 -
Sunbelt 6441 2010.06.12 -
Symantec 20101.1.0.89 2010.06.12 -
TheHacker 6.5.2.0.298 2010.06.12 -
TrendMicro 9.120.0.1004 2010.06.12 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.12 -
VBA32 3.12.12.5 2010.06.11 -
ViRobot 2010.6.12.3882 2010.06.12 -
VirusBuster 5.0.27.0 2010.06.12 -
Information additionnelle
File size: 9621 bytes
MD5...: 1a47aa36d2651f020a3b5d7a87f7a6bc
SHA1..: 7144a598f7bdfc6611c4e6922ba42c3506548d45
SHA256: 9e6a9d8837da4457b4afea73529b9204b3e40828eda70d16a8458a4248baeb1b
ssdeep: 192:arjwprWbrnWrwDgL/CldolMGonSIa+0ivxg2B8:an+KK0gLCcMnSId0iZji<br>
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
trid..: DER encoded X509 Certificate (66.6%)<br>PKCS #7 Signature (33.3%)
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: Microsoft Windows Hardware Compatibility Publisher<br> Microsoft Windows Hardware Compatibility PCA<br> Microsoft Root Authority<br>signing date.: 1:32 PM 12/28/2005<br>verified.....: -<br>

Antivirus Version Dernière mise à jour Résultat
a-squared 5.0.0.26 2010.06.12 -
AhnLab-V3 2010.06.13.00 2010.06.12 -
AntiVir 8.2.2.6 2010.06.11 -
Antiy-AVL 2.0.3.7 2010.06.11 -
Authentium 5.2.0.5 2010.06.12 -
Avast 4.8.1351.0 2010.06.12 -
Avast5 5.0.332.0 2010.06.12 -
AVG 9.0.0.787 2010.06.11 -
BitDefender 7.2 2010.06.12 -
CAT-QuickHeal 10.00 2010.06.12 -
ClamAV 0.96.0.3-git 2010.06.12 -
Comodo 5077 2010.06.12 -
DrWeb 5.0.2.03300 2010.06.12 -
eSafe 7.0.17.0 2010.06.10 -
eTrust-Vet 36.1.7629 2010.06.11 -
F-Prot 4.6.0.103 2010.06.12 -
F-Secure 9.0.15370.0 2010.06.12 -
Fortinet 4.1.133.0 2010.06.12 -
GData 21 2010.06.12 -
Ikarus T3.1.1.84.0 2010.06.12 -
Jiangmin 13.0.900 2010.06.12 -
Kaspersky 7.0.0.125 2010.06.12 -
McAfee 5.400.0.1158 2010.06.12 -
McAfee-GW-Edition 2010.1 2010.06.12 -
Microsoft 1.5802 2010.06.12 -
NOD32 5192 2010.06.12 -
Norman 6.04.12 2010.06.12 -
nProtect 2010-06-12.01 2010.06.12 -
Panda 10.0.2.7 2010.06.12 -
PCTools 7.0.3.5 2010.06.12 -
Prevx 3.0 2010.06.12 -
Rising 22.51.05.02 2010.06.12 -
Sophos 4.54.0 2010.06.12 -
Sunbelt 6441 2010.06.12 -
Symantec 20101.1.0.89 2010.06.12 -
TheHacker 6.5.2.0.298 2010.06.12 -
TrendMicro 9.120.0.1004 2010.06.12 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.12 -
VBA32 3.12.12.5 2010.06.11 -
ViRobot 2010.6.12.3882 2010.06.12 -
VirusBuster 5.0.27.0 2010.06.12 -

Information additionnelle
File size: 9621 bytes
MD5...: 1a47aa36d2651f020a3b5d7a87f7a6bc
SHA1..: 7144a598f7bdfc6611c4e6922ba42c3506548d45
SHA256: 9e6a9d8837da4457b4afea73529b9204b3e40828eda70d16a8458a4248baeb1b
ssdeep: 192:arjwprWbrnWrwDgL/CldolMGonSIa+0ivxg2B8:an+KK0gLCcMnSId0iZji<br>
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
trid..: DER encoded X509 Certificate (66.6%)<br>PKCS #7 Signature (33.3%)
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: Microsoft Windows Hardware Compatibility Publisher<br> Microsoft Windows Hardware Compatibility PCA<br> Microsoft Root Authority<br>signing date.: 1:32 PM 12/28/2005<br>verified.....: -<br>

C:\WINDOWS\System32\Unusb20.exe , voici le rapport :
Fichier Unusb20.exe reçu le 2010.06.12 19:23:56 (UTC)
Antivirus Version Dernière mise à jour Résultat
a-squared 5.0.0.26 2010.06.12 -
AhnLab-V3 2010.06.13.00 2010.06.12 -
AntiVir 8.2.2.6 2010.06.11 -
Antiy-AVL 2.0.3.7 2010.06.11 -
Authentium 5.2.0.5 2010.06.12 -
Avast 4.8.1351.0 2010.06.12 -
Avast5 5.0.332.0 2010.06.12 -
AVG 9.0.0.787 2010.06.11 -
BitDefender 7.2 2010.06.12 -
CAT-QuickHeal 10.00 2010.06.12 -
ClamAV 0.96.0.3-git 2010.06.12 -
Comodo 5077 2010.06.12 -
DrWeb 5.0.2.03300 2010.06.12 -
eSafe 7.0.17.0 2010.06.10 -
eTrust-Vet 36.1.7629 2010.06.11 -
F-Prot 4.6.0.103 2010.06.12 -
F-Secure 9.0.15370.0 2010.06.12 -
Fortinet 4.1.133.0 2010.06.12 -
GData 21 2010.06.12 -
Ikarus T3.1.1.84.0 2010.06.12 -
Jiangmin 13.0.900 2010.06.12 -
Kaspersky 7.0.0.125 2010.06.12 -
McAfee 5.400.0.1158 2010.06.12 -
McAfee-GW-Edition 2010.1 2010.06.12 -
Microsoft 1.5802 2010.06.12 -
NOD32 5192 2010.06.12 -
Norman 6.04.12 2010.06.12 -
nProtect 2010-06-12.01 2010.06.12 -
Panda 10.0.2.7 2010.06.12 -
PCTools 7.0.3.5 2010.06.12 -
Prevx 3.0 2010.06.12 -
Rising 22.51.05.02 2010.06.12 -
Sophos 4.54.0 2010.06.12 -
Sunbelt 6441 2010.06.12 -
Symantec 20101.1.0.89 2010.06.12 -
TheHacker 6.5.2.0.298 2010.06.12 -
TrendMicro 9.120.0.1004 2010.06.12 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.12 -
VBA32 3.12.12.5 2010.06.11 -
ViRobot 2010.6.12.3882 2010.06.12 -
VirusBuster 5.0.27.0 2010.06.12 -
Information additionnelle
File size: 23498 bytes
MD5...: 52e1ca37923565ab84a5ab045c0e790c
SHA1..: 2655739dabacbc83c3b99996826a11ef7b7056e2
SHA256: bbc890270c158f136188bda7ebc309bb185472bcc5d2765464c0b1f8fe71b229
ssdeep: 384:7C0Yhc0OYOTEhiezeH2eQkPxhm8boSZP4AY:7Ahc0hZ3aWeQevOAY<br>
PEiD..: -
PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0x1000<br>timedatestamp.....: 0x4405192d (Wed Mar 01 03:46:53 2006)<br>machinetype.......: 0x14c (I386)<br><br>( 4 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0x12b4 0x1400 5.62 ba00975860df86708934f3bbf3d3bfe9<br>.data 0x3000 0x70 0x200 0.24 931e05064a131afe49c1572b43570545<br>.bss 0x4000 0x70 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<br>.idata 0x5000 0x53c 0x600 3.94 c9c6944f0ba1138de3c36e371d9b7d08<br><br>( 5 imports ) <br>> ADVAPI32.DLL: RegDeleteKeyA, RegEnumKeyA, RegOpenKeyA<br>> KERNEL32.dll: AddAtomA, DeleteFileA, ExitProcess, FindAtomA, FindClose, FindFirstFileA, FindNextFileA, GetAtomNameA, GetCommandLineA, GetModuleHandleA, GetPrivateProfileStringA, GetStartupInfoA, GetSystemDirectoryA, GetVersion, GetWindowsDirectoryA, SetUnhandledExceptionFilter, WinExec<br>> msvcrt.dll: _stricmp<br>> msvcrt.dll: __getmainargs, __p__environ, __p__fmode, __set_app_type, _cexit, _iob, _onexit, _setmode, abort, atexit, free, malloc, signal, strcat, strcpy, strlen, strstr<br>> USER32.dll: MessageBoxA<br><br>( 0 exports ) <br>
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
trid..: Win32 Executable Generic (38.3%)<br>Win32 Dynamic Link Library (generic) (34.1%)<br>Win16/32 Executable Delphi generic (9.3%)<br>Generic Win/DOS Executable (9.0%)<br>DOS Executable Generic (9.0%)
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>

Antivirus Version Dernière mise à jour Résultat
a-squared 5.0.0.26 2010.06.12 -
AhnLab-V3 2010.06.13.00 2010.06.12 -
AntiVir 8.2.2.6 2010.06.11 -
Antiy-AVL 2.0.3.7 2010.06.11 -
Authentium 5.2.0.5 2010.06.12 -
Avast 4.8.1351.0 2010.06.12 -
Avast5 5.0.332.0 2010.06.12 -
AVG 9.0.0.787 2010.06.11 -
BitDefender 7.2 2010.06.12 -
CAT-QuickHeal 10.00 2010.06.12 -
ClamAV 0.96.0.3-git 2010.06.12 -
Comodo 5077 2010.06.12 -
DrWeb 5.0.2.03300 2010.06.12 -
eSafe 7.0.17.0 2010.06.10 -
eTrust-Vet 36.1.7629 2010.06.11 -
F-Prot 4.6.0.103 2010.06.12 -
F-Secure 9.0.15370.0 2010.06.12 -
Fortinet 4.1.133.0 2010.06.12 -
GData 21 2010.06.12 -
Ikarus T3.1.1.84.0 2010.06.12 -
Jiangmin 13.0.900 2010.06.12 -
Kaspersky 7.0.0.125 2010.06.12 -
McAfee 5.400.0.1158 2010.06.12 -
McAfee-GW-Edition 2010.1 2010.06.12 -
Microsoft 1.5802 2010.06.12 -
NOD32 5192 2010.06.12 -
Norman 6.04.12 2010.06.12 -
nProtect 2010-06-12.01 2010.06.12 -
Panda 10.0.2.7 2010.06.12 -
PCTools 7.0.3.5 2010.06.12 -
Prevx 3.0 2010.06.12 -
Rising 22.51.05.02 2010.06.12 -
Sophos 4.54.0 2010.06.12 -
Sunbelt 6441 2010.06.12 -
Symantec 20101.1.0.89 2010.06.12 -
TheHacker 6.5.2.0.298 2010.06.12 -
TrendMicro 9.120.0.1004 2010.06.12 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.12 -
VBA32 3.12.12.5 2010.06.11 -
ViRobot 2010.6.12.3882 2010.06.12 -
VirusBuster 5.0.27.0 2010.06.12 -

Information additionnelle
File size: 23498 bytes
MD5...: 52e1ca37923565ab84a5ab045c0e790c
SHA1..: 2655739dabacbc83c3b99996826a11ef7b7056e2
SHA256: bbc890270c158f136188bda7ebc309bb185472bcc5d2765464c0b1f8fe71b229
ssdeep: 384:7C0Yhc0OYOTEhiezeH2eQkPxhm8boSZP4AY:7Ahc0hZ3aWeQevOAY<br>
PEiD..: -
PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0x1000<br>timedatestamp.....: 0x4405192d (Wed Mar 01 03:46:53 2006)<br>machinetype.......: 0x14c (I386)<br><br>( 4 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0x12b4 0x1400 5.62 ba00975860df86708934f3bbf3d3bfe9<br>.data 0x3000 0x70 0x200 0.24 931e05064a131afe49c1572b43570545<br>.bss 0x4000 0x70 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<br>.idata 0x5000 0x53c 0x600 3.94 c9c6944f0ba1138de3c36e371d9b7d08<br><br>( 5 imports ) <br>> ADVAPI32.DLL: RegDeleteKeyA, RegEnumKeyA, RegOpenKeyA<br>> KERNEL32.dll: AddAtomA, DeleteFileA, ExitProcess, FindAtomA, FindClose, FindFirstFileA, FindNextFileA, GetAtomNameA, GetCommandLineA, GetModuleHandleA, GetPrivateProfileStringA, GetStartupInfoA, GetSystemDirectoryA, GetVersion, GetWindowsDirectoryA, SetUnhandledExceptionFilter, WinExec<br>> msvcrt.dll: _stricmp<br>> msvcrt.dll: __getmainargs, __p__environ, __p__fmode, __set_app_type, _cexit, _iob, _onexit, _setmode, abort, atexit, free, malloc, signal, strcat, strcpy, strlen, strstr<br>> USER32.dll: MessageBoxA<br><br>( 0 exports ) <br>
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
trid..: Win32 Executable Generic (38.3%)<br>Win32 Dynamic Link Library (generic) (34.1%)<br>Win16/32 Executable Delphi generic (9.3%)<br>Generic Win/DOS Executable (9.0%)<br>DOS Executable Generic (9.0%)
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>

pour C:\WINDOWS\System32\PCIVP.SYS
il me dit que le fichier a deja été analysé et m'a proposé le dernier rapport que voici :

Fichier pcivp.sys reçu le 2010.02.28 11:26:00 (UTC)
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.02.28 -
AhnLab-V3 5.0.0.2 2010.02.27 -
AntiVir 8.2.1.176 2010.02.26 -
Antiy-AVL 2.0.3.7 2010.02.26 -
Authentium 5.2.0.5 2010.02.27 -
Avast 4.8.1351.0 2010.02.27 -
AVG 9.0.0.730 2010.02.28 -
BitDefender 7.2 2010.02.28 -
CAT-QuickHeal 10.00 2010.02.27 -
ClamAV 0.96.0.0-git 2010.02.28 -
Comodo 4091 2010.02.28 -
DrWeb 5.0.1.12222 2010.02.28 -
eSafe 7.0.17.0 2010.02.25 -
eTrust-Vet 35.2.7331 2010.02.26 -
F-Prot 4.5.1.85 2010.02.27 -
F-Secure 9.0.15370.0 2010.02.27 -
Fortinet 4.0.14.0 2010.02.28 -
GData 19 2010.02.28 -
Ikarus T3.1.1.80.0 2010.02.28 -
Jiangmin 13.0.900 2010.02.28 -
K7AntiVirus 7.10.984 2010.02.26 -
Kaspersky 7.0.0.125 2010.02.28 -
McAfee 5905 2010.02.27 -
McAfee+Artemis 5905 2010.02.27 -
McAfee-GW-Edition 6.8.5 2010.02.28 -
Microsoft 1.5502 2010.02.28 -
NOD32 4901 2010.02.27 -
Norman 6.04.08 2010.02.28 -
nProtect 2009.1.8.0 2010.02.28 -
Panda 10.0.2.2 2010.02.27 -
PCTools 7.0.3.5 2010.02.28 -
Prevx 3.0 2010.02.28 -
Rising 22.36.06.04 2010.02.28 -
Sophos 4.50.0 2010.02.28 -
Sunbelt 5707 2010.02.28 -
Symantec 20091.2.0.41 2010.02.28 -
TheHacker 6.5.1.7.214 2010.02.28 -
TrendMicro 9.120.0.1004 2010.02.28 -
VBA32 3.12.12.2 2010.02.26 -
ViRobot 2010.2.27.2206 2010.02.27 -
VirusBuster 5.0.27.0 2010.02.27 -
Information additionnelle
File size: 12288 bytes
MD5   : e4784d0232768713bd82be8174a0d678
SHA1  : 364132235c0c1e8e2a65423f1ed343b064153d57
SHA256: 04d53c26c78b609f6daf0f730166cfc7b59637cb1efed747772db3be01069501
PEInfo: PE Structure information<br> <br> ( base data )<br> entrypointaddress.: 0x2E4<br> timedatestamp.....: 0x387593B5 (Fri Jan 7 08:20:21 2000)<br> machinetype.......: 0x14C (Intel I386)<br> <br> ( 3 sections )<br> name viradd virsiz rawdsiz ntrpy md5<br> .text 0x220 0x1CE5 0x1D00 6.52 64ee779680aa61327ab0aa79b932c19b<br>INIT 0x1F20 0x2C4 0x2E0 4.96 c5f432f4f54cf36e660497e25668a504<br>.reloc 0x2200 0x140 0x140 5.39 7016270222a1d764bcd0e3a01f234644<br> <br> ( 2 imports )<br> <br>> hal.dll: WRITE_PORT_USHORT, WRITE_PORT_UCHAR, READ_PORT_USHORT, READ_PORT_UCHAR, WRITE_PORT_ULONG, READ_PORT_ULONG, HalTranslateBusAddress<br>> ntoskrnl.exe: IofCompleteRequest, MmAllocateNonCachedMemory, MmFreeNonCachedMemory, READ_REGISTER_UCHAR, READ_REGISTER_ULONG, WRITE_REGISTER_ULONG, WRITE_REGISTER_USHORT, IoDeleteSymbolicLink, MmUnmapIoSpace, RtlInitUnicodeString, IoCreateDevice, IoCreateSymbolicLink, IoDeleteDevice, IoReportResourceUsage, MmMapIoSpace, READ_REGISTER_USHORT, WRITE_REGISTER_UCHAR<br> <br> ( 0 exports )<br>
TrID  : File type identification<br>Clipper DOS Executable (33.4%)<br>Generic Win/DOS Executable (33.2%)<br>DOS Executable Generic (33.1%)<br>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
ssdeep: 192:5DxDWAtxB4Ei+t2N/TyazFkq0vM7x1D/cDGQGnPF2y2p+iYuM7FExcLtlcbHxs:5dDWIC+t2xyazFkq661DcaQGnPF2H0FE
sigcheck: publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
PEiD  : -
RDS   : NSRL Reference Data Set<br>-

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.02.28 -
AhnLab-V3 5.0.0.2 2010.02.27 -
AntiVir 8.2.1.176 2010.02.26 -
Antiy-AVL 2.0.3.7 2010.02.26 -
Authentium 5.2.0.5 2010.02.27 -
Avast 4.8.1351.0 2010.02.27 -
AVG 9.0.0.730 2010.02.28 -
BitDefender 7.2 2010.02.28 -
CAT-QuickHeal 10.00 2010.02.27 -
ClamAV 0.96.0.0-git 2010.02.28 -
Comodo 4091 2010.02.28 -
DrWeb 5.0.1.12222 2010.02.28 -
eSafe 7.0.17.0 2010.02.25 -
eTrust-Vet 35.2.7331 2010.02.26 -
F-Prot 4.5.1.85 2010.02.27 -
F-Secure 9.0.15370.0 2010.02.27 -
Fortinet 4.0.14.0 2010.02.28 -
GData 19 2010.02.28 -
Ikarus T3.1.1.80.0 2010.02.28 -
Jiangmin 13.0.900 2010.02.28 -
K7AntiVirus 7.10.984 2010.02.26 -
Kaspersky 7.0.0.125 2010.02.28 -
McAfee 5905 2010.02.27 -
McAfee+Artemis 5905 2010.02.27 -
McAfee-GW-Edition 6.8.5 2010.02.28 -
Microsoft 1.5502 2010.02.28 -
NOD32 4901 2010.02.27 -
Norman 6.04.08 2010.02.28 -
nProtect 2009.1.8.0 2010.02.28 -
Panda 10.0.2.2 2010.02.27 -
PCTools 7.0.3.5 2010.02.28 -
Prevx 3.0 2010.02.28 -
Rising 22.36.06.04 2010.02.28 -
Sophos 4.50.0 2010.02.28 -
Sunbelt 5707 2010.02.28 -
Symantec 20091.2.0.41 2010.02.28 -
TheHacker 6.5.1.7.214 2010.02.28 -
TrendMicro 9.120.0.1004 2010.02.28 -
VBA32 3.12.12.2 2010.02.26 -
ViRobot 2010.2.27.2206 2010.02.27 -
VirusBuster 5.0.27.0 2010.02.27 -

Information additionnelle
File size: 12288 bytes
MD5   : e4784d0232768713bd82be8174a0d678
SHA1  : 364132235c0c1e8e2a65423f1ed343b064153d57
SHA256: 04d53c26c78b609f6daf0f730166cfc7b59637cb1efed747772db3be01069501
PEInfo: PE Structure information<br> <br> ( base data )<br> entrypointaddress.: 0x2E4<br> timedatestamp.....: 0x387593B5 (Fri Jan 7 08:20:21 2000)<br> machinetype.......: 0x14C (Intel I386)<br> <br> ( 3 sections )<br> name viradd virsiz rawdsiz ntrpy md5<br> .text 0x220 0x1CE5 0x1D00 6.52 64ee779680aa61327ab0aa79b932c19b<br>INIT 0x1F20 0x2C4 0x2E0 4.96 c5f432f4f54cf36e660497e25668a504<br>.reloc 0x2200 0x140 0x140 5.39 7016270222a1d764bcd0e3a01f234644<br> <br> ( 2 imports )<br> <br>> hal.dll: WRITE_PORT_USHORT, WRITE_PORT_UCHAR, READ_PORT_USHORT, READ_PORT_UCHAR, WRITE_PORT_ULONG, READ_PORT_ULONG, HalTranslateBusAddress<br>> ntoskrnl.exe: IofCompleteRequest, MmAllocateNonCachedMemory, MmFreeNonCachedMemory, READ_REGISTER_UCHAR, READ_REGISTER_ULONG, WRITE_REGISTER_ULONG, WRITE_REGISTER_USHORT, IoDeleteSymbolicLink, MmUnmapIoSpace, RtlInitUnicodeString, IoCreateDevice, IoCreateSymbolicLink, IoDeleteDevice, IoReportResourceUsage, MmMapIoSpace, READ_REGISTER_USHORT, WRITE_REGISTER_UCHAR<br> <br> ( 0 exports )<br>
TrID  : File type identification<br>Clipper DOS Executable (33.4%)<br>Generic Win/DOS Executable (33.2%)<br>DOS Executable Generic (33.1%)<br>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
ssdeep: 192:5DxDWAtxB4Ei+t2N/TyazFkq0vM7x1D/cDGQGnPF2y2p+iYuM7FExcLtlcbHxs:5dDWIC+t2xyazFkq661DcaQGnPF2H0FE
sigcheck: publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
PEiD  : -
RDS   : NSRL Reference Data Set<br>-

C:\WINDOWS\System32\drivers\pctgntdi.cat
celui-ci je ne le trouve pas, il n y est pas