VIRUS NON DECTETES

Salut,
2 infections en vue ...

A-Télécharges le patch "Amvo variants" sur ton bureau :
http://www.net-studio.org/software/AmvoRemover.rar

Extrait l'exécutable sur ton bureau et n 'y touche pas pour le moment .

Attention :
Si tu possèdes des unité externes (clé usb , disk dur externe , lecteur mp3,...) laisse les bien branchés à ton PC , c'est très important ! le virus s'y cache peut-être ...

B-Redémarrer l'ordinateur en mode sans échec (et sans prise en charge du réseau) .
Comment aller en Mode sans échec
1) Redémarre ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
(attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreur ...)

C-Lances le Patch en double clickant dessus et laisses faire .

Une fois finis, redémarre ton PC et refait un nouveau scan Hijacthis et postes le ...

bonjour ske69,

voici le nouveau rapport:

Scan saved at 11:25:37 ص, on 30/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\D-Link\DSL-200\dslstat.exe
C:\Program Files\D-Link\DSL-200\dslagent.exe
C:\WINDOWS\V0420Mon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NoooH] C:\WINDOWS\Web\Sys.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\D-Link\DSL-200\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\D-Link\DSL-200\dslagent.exe
O4 - HKLM\..\Run: [V0420Mon.exe] C:\WINDOWS\V0420Mon.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA55DC8E-9D79-4B2E-8925-E3317B254915}: NameServer = 65.162.184.33 195.94.0.34
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

c grave docteur ?
--> faut voir ... ^^

Supprimes le patch que tu as téléchargé , puis essayes ce-ci :

souligne>Télécharges SmitfraudFix (de S!Ri, balltrap34 et moe31 )</souligne> :
http://siri.urz.free.fr/Fix/SmitfraudFix.exe

!! Déconnectes toi, fermes toute tes applications et désactives tes défenses ( anti-virus ,anti-spyware,...) le temps de la manipe !!

Installes le soft à la racine de C\ ( et pas ailleurs! --->"C\:SmitfraudFix.exe" ) .

Tuto ( aide ) : http://siri.urz.free.fr/Fix/SmitfraudFix.php

Utilisation ---> option 1 / Recherche :
Double clique sur l'icône "Smitfraudfix.exe" et sélectionnes 1 (et pas sur autre chose sans notre accord !) pour créer un rapport des fichiers responsables de l'infection.

Postes le rapport ( "rapport.txt" qui se trouve sous C\: ) et attends la suite .

(Attention : process.exe est détecté par certains antivirus comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité.)

voici le rapport:

Scan done at 11:44:00.35, Wed 07/30/2008
Run from C:\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\D-Link\DSL-200\dslstat.exe
C:\Program Files\D-Link\DSL-200\dslagent.exe
C:\WINDOWS\V0420Mon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
C:\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\ê©ں§

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\ê©ں§\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\7C2D~1\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="ںé­ه¥، ںé©‍ï«ï، ںé¥ںéï،"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

Ok ... rien de ce côté là ... c'était pour une vérif ...

continuons :

Télécharges SDFix sur ton bureau :
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe.

--->Double-cliques sur SDFix.exe et choisis "Install" .

( tuto ici : https://www.malekal.com/slenfbot-still-an-other-irc-bot/ )

Puis une fois l'installe faite ,redémarres en mode sans échec .
Comment aller en Mode sans échec :
1) Redémarres ton ordi
2) Tapotes la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )

Ouvres le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double cliques sur RunThis.bat pour lancer le script.
--->Tapes Y pour lancer le script ...
Le Fix supprime les services du virus et nettoie le registre, de ce fait un redémarrage est nécessaire , donc :
presses une touche pour redémarrer quand il te le sera demandé .

Le PC va mettre du temps avant de démarrer ( c'est normale ), après le chargement du Bureau presses une touche lorsque "Finished" s'affiche .

Le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier C:\SDFix sous le nom "Report.txt".
Postes ce dernier dans ta prochaine réponse accompagné d'un nouveau rapport Hijakcthis pour analyse ...

salut,

desole pour le retard,
voice le rapport SDFix:

Run by ê©ں§ on Wed 07/30/2008 at 12:15 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services /b:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files /b:

Trojan Files Found:

C:\DOCUME~1\7C2D~1\LOCALS~1\Temp\tmp96.tmp - Deleted

et le nouveau rapport hijackthis:

Scan saved at 12:27:39, on 30/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\D-Link\DSL-200\dslstat.exe
C:\Program Files\D-Link\DSL-200\dslagent.exe
C:\WINDOWS\V0420Mon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\D-Link\DSL-200\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\D-Link\DSL-200\dslagent.exe
O4 - HKLM\..\Run: [V0420Mon.exe] C:\WINDOWS\V0420Mon.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

le rapport SDFix est incomplet ... erreur de copier/coller ? ^^

peux tu me le repposter stp ...

desole, le revoici complet:

[b]SDFix: Version 1.209 [/b]
Run by ê©ں§ on Wed 07/30/2008 at 12:15 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files [/b]:

Trojan Files Found:

C:\DOCUME~1\7C2D~1\LOCALS~1\Temp\tmp96.tmp - Deleted

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-30 12:25:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions]
"E\6-\6H\6D\6 ?R?A?S? ?A?s?y?n?c?"=str(7):"1\0"
"E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ? ?(?L?2?T?P?)?"=str(7):"1\0"
"E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ?(?P?P?T?P?)?"=str(7):"1\0"
"E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ?(?P?P?P?O?E?)?"=str(7):"1\0"
"E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ?(?I?P?)?"=str(7):"1\0"
"E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6,\6/\6H\6D\6)\6 ?'\6D\6-\0062\6E\6"=str(7):"1\0002\0"
"'\6*\0065\6'\6D\6 ?*\6D\6A\0062\6J\6H\6F\6/?A\6J\6/\6J\6H\6 ?M?i?c?r?o?s?o?f?t?"=str(7):"1\0"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions]
"E\6-\6H\6D\6 ?R?A?S? ?A?s?y?n?c?"=str(7):"1\0"
"E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ? ?(?L?2?T?P?)?"=str(7):"1\0"
"E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ?(?P?P?T?P?)?"=str(7):"1\0"
"E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ?(?P?P?P?O?E?)?"=str(7):"1\0"
"E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6@\6 ?W?A?N? ?(?I?P?)?"=str(7):"1\0"
"E\6F\6A\0060\6 ?E\0065\6:\0061\6 ?D\6,\6/\6H\6D\6)\6 ?'\6D\6-\0062\6E\6"=str(7):"1\0002\0"
"'\6*\0065\6'\6D\6 ?*\6D\6A\0062\6J\6H\6F\6/?A\6J\6/\6J\6H\6 ?M?i?c?r?o?s?o?f?t?"=str(7):"1\0"

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cursors\Schemes]
"4\69\6'\0061\6'\6*\6 ?W?i?n?d?o?w?s? ?'\6D\6E\6*\6-\0061\6C\6)\6"=""C:\WINDOWS\Cursors\rainbow.ani,,C:\WINDOWS\Cursors\appstart.ani,C:\WINDOWS\Cursors\hourglas.ani,C:\WINDOWS\Cursors\cross.cur,,,,C:\WINDOWS\Cursors\sizens.ani,C:\WINDOWS\Cursors\sizewe.ani,C:\WINDOWS\Cursors\sizenwse.ani,C:\WINDOWS\Cursors\sizenesw.ani,,""
"#\6(\6J\0066\6 ?+\6D\6'\6+\6J\6 ?'\6D\6#\6(\69\6'\6/\6"=""C:\WINDOWS\Cursors\3dwarro.cur,,C:\WINDOWS\Cursors\appstar3.ani,C:\WINDOWS\Cursors\hourgla3.ani,C:\WINDOWS\Cursors\cross.cur,,,C:\WINDOWS\Cursors\3dwno.cur,C:\WINDOWS\Cursors\3dwns.cur,C:\WINDOWS\Cursors\3dwwe.cur,C:\WINDOWS\Cursors\3dwnwse.cur,C:\WINDOWS\Cursors\3dwnesw.cur,C:\WINDOWS\Cursors\3dwmove.cur,""
"#\6J\6/\6J\6 ?1?"=""C:\WINDOWS\Cursors\harrow.cur,,C:\WINDOWS\Cursors\handapst.ani,C:\WINDOWS\Cursors\hand.ani,C:\WINDOWS\Cursors\hcross.cur,C:\WINDOWS\Cursors\hibeam.cur,,C:\WINDOWS\Cursors\hnodrop.cur,C:\WINDOWS\Cursors\hns.cur,C:\WINDOWS\Cursors\hwe.cur,C:\WINDOWS\Cursors\hnwse.cur,C:\WINDOWS\Cursors\hnesw.cur,C:\WINDOWS\Cursors\hmove.cur,""
"#\6J\6/\6J\6 ?2?"=""C:\WINDOWS\Cursors\harrow.cur,,C:\WINDOWS\Cursors\handapst.ani,C:\WINDOWS\Cursors\handwait.ani,C:\WINDOWS\Cursors\hcross.cur,C:\WINDOWS\Cursors\hibeam.cur,,C:\WINDOWS\Cursors\handno.ani,C:\WINDOWS\Cursors\handns.ani,C:\WINDOWS\Cursors\handwe.ani,C:\WINDOWS\Cursors\handnwse.ani,C:\WINDOWS\Cursors\handnesw.ani,C:\WINDOWS\Cursors\hmove.cur,""
"/\6J\6F\0065\6H\0061\6"=""C:\WINDOWS\Cursors\3dgarro.cur,,C:\WINDOWS\Cursors\dinosaur.ani,C:\WINDOWS\Cursors\dinosau2.ani,C:\WINDOWS\Cursors\cross.cur,,,C:\WINDOWS\Cursors\banana.ani,C:\WINDOWS\Cursors\3dsns.cur,C:\WINDOWS\Cursors\3dgwe.cur,C:\WINDOWS\Cursors\3dsnwse.cur,C:\WINDOWS\Cursors\3dgnesw.cur,C:\WINDOWS\Cursors\3dsmove.cur,""
"7\0061\6'\0062\6 ?B\6/\6J\6E\6"=""C:\WINDOWS\Cursors\harrow.cur,,C:\WINDOWS\Cursors\horse.ani,C:\WINDOWS\Cursors\barber.ani,C:\WINDOWS\Cursors\hcross.cur,C:\WINDOWS\Cursors\hibeam.cur,,C:\WINDOWS\Cursors\coin.ani,C:\WINDOWS\Cursors\3dgns.cur,C:\WINDOWS\Cursors\3dgwe.cur,C:\WINDOWS\Cursors\3dgnwse.cur,C:\WINDOWS\Cursors\3dgnesw.cur,C:\WINDOWS\Cursors\3dgmove.cur,""
"E\6H\0065\6D\6"=""C:\WINDOWS\Cursors\harrow.cur,,C:\WINDOWS\Cursors\drum.ani,C:\WINDOWS\Cursors\metronom.ani,C:\WINDOWS\Cursors\hcross.cur,C:\WINDOWS\Cursors\hibeam.cur,,C:\WINDOWS\Cursors\piano.ani,C:\WINDOWS\Cursors\hns.cur,C:\WINDOWS\Cursors\hwe.cur,C:\WINDOWS\Cursors\hnwse.cur,C:\WINDOWS\Cursors\hnesw.cur,C:\WINDOWS\Cursors\hmove.cur,""
"E\6C\6(\0061\6"=""C:\WINDOWS\Cursors\larrow.cur,,C:\WINDOWS\Cursors\lappstrt.cur,C:\WINDOWS\Cursors\lwait.cur,C:\WINDOWS\Cursors\lcross.cur,C:\WINDOWS\Cursors\libeam.cur,,C:\WINDOWS\Cursors\lnodrop.cur,C:\WINDOWS\Cursors\lns.cur,C:\WINDOWS\Cursors\lwe.cur,C:\WINDOWS\Cursors\lnwse.cur,C:\WINDOWS\Cursors\lnesw.cur,C:\WINDOWS\Cursors\lmove.cur,""
"*\6A\6'\6H\6*\6'\6*\6"=""C:\WINDOWS\Cursors\fillitup.ani,,C:\WINDOWS\Cursors\raindrop.ani,C:\WINDOWS\Cursors\counter.ani,C:\WINDOWS\Cursors\cross.cur,,,C:\WINDOWS\Cursors\wagtail.ani,C:\WINDOWS\Cursors\sizens.ani,C:\WINDOWS\Cursors\sizewe.ani,C:\WINDOWS\Cursors\sizenwse.ani,C:\WINDOWS\Cursors\sizenesw.ani,""
"(\0061\6H\6F\0062\6 ?+\6D\6'\6+\6J\6 ?'\6D\6#\6(\69\6'\6/\6"=""C:\WINDOWS\Cursors\3dgarro.cur,,C:\WINDOWS\Cursors\appstar2.ani,C:\WINDOWS\Cursors\hourgla2.ani,C:\WINDOWS\Cursors\cross.cur,,,C:\WINDOWS\Cursors\3dgno.cur,C:\WINDOWS\Cursors\3dgns.cur,C:\WINDOWS\Cursors\3dgwe.cur,C:\WINDOWS\Cursors\3dgnwse.cur,C:\WINDOWS\Cursors\3dgnesw.cur,C:\WINDOWS\Cursors\3dgmove.cur,""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DocFolderPaths]
"E\0061\6'\6/\6"="C:\Documents and Settings\E1'/\My Documents"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GrpConv\MapGroups]
"*\0063\6'\6D\6J\6"="'D(1'E, 'DED-B)\*3'DJ"
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Devices]
"%\0061\0063\6'\6D\6 ?%\6D\6I\6 ?O?n?e?N?o?t?e? ?2?0?0?7?"="winspool,Ne00:"
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts]
"%\0061\0063\6'\6D\6 ?%\6D\6I\6 ?O?n?e?N?o?t?e? ?2?0?0?7?"="winspool,Ne00:,15,45"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Paltalk Messenger\\paltalk.exe"="C:\\Program Files\\Paltalk Messenger\\paltalk.exe:*:Disabled:PaltalkScene"
"C:\\Program Files\\SoftPhone\\SoftPhoneMain.exe"="C:\\Program Files\\SoftPhone\\SoftPhoneMain.exe:*:Disabled:SoftPhoneMain"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Disabled:Microsoft DirectPlay Voice Test"
"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Disabled:Run a DLL as an App"
"C:\\Program Files\\SightSpeed\\SightSpeed.exe"="C:\\Program Files\\SightSpeed\\SightSpeed.exe:*:Enabled:SightSpeed"
"C:\\Program Files\\pc2ph\\pc2ph.exe"="C:\\Program Files\\pc2ph\\pc2ph.exe:*:Disabled:pc2ph"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\00463b872458265f0f871fed43ff2946\BIT1.tmp"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0c909c63b4fa217757574b9dcdd658c3\BIT21.tmp"
Wed 30 Jul 2008 7,680,155 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\29c2f3fb5a7e6317d299b7582ff51eb8\BIT1C.tmp"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3397d0fe86fbc842c1a77df8e47f36fd\BIT22.tmp"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\41161276ef6907e60cc0bc77a8ac0c36\BIT26.tmp"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5b68a8371325b092494be04cd7222f7e\BIT24.tmp"
Wed 30 Jul 2008 8,956,536 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\629fb349f79d041367053463942bc2eb\BIT16.tmp"
Wed 30 Jul 2008 8,795,102 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\65d355385a56c3fa2bfdd7a104ca0c0b\BIT1A.tmp"
Tue 17 Jun 2008 17,243,664 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6e0cf36117c7bac06954929597c287c3\BIT8FF9.tmp"
Wed 30 Jul 2008 7,568,097 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7faa20870c6776cd1f316e4a996e02a0\BIT2.tmp"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9664ff6405d9e0e32778ca8618d4be26\BIT20.tmp"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\97de84be36b27af6e66a0586433cda52\BIT1E.tmp"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9b8cc78cebf74652d156f19fe9369e88\BIT27.tmp"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9ec3943a72ea4aa7fb7b808e2b7554c8\BIT1F.tmp"
Fri 25 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b3ff4efc32ac8149b7151c8915923d43\BIT15.tmp"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b5ceb6274f4d7fd206d6adab3df8e834\BIT29.tmp"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cb1cc7c8ed3868a5a32ffb677fe0fde8\BIT25.tmp"
Fri 25 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cc1328dc8b68a6a565df5084ae8c315c\BIT16.tmp"
Wed 30 Jul 2008 9,174,979 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e43605c24c1590c9b3f6144c850d6e5b\BIT14.tmp"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ecbed6a46e893aed1b1605dae2bcdf80\BIT28.tmp"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\eff5280e14d96e5642ae927a99b7c5d3\BIT23.tmp"
Fri 25 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\aafeca92af819f7a37d9eec34d2a569c\download\BIT1C.tmp"
Fri 25 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f3337dca5383709e73818a353e304850\download\BIT1B.tmp"
Wed 30 Jul 2008 8,797,766 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f640b1b5ae954105df8aff78be43175c\download\BIT39.tmp"

[b]Finished![/b]

bon ...

1- Télécharges : - CCleaner
https://www.pcastuces.com/logitheque/ccleaner.htm
Ce logiciel va permettre de supprimer tous les fichiers temporaires et de corrigé ton registre .Lors de l'installation, avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires" sauf les 2 première.
Une fois le prg instalé et lancé, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures"( Par la suite, laisse-le avec ses réglages par défaut. C'est tout ).

Un tuto ( aide ):
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

---> Utilisation:
vas dans "nettoyeur" : fait analyse puis nettoyage
et vas dans "registre" : fait chercher les erreurs et réparer ( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) .

( CCleaner : soft à garder sur son PC , super utile pour de bons nettoyages ... )

2- Télécharges MalwareByte's :
ici ftp://ftp.commentcamarche.com/download/mbam-setup.exe
ou ici : http://www.malwarebytes.org/mbam.php

Installes le ( choisis bien "francais" ; ne modifies pas les paramètres d'installe ) et mets le à jour .

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharges le ici : https://www.malekal.com/tutorial-aboutbuster/ )

Potasses le tuto pour te familiariser avec le prg : https://forum.pcastuces.com/sujet.asp?f=31&s=3
( cela dis, il est très simple d'utilisation ).

Impératif : redémarres en mode sans échec :
Comment aller en Mode sans échec
1) Redémarres ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
(attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreurs ...)

Lances Malwarebyte's .

Fais un scan dit "complet" ( sélectionnes bien tout tes disks avant le scan ) et supprimes tout ce qu'il peut trouver :
--->une fois le scan terminé , click sur "résultat" : puis vérifies que tous les objets infectés soient validés, puis click sur " suppression " .

Redémarres ton PC ( mode normal ).

Postes le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes) accompagné d'un nouvel hijackthis ( fait en mode normal ) ...

salut, j'ai fait ce que tu m'as demande

voici le rapport de malwarebytes:

Version de la base de données: 1008
Windows 5.1.2600 Service Pack 2

02:10:04 م 30/07/2008
mbam-log-7-30-2008 (14-10-04).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|F:\|G:\|)
Eléments examinés: 55578
Temps écoulé: 34 minute(s), 19 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

ainsi que le nouveau rapport hijackthis:

Scan saved at 14:15:20, on 30/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\D-Link\DSL-200\dslstat.exe
C:\Program Files\D-Link\DSL-200\dslagent.exe
C:\WINDOWS\V0420Mon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\D-Link\DSL-200\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\D-Link\DSL-200\dslagent.exe
O4 - HKLM\..\Run: [V0420Mon.exe] C:\WINDOWS\V0420Mon.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA55DC8E-9D79-4B2E-8925-E3317B254915}: NameServer = 65.162.184.33 195.94.0.34
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Bien ...

1- Fermes toutes tes applications et déconnectes toi .

Relances Hijackthis mais click sur " Do a scan only "
Tu vois donc apparaitre le résultat du scan : une multitudes de lignes ,chacunes précédées d'un carré vide .
Tu vas cliquer sur les carrés des lignes suivantes :

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

Tu cliques en bas sur le bouton FIX CHECKED et valides .

2- ends toi sur ce site :

https://www.virustotal.com/gui/

Copies ce qui suit et colles le dans l'espace pour la recherche :
C:\WINDOWS\V0420Mon.exe

Cliques sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends bien la fin ... Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copies le dans ta prochaine réponse ...

( Si VirusTotal indique que le fichier a déjà été analysé, clique sur le bouton Ré-analyse le fichier maintenant )

une fois ce rapport poster, fais ce qui suit :

3- Télécharge DiagHelp.zip sur ton bureau :

http://www.malekal.com/download/DiagHelp.zip

!! déconnectes toi et fermes toutes tes applications en cours !!

Fais un clic droit sur le fichier et extraire tout .

--> Un nouveau dossier va être créé : "DiagHelp"
Ouvres le et double-clic sur go.cmd et pas sur autre chose ! (le .cmd peut ne pas apparaître )

--> Une fenêtre va s'ouvrir, choisis l'option 1
L'analyse va commencer, ce-ci peut durer quelques minutes, laisses faire et appuies sur une touche quand on te le demandera :
une page IE va s'ouvrir , fermes la .
Re-appuis sur une touche, le bloc-note s'ouvre :
Sauvegardes ce rapport de façon à le retrouver et postes tout son contenu dans ta prochaine réponse ...

voici le rapport:

File V0420Mon.exe_ received on 07.30.2008 13:51:07 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED

Result: 0/35 (0%)
Loading server information...
Your file is queued in position: ___.
Estimated start time is between ___ and ___ .
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
AhnLab-V3 2008.7.29.1 2008.07.30 -
AntiVir 7.8.1.12 2008.07.30 -
Authentium 5.1.0.4 2008.07.30 -
Avast 4.8.1195.0 2008.07.29 -
AVG 8.0.0.130 2008.07.30 -
BitDefender 7.2 2008.07.30 -
CAT-QuickHeal 9.50 2008.07.29 -
ClamAV 0.93.1 2008.07.30 -
DrWeb 4.44.0.09170 2008.07.30 -
eSafe 7.0.17.0 2008.07.29 -
eTrust-Vet 31.6.5995 2008.07.30 -
Ewido 4.0 2008.07.30 -
F-Prot 4.4.4.56 2008.07.30 -
F-Secure 7.60.13501.0 2008.07.30 -
Fortinet 3.14.0.0 2008.07.30 -
GData 2.0.7306.1023 2008.07.30 -
Ikarus T3.1.1.34.0 2008.07.30 -
Kaspersky 7.0.0.125 2008.07.30 -
McAfee 5349 2008.07.29 -
Microsoft 1.3704 2008.07.28 -
NOD32v2 3309 2008.07.30 -
Norman 5.80.02 2008.07.30 -
Panda 9.0.0.4 2008.07.29 -
PCTools 4.4.2.0 2008.07.30 -
Prevx1 V2 2008.07.30 -
Rising 20.55.22.00 2008.07.30 -
Sophos 4.31.0 2008.07.30 -
Sunbelt 3.1.1537.1 2008.07.29 -
Symantec 10 2008.07.30 -
TheHacker 6.2.96.389 2008.07.25 -
TrendMicro 8.700.0.1004 2008.07.30 -
VBA32 3.12.8.1 2008.07.29 -
ViRobot 2008.7.30.1317 2008.07.30 -
VirusBuster 4.5.11.0 2008.07.29 -
Webwasher-Gateway 6.6.2 2008.07.30 -
Additional information
File size: 32768 bytes
MD5...: f5948132d8a0dfa7390f7b1e58bb6057
SHA1..: bb0f48c82b5bbf37d791f123d26b081140a86a2c
SHA256: 19aa8356fbbd5d0eb2a6256982a575ebed8e1c7b1c4586e5fa26a817d1fc92c6
SHA512: 83d0fb58b38de7d6e76b3b3f5a7ed3898751b5bd008a12395b47001cb05a7e04
8ae9136947f659087e92ce5c55adc521731f1a2c3ec9efeb25b725bcd2563e8d
PEiD..: Armadillo v1.71
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40310e
timedatestamp.....: 0x46355aca (Mon Apr 30 02:56:10 2007)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x229c 0x3000 4.91 3cd8163ac25094f116ed3d267c3e8a71
.rdata 0x4000 0x8fa 0x1000 3.35 8162f6c04bd480430e2059b2c7614914
.data 0x5000 0x240 0x1000 1.10 a81109e9cd3552851c0574199889f1dd
PAGECONS 0x6000 0x10 0x1000 0.05 b108dd9efebe4d7ac76987fad2d0aa36
.rsrc 0x7000 0x3b0 0x1000 0.94 227a0f22ea4fcbc5cb06d6de2fec5e00

( 7 imports )
> KERNEL32.dll: HeapFree, CreateFileA, lstrcatA, Sleep, WaitForSingleObject, HeapAlloc, GetTickCount, lstrcmpiA, lstrcpyA, lstrlenA, GetProcessHeap, OpenProcess, IsBadReadPtr, ResetEvent, CreateToolhelp32Snapshot, WaitForMultipleObjects, CreateMutexA, GetWindowsDirectoryA, GetFullPathNameA, GetModuleFileNameA, SetEvent, GetExitCodeProcess, CreateProcessA, CreateEventA, GetLastError, Process32First, Process32Next, GetVersionExA, GetStartupInfoA, CloseHandle, GetModuleHandleA
> MSVCRT.dll: _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, __p__fmode, _except_handler3, _acmdln, __set_app_type, _controlfp, exit, _XcptFilter, _exit, _beginthread, _endthread, __p__commode
> SHLWAPI.dll: StrStrIA
> SETUPAPI.dll: SetupDiDestroyDeviceInfoList, SetupDiGetDeviceInstanceIdA, SetupDiGetDeviceInterfaceDetailA, SetupDiEnumDeviceInterfaces, SetupDiGetClassDevsA, SetupDiEnumDeviceInfo, SetupDiGetClassDevsExA, SetupDiGetDeviceRegistryPropertyA
> USER32.dll: IsDialogMessageA, GetMessageA, DispatchMessageA, BroadcastSystemMessageA, wsprintfA, TranslateMessage, GetWindowLongA, PostQuitMessage, SetWindowLongA, RegisterWindowMessageA, DestroyWindow, PostMessageA, IsWindow, CreateDialogParamA
> ADVAPI32.dll: RegQueryValueExA, RegOpenKeyExA, RegDeleteValueA, RegSetValueExA, RegCloseKey
> ksproxy.ax: KsSynchronousDeviceControl

( 0 exports )

voila le rapport diaghelp:

excute le Wed 07/30/2008 à 15:09:09.42

Liste des derniers fichies modifies/crees dans windir\system32 et prefetch
C:\WINDOWS\prefetch\CHCP.COM-18156052.pf -->30/07/2008 03:09:07 م
C:\WINDOWS\prefetch\IEXPLORE.EXE-27122324.pf -->30/07/2008 03:07:49 م
C:\WINDOWS\prefetch\RUNDLL32.EXE-1F22C517.pf -->30/07/2008 03:07:48 م
C:\WINDOWS\prefetch\AVWSC.EXE-347FCF75.pf -->30/07/2008 03:07:32 م
C:\WINDOWS\prefetch\RUNDLL32.EXE-37835EC4.pf -->30/07/2008 03:01:15 م
C:\WINDOWS\prefetch\FIND.EXE-0EC32F1E.pf -->30/07/2008 03:00:37 م
C:\WINDOWS\prefetch\NTVDM.EXE-1A10A423.pf -->30/07/2008 03:00:31 م
C:\WINDOWS\prefetch\GZIP.EXE-3628D05B.pf -->30/07/2008 03:00:23 م
C:\WINDOWS\prefetch\SORT.EXE-194AE83C.pf -->30/07/2008 03:00:20 م
C:\WINDOWS\prefetch\REG.EXE-0D2A95F7.pf -->30/07/2008 03:00:15 م

C:\WINDOWS\System32\drivers\fidbox.dat -->30/07/2008 02:59:21 م
C:\WINDOWS\System32\drivers\fidbox.idx -->30/07/2008 01:33:11 م
C:\WINDOWS\System32\drivers\mbamswissarmy.sys -->23/07/2008 08:09:44 م
C:\WINDOWS\System32\drivers\mbam.sys -->23/07/2008 08:09:38 م
C:\WINDOWS\System32\drivers\avipbb.sys -->27/06/2008 03:03:55 م
C:\WINDOWS\System32\drivers\avgntdd.sys -->09/05/2008 01:15:51 م
C:\WINDOWS\System32\drivers\rmcast.sys -->08/05/2008 03:28:49 م

C:\WINDOWS\System32\PerfStringBackup.INI -->30/07/2008 02:15:47 م
C:\WINDOWS\System32\perfh009.dat -->30/07/2008 02:15:47 م
C:\WINDOWS\System32\perfh001.dat -->30/07/2008 02:15:47 م
C:\WINDOWS\System32\perfc009.dat -->30/07/2008 02:15:47 م
C:\WINDOWS\System32\perfc001.dat -->30/07/2008 02:15:47 م
C:\WINDOWS\System32\vsconfig.xml -->30/07/2008 02:11:40 م
C:\WINDOWS\System32\tmp.txt -->30/07/2008 11:44:03 ص
C:\WINDOWS\System32\tmp.reg -->30/07/2008 11:44:03 ص
C:\WINDOWS\System32\TZLog.log -->30/07/2008 11:07:10 ص
C:\WINDOWS\System32\wpa.dbl -->29/07/2008 08:02:59 م
C:\WINDOWS\System32\zllictbl.dat -->24/07/2008 02:24:36 ص
C:\WINDOWS\System32\svgainit.drv -->21/07/2008 01:26:11 م
C:\WINDOWS\System32\FNTCACHE.DAT -->12/07/2008 05:10:03 ص
C:\WINDOWS\System32\vsutil_loc040c.dll -->09/07/2008 09:05:44 ص
C:\WINDOWS\System32\imslsp_install_loc040c.dll -->09/07/2008 09:05:42 ص
C:\WINDOWS\System32\imsinstall_loc040c.dll -->09/07/2008 09:05:42 ص
C:\WINDOWS\System32\vsdatant.sys -->09/07/2008 09:05:22 ص
C:\WINDOWS\System32\zpeng24.dll -->09/07/2008 09:05:16 ص
C:\WINDOWS\System32\zlcommdb.dll -->09/07/2008 09:05:12 ص
C:\WINDOWS\System32\zlcomm.dll -->09/07/2008 09:05:12 ص
C:\WINDOWS\System32\vsxml.dll -->09/07/2008 09:05:12 ص
C:\WINDOWS\System32\vswmi.dll -->09/07/2008 09:05:12 ص
C:\WINDOWS\System32\vsutil.dll -->09/07/2008 09:05:12 ص
C:\WINDOWS\System32\vsregexp.dll -->09/07/2008 09:05:10 ص
C:\WINDOWS\System32\vspubapi.dll -->09/07/2008 09:05:10 ص

C:\WINDOWS\WindowsUpdate.log -->30/07/2008 02:45:29 م
C:\WINDOWS\0.log -->30/07/2008 02:11:36 م
C:\WINDOWS\bootstat.dat -->30/07/2008 02:11:24 م
C:\WINDOWS\ntbtlog.txt -->30/07/2008 02:10:19 م
C:\WINDOWS\SchedLgU.Txt -->30/07/2008 01:32:50 م
C:\WINDOWS\NeroDigital.ini -->23/07/2008 09:04:06 م
C:\WINDOWS\ModemLog_Motorola SM56 Speakerphone Modem.txt -->22/07/2008 11:55:05 ص
C:\WINDOWS\wafi2000.ini -->09/07/2008 01:36:28 م
C:\WINDOWS\ata live update.ini -->09/07/2008 01:34:52 م
C:\WINDOWS\zllsputility_loc040c.dll -->09/07/2008 09:05:44 ص
C:\WINDOWS\zllsputility.exe -->09/07/2008 09:05:20 ص
C:\WINDOWS\WMSysPr9.prx -->28/06/2008 09:44:33 م
C:\WINDOWS\INI2=No -->22/06/2008 11:41:25 ص
C:\WINDOWS\INI1=No -->22/06/2008 11:41:25 ص
C:\WINDOWS\d3dx.dat -->22/06/2008 10:46:19 ص

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 520
Command line: C:\WINDOWS\Explorer.EXE

Base Size Version Path
0x76f60000 0x7f000 2001.12.4414.0258 C:\WINDOWS\system32\CLBCATQ.DLL
0x76fe0000 0xbf000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
0x661c0000 0x21d000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
0x68ef0000 0xf1000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GrooveUtil.DLL
0x78130000 0x9b000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
0x68ff0000 0x7000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GrooveNew.DLL
0x7c630000 0x1b000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.DLL
0x76a90000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
0x65e30000 0x37000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
0x748c0000 0x130000 8.50.2162.0000 C:\WINDOWS\system32\msxml3.dll
0x020e0000 0x2c6000 3.01.4000.2435 C:\WINDOWS\system32\msi.dll
0x66b40000 0x17d000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GR326C~1.DLL
0x020b0000 0x2e000 C:\Program Files\WinRAR\rarext.dll
0x10000000 0x1e1000 2.09.0001.0000 C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll
0x7c140000 0x103000 7.10.3077.0000 C:\Program Files\Nero\Nero 7\Nero CoverDesigner\MFC71.DLL
0x7c340000 0x56000 7.10.3052.0004 C:\Program Files\Nero\Nero 7\Nero CoverDesigner\MSVCR71.dll
0x7c3a0000 0x7b000 7.10.3077.0000 C:\Program Files\Nero\Nero 7\Nero CoverDesigner\MSVCP71.dll
0x74d70000 0x6c000 5.30.0023.1221 C:\WINDOWS\system32\RICHED20.dll
0x01ce0000 0x19000 2.09.0001.0000 C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll
0x03900000 0x102000 7.10.3077.0000 C:\Program Files\Nero\Nero 7\Nero BackItUp\MFC71U.DLL
0x013c0000 0xb000 7.00.0483.0000 C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll
0x01d40000 0x4000 5.03.0017.0000 C:\Program Files\Zone Labs\ZoneAlarm\zlavscan_Loc040c.dll
0x02550000 0x12000 7.00.0000.0015 C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll
0x02570000 0x12000 1.01.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
0x1c000000 0x18000 5.05.0002.0008 C:\Program Files\Nero\Nero 7\InCD\InCDshx.dll
0x028a0000 0x16000 5.05.0002.0008 C:\Program Files\Nero\Nero 7\InCD\NBHApi.dll
0x02e00000 0x38000 3.00.0000.0058 C:\Program Files\a-squared Free\a2freecontmenu.dll
0x5a500000 0x50000 8.05.1302.1018 C:\Program Files\Windows Live\Messenger\fsshext.8.5.1302.1018.dll
0x73f90000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
0x03b50000 0x17000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x03c00000 0xc000 6.00.0001.1091 C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
0x03c10000 0xe1000 12.00.4518.1014 C:\Program Files\Microsoft Office\Office12\1033\GrooveIntlResource.dll
0x4aaa0000 0x86000 5.41.0015.1509 C:\WINDOWS\system32\MSFTEDIT.DLL
0x6bd10000 0x10000 12.00.4518.1014 C:\Program Files\Microsoft Office\Office12\msohevi.dll
0x60980000 0x7000 3.01.4000.1823 C:\WINDOWS\system32\MSISIP.DLL
0x74de0000 0x10000 5.06.0000.8820 C:\WINDOWS\system32\wshext.dll
0x73d10000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL
0x61e80000 0xd000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL
0x58e70000 0xd000 5.06.0000.6626 C:\WINDOWS\system32\wshAR.DLL

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 760
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x7f000 \??\C:\WINDOWS\system32\winlogon.exe
0x73f90000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
0x20000000 0x17000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
0x76fe0000 0xbf000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
0x76f60000 0x7f000 2001.12.4414.0258 C:\WINDOWS\system32\CLBCATQ.DLL

Volume in drive C has no label.
Volume Serial Number is 947C-FE90

Directory of C:\WINDOWS\system32

08/04/2004 12:56 AM 6,144 csrss.exe
1 File(s) 6,144 bytes
0 Dir(s) 29,153,193,984 bytes free

Contenu de Downloaded Program Files
Volume in drive C has no label.
Volume Serial Number is 947C-FE90

Directory of C:\WINDOWS\Downloaded Program Files

07/02/2008 01:31 AM <DIR> .
07/02/2008 01:31 AM <DIR> ..
06/02/2008 02:11 AM 65 desktop.ini
01/20/2000 03:25 PM 1,162 Microsoft XML Parser for Java.osd
06/17/2008 03:26 PM 144 swdir.inf
07/30/2007 07:24 PM 293 wuweb.inf
4 File(s) 1,664 bytes

Total Files Listed:
4 File(s) 1,664 bytes
2 Dir(s) 29,153,193,984 bytes free

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..

Liste des fichiers en exception sur le pare-feu XP SP2

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Paltalk Messenger\\paltalk.exe"="C:\\Program Files\\Paltalk Messenger\\paltalk.exe:*:Disabled:PaltalkScene"
"C:\\Program Files\\SoftPhone\\SoftPhoneMain.exe"="C:\\Program Files\\SoftPhone\\SoftPhoneMain.exe:*:Disabled:SoftPhoneMain"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Disabled:Microsoft DirectPlay Voice Test"
"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Disabled:Run a DLL as an App"
"C:\\Program Files\\SightSpeed\\SightSpeed.exe"="C:\\Program Files\\SightSpeed\\SightSpeed.exe:*:Enabled:SightSpeed"
"C:\\Program Files\\pc2ph\\pc2ph.exe"="C:\\Program Files\\pc2ph\\pc2ph.exe:*:Disabled:pc2ph"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="البرنامج الخفي لذاكرة التخزين المؤقت لفئات المكونات"

exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
212 - cmd.exe
280 - igfxpers.exe
520 - explorer.exe
640 - GrooveMonitor.e
648 - igfxtray.exe
680 - hkcmd.exe
692 - RTHDCPL.exe
708 - sm56hlpr.exe
724 - NBHGui.exe
736 - csrss.exe
760 - winlogon.exe
780 - realsched.exe
804 - services.exe
816 - lsass.exe
820 - dslagent.exe
924 - dslstat.exe
968 - svchost.exe
1028 - svchost.exe
1068 - svchost.exe
1092 - V0420Mon.exe
1116 - igfxsrvc.exe
1160 - svchost.exe
1192 - svchost.exe
1240 - vsmon.exe
1248 - zlclient.exe
1276 - avgnt.exe
1304 - msnmsgr.exe
1404 - CTLCMgr.exe
1548 - sched.exe
1628 - a2service.exe
1676 - avguard.exe
1748 - mdm.exe
2388 - alg.exe
2936 - Ymsgr_tray.exe
3788 - ctfmon.exe
3872 - msnmsgr.exe
4060 - usnsvc.exe

Total number of processes = 38
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - \WINDOWS\system32\ntkrnlpa.exe
806E2000 - \WINDOWS\system32\hal.dll
F7AEE000 - \WINDOWS\system32\KDCOM.DLL
F79FE000 - \WINDOWS\system32\BOOTVID.dll
F74BF000 - ACPI.sys
F7AF0000 - \WINDOWS\system32\DRIVERS\WMILIB.SYS
F74AE000 - pci.sys
F75EE000 - isapnp.sys
F7BB6000 - pciide.sys
F786E000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
F75FE000 - MountMgr.sys
F748F000 - ftdisk.sys
F7AF2000 - dmload.sys
F7469000 - dmio.sys
F7876000 - PartMgr.sys
F760E000 - VolSnap.sys
F7451000 - atapi.sys
F761E000 - disk.sys
F762E000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
F7432000 - fltMgr.sys
F741B000 - KSecDD.sys
F738E000 - Ntfs.sys
F7361000 - NDIS.sys
F734D000 - srescan.sys
F7332000 - Mup.sys
F76FE000 - \SystemRoot\system32\DRIVERS\intelppm.sys
F6D69000 - \SystemRoot\system32\DRIVERS\igxpmp32.sys
F6D55000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
F6D30000 - \SystemRoot\system32\DRIVERS\HDAudBus.sys
F6D19000 - \SystemRoot\system32\DRIVERS\Rtenicxp.sys
F78EE000 - \SystemRoot\system32\DRIVERS\usbuhci.sys
F6CF6000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
F78F6000 - \SystemRoot\system32\DRIVERS\usbehci.sys
F6C05000 - \SystemRoot\system32\DRIVERS\smserial.sys
F78FE000 - \SystemRoot\System32\Drivers\Modem.SYS
F7906000 - \SystemRoot\system32\DRIVERS\fdc.sys
F6BF1000 - \SystemRoot\system32\DRIVERS\parport.sys
F770E000 - \SystemRoot\system32\DRIVERS\i8042prt.sys
F790E000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
F771E000 - \SystemRoot\system32\DRIVERS\serial.sys
F7AB2000 - \SystemRoot\system32\DRIVERS\serenum.sys
F772E000 - \SystemRoot\system32\DRIVERS\imapi.sys
F773E000 - \SystemRoot\system32\DRIVERS\cdrom.sys
F774E000 - \SystemRoot\system32\DRIVERS\redbook.sys
F6BCE000 - \SystemRoot\system32\DRIVERS\ks.sys
F7916000 - \SystemRoot\system32\drivers\InCDPass.sys
F775E000 - \SystemRoot\system32\drivers\InCDRm.sys
F7D34000 - \SystemRoot\system32\DRIVERS\audstub.sys
F776E000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
F7ABE000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
F6BB7000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
F777E000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
F778E000 - \SystemRoot\system32\DRIVERS\raspptp.sys
F791E000 - \SystemRoot\system32\DRIVERS\TDI.SYS
F6BA6000 - \SystemRoot\system32\DRIVERS\psched.sys
F779E000 - \SystemRoot\system32\DRIVERS\msgpc.sys
F7926000 - \SystemRoot\system32\DRIVERS\ptilink.sys
F792E000 - \SystemRoot\system32\DRIVERS\raspti.sys
F6B4D000 - \SystemRoot\system32\DRIVERS\rdpdr.sys
F77AE000 - \SystemRoot\system32\DRIVERS\termdd.sys
F7936000 - \SystemRoot\system32\DRIVERS\mouclass.sys
F7B04000 - \SystemRoot\system32\DRIVERS\swenum.sys
F6B19000 - \SystemRoot\system32\DRIVERS\update.sys
F7AE2000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
F77BE000 - \SystemRoot\System32\Drivers\NDProxy.SYS
AA363000 - \SystemRoot\system32\drivers\RtkHDAud.sys
AA341000 - \SystemRoot\system32\drivers\portcls.sys
F77DE000 - \SystemRoot\system32\drivers\drmk.sys
F77EE000 - \SystemRoot\system32\DRIVERS\usbhub.sys
F7B08000 - \SystemRoot\system32\DRIVERS\USBD.SYS
F6B9A000 - \SystemRoot\system32\drivers\MODEMCSA.sys
F793E000 - \SystemRoot\system32\DRIVERS\flpydisk.sys
AA22E000 - \SystemRoot\system32\DRIVERS\klif.sys
F7B0A000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F7CF5000 - \SystemRoot\System32\Drivers\Null.SYS
F7B0C000 - \SystemRoot\System32\Drivers\Beep.SYS
F794E000 - \SystemRoot\System32\drivers\vga.sys
F7B0E000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F7B10000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F6B8A000 - \SystemRoot\System32\Drivers\InCDrec.SYS
AA1F2000 - \SystemRoot\system32\drivers\InCDFs.sys
F7956000 - \SystemRoot\System32\Drivers\Msfs.SYS
F795E000 - \SystemRoot\System32\Drivers\Npfs.SYS
F6B86000 - \SystemRoot\system32\DRIVERS\rasacd.sys
AA1DF000 - \SystemRoot\system32\DRIVERS\ipsec.sys
AA187000 - \SystemRoot\system32\DRIVERS\tcpip.sys
AA166000 - \SystemRoot\system32\DRIVERS\ipnat.sys
AA13E000 - \SystemRoot\system32\DRIVERS\netbt.sys
F780E000 - \SystemRoot\system32\DRIVERS\wanarp.sys
AA0DE000 - \SystemRoot\System32\vsdatant.sys
AA0BC000 - \SystemRoot\System32\drivers\afd.sys
F781E000 - \SystemRoot\system32\DRIVERS\netbios.sys
F7966000 - \SystemRoot\system32\DRIVERS\ssmdrv.sys
AA090000 - \SystemRoot\system32\DRIVERS\rdbss.sys
A9FF9000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys
F782E000 - \SystemRoot\System32\Drivers\Fips.SYS
A9FE8000 - \SystemRoot\system32\DRIVERS\avipbb.sys
F7B18000 - \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
AA29D000 - \SystemRoot\system32\DRIVERS\hidusb.sys
F784E000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
F7976000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
A9FC1000 - \SystemRoot\system32\DRIVERS\gwausb.sys
F785E000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F797E000 - \SystemRoot\system32\DRIVERS\usbccgp.sys
AA295000 - \SystemRoot\system32\DRIVERS\mouhid.sys
A9F80000 - \SystemRoot\system32\DRIVERS\V0420Vid.sys
F764E000 - \SystemRoot\system32\drivers\usbaudio.sys
A9F68000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F7B3E000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F798E000 - \SystemRoot\System32\watchdog.sys
AA285000 - \SystemRoot\System32\drivers\Dxapi.sys
BF000000 - \SystemRoot\System32\drivers\dxg.sys
F7C8D000 - \SystemRoot\System32\drivers\dxgthk.sys
BF024000 - \SystemRoot\System32\igxpgd32.dll
BF012000 - \SystemRoot\System32\igxprd32.dll
BF04E000 - \SystemRoot\System32\igxpdv32.DLL
BF1D8000 - \SystemRoot\System32\igxpdx32.DLL
A9E70000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
A9A8B000 - \SystemRoot\system32\DRIVERS\mrxdav.sys
F7B96000 - \SystemRoot\System32\Drivers\ParVdm.SYS
A9920000 - \SystemRoot\system32\DRIVERS\srv.sys
A97F4000 - \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
A96EF000 - \SystemRoot\system32\drivers\wdmaud.sys
A9878000 - \SystemRoot\system32\drivers\sysaudio.sys
A91AF000 - \SystemRoot\System32\Drivers\HTTP.sys
A887D000 - \SystemRoot\system32\drivers\kmixer.sys
F7D20000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 128

Liste des programmes installes

‏‏تحديث الأمان لـ Windows XP (KB923689)
‏‏تحديث الأمان لـ Windows XP (KB941569)
تحديث أمان لـ Windows XP (KB950760)‎
تحديث أمان لـ Windows XP (KB950762)‎
تحديث لـ Windows XP (KB898461)‎
تحديث لـ Windows XP (KB942763)‎
a-squared Free 3.5
Adobe Flash Player ActiveX
Adobe Reader 6.0.1
Adobe Shockwave Player
Avira AntiVir Personal - Free Antivirus
CCleaner (remove only)
Creative Live! Cam Center
Creative Live! Cam Manager
Creative Live! Cam Vista IM Driver (1.00.03.0000)
Creative Software AutoUpdate
Creative System Information
D-Link DSL-200 ADSL Modem
Gestionnaire de photos Creative
Golden Al-Wafi Translator
Google Earth
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Guide de l'utilisateur Creative Live! Cam
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Intel(R) Graphics Media Accelerator Driver
Malwarebytes' Anti-Malware
Microsoft Office Access MUI (Arabic) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (Arabic) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (Arabic) 2007
Microsoft Office InfoPath MUI (Arabic) 2007
Microsoft Office OneNote MUI (Arabic) 2007
Microsoft Office Outlook MUI (Arabic) 2007
Microsoft Office PowerPoint MUI (Arabic) 2007
Microsoft Office Professional Edition 2003
Microsoft Office Proof (Arabic) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proofing (Arabic) 2007
Microsoft Office Publisher MUI (Arabic) 2007
Microsoft Office Shared MUI (Arabic) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Word MUI (Arabic) 2007
Microsoft Software Update for Web Folders (Arabic) 12
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Motorola SM56 Speakerphone Modem
MSXML 4.0 SP2 Parser and SDK
Nero 7 Essentials
neroxml
pc2ph
RealPlayer
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB951808)
Security Update for Outlook 2007 (KB946983)
SightSpeed (remove only)
SoftPhone 1.3.2.2
Update for Outlook 2007 Junk Email Filter (kb953463)
Vista Anthracite Pack - Lite 1.30
WebFldrs XP
Windows Installer 3.1 (KB893803)
Windows Live installer
Windows Live Messenger
Windows Media Format Runtime
WinRAR archiver
Yahoo! Install Manager
Yahoo! Messenger
Yahoo! Toolbar
Yahoo! Toolbar
ZoneAlarm

Volume in drive C has no label.
Volume Serial Number is 947C-FE90

Directory of C:\Program Files

07/25/2008 05:36 AM <DIR> .
07/25/2008 05:36 AM <DIR> ..
06/02/2008 01:56 PM <DIR> Adobe
07/29/2008 09:53 PM <DIR> a-squared Free
07/24/2008 02:26 AM <DIR> Avira
07/30/2008 01:19 PM <DIR> CCleaner
07/01/2008 02:13 PM <DIR> Common Files
06/02/2008 02:09 AM <DIR> ComPlus Applications
06/28/2008 09:48 PM <DIR> Creative
06/21/2008 02:43 PM <DIR> D-Link
07/09/2008 01:35 PM <DIR> Golden Al-Wafi Translator
07/02/2008 01:37 AM <DIR> Google
06/02/2008 02:39 AM <DIR> Intel
06/02/2008 02:32 AM <DIR> Internet Explorer
07/30/2008 01:29 PM <DIR> Malwarebytes' Anti-Malware
06/02/2008 02:08 AM <DIR> Messenger
06/02/2008 02:12 AM <DIR> microsoft frontpage
06/15/2008 07:07 PM <DIR> Microsoft Office
06/02/2008 02:22 AM <DIR> Microsoft Visual Studio
06/02/2008 02:23 AM <DIR> Microsoft Works
06/02/2008 02:57 AM <DIR> Motorola
06/02/2008 02:10 AM <DIR> Movie Maker
06/02/2008 02:23 AM <DIR> MSBuild
06/02/2008 02:08 AM <DIR> MSN Gaming Zone
06/02/2008 02:39 AM <DIR> MSXML 4.0
06/02/2008 03:03 AM <DIR> Nero
06/02/2008 02:10 AM <DIR> NetMeeting
06/02/2008 02:11 AM <DIR> Online Services
06/02/2008 02:10 AM <DIR> Outlook Express
07/13/2008 05:18 PM <DIR> pc2ph
06/02/2008 01:58 PM <DIR> Real
06/02/2008 02:47 AM <DIR> Realtek
06/28/2008 09:39 PM <DIR> SightSpeed
07/13/2008 01:43 PM <DIR> SoftPhone
07/24/2008 11:53 PM <DIR> Trend Micro
06/21/2008 02:59 PM <DIR> Windows Live
06/02/2008 03:03 AM <DIR> Windows Media Player
06/02/2008 02:32 AM <DIR> Windows NT
06/02/2008 01:51 PM <DIR> WinRAR
06/02/2008 02:12 AM <DIR> xerox
07/24/2008 10:35 PM <DIR> Yahoo!
07/24/2008 02:22 AM <DIR> Zone Labs
0 File(s) 0 bytes
42 Dir(s) 29,152,526,336 bytes free
Volume in drive C has no label.
Volume Serial Number is 947C-FE90

Directory of C:\Program Files\common files

07/01/2008 02:13 PM <DIR> .
07/01/2008 02:13 PM <DIR> ..
06/21/2008 01:26 PM <DIR> Adobe
06/02/2008 03:05 AM <DIR> Ahead
06/02/2008 02:22 AM <DIR> DESIGNER
06/28/2008 09:46 PM <DIR> InstallShield
06/15/2008 07:05 PM <DIR> Microsoft Shared
06/02/2008 02:10 AM <DIR> MSSoap
06/02/2008 05:02 AM <DIR> ODBC
06/02/2008 01:58 PM <DIR> Real
06/02/2008 02:10 AM <DIR> Services
06/02/2008 05:02 AM <DIR> SpeechEngines
06/02/2008 02:19 AM <DIR> System
06/02/2008 01:58 PM <DIR> xing shared
0 File(s) 0 bytes
14 Dir(s) 29,152,526,336 bytes free
Volume in drive C has no label.
Volume Serial Number is 947C-FE90

Directory of C:\

07/30/2008 11:40 AM 1,478,876 SmitfraudFix.exe
1 File(s) 1,478,876 bytes
0 Dir(s) 29,152,526,336 bytes free

c:\Documents and Settings\????\Application Data\Microsoft\Installer\{25004377-4857-1681-4143-807477830576}\_58660F67234EEC5DEC9826.exe
c:\Documents and Settings\????\Application Data\Microsoft\Installer\{25004377-4857-1681-4143-807477830576}\_796B1106A7550AAC7E41BF.exe
c:\Documents and Settings\????\??? ??????\SDFix.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\catchme.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\diff.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\dumphive.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\FilesInfoCmd.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\find2.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\Fport.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\grep.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\gzip.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\KProcCheck.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\LFiles.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\LISTDLLS.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\md5sums.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\pslist.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\sigcheck.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\streams.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\swreg.exe
c:\Documents and Settings\????\??? ??????\DiagHelp\DiagHelp\tar.exe
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
c:\Documents and Settings\All Users\Application Data\Nero\DrWeb\Drweb32.dll

****** Fin du rapport DiagHelp
Veuillez svp envoyer le fichier C:\upload_moi_MICROPOW-2D9BBB.tar.gz a l'adresse http://upload.malekal.com

tu vois qqch ?

Tout semble nickel ...

fais ce-ci dans l'ordre pour un dernier contrôle :

1- Télécharges ToolsCleaner (de A.Rothstein) sur ton Bureau.
http://pc-system.fr/

Déconnectes toi et fermes bien toutes tes applications en cours .

Lances le .
*Cliques sur Recherche et laisses le scan se terminer (cela peut être long).
*Cliques sur Suppression pour finaliser.
*Tu peux, si tu le souhaites, te servir des Options facultatives
*Click sur "quitter" pour générer un rapport :
---> Postes le (TCleaner.txt), il se trouve à la racine de ton disque dur (C:\).

Note : Ce petit soft va te nettoyer tout les trucs dont on c'est servi pour la désinfection ( tu n'en as plus besion ! ) .
Supprimes tout les outils , dossiers ou rapports consernant la désinfection que Toolsclaener2 n'a pas supprimé .

Puis enfin supprimes Toolscleaner2 ... ( gardes CCleaner et Malwarebytes : très utiles )

2- Restauration système
*Désactives ta restauration :
Cliques droit sur poste de travail/propriétés/Restauration système/coche la case désactiver la restauration, appliquer, OK
--->Redémarres ton PC
*Réactives ta restauration :
Cliques droit sur poste de travail/propriétés/Restauration système/décoche la case désactiver la restauration, appliquer, OK
--->Redémarres ton PC

3- Fais un scan antivirus en ligne, avec Internet Explorer et accepter l'ActiveX :
https://www.bitdefender.fr/
(pour le rapport ,qui est un doc IE , clik sur l'onglet "plus de détailles" : et à la fin du scan tu demandes à le sauvegarder sur ton bureau)

--->fais un copier/coller et postes le rapport dans ta prochaine réponse ...

Aide : En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE
Dans la nouvelle fenêtre, clique sur j’accepte .
La fenêtre change encore, clique sur scanner .
Les signatures se chargent, etc ...

Tutoriel en images ici : http://pageperso.aol.fr/rginformatique/mapage/defender.htm (merci à Balltrap34 pour cette réalisation)
Et ici : http://www.commentcamarche.net/faq/sujet 8872 scanner en ligne avec bitdefender

salut,

voici le rapport toolscleaner:

C:\SmitFraudFix.exe: trouvé !
C:\SDFIX: trouvé !
C:\SmitFraudfix: trouvé !
C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\HijackThis: trouvé !
C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\مراد\سطح المكتب\SdFix.exe: trouvé !
C:\Documents and Settings\مراد\سطح المكتب\HijackThis.lnk: trouvé !
C:\Documents and Settings\مراد\سطح المكتب\DiagHelp.zip: trouvé !
C:\Documents and Settings\مراد\سطح المكتب\DiagHelp: trouvé !
C:\Documents and Settings\مراد\سطح المكتب\DiagHelp\DiagHelp: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\HJTInstall.exe: trouvé !

---------------------------------
-->- Suppression:

C:\SmitFraudFix.exe: supprimé !
C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\مراد\سطح المكتب\SdFix.exe: supprimé !
C:\Documents and Settings\مراد\سطح المكتب\HijackThis.lnk: supprimé !
C:\Documents and Settings\مراد\سطح المكتب\DiagHelp.zip: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\HJTInstall.exe: supprimé !
C:\SDFIX: supprimé !
C:\SmitFraudfix: supprimé !
C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\HijackThis: supprimé !
C:\Documents and Settings\مراد\سطح المكتب\DiagHelp: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

ainsi que le rapport bitdefender:
BitDefender Online Scanner - Rapport virus en temps réel

Généré à: Wed, Jul 30, 2008 - 19:28:37

--------------------------------------------------------------------------------

Info d'analyse

Fichiers scannés
29995

Infectés Fichiers
0

Virus Détectés

Aucun virus trouvé.

Mais cependant j'ai toujours le meme pb: le pc est tjs lent, et quand j'ouvre ma boite mail hotmail c'est tres flou et en tres petit caractere jusqu'a ce que je clique dessus (ca refait la meme chose a chaque fois que je revien a la page principale)

Bizarre non ?

bizard effectivement ...

mais là, je ne vois plus ...

fais exactement ce qui suit :

Télécharges ComboFix (par sUBs) sur ton Bureau (et pas ailleur !):
http://download.bleepingcomputer.com/sUBs/ComboFix.exe <--- clik droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix et valide .

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnectes toi,fermes tes applications en cours et DESACTIVES TOUTES TES DEFENSES (anti-virus, guardes anti spy-ware, pare-feu) le temps de la manipe :
en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!
--->Important : si tu rencontres des difficultés à ce niveau là, fais m'en part avant de poursuivre ...
Tuto ( aide ) ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :
double-cliques C-Fix.exe ( = combofix.exe ) .

Appuyes sur la touche Y (Yes) pour démarrer le scan .

Attention : n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
---> si un message d'erreur windows apparait à un momment : clik sur la croix rouge en haut à droite de la fenêtre pour la fermer ( et pas sur autre chose ! sinon pas de rapport ... )

Le rapport sera crée dans: C:\Combofix.txt

Postes le rapport Combofix pour analyse ...

voila le rapport (ca commence a m'inquieter cette histoire...):

Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.545 [GMT 3:00]
Running from: C:\Documents and Settings\مراد\سطح المكتب\C-Fix.exe
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_poof

((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-30 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-30 19:38 3,149,856 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-30 19:36 41,048 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-30 15:47 --------- d-----w C:\Program Files\Trend Micro
2008-07-30 10:29 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-07-30 10:19 --------- d-----w C:\Program Files\CCleaner
2008-07-30 08:44 3,046 ----a-w C:\WINDOWS\system32\tmp.reg
2008-07-30 08:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-29 18:53 --------- d-----w C:\Program Files\a-squared Free
2008-07-24 19:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-07-24 19:35 --------- d-----w C:\Program Files\Yahoo!
2008-07-24 19:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-24 00:00 52,736 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-07-23 23:26 --------- d-----w C:\Program Files\Avira
2008-07-23 23:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-07-23 23:22 --------- d-----w C:\Program Files\Zone Labs
2008-07-23 23:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-07-23 17:09 38,472 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-07-23 17:09 17,144 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-07-13 14:18 --------- d-----w C:\Program Files\pc2ph
2008-07-13 10:43 --------- d-----w C:\Program Files\SoftPhone
2008-07-09 10:35 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-07-09 06:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe
2008-07-09 06:05 54,672 ----a-w C:\WINDOWS\system32\vsutil_loc040c.dll
2008-07-09 06:05 42,384 ----a-w C:\WINDOWS\zllsputility_loc040c.dll
2008-07-09 06:05 21,904 ----a-w C:\WINDOWS\system32\imsinstall_loc040c.dll
2008-07-09 06:05 17,808 ----a-w C:\WINDOWS\system32\imslsp_install_loc040c.dll
2008-07-09 06:05 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
2008-07-02 10:33 82,432 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-07-01 22:37 --------- d-----w C:\Program Files\Google
2008-07-01 11:13 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-01 10:50 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-30 20:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\SweetIM
2008-06-28 18:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Creative
2008-06-28 18:48 --------- d-----w C:\Program Files\Creative
2008-06-28 18:46 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-28 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\muvee Technologies
2008-06-28 18:39 --------- d-----w C:\Program Files\SightSpeed
2008-06-22 07:47 661,885 ----a-w C:\WINDOWS\system32\360x180° Mekan.scr
2008-06-21 11:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-21 11:59 --------- d-----w C:\Program Files\Windows Live
2008-06-21 11:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-06-21 11:43 --------- d-----w C:\Program Files\D-Link
2008-06-21 10:26 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-17 12:17 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-06-17 12:14 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-06-15 22:21 2,585,872 ----a-w C:\WINDOWS\WindowsInstaller-KB893803-v2-x86.exe
2008-06-15 21:01 2,402,832 ----a-w C:\WINDOWS\WLinstaller.exe
2008-06-02 11:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-06-02 10:59 155,995 ----a-w C:\WINDOWS\java\Packages\6GCBJ7FP.ZIP
2008-06-02 10:58 --------- d-----w C:\Program Files\Real
2008-06-02 10:58 --------- d-----w C:\Program Files\Common Files\xing shared
2008-06-02 10:58 --------- d-----w C:\Program Files\Common Files\Real
2008-06-02 10:53 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-06-02 10:53 172,032 ------w C:\WINDOWS\Setup1.exe
2008-06-02 10:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-06-02 00:05 --------- d-----w C:\Program Files\Common Files\Ahead
2008-06-02 00:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-06-02 00:03 --------- d-----w C:\Program Files\Nero
2008-06-02 00:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-06-01 23:57 --------- d-----w C:\Program Files\Motorola
2008-06-01 23:47 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-06-01 23:47 --------- d-----w C:\Program Files\Realtek
2008-06-01 23:39 --------- d-----w C:\Program Files\MSXML 4.0
2008-06-01 23:39 --------- d-----w C:\Program Files\Intel
2008-06-01 23:32 862,720 ----a-w C:\WINDOWS\system32\shdoclc.dll
2008-06-01 23:30 841,216 ----a-w C:\WINDOWS\system32\rasdlg.dll
2008-06-01 23:27 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-06-01 23:27 1,949,184 ----a-w C:\WINDOWS\system32\logonui.exe
2008-06-01 23:23 --------- d-----w C:\Program Files\MSBuild
2008-06-01 23:23 --------- d-----w C:\Program Files\Microsoft Works
2008-06-01 23:12 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-29 06:35 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-05-23 15:21 81,920 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-05-18 18:40 82,944 ----a-w C:\WINDOWS\system32\IEDFix.exe
.

------- Sigcheck -------

06/02/2008 02:30 AM 1655296 2fd48aaeaec9c891f72277bbe701f5db C:\WINDOWS\explorer.exe
06/02/2008 02:30 AM 1655296 2fd48aaeaec9c891f72277bbe701f5db C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [07/17/2008 10:38 AM 5724184]
"Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [06/07/2007 02:01 PM 155648]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [12/17/2007 05:13 PM 3810544]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 12:47 AM 31016]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [07/11/2007 07:07 AM 131072]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [07/11/2007 07:07 AM 155648]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [07/11/2007 07:07 AM 131072]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [01/29/2007 01:22 PM 638976]
"SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [05/15/2007 03:55 PM 1628208]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [06/02/2008 01:58 PM 180269]
"DSLSTATEXE"="C:\Program Files\D-Link\DSL-200\dslstat.exe" [12/12/2005 10:44 AM 344064]
"DSLAGENTEXE"="C:\Program Files\D-Link\DSL-200\dslagent.exe" [08/25/2005 12:47 PM 65536]
"V0420Mon.exe"="C:\WINDOWS\V0420Mon.exe" [04/30/2007 04:00 AM 32768]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [07/09/2008 09:05 AM 919016]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [06/12/2008 02:28 PM 266497]
"RTHDCPL"="RTHDCPL.EXE" [07/11/2007 07:07 AM 16132608 C:\WINDOWS\RTHDCPL.exe]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogOff"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"= winaux.drv

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^PalTalk.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\PalTalk.lnk
backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--a------ 05/15/2007 03:55 PM 1057328 C:\Program Files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 06/02/2008 01:58 PM 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 12/17/2007 05:13 PM 3810544 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\SoftPhone\\SoftPhoneMain.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\SightSpeed\\SightSpeed.exe"=
"C:\\Program Files\\pc2ph\\pc2ph.exe"=

R3 V0420VID;Live! Cam Vista IM (VF0420);C:\WINDOWS\system32\DRIVERS\V0420Vid.sys [05/31/2007 04:32 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d4efa8dc-3574-11dd-ae21-001cc03e54a0}]
\Shell\AutoRun\command - H:\AutoTransfer.exe
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.fr/
R0 -: HKLM-Main,Start Page = hxxp://home.sweetim.com
R1 -: HKCU-Internet Settings,ProxyOverride = local
O8 -: ت&صدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
C:\WINDOWS\Downloaded Program Files\oscan8.inf
C:\WINDOWS\bdoscandellang.ini
C:\WINDOWS\bdoscandel.exe
C:\WINDOWS\Downloaded Program Files\live.ini
C:\WINDOWS\Downloaded Program Files\scanoptions.tsi
C:\WINDOWS\Downloaded Program Files\lang.ini
C:\WINDOWS\Downloaded Program Files\ipsupd.dll
C:\WINDOWS\Downloaded Program Files\bdupd.dll
C:\WINDOWS\Downloaded Program Files\libfn.dll
C:\WINDOWS\Downloaded Program Files\bdcore.dll
C:\WINDOWS\Downloaded Program Files\oscan8.ocx

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-30 22:37:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 07/30/2008 22:40:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-30 19:40:42

Pre-Run: 28,997,607,424 bytes free
Post-Run: 28,979,888,128 bytes free

205 --- E O F --- 2008-07-30 08:07:17

mouais ...

vérifions quelques trucs :

Rends toi sur ce site :

https://www.virustotal.com/gui/

Copies ce qui suit et colles le dans l'espace pour la recherche :
C:\WINDOWS\system32\360x180° Mekan.scr

Cliques sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends bien la fin ... Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copies le dans ta prochaine réponse ...

( Si VirusTotal indique que le fichier a déjà été analysé, clique sur le bouton Ré-analyse le fichier maintenant )

Fais de même pour :
C:\WINDOWS\java\Packages\6GCBJ7FP.ZIP
C:\WINDOWS\WindowsInstaller-KB893803-v2-x86.exe
C:\WINDOWS\system32\rasdlg.dll
H:\AutoTransfer.exe

---> postes moi donc ces 5 rapports ( en précisant bien au début de chacuns à quel fichier ils correspondent ) et attends la suite ...

Voici les rapports (je crois que tu tiesn une piste...);

C:\WINDOWS\system32\360x180° Mekan.scr

File 360x180___Mekan.scr_ received on 07.30.2008 23:07:00 (CET)
Current status: finished
Result: 1/35 (2.86%)
Compact
Print results
Email:

Antivirus Version Last Update Result
AhnLab-V3 2008.7.29.1 2008.07.30 -
AntiVir 7.8.1.12 2008.07.30 -
Authentium 5.1.0.4 2008.07.30 -
Avast 4.8.1195.0 2008.07.30 -
AVG 8.0.0.156 2008.07.30 -
BitDefender 7.2 2008.07.30 -
CAT-QuickHeal 9.50 2008.07.30 -
ClamAV 0.93.1 2008.07.30 -
DrWeb 4.44.0.09170 2008.07.30 -
eSafe 7.0.17.0 2008.07.29 -
eTrust-Vet 31.6.5995 2008.07.30 -
Ewido 4.0 2008.07.30 -
F-Prot 4.4.4.56 2008.07.30 -
F-Secure 7.60.13501.0 2008.07.30 -
Fortinet 3.14.0.0 2008.07.30 -
GData 2.0.7306.1023 2008.07.30 -
Ikarus T3.1.1.34.0 2008.07.30 -
Kaspersky 7.0.0.125 2008.07.30 -
McAfee 5350 2008.07.30 -
Microsoft 1.3704 2008.07.28 -
NOD32v2 3311 2008.07.30 -
Norman 5.80.02 2008.07.30 -
Panda 9.0.0.4 2008.07.30 -
PCTools 4.4.2.0 2008.07.30 -
Prevx1 V2 2008.07.30 Malicious Software
Rising 20.55.22.00 2008.07.30 -
Sophos 4.31.0 2008.07.30 -
Sunbelt 3.1.1537.1 2008.07.29 -
Symantec 10 2008.07.30 -
TheHacker 6.2.96.389 2008.07.25 -
TrendMicro 8.700.0.1004 2008.07.30 -
VBA32 3.12.8.1 2008.07.29 -
ViRobot 2008.7.30.1317 2008.07.30 -
VirusBuster 4.5.11.0 2008.07.30 -
Webwasher-Gateway 6.6.2 2008.07.30 -
Additional information
File size: 661885 bytes
MD5...: fd812553effdf73fd93982087d79ece2
SHA1..: 7e95fdfff72584d4ea233693af812e80e331479a
SHA256: c873c64890e1d0f7300e8dbcf1b08caf7e49333b50e0e22edf2ab5e0665a9101
SHA512: ae0b5eda0827b1821bdc5df5dfd0f5fcf7dafec48530c678fa56c64f31a8428d
18985ebbf855db40d0670150350d9d3de960cc591a390573bd64de0d93d0a742
PEiD..: Armadillo v1.71
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x46278b
timedatestamp.....: 0x45abea16 (Mon Jan 15 20:54:46 2007)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x6c9b0 0x6d000 6.64 0e8e66cb49b3787990bcab5740fdeb8b
.rdata 0x6e000 0x5406 0x6000 5.19 9ca2957498da3a45ac7d3d5ff2ab100d
.data 0x74000 0x7bf8 0x6000 3.11 3e92712df0668bb1b2248b8c7921df58
.data1 0x7c000 0x1ba0 0x2000 4.19 0461214124d6833a5d1a46422e62836e
.rsrc 0x7e000 0x5468 0x6000 6.19 2a060bb02eba4caabbba4eda81416a44

( 9 imports )
> VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA
> USER32.dll: UnregisterClassA, RegisterHotKey, UpdateWindow, ShowWindow, LoadIconA, FindWindowA, ClientToScreen, SetCursorPos, GetAsyncKeyState, SendMessageA, SetWindowPos, DefWindowProcA, IsWindowVisible, IsIconic, LoadCursorA, SetCursor, MessageBoxA, GetCursorPos, ScreenToClient, WaitMessage, PeekMessageA, TranslateMessage, DispatchMessageA, GetWindowRect, ShowCursor, RegisterClassA, GetDesktopWindow, wsprintfA, LoadImageA, DrawTextA, ReleaseDC, GetDC, SetFocus, GetParent, SetWindowPlacement, AdjustWindowRectEx, GetWindowLongA, GetMenu, GetWindowPlacement, GetSystemMetrics, GetClassInfoA, DestroyWindow, GetClientRect, CreateWindowExA, PostQuitMessage
> ADVAPI32.dll: RegSetValueExA, RegOpenKeyA, RegCloseKey
> SHELL32.dll: SHGetPathFromIDListA, SHGetSpecialFolderLocation, SHGetMalloc
> ole32.dll: CoInitialize, CoCreateInstance
> DDRAW.dll: DirectDrawCreateEx, DirectDrawEnumerateExA
> WINMM.dll: timeGetTime
> KERNEL32.dll: GetStringTypeW, GetStringTypeA, SetEndOfFile, GetOEMCP, GetACP, LCMapStringA, IsBadCodePtr, GetTimeZoneInformation, FlushFileBuffers, SetStdHandle, SetUnhandledExceptionFilter, GetEnvironmentStringsW, GetEnvironmentStrings, WideCharToMultiByte, FreeEnvironmentStringsW, FreeEnvironmentStringsA, LCMapStringW, CompareStringA, CompareStringW, UnhandledExceptionFilter, HeapCreate, HeapDestroy, GetEnvironmentVariableA, IsBadWritePtr, VirtualAlloc, VirtualFree, SetEnvironmentVariableA, GetCPInfo, GetFileType, GetStdHandle, GetProfileIntA, GetProfileStringA, QueryPerformanceFrequency, GetTickCount, GetCommandLineA, GetSystemDirectoryA, MultiByteToWideChar, WritePrivateProfileStringA, GetLastError, GetShortPathNameA, QueryPerformanceCounter, Sleep, GetModuleFileNameA, lstrcmpiA, IsBadReadPtr, GetModuleHandleA, lstrlenA, GetProcAddress, LoadLibraryA, MapViewOfFile, CreateFileMappingA, GetFileSize, CreateFileA, UnmapViewOfFile, CloseHandle, DeleteFileA, GetVersionExA, GetWindowsDirectoryA, FreeLibrary, ReadFile, WriteFile, SetFilePointer, HeapReAlloc, HeapAlloc, HeapFree, GetFileAttributesA, FindFirstFileA, FindNextFileA, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, RtlUnwind, CreateDirectoryA, ExitProcess, TerminateProcess, GetCurrentProcess, GetExitCodeProcess, WaitForSingleObject, CreateProcessA, GetStartupInfoA, GetVersion, RaiseException, SetHandleCount
> GDI32.dll: DeleteObject, CreateCompatibleDC, GetObjectA, BitBlt, DeleteDC, SetBkMode, SetTextColor, StretchBlt, GetStockObject, GetPaletteEntries, SelectObject

( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=68C2288E7DCD574319240ABE566C3E000F69E799

C:\WINDOWS\java\Packages\6GCBJ7FP.ZIP

File 6GCBJ7FP.ZIP_ received on 07.30.2008 23:10:50 (CET)
Current status: finished
Result: 0/34 (0%)
Compact
Print results
Email:

Antivirus Version Last Update Result
AhnLab-V3 2008.7.29.1 2008.07.30 -
AntiVir 7.8.1.12 2008.07.30 -
Authentium 5.1.0.4 2008.07.30 -
Avast 4.8.1195.0 2008.07.30 -
AVG 8.0.0.156 2008.07.30 -
BitDefender 7.2 2008.07.30 -
CAT-QuickHeal 9.50 2008.07.30 -
ClamAV 0.93.1 2008.07.30 -
DrWeb 4.44.0.09170 2008.07.30 -
eSafe 7.0.17.0 2008.07.29 -
eTrust-Vet 31.6.5995 2008.07.30 -
Ewido 4.0 2008.07.30 -
F-Prot 4.4.4.56 2008.07.30 -
F-Secure 7.60.13501.0 2008.07.30 -
Fortinet 3.14.0.0 2008.07.30 -
GData 2.0.7306.1023 2008.07.30 -
Ikarus T3.1.1.34.0 2008.07.30 -
Kaspersky 7.0.0.125 2008.07.30 -
McAfee 5350 2008.07.30 -
Microsoft 1.3704 2008.07.28 -
NOD32v2 3311 2008.07.30 -
Norman 5.80.02 2008.07.30 -
Panda 9.0.0.4 2008.07.30 -
PCTools 4.4.2.0 2008.07.30 -
Prevx1 V2 2008.07.30 -
Rising 20.55.22.00 2008.07.30 -
Sophos 4.31.0 2008.07.30 -
Sunbelt 3.1.1537.1 2008.07.29 -
TheHacker 6.2.96.389 2008.07.25 -
TrendMicro 8.700.0.1004 2008.07.30 -
VBA32 3.12.8.1 2008.07.29 -
ViRobot 2008.7.30.1317 2008.07.30 -
VirusBuster 4.5.11.0 2008.07.30 -
Webwasher-Gateway 6.6.2 2008.07.30 -
Additional information
File size: 155995 bytes
MD5...: d3c3efcb8ce5fc802b18d65dc47217ad
SHA1..: 27f3c0821836fe1d53f4b44b36360414fb7f5392
SHA256: 8ad2efc5f2521f731bb9df5e44bf5cd17a540c6efc4a365981faab96197a3eb4
SHA512: bfd637963d78b41aa82d3dbdbdee1fe28b0525126982a91b68af9a1c8797e4c3
5a111a086da9553a9955fe956c3abc4d998ba34dcc71498f8c946996e1e761fb
PEiD..: -
PEInfo: -

C:\WINDOWS\WindowsInstaller-KB893803-v2-x86.exe

File WindowsInstaller-KB893803-v2-x86. received on 07.30.2008 23:11:22 (CET)
Current status: finished
Result: 0/33 (0%)
Compact
Print results
Email:

Antivirus Version Last Update Result
AhnLab-V3 2008.7.29.1 2008.07.30 -
AntiVir 7.8.1.12 2008.07.30 -
Authentium 5.1.0.4 2008.07.30 -
Avast 4.8.1195.0 2008.07.30 -
AVG 8.0.0.156 2008.07.30 -
BitDefender 7.2 2008.07.30 -
CAT-QuickHeal 9.50 2008.07.30 -
ClamAV 0.93.1 2008.07.30 -
DrWeb 4.44.0.09170 2008.07.30 -
eSafe 7.0.17.0 2008.07.29 -
eTrust-Vet 31.6.5995 2008.07.30 -
Ewido 4.0 2008.07.30 -
F-Prot 4.4.4.56 2008.07.30 -
Fortinet 3.14.0.0 2008.07.30 -
GData 2.0.7306.1023 2008.07.30 -
Ikarus T3.1.1.34.0 2008.07.30 -
Kaspersky 7.0.0.125 2008.07.30 -
McAfee 5350 2008.07.30 -
Microsoft 1.3704 2008.07.28 -
NOD32v2 3311 2008.07.30 -
Norman 5.80.02 2008.07.30 -
Panda 9.0.0.4 2008.07.30 -
PCTools 4.4.2.0 2008.07.30 -
Rising 20.55.22.00 2008.07.30 -
Sophos 4.31.0 2008.07.30 -
Sunbelt 3.1.1537.1 2008.07.29 -
Symantec 10 2008.07.30 -
TheHacker 6.2.96.389 2008.07.25 -
TrendMicro 8.700.0.1004 2008.07.30 -
VBA32 3.12.8.1 2008.07.29 -
ViRobot 2008.7.30.1317 2008.07.30 -
VirusBuster 4.5.11.0 2008.07.30 -
Webwasher-Gateway 6.6.2 2008.07.30 -
Additional information
File size: 2585872 bytes
MD5...: 342f79337765760ad4e392eb67d5ed2c
SHA1..: 8318455b36ba0a748307459279d46f2f4cdb5a0e
SHA256: 69b61b2c00323cea3686315617d0f452e205dae10c47e02cbe1ea96fea38f582
SHA512: 70f32d415c70a97eecf0280ee9e6b10db8f367eecfedd92fca6155a7db19a776
d2a96d5fcdbde847036f4d7cf2e69b1d6df6c073025582097f28c71f607b7e12
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1005e02
timedatestamp.....: 0x4193d582 (Thu Nov 11 21:11:30 2004)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x2000 0x7c0e 0x7e00 6.57 8fa1bf8fc727e320914ba63135cc6635
.data 0xa000 0x110cc 0x200 0.38 4e3d324f9024d7451fbd68003a615774
.rsrc 0x1c000 0x1c30 0x26d600 7.98 45fd50b9ad5c537932382c5faa9bb6d9

( 8 imports )
> msvcrt.dll: strncpy, toupper, sprintf, strchr, _strnicmp, _stricmp, strrchr, _strcmpi, strstr, _strlwr, _snprintf
> ADVAPI32.dll: InitiateSystemShutdownA, InitializeSecurityDescriptor, InitializeAcl, AddAccessAllowedAce, SetSecurityDescriptorDacl, CryptAcquireContextA, CryptGenRandom, CryptReleaseContext, AllocateAndInitializeSid, OpenProcessToken, GetTokenInformation, GetLengthSid
> KERNEL32.dll: ExpandEnvironmentStringsA, CreateProcessA, GetExitCodeProcess, GetFileSize, CreateThread, CreateEventA, GetProcessHeap, InitializeCriticalSectionAndSpinCount, MoveFileA, ReadFile, SetFilePointer, MoveFileExA, RemoveDirectoryA, GetLastError, CreateDirectoryA, GetTickCount, SetErrorMode, FreeLibrary, GetProcAddress, LoadLibraryA, GetSystemDirectoryA, CloseHandle, DeviceIoControl, CreateFileA, GetDriveTypeA, HeapFree, FormatMessageA, LeaveCriticalSection, DeleteFileA, EnterCriticalSection, TerminateProcess, WaitForMultipleObjects, CreateEventW, SetEvent, Sleep, SetEnvironmentVariableA, GetEnvironmentVariableA, WideCharToMultiByte, HeapAlloc, SetLastError, WriteFile, DosDateTimeToFileTime, ExitProcess, DeleteCriticalSection, FlushFileBuffers, GetVersionExA, WaitForSingleObject, OpenEventA, GetCurrentProcess, GetFileAttributesA, GetCommandLineA, GetModuleFileNameA, FindClose, FindNextFileA, FindFirstFileA, CopyFileA, SetFileAttributesA, SystemTimeToFileTime, GetSystemTime, GetDiskFreeSpaceA, QueryDosDeviceA, GetCurrentDirectoryA, SetEndOfFile, SetFileTime, LocalFileTimeToFileTime
> USER32.dll: ShowWindow, SendDlgItemMessageA, SendMessageA, DialogBoxParamA, MessageBoxA, SetParent, LoadStringA, EndDialog
> ntdll.dll: NtOpenProcessToken, NtAdjustPrivilegesToken, NtClose, NtShutdownSystem
> COMCTL32.dll: -
> SHELL32.dll: SHBrowseForFolderA, SHGetPathFromIDListA
> VERSION.dll: GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

( 0 exports )
ThreatExpert info: https://www.symantec.com?md5=342f79337765760ad4e392eb67d5ed2c
packers (F-Prot): CAB
packers (Kaspersky): PE_Patch

C:\WINDOWS\system32\rasdlg.dll

File rasdlg.dll_ received on 07.30.2008 23:19:17 (CET)
Current status: finished
Result: 0/35 (0%)
Compact
Print results
Email:

Antivirus Version Last Update Result
AhnLab-V3 2008.7.29.1 2008.07.30 -
AntiVir 7.8.1.12 2008.07.30 -
Authentium 5.1.0.4 2008.07.30 -
Avast 4.8.1195.0 2008.07.30 -
AVG 8.0.0.156 2008.07.30 -
BitDefender 7.2 2008.07.30 -
CAT-QuickHeal 9.50 2008.07.30 -
ClamAV 0.93.1 2008.07.30 -
DrWeb 4.44.0.09170 2008.07.30 -
eSafe 7.0.17.0 2008.07.29 -
eTrust-Vet 31.6.5995 2008.07.30 -
Ewido 4.0 2008.07.30 -
F-Prot 4.4.4.56 2008.07.30 -
F-Secure 7.60.13501.0 2008.07.30 -
Fortinet 3.14.0.0 2008.07.30 -
GData 2.0.7306.1023 2008.07.30 -
Ikarus T3.1.1.34.0 2008.07.30 -
Kaspersky 7.0.0.125 2008.07.30 -
McAfee 5350 2008.07.30 -
Microsoft 1.3704 2008.07.28 -
NOD32v2 3311 2008.07.30 -
Norman 5.80.02 2008.07.30 -
Panda 9.0.0.4 2008.07.30 -
PCTools 4.4.2.0 2008.07.30 -
Prevx1 V2 2008.07.30 -
Rising 20.55.22.00 2008.07.30 -
Sophos 4.31.0 2008.07.30 -
Sunbelt 3.1.1537.1 2008.07.29 -
Symantec 10 2008.07.30 -
TheHacker 6.2.96.389 2008.07.25 -
TrendMicro 8.700.0.1004 2008.07.30 -
VBA32 3.12.8.1 2008.07.29 -
ViRobot 2008.7.30.1317 2008.07.30 -
VirusBuster 4.5.11.0 2008.07.30 -
Webwasher-Gateway 6.6.2 2008.07.30 -
Additional information
File size: 841216 bytes
MD5...: d912c740cb112645c69059d142cbc45b
SHA1..: 277abcbd8807303dc48b8d9ce81620005176eaee
SHA256: 9f02de4e2f7bec2adbf101d64b340be8d38b71522c9b13def0c85026221c9c13
SHA512: cac43584871644770acb3883e171423dd074fef3539cee719c2fc9fc909643f1
67d7d43233cf3c3b2e1e241c01bbba205f78d38a5d01bc7735c8009d22cf7260
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x76877d4d
timedatestamp.....: 0x41109631 (Wed Aug 04 07:54:25 2004)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x4f7f0 0x4f800 6.51 af3ca04c86b56f36858677364183c7ab
.data 0x51000 0x187c 0x1200 3.42 c3fd777aa6e154ebb1cb9f49f14591cd
.rsrc 0x53000 0x77085 0x77200 5.99 492c04af28461ef51e3b9ca243a4732a
.reloc 0xcb000 0x547e 0x5600 6.21 931a1c0ee3b7b417767a5a85024ead11

( 13 imports )
> msvcrt.dll: _ltoa, _wcsnicmp, _wtol, atol, _except_handler3, _local_unwind2, wcsncpy, wcslen, wcspbrk, _wcsicmp, wcstoul, wcsstr, __2@YAPAXI@Z, wcscpy, wcscmp, sprintf, vsprintf, wcscat, qsort, memmove, atoi, iswdigit, free, _initterm, _ftol, __3@YAXPAX@Z, wcsncmp, malloc, _adjust_fdiv
> ntdll.dll: DbgPrint, RtlGetNtProductType, RtlNtStatusToDosError
> ADVAPI32.dll: FreeSid, AllocateAndInitializeSid, CheckTokenMembership, RegEnumKeyExA, RegOpenKeyExA, RegConnectRegistryW, RegEnumKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegQueryInfoKeyW, SetSecurityDescriptorGroup, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, AddAccessAllowedAce, InitializeAcl, GetSidSubAuthority, ChangeServiceConfigW, ControlService, StartServiceW, QueryServiceStatus, OpenSCManagerW, OpenServiceW, CloseServiceHandle, OpenThreadToken, OpenProcessToken, GetSidLengthRequired, InitializeSid, RegCloseKey, RegOpenKeyExW, RegSetValueExW, RegCreateKeyExW, RegQueryValueExW, RegOpenKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, SetSecurityDescriptorOwner
> GDI32.dll: GetTextExtentPoint32W, TranslateCharsetInfo, DeleteDC, LineTo, MoveToEx, ExtTextOutW, CreatePen, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, CreateFontIndirectW, GetObjectW, GetStockObject, GetDeviceCaps, DeleteObject, SetTextColor, SetBkColor, BitBlt, GetClipBox, PatBlt, GetCharWidthW, CreateSolidBrush, GetTextExtentPointW, GetTextMetricsW
> KERNEL32.dll: GetCurrentThreadId, GetCurrentProcessId, FreeLibrary, GetProcAddress, LoadLibraryW, lstrcpynW, lstrlenW, lstrcatW, ReleaseMutex, WaitForSingleObject, Sleep, lstrlenA, CreateProcessW, SetLastError, LoadLibraryA, lstrcmpiW, CloseHandle, FindClose, FindNextFileW, FindFirstFileW, IsBadWritePtr, CompareStringW, WideCharToMultiByte, lstrcpyW, GlobalDeleteAtom, CreateMutexW, GlobalAddAtomW, SetEvent, GetTickCount, CreateThread, CreateEventW, ExpandEnvironmentStringsW, LoadLibraryExW, GlobalReAlloc, DelayLoadFailureHook, InterlockedCompareExchange, QueryPerformanceCounter, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, LockResource, LoadResource, FindResourceW, HeapCreate, InitializeCriticalSection, DeleteCriticalSection, HeapDestroy, LeaveCriticalSection, EnterCriticalSection, HeapAlloc, GetProcessHeap, HeapFree, CreateProcessA, GetSystemDirectoryA, GetCurrentThread, GetLocaleInfoW, GetLocaleInfoA, GetNumberFormatW, GetModuleHandleW, GetWindowsDirectoryW, GetModuleFileNameW, CreateFileW, lstrcmpW, GetLastError, FormatMessageW, LocalFree, GlobalAlloc, GlobalFree, InterlockedIncrement, CreateDirectoryW, MultiByteToWideChar, LocalAlloc, GetSystemDirectoryW, GetVersionExW, lstrcmpiA, lstrcpyA, GetSystemWindowsDirectoryW, OpenMutexA, CreateMutexA, GetFullPathNameW, InterlockedDecrement, GetACP, MulDiv, GetThreadLocale, GlobalUnlock, GlobalLock, GetComputerNameW
> MPRAPI.dll: MprAdminPortDisconnect, MprAdminBufferFree, MprAdminPortEnum, MprAdminIsServiceRunning, MprAdminConnectionEnum, MprAdminConnectionGetInfo, MprAdminServerDisconnect, MprAdminServerConnect, MprAdminUserServerDisconnect, MprAdminUserWriteProfFlags, MprAdminUserServerConnect, MprAdminUserReadProfFlags, MprAdminUserOpen, MprAdminUserRead, MprAdminUserClose, MprAdminUserWrite, MprAdminInterfaceDelete
> ole32.dll: CoUninitialize, CoCreateInstance, CoSetProxyBlanket, CoInitializeEx, CoTaskMemFree, CLSIDFromString
> RASAPI32.dll: RasScriptGetIpAddress, RasGetEapUserDataW, RasfileFindNextKeyLine, RasScriptTerm, RasScriptReceive, RasScriptSend, RasSetAutodialAddressW, RasfileGetKeyValueFields, RasGetAutodialAddressW, RasfileClose, RasfileDeleteLine, RasfileGetLineMark, RasfileFindFirstLine, RasfilePutLineMark, RasfileFindLastLine, RasfilePutKeyValueFields, RasfileFindNextLine, RasfileInsertLine, RasScriptInit, RasfileFindPrevLine, RasfileGetLine, RasfilePutSectionName, RasfileFindSectionLine, RasfileWrite, RasfileGetSectionName, RasfileLoad
> rasman.dll: RasGetDeviceConfigInfo, RasSetDeviceConfigInfo, RasGetCustomScriptDll, RasSetCommSettings, RasIsTrustedCustomDll, RasSendNotification, RasGetDeviceNameW, RasGetUnicodeDeviceName, RasRpcSetUserPreferences, RasRpcGetUserPreferences, RasRpcGetSystemDirectory, RasRpcGetInstalledProtocolsEx, RasRpcGetInstalledProtocols, RasRpcGetVersion, RasGetInfo
> TAPI32.dll: lineTranslateDialogW, lineSetCurrentLocation, LOpenDialAsst, lineGetCountryW, lineGetTranslateCapsW, lineConfigDialogW, lineTranslateAddressW
> USER32.dll: SendMessageA, CreateIconIndirect, GetIconInfo, LoadIconW, MessageBoxW, SendDlgItemMessageW, DialogBoxParamW, ShowCursor, SetCursor, LoadCursorW, ExitWindowsEx, LoadStringW, GetDlgItemTextW, SetCaretPos, GetCaretPos, CreateWindowExW, RegisterClassW, GetClassInfoW, GetKeyState, SetWindowsHookExW, PeekMessageW, UnhookWindowsHookEx, PostMessageW, GetClientRect, GetDC, GetSysColorBrush, ReleaseDC, WinHelpW, SetDlgItemTextW, SetForegroundWindow, GetWindowTextW, wsprintfW, SetDlgItemInt, GetDlgItemInt, SetWindowPos, ShowWindow, SetTimer, IsDlgButtonChecked, KillTimer, CheckDlgButton, LoadImageW, EndDialog, SetWindowLongW, GetDlgItem, SetWindowTextW, GetParent, EnableWindow, GetFocus, IsWindowEnabled, SetFocus, GetWindowLongW, SendMessageW, GetWindowRect, RemovePropW, GetActiveWindow, InvalidateRect, UpdateWindow, LoadBitmapW, GetWindowTextLengthW, EnumChildWindows, EnumWindows, SetPropW, GetPropW, CallWindowProcW, DestroyIcon, CharNextW, CharPrevW, GetDlgCtrlID, MapWindowPoints, ScreenToClient, IsWindowVisible, GetSystemMetrics, InflateRect, GetSysColor, EnumThreadWindows, GetCursorPos, DestroyWindow, MessageBeep, DefWindowProcW, EndPaint, SetRect, FillRect, BeginPaint, DrawFocusRect, DrawTextW
> WS2_32.dll: -, -, -
> RPCRT4.dll: I_RpcExceptionFilter, RpcBindingFree, UuidCreate

( 36 exports )
DwTerminalDlg, GetRasDialOutProtocols, RasAutodialDisableDlgA, RasAutodialDisableDlgW, RasAutodialQueryDlgA, RasAutodialQueryDlgW, RasDialDlgA, RasDialDlgW, RasEntryDlgA, RasEntryDlgW, RasMonitorDlgA, RasMonitorDlgW, RasPhonebookDlgA, RasPhonebookDlgW, RasSrvAddPropPages, RasSrvAddWizPages, RasSrvAllowConnectionsConfig, RasSrvCleanupService, RasSrvEnumConnections, RasSrvHangupConnection, RasSrvInitializeService, RasSrvIsConnectionConnected, RasSrvIsServiceRunning, RasSrvQueryShowIcon, RasUserEnableManualDial, RasUserGetManualDial, RasUserPrefsDlg, RasWizCreateNewEntry, RasWizGetNCCFlags, RasWizGetSuggestedEntryName, RasWizGetUserInputConnectionName, RasWizIsEntryRenamable, RasWizQueryMaxPageCount, RasWizSetEntryName, RouterEntryDlgA, RouterEntryDlgW

H:\AutoTransfer.exe

je n'arrive pas a scanner ce fichier, ca me met: 0 bytes size received / Se ha recibido un archivo vacio