Google redirigé et malwarebytes envahi

Je n'ai pas été capable de mettre en ligne le rapport conbo.fix. Je le collais, mais il ne voulait pas être validé comme commentaire
http://www.cijoint.fr/cjlink.php?file=cj201004/cijO5wiOji.txt

Fichier iaStor.sys reçu le 2010.04.27 13:49:32 (UTC)
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.04.27 -
AhnLab-V3 5.0.0.2 2010.04.27 -
AntiVir 8.2.1.224 2010.04.27 -
Antiy-AVL 2.0.3.7 2010.04.27 -
Authentium 5.2.0.5 2010.04.27 -
Avast 4.8.1351.0 2010.04.27 -
Avast5 5.0.332.0 2010.04.27 -
AVG 9.0.0.787 2010.04.27 -
BitDefender 7.2 2010.04.27 -
CAT-QuickHeal 10.00 2010.04.27 -
ClamAV 0.96.0.3-git 2010.04.27 -
Comodo 4689 2010.04.27 -
DrWeb 5.0.2.03300 2010.04.27 -
eSafe 7.0.17.0 2010.04.26 -
eTrust-Vet 35.2.7453 2010.04.27 -
F-Prot 4.5.1.85 2010.04.26 -
F-Secure 9.0.15370.0 2010.04.27 -
Fortinet 4.0.14.0 2010.04.27 -
GData 21 2010.04.27 -
Ikarus T3.1.1.80.0 2010.04.27 -
Jiangmin 13.0.900 2010.04.27 -
Kaspersky 7.0.0.125 2010.04.27 -
McAfee 5.400.0.1158 2010.04.27 -
McAfee-GW-Edition 6.8.5 2010.04.27 -
Microsoft 1.5703 2010.04.27 -
NOD32 5065 2010.04.27 -
Norman 6.04.11 2010.04.27 -
nProtect 2010-04-27.01 2010.04.27 -
Panda 10.0.2.7 2010.04.26 -
PCTools 7.0.3.5 2010.04.27 -
Prevx 3.0 2010.04.27 -
Rising 22.45.01.04 2010.04.27 -
Sophos 4.53.0 2010.04.27 -
Sunbelt 6227 2010.04.27 -
Symantec 20091.2.0.41 2010.04.27 -
TheHacker 6.5.2.0.270 2010.04.27 -
TrendMicro 9.120.0.1004 2010.04.27 -
TrendMicro-HouseCall 9.120.0.1004 2010.04.27 -
VBA32 3.12.12.4 2010.04.27 -
ViRobot 2010.4.26.2294 2010.04.26 -
VirusBuster 5.0.27.0 2010.04.27 -
Information additionnelle
File size: 330264 bytes
MD5...: d483687eace0c065ee772481a96e05f5
SHA1..: 97cf5a57cf4653d28dd39e37c38a3d7caf2515e3
SHA256: a22200e90c78dfe73fe0fbeed5331ab43cd7133651fd125595c4db604ad71b29
ssdeep: 6144:0eEd3/ojyCpIf3vzTP9p0gIuZHRQcckOJSo/GT7x506/guBomb:S3/b57TP<br>RIEinkOzeTz06Ikomb<br>
PEiD..: -
PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0xd5005<br>timedatestamp.....: 0x4a287809 (Fri Jun 05 01:42:33 2009)<br>machinetype.......: 0x14c (I386)<br><br>( 6 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0x49352 0x49400 6.49 0ab5138f6e755df37b91122737e109f6<br>.rdata 0x4b000 0xc2c 0xe00 5.23 30538f61b97658a9fc8c841cf09d5974<br>.data 0x4c000 0x88b68 0x1000 4.82 7757b10f6f756f78fe2b6436ed5c80bf<br>INIT 0xd5000 0xeaa 0x1000 5.39 6abf13895504fcef58c69e7607a6655a<br>.rsrc 0xd6000 0x458 0x600 2.60 f25f403330fd8946fc0dca65e705eb6f<br>.reloc 0xd7000 0x2322 0x2400 5.50 ca39337b810d646ae5fada54fb9c3e38<br><br>( 2 imports ) <br>> ntoskrnl.exe: ZwOpenKey, DbgPrint, _allmul, IofCompleteRequest, KeSetEvent, PoSetPowerState, _aullshr, MmIsAddressValid, KeWaitForSingleObject, IoFreeWorkItem, IoUnregisterPlugPlayNotification, ObfDereferenceObject, IofCallDriver, IoBuildDeviceIoControlRequest, KeInitializeEvent, memcpy, IoGetDeviceObjectPointer, IoQueueWorkItem, IoAllocateWorkItem, IoRegisterPlugPlayNotification, KeClearEvent, WRITE_REGISTER_ULONG, READ_REGISTER_ULONG, ObReferenceObjectByHandle, KeQueryTimeIncrement, KeTickCount, _aulldiv, KeDelayExecutionThread, MmGetPhysicalAddress, KeCancelTimer, KeSetTimerEx, KeInitializeTimerEx, KeSetTimer, KeInitializeDpc, KeInitializeTimer, memmove, strncpy, strncmp, _purecall, sprintf, InterlockedPopEntrySList, InterlockedPushEntrySList, RtlCompareMemory, KeBugCheckEx, IoInvalidateDeviceRelations, RtlWriteRegistryValue, RtlDeleteRegistryValue, IoOpenDeviceRegistryKey, ExSystemTimeToLocalTime, KeQuerySystemTime, MmUnmapIoSpace, MmMapIoSpace, ZwCreateKey, swprintf, KeLeaveCriticalRegion, KeEnterCriticalRegion, MmMapLockedPagesSpecifyCache, ExDeleteNPagedLookasideList, KeBugCheck, PsTerminateSystemThread, KeWaitForMultipleObjects, KeSetPriorityThread, ZwQueryValueKey, ExInitializeNPagedLookasideList, _aullrem, _aulldvrm, PoRequestPowerIrp, PoStartNextPowerIrp, PoCallDriver, IoReleaseRemoveLockEx, IoAcquireRemoveLockEx, IoFreeIrp, IoGetLowerDeviceObject, IoGetAttachedDeviceReference, IoAllocateIrp, strstr, RtlGetVersion, _alldiv, IoDeleteSymbolicLink, IoAttachDeviceToDeviceStack, IoCreateSymbolicLink, IoCsqInitialize, IoInitializeRemoveLockEx, IoCreateDevice, RtlUnicodeStringToInteger, wcsncpy, wcsstr, IoRegisterDeviceInterface, IoDeleteDevice, IoDetachDevice, _wcsupr, IoGetDeviceProperty, ZwCreateDirectoryObject, ExRegisterCallback, ExCreateCallback, IoConnectInterrupt, IoReportResourceForDetection, ExUnregisterCallback, IoDisconnectInterrupt, IoReleaseRemoveLockAndWaitEx, IoGetConfigurationInformation, IoSetDeviceInterfaceState, KeRemoveQueueDpc, IoCsqInsertIrp, IoCsqRemoveNextIrp, IoFreeMdl, MmProbeAndLockPages, IoAllocateMdl, strncat, RtlAnsiStringToUnicodeString, RtlInitAnsiString, ObfReferenceObject, PoRegisterDeviceForIdleDetection, IoInvalidateDeviceState, IoWriteErrorLogEntry, IoAllocateErrorLogEntry, KeInsertQueueDpc, IoGetDmaAdapter, RtlFreeUnicodeString, KefAcquireSpinLockAtDpcLevel, KefReleaseSpinLockFromDpcLevel, IoRequestDeviceEject, RtlCreateRegistryKey, RtlCopyUnicodeString, RtlUnwind, ZwClose, memset, RtlInitUnicodeString, ExAllocatePoolWithTag, RtlAppendUnicodeToString, RtlAppendUnicodeStringToString, RtlQueryRegistryValues, PsCreateSystemThread, ExFreePoolWithTag<br>> HAL.dll: KeAcquireInStackQueuedSpinLock, KfAcquireSpinLock, KfReleaseSpinLock, ExAcquireFastMutex, ExReleaseFastMutex, KeGetCurrentIrql, KeStallExecutionProcessor, KeReleaseInStackQueuedSpinLock<br><br>( 0 exports ) <br>
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)<br>Generic Win/DOS Executable (15.9%)<br>DOS Executable Generic (15.9%)<br>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:<br>publisher....: Intel Corporation<br>copyright....: Copyright(C) Intel Corporation 1994-2009<br>product......: Intel Matrix Storage Manager driver<br>description..: Intel Matrix Storage Manager driver - ia32<br>original name: iaStor.sys<br>internal name: iaStor.sys<br>file version.: 8.9.0.1023<br>comments.....: -ia32<br>signers......: Intel Corporation<br> VeriSign Class 3 Code Signing 2004 CA<br> Class 3 Public Primary Certification Authority<br>signing date.: 3:43 AM 6/5/2009<br>verified.....: -<br>

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.04.27 -
AhnLab-V3 5.0.0.2 2010.04.27 -
AntiVir 8.2.1.224 2010.04.27 -
Antiy-AVL 2.0.3.7 2010.04.27 -
Authentium 5.2.0.5 2010.04.27 -
Avast 4.8.1351.0 2010.04.27 -
Avast5 5.0.332.0 2010.04.27 -
AVG 9.0.0.787 2010.04.27 -
BitDefender 7.2 2010.04.27 -
CAT-QuickHeal 10.00 2010.04.27 -
ClamAV 0.96.0.3-git 2010.04.27 -
Comodo 4689 2010.04.27 -
DrWeb 5.0.2.03300 2010.04.27 -
eSafe 7.0.17.0 2010.04.26 -
eTrust-Vet 35.2.7453 2010.04.27 -
F-Prot 4.5.1.85 2010.04.26 -
F-Secure 9.0.15370.0 2010.04.27 -
Fortinet 4.0.14.0 2010.04.27 -
GData 21 2010.04.27 -
Ikarus T3.1.1.80.0 2010.04.27 -
Jiangmin 13.0.900 2010.04.27 -
Kaspersky 7.0.0.125 2010.04.27 -
McAfee 5.400.0.1158 2010.04.27 -
McAfee-GW-Edition 6.8.5 2010.04.27 -
Microsoft 1.5703 2010.04.27 -
NOD32 5065 2010.04.27 -
Norman 6.04.11 2010.04.27 -
nProtect 2010-04-27.01 2010.04.27 -
Panda 10.0.2.7 2010.04.26 -
PCTools 7.0.3.5 2010.04.27 -
Prevx 3.0 2010.04.27 -
Rising 22.45.01.04 2010.04.27 -
Sophos 4.53.0 2010.04.27 -
Sunbelt 6227 2010.04.27 -
Symantec 20091.2.0.41 2010.04.27 -
TheHacker 6.5.2.0.270 2010.04.27 -
TrendMicro 9.120.0.1004 2010.04.27 -
TrendMicro-HouseCall 9.120.0.1004 2010.04.27 -
VBA32 3.12.12.4 2010.04.27 -
ViRobot 2010.4.26.2294 2010.04.26 -
VirusBuster 5.0.27.0 2010.04.27 -

Information additionnelle
File size: 330264 bytes
MD5...: d483687eace0c065ee772481a96e05f5
SHA1..: 97cf5a57cf4653d28dd39e37c38a3d7caf2515e3
SHA256: a22200e90c78dfe73fe0fbeed5331ab43cd7133651fd125595c4db604ad71b29
ssdeep: 6144:0eEd3/ojyCpIf3vzTP9p0gIuZHRQcckOJSo/GT7x506/guBomb:S3/b57TP<br>RIEinkOzeTz06Ikomb<br>
PEiD..: -
PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0xd5005<br>timedatestamp.....: 0x4a287809 (Fri Jun 05 01:42:33 2009)<br>machinetype.......: 0x14c (I386)<br><br>( 6 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0x49352 0x49400 6.49 0ab5138f6e755df37b91122737e109f6<br>.rdata 0x4b000 0xc2c 0xe00 5.23 30538f61b97658a9fc8c841cf09d5974<br>.data 0x4c000 0x88b68 0x1000 4.82 7757b10f6f756f78fe2b6436ed5c80bf<br>INIT 0xd5000 0xeaa 0x1000 5.39 6abf13895504fcef58c69e7607a6655a<br>.rsrc 0xd6000 0x458 0x600 2.60 f25f403330fd8946fc0dca65e705eb6f<br>.reloc 0xd7000 0x2322 0x2400 5.50 ca39337b810d646ae5fada54fb9c3e38<br><br>( 2 imports ) <br>> ntoskrnl.exe: ZwOpenKey, DbgPrint, _allmul, IofCompleteRequest, KeSetEvent, PoSetPowerState, _aullshr, MmIsAddressValid, KeWaitForSingleObject, IoFreeWorkItem, IoUnregisterPlugPlayNotification, ObfDereferenceObject, IofCallDriver, IoBuildDeviceIoControlRequest, KeInitializeEvent, memcpy, IoGetDeviceObjectPointer, IoQueueWorkItem, IoAllocateWorkItem, IoRegisterPlugPlayNotification, KeClearEvent, WRITE_REGISTER_ULONG, READ_REGISTER_ULONG, ObReferenceObjectByHandle, KeQueryTimeIncrement, KeTickCount, _aulldiv, KeDelayExecutionThread, MmGetPhysicalAddress, KeCancelTimer, KeSetTimerEx, KeInitializeTimerEx, KeSetTimer, KeInitializeDpc, KeInitializeTimer, memmove, strncpy, strncmp, _purecall, sprintf, InterlockedPopEntrySList, InterlockedPushEntrySList, RtlCompareMemory, KeBugCheckEx, IoInvalidateDeviceRelations, RtlWriteRegistryValue, RtlDeleteRegistryValue, IoOpenDeviceRegistryKey, ExSystemTimeToLocalTime, KeQuerySystemTime, MmUnmapIoSpace, MmMapIoSpace, ZwCreateKey, swprintf, KeLeaveCriticalRegion, KeEnterCriticalRegion, MmMapLockedPagesSpecifyCache, ExDeleteNPagedLookasideList, KeBugCheck, PsTerminateSystemThread, KeWaitForMultipleObjects, KeSetPriorityThread, ZwQueryValueKey, ExInitializeNPagedLookasideList, _aullrem, _aulldvrm, PoRequestPowerIrp, PoStartNextPowerIrp, PoCallDriver, IoReleaseRemoveLockEx, IoAcquireRemoveLockEx, IoFreeIrp, IoGetLowerDeviceObject, IoGetAttachedDeviceReference, IoAllocateIrp, strstr, RtlGetVersion, _alldiv, IoDeleteSymbolicLink, IoAttachDeviceToDeviceStack, IoCreateSymbolicLink, IoCsqInitialize, IoInitializeRemoveLockEx, IoCreateDevice, RtlUnicodeStringToInteger, wcsncpy, wcsstr, IoRegisterDeviceInterface, IoDeleteDevice, IoDetachDevice, _wcsupr, IoGetDeviceProperty, ZwCreateDirectoryObject, ExRegisterCallback, ExCreateCallback, IoConnectInterrupt, IoReportResourceForDetection, ExUnregisterCallback, IoDisconnectInterrupt, IoReleaseRemoveLockAndWaitEx, IoGetConfigurationInformation, IoSetDeviceInterfaceState, KeRemoveQueueDpc, IoCsqInsertIrp, IoCsqRemoveNextIrp, IoFreeMdl, MmProbeAndLockPages, IoAllocateMdl, strncat, RtlAnsiStringToUnicodeString, RtlInitAnsiString, ObfReferenceObject, PoRegisterDeviceForIdleDetection, IoInvalidateDeviceState, IoWriteErrorLogEntry, IoAllocateErrorLogEntry, KeInsertQueueDpc, IoGetDmaAdapter, RtlFreeUnicodeString, KefAcquireSpinLockAtDpcLevel, KefReleaseSpinLockFromDpcLevel, IoRequestDeviceEject, RtlCreateRegistryKey, RtlCopyUnicodeString, RtlUnwind, ZwClose, memset, RtlInitUnicodeString, ExAllocatePoolWithTag, RtlAppendUnicodeToString, RtlAppendUnicodeStringToString, RtlQueryRegistryValues, PsCreateSystemThread, ExFreePoolWithTag<br>> HAL.dll: KeAcquireInStackQueuedSpinLock, KfAcquireSpinLock, KfReleaseSpinLock, ExAcquireFastMutex, ExReleaseFastMutex, KeGetCurrentIrql, KeStallExecutionProcessor, KeReleaseInStackQueuedSpinLock<br><br>( 0 exports ) <br>
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)<br>Generic Win/DOS Executable (15.9%)<br>DOS Executable Generic (15.9%)<br>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:<br>publisher....: Intel Corporation<br>copyright....: Copyright(C)

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-26 10:10:48
Windows 5.1.2600 Service Pack 3
Running: qbnjh29w.exe; Driver: C:\DOCUME~1\THUYDO~1\LOCALS~1\Temp\pxtdypow.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xA2A46C08]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xA2A46AC4]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xA2A47078]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xA2A46FA2]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xA2A4669A]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xA2A46B9E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xA2A465DA]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xA2A4663E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xA2A46CBE]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xA2A47146]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xA2A46C7E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xA2A46DFE]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xA2A5350A]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xA2A5332E]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xA2A53468]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

PAGE ntkrnlpa.exe!ZwLoadDriver 8058413A 7 Bytes JMP A2A5346C \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!NtCreateSection 805AB3AC 7 Bytes JMP A2A53332 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ObMakeTemporaryObject 805BC520 5 Bytes JMP A2A4F4AA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ObInsertObject 805C2FA4 5 Bytes JMP A2A5097E \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ZwCreateProcessEx 805D1144 7 Bytes JMP A2A5350E \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
.rsrc C:\WINDOWS\system32\drivers\iaStor.sys entry point in ".rsrc" section [0xF7425000]

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[720] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00380002
IAT C:\WINDOWS\system32\services.exe[720] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00380000

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 SaibIa32.sys (Disk Filter Driver/Sonic Solutions)

Device \Driver\iaStor \Device\Ide\iaStor0 [F7399352] iaStor.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}
Device \Driver\iaStor \Device\Ide\IAAStorageDevice-0 [F7399352] iaStor.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\iaStor.sys suspicious modification

---- EOF - GMER 1.0.15 ----

Combofix dit que CFScrip semble mal écrit

c'est CFscript il a fait une faute de frappe...

ComboFix 10-04-21.01 - Thuy Doan 2010-04-25 20:44:40.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.2.1033.18.1015.707 [GMT -4:00]
Lancé depuis: c:\documents and settings\Thuy Doan\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Thuy Doan\Desktop\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
- Mode FONCTIONNALITES REDUITES -

FILE ::
"c:\windows\system32\Setup\zf32.dll"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Setup\zf32.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-03-26 au 2010-04-26 ))))))))))))))))))))))))))))))))))))
.

2010-04-25 09:05 . 2005-05-26 19:34 2297552 ----a-w- c:\windows\system32\d3dx9_26.dll
2010-04-24 04:02 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-24 04:02 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-24 04:02 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-24 04:02 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-24 04:02 . 2010-04-14 16:31 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-04-24 04:02 . 2010-04-14 16:31 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-04-24 04:02 . 2010-04-14 16:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-04-24 04:01 . 2010-04-24 04:01 -------- d-----w- c:\program files\Alwil Software
2010-04-24 04:01 . 2010-04-24 04:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-04-23 00:30 . 2010-04-23 02:24 -------- d-----w- C:\Kill'em
2010-04-23 00:30 . 2010-04-23 03:28 -------- d-----w- c:\program files\List_Kill'em
2010-04-22 23:58 . 2010-04-22 23:58 -------- d-----w- C:\_OTL
2010-04-22 22:46 . 2008-04-14 09:41 21504 ----a-w- c:\windows\system32\drivers\hidserv.dll
2010-04-21 13:46 . 2010-04-21 18:40 -------- d-----w- c:\windows\system32\MpEngineStore
2010-04-21 06:18 . 2010-02-24 13:11 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-21 06:18 . 2010-02-24 13:11 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-04-21 06:17 . 2009-10-23 15:28 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe
2010-04-21 06:01 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-21 05:47 . 2010-04-21 05:47 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-04-21 05:47 . 2010-04-21 05:47 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-21 04:42 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-21 04:23 . 2010-04-21 06:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-21 03:57 . 2010-04-21 04:00 -------- d-----w- C:\WORT
2010-04-21 03:32 . 2010-04-22 16:43 -------- d-----w- c:\program files\ZHPDiag
2010-04-21 02:36 . 2010-04-21 02:36 -------- d-----w- c:\program files\trend micro
2010-04-18 05:41 . 2010-04-18 05:41 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\Foxit Software
2010-04-18 05:40 . 2010-04-18 05:40 -------- d-----w- c:\documents and settings\LocalService\Application Data\Foxit Software
2010-04-18 05:03 . 2010-04-14 16:47 38848 ------w- c:\windows\system32\avastSS.scr
2010-04-18 05:03 . 2010-04-14 16:47 153184 ------w- c:\windows\system32\aswBoot.exe
2010-04-15 21:41 . 2010-04-15 21:42 -------- d-----w- c:\documents and settings\All Users\Application Data\FarmFrenzy-PizzaParty
2010-04-13 06:07 . 2010-04-13 06:07 388096 ----a-r- c:\documents and settings\Thuy Doan\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-04-13 06:07 . 2010-04-13 06:07 -------- d-----w- c:\program files\TrendMicro
2010-04-07 13:40 . 2010-04-07 13:40 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\Malwarebytes
2010-04-07 13:40 . 2010-04-07 13:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-30 04:33 . 2010-03-30 04:33 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\Jasc
2010-03-30 04:30 . 2010-03-30 04:30 -------- d-----w- c:\program files\Jasc Software Inc
2010-03-30 03:25 . 2010-03-30 03:25 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2010-03-29 23:36 . 2010-04-21 03:26 -------- d-----w- c:\documents and settings\Thuy Doan\Local Settings\Application Data\Temp
2010-03-29 23:36 . 2010-04-21 03:26 -------- d-----w- c:\documents and settings\Thuy Doan\Local Settings\Application Data\Google
2010-03-29 23:36 . 2010-03-29 23:36 -------- d-----w- c:\documents and settings\Thuy Doan\Local Settings\Application Data\Deployment

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-25 22:22 . 2010-01-30 18:20 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\uTorrent
2010-04-25 07:42 . 2009-12-29 00:48 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\vlc
2010-04-23 07:19 . 2010-01-06 22:04 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\LimeWire
2010-04-23 05:56 . 2009-12-29 00:48 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\dvdcss
2010-04-23 00:05 . 2009-12-26 10:29 76880 ----a-w- c:\documents and settings\Thuy Doan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-22 02:36 . 2010-04-22 02:36 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2010-04-21 06:30 . 2009-12-26 10:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-18 05:40 . 2010-03-10 13:52 -------- d-----w- c:\program files\Foxit Software
2010-04-16 16:42 . 2010-02-01 18:01 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\U3
2010-04-15 21:45 . 2009-12-26 10:05 -------- d-----w- c:\documents and settings\All Users\Application Data\WildTangent
2010-04-13 06:09 . 2010-03-05 15:25 -------- d-----w- c:\program files\Paint.NET
2010-04-13 06:08 . 2010-03-16 06:41 -------- d-----w- c:\program files\WarZone
2010-04-13 06:08 . 2010-01-07 07:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-04-13 06:08 . 2010-01-07 07:11 -------- d-----w- c:\program files\Yahoo!
2010-04-06 06:00 . 2010-03-20 19:30 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\Skype
2010-04-06 05:25 . 2010-03-20 19:35 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\skypePM
2010-03-30 05:23 . 2010-01-06 16:48 -------- d-----w- c:\program files\Inkscape
2010-03-30 05:19 . 2009-12-26 10:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-30 04:29 . 2010-01-31 10:05 1385744 ----a-w- c:\windows\system32\Msvbvm60.dll
2010-03-23 21:33 . 2010-01-30 18:24 -------- d-----w- c:\program files\uTorrent
2010-03-23 17:13 . 2010-03-23 17:13 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-03-23 17:01 . 2009-12-26 10:06 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-23 16:59 . 2010-03-23 16:59 -------- d-----w- c:\program files\Adobe Media Player
2010-03-23 16:48 . 2010-03-23 16:48 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-03-23 16:25 . 2010-03-23 16:22 -------- d-----w- c:\program files\Conquest
2010-03-21 19:18 . 2009-12-26 10:06 -------- d-----w- c:\program files\Windows Media Connect 2
2010-03-21 19:18 . 2009-12-26 10:06 -------- d-----w- c:\program files\Microsoft Works
2010-03-21 19:18 . 2010-03-20 21:38 -------- d-----w- c:\program files\DivX
2010-03-20 21:43 . 2010-03-20 21:37 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2010-03-20 21:42 . 2010-03-20 21:42 56766 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-03-20 21:41 . 2010-03-20 21:41 56978 ----a-w- c:\documents and settings\All Users\Application Data\DivX\WebPlayer\Uninstaller.exe
2010-03-20 21:41 . 2010-03-20 21:41 53600 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Update\Uninstaller.exe
2010-03-20 21:41 . 2010-03-20 21:41 57409 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ControlPanel\Uninstaller.exe
2010-03-20 21:41 . 2010-03-20 21:41 52963 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-03-20 21:41 . 2010-03-20 21:41 54073 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Qt4.5\Uninstaller.exe
2010-03-20 21:41 . 2010-03-20 21:41 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-03-20 21:37 . 2010-03-20 21:42 754984 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll
2010-03-20 21:36 . 2010-03-20 21:42 986904 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe
2010-03-20 19:35 . 2010-03-20 19:35 48 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-03-20 19:30 . 2010-03-20 19:30 -------- d-----r- c:\program files\Skype
2010-03-20 19:30 . 2010-03-20 19:30 -------- d-----w- c:\program files\Common Files\Skype
2010-03-20 19:30 . 2010-03-20 19:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-03-17 16:07 . 2010-03-17 16:06 -------- d-----w- c:\program files\Free Video Converter
2010-03-17 16:07 . 2010-03-17 16:06 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\FreeVideoConverter
2010-03-16 06:43 . 2010-03-16 06:43 1403389 ----a-w- c:\documents and settings\Thuy Doan\Application Data\WarZone\WarZoneInstall.exe
2010-03-16 06:43 . 2010-03-16 06:42 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\WarZone
2010-03-16 06:41 . 2010-03-16 06:41 -------- d-----w- c:\program files\Common Files\Idu
2010-03-16 06:40 . 2010-03-16 06:40 -------- d-----w- c:\program files\Microprose
2010-03-12 16:06 . 2009-12-30 20:39 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\FileZilla
2010-03-11 12:38 . 2010-03-11 12:38 832512 ------w- c:\windows\system32\wininet.dll
2010-03-11 12:38 . 2010-03-11 12:38 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-11 12:38 . 2010-03-11 12:38 17408 ----a-w- c:\windows\system32\corpol.dll
2010-03-10 13:52 . 2010-03-10 13:52 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\Foxit
2010-03-09 11:09 . 2010-03-09 11:09 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-03-05 16:02 . 2010-03-05 16:02 10134 ----a-r- c:\documents and settings\Thuy Doan\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2010-03-05 16:02 . 2010-03-05 16:02 -------- d-----w- c:\program files\Microsoft WSE
2010-03-05 15:50 . 2010-03-05 15:50 -------- d-----w- c:\program files\Electronic Arts
2010-02-25 17:22 . 2009-12-26 10:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-02-12 04:33 . 2010-02-12 04:33 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2010-02-11 12:02 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2010-01-31 10:25 . 2010-01-31 10:25 170 ----a-w- c:\program files\1bomb.ini
2008-04-15 12:00 . 2008-04-15 12:00 45056 --sh--r- c:\windows\system32\Setup\MPClient.exe
2008-04-15 12:00 . 2008-04-15 12:00 36864 --sh--r- c:\windows\system32\Setup\MPSvc.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-04-24_21.14.59 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-04-11 02:06 . 2010-04-24 21:06 69390 c:\windows\system32\perfc009.dat
+ 2009-04-11 02:06 . 2010-04-26 00:45 69390 c:\windows\system32\perfc009.dat
+ 2010-04-25 09:05 . 2005-03-18 21:23 12800 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll
+ 2010-04-25 09:05 . 2005-03-18 21:23 53248 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2010-04-25 09:05 . 2010-04-25 09:05 12800 c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2010-04-25 09:05 . 2010-04-25 09:05 53248 c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
- 2009-04-11 02:06 . 2010-04-24 21:06 436878 c:\windows\system32\perfh009.dat
+ 2009-04-11 02:06 . 2010-04-26 00:45 436878 c:\windows\system32\perfh009.dat
+ 2010-04-25 09:05 . 2005-05-26 19:15 576000 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll
+ 2010-04-25 09:05 . 2005-03-18 21:23 223232 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll
+ 2010-04-25 09:05 . 2005-03-18 21:23 178176 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll
+ 2010-04-25 09:05 . 2005-03-18 21:23 364544 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll
+ 2010-04-25 09:05 . 2005-03-18 21:23 159232 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll
+ 2010-04-25 09:05 . 2005-03-18 21:23 145920 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll
+ 2010-04-25 09:05 . 2005-03-18 21:23 473600 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll
+ 2010-04-25 09:05 . 2010-04-25 09:05 223232 c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2010-04-25 09:05 . 2010-04-25 09:05 178176 c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
+ 2010-04-25 09:05 . 2010-04-25 09:05 364544 c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2010-04-25 09:05 . 2010-04-25 09:05 159232 c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
+ 2010-04-25 09:05 . 2010-04-25 09:05 145920 c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2010-04-25 09:05 . 2010-04-25 09:05 576000 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-04-25 09:05 . 2010-04-25 09:05 473600 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Thuy Doan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-21 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-15 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-15 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-15 131072]
"HP BTW Detect Program"="c:\program files\HP\HPBTWD.exe" [2009-03-30 319488]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-01-16 1418536]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-06-29 458844]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-07-06 737280]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-04-14 2790472]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-03-05 1135912]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Microprose\\Risk II\\RISKII.EXE"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [2009-08-25 21488]
R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [2009-08-25 15856]
R0 SysCow;SysCow;c:\windows\system32\drivers\syscow32x.sys [2009-07-02 103792]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-04-24 162768]
R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [2009-08-25 25584]
R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2009-06-02 457200]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-04-24 19024]
R2 BOTService;BOTService;c:\program files\Roxio\BackOnTrack\Instant Restore\BOTService.exe [2009-07-09 199152]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-08-25 113664]
S3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [2009-03-31 39424]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [2009-08-25 160256]
S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
.
Contenu du dossier 'Tâches planifiées'

2010-04-26 c:\windows\Tasks\BackOnTrack Instant Restore Idle.job
- c:\program files\Roxio\BackOnTrack\Instant Restore\RstIdle.exe [2009-07-09 11:09]

2010-04-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154108922-552443303-2849269232-1005Core.job
- c:\documents and settings\Thuy Doan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-21 03:25]

2010-04-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154108922-552443303-2849269232-1005UA.job
- c:\documents and settings\Thuy Doan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-21 03:25]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_CA&c=94&bd=Pavilion&pf=cnnb
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: localhost
FF - ProfilePath - c:\documents and settings\Thuy Doan\Application Data\Mozilla\Firefox\Profiles\oam08gym.default\
FF - plugin: c:\documents and settings\Thuy Doan\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************
Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés:

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(680)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(216)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\idt\wdm\STacSV.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Hewlett-Packard\Shared\hpqToaster.exe
.
**************************************************************************
.
Heure de fin: 2010-04-25 20:53:23 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-04-26 00:53
ComboFix2.txt 2010-04-24 21:18

Avant-CF: 77 357 998 080 bytes free
Après-CF: 77 301 350 400 bytes free

- - End Of File - - FA9EF5E0EEC97AB10C8D894D16A9054A

toujours la même affaire avec google qui m'amène sur de mauvaises pages

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.04.12 -
AhnLab-V3 5.0.0.2 2010.04.12 -
AntiVir 7.10.6.64 2010.04.12 -
Antiy-AVL 2.0.3.7 2010.04.12 -
Authentium 5.2.0.5 2010.04.12 -
Avast 4.8.1351.0 2010.04.12 -
Avast5 5.0.332.0 2010.04.12 -
AVG 9.0.0.787 2010.04.12 -
BitDefender 7.2 2010.04.13 -
CAT-QuickHeal 10.00 2010.04.12 -
ClamAV 0.96.0.3-git 2010.04.12 -
Comodo 4581 2010.04.12 -
DrWeb 5.0.2.03300 2010.04.13 -
eSafe 7.0.17.0 2010.04.12 -
eTrust-Vet 35.2.7421 2010.04.12 -
F-Prot 4.5.1.85 2010.04.12 -
F-Secure 9.0.15370.0 2010.04.12 -
Fortinet 4.0.14.0 2010.04.12 -
GData 19 2010.04.12 -
Ikarus T3.1.1.80.0 2010.04.12 -
Jiangmin 13.0.900 2010.04.12 -
Kaspersky 7.0.0.125 2010.04.12 -
McAfee 5.400.0.1158 2010.04.12 -
McAfee-GW-Edition 6.8.5 2010.04.12 -
Microsoft 1.5605 2010.04.13 -
NOD32 5023 2010.04.12 -
Norman 6.04.11 2010.04.12 -
nProtect 2009.1.8.0 2010.04.06 Trojan/W32.Agent.28672.AUT
Panda 10.0.2.2 2010.04.12 -
PCTools 7.0.3.5 2010.04.12 -
Prevx 3.0 2010.04.13 -
Rising 22.43.00.04 2010.04.12 -
Sophos 4.52.0 2010.04.12 -
Sunbelt 6168 2010.04.13 -
Symantec 20091.2.0.41 2010.04.13 -
TheHacker 6.5.2.0.259 2010.04.12 -
TrendMicro 9.120.0.1004 2010.04.12 -
VBA32 3.12.12.4 2010.04.09 -
ViRobot 2010.4.12.2272 2010.04.12 -
VirusBuster 5.0.27.0 2010.04.12 -

Information additionnelle
File size: 28672 bytes
MD5   : eb4eca9943da94e09d22134ea20dc602
SHA1  : a2f97d195ff9620ce7535aab0bc8e79697a85536
SHA256: 1ccc522b30441d2f3eb08530ee0370431b45d8a5e90c16c745e71df1238d8113
PEInfo: PE Structure information<br> <br> ( base data )<br> entrypointaddress.: 0x12DF0<br> timedatestamp.....: 0x4048B8DC (Fri Mar 5 18:29:00 2004)<br> machinetype.......: 0x14C (Intel I386)<br> <br> ( 3 sections )<br> name viradd virsiz rawdsiz ntrpy md5<br> UPX0 0x1000 0xC000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<br>UPX1 0xD000 0x6000 0x6000 7.89 71032bc5bb329a80139fa1850b861b54<br>.rsrc 0x13000 0x1000 0xC00 4.14 3a4cee30dcbd8da179e9888e86637f7f<br> <br> ( 2 imports )<br> <br>> crtdll.dll: free<br>> kernel32.dll: LoadLibraryA, GetProcAddress<br> <br> ( 1 exports )<br> <br>> adler32, compress, compress2, crc32, deflate, deflateCopy, deflateEnd, deflateInit2_, deflateInit_, deflateParams, deflateReset, deflateSetDictionary, get_crc_table, gzclose, gzdopen, gzeof, gzerror, gzflush, gzgetc, gzgets, gzopen, gzprintf, gzputc, gzputs, gzread, gzrewind, gzseek, gzsetparams, gztell, gzwrite, inflate, inflateEnd, inflateInit2_, inflateInit_, inflateReset, inflateSetDictionary, inflateSync, inflateSyncPoint, uncompress, unzClose, unzCloseCurrentFile, unzGetCurrentFileInfo, unzGetGlobalComment, unzGetGlobalInfo, unzGetLocalExtrafield, unzGoToFirstFile, unzGoToNextFile, unzLocateFile, unzOpen, unzOpen2, unzOpenCurrentFile, unzOpenCurrentFile2, unzReadCurrentFile, unzStringFileNameCompare, unzeof, unztell, zError, zipClose, zipCloseFileInZip, zipCloseFileInZipRaw, zipOpen, zipOpenNewFileInZip, zipOpenNewFileInZip2, zipWriteInFileInZip, zlibVersion
TrID  : File type identification<br>UPX compressed Win32 Executable (39.5%)<br>Win32 EXE Yoda's Crypter (34.3%)<br>Win32 Executable Generic (11.0%)<br>Win32 Dynamic Link Library (generic) (9.8%)<br>Generic Win/DOS Executable (2.5%)
ssdeep: 768:U6KSoGR6kfaWCpaaiTukSg7jJ0BoqV1/J5tK16P:UyyWCpaz+g/ktsM
sigcheck: publisher....: n/a<br>copyright....: (C) 1995-2002 Jean-loup Gailly _ Mark Adler<br>product......: ZLib.DLL<br>description..: zlib data compression library<br>original name: zlib.dll<br>internal name: zlib<br>file version.: 1.1.4.0<br>comments.....: DLL support by Alessandro Iacopetti _ Gilles Vollant<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
PEiD  : -
packers (Kaspersky): UPX
packers (F-Prot): UPX
RDS   : NSRL Reference Data Set<br>-

ComboFix 10-04-21.01 - Thuy Doan 2010-04-24 17:03:03.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.2.1033.18.1015.705 [GMT -4:00]
Lancé depuis: c:\documents and settings\Thuy Doan\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Toolbar4
c:\recycler\S-1-5-21-2836507415-3941287240-653123443-1003
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\msconfig32.sys
c:\windows\system32\o4Patch.exe
c:\windows\system32\zf32.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-03-24 au 2010-04-24 ))))))))))))))))))))))))))))))))))))
.

2010-04-24 04:02 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-24 04:02 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-24 04:02 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-24 04:02 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-24 04:02 . 2010-04-14 16:31 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-04-24 04:02 . 2010-04-14 16:31 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-04-24 04:02 . 2010-04-14 16:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-04-24 04:01 . 2010-04-24 04:01 -------- d-----w- c:\program files\Alwil Software
2010-04-24 04:01 . 2010-04-24 04:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-04-23 00:30 . 2010-04-23 02:24 -------- d-----w- C:\Kill'em
2010-04-23 00:30 . 2010-04-23 03:28 -------- d-----w- c:\program files\List_Kill'em
2010-04-22 23:58 . 2010-04-22 23:58 -------- d-----w- C:\_OTL
2010-04-22 22:46 . 2008-04-14 09:41 21504 ----a-w- c:\windows\system32\drivers\hidserv.dll
2010-04-21 13:46 . 2010-04-21 18:40 -------- d-----w- c:\windows\system32\MpEngineStore
2010-04-21 06:18 . 2010-02-24 13:11 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-21 06:18 . 2010-02-24 13:11 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-04-21 06:17 . 2009-10-23 15:28 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe
2010-04-21 06:01 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-21 05:47 . 2010-04-21 05:47 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-04-21 05:47 . 2010-04-21 05:47 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-21 04:42 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-21 04:23 . 2010-04-21 06:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-21 03:57 . 2010-04-21 04:00 -------- d-----w- C:\WORT
2010-04-21 03:32 . 2010-04-22 16:43 -------- d-----w- c:\program files\ZHPDiag
2010-04-21 02:36 . 2010-04-21 02:36 -------- d-----w- c:\program files\trend micro
2010-04-18 05:41 . 2010-04-18 05:41 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\Foxit Software
2010-04-18 05:40 . 2010-04-18 05:40 -------- d-----w- c:\documents and settings\LocalService\Application Data\Foxit Software
2010-04-18 05:03 . 2010-04-14 16:47 38848 ------w- c:\windows\system32\avastSS.scr
2010-04-18 05:03 . 2010-04-14 16:47 153184 ------w- c:\windows\system32\aswBoot.exe
2010-04-15 21:41 . 2010-04-15 21:42 -------- d-----w- c:\documents and settings\All Users\Application Data\FarmFrenzy-PizzaParty
2010-04-13 06:07 . 2010-04-13 06:07 388096 ----a-r- c:\documents and settings\Thuy Doan\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-04-13 06:07 . 2010-04-13 06:07 -------- d-----w- c:\program files\TrendMicro
2010-04-07 13:40 . 2010-04-07 13:40 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\Malwarebytes
2010-04-07 13:40 . 2010-04-07 13:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-30 04:33 . 2010-03-30 04:33 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\Jasc
2010-03-30 04:30 . 2010-03-30 04:30 -------- d-----w- c:\program files\Jasc Software Inc
2010-03-30 03:25 . 2010-03-30 03:25 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2010-03-29 23:36 . 2010-04-21 03:26 -------- d-----w- c:\documents and settings\Thuy Doan\Local Settings\Application Data\Temp
2010-03-29 23:36 . 2010-04-21 03:26 -------- d-----w- c:\documents and settings\Thuy Doan\Local Settings\Application Data\Google
2010-03-29 23:36 . 2010-03-29 23:36 -------- d-----w- c:\documents and settings\Thuy Doan\Local Settings\Application Data\Deployment

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-24 18:28 . 2010-01-30 18:20 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\uTorrent
2010-04-24 18:28 . 2009-12-29 00:48 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\vlc
2010-04-23 07:19 . 2010-01-06 22:04 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\LimeWire
2010-04-23 05:56 . 2009-12-29 00:48 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\dvdcss
2010-04-23 00:05 . 2009-12-26 10:29 76880 ----a-w- c:\documents and settings\Thuy Doan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-22 02:36 . 2010-04-22 02:36 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2010-04-21 06:30 . 2009-12-26 10:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-18 05:40 . 2010-03-10 13:52 -------- d-----w- c:\program files\Foxit Software
2010-04-16 16:42 . 2010-02-01 18:01 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\U3
2010-04-15 21:45 . 2009-12-26 10:05 -------- d-----w- c:\documents and settings\All Users\Application Data\WildTangent
2010-04-13 06:09 . 2010-03-05 15:25 -------- d-----w- c:\program files\Paint.NET
2010-04-13 06:08 . 2010-03-16 06:41 -------- d-----w- c:\program files\WarZone
2010-04-13 06:08 . 2010-01-07 07:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-04-13 06:08 . 2010-01-07 07:11 -------- d-----w- c:\program files\Yahoo!
2010-04-06 06:00 . 2010-03-20 19:30 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\Skype
2010-04-06 05:25 . 2010-03-20 19:35 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\skypePM
2010-03-30 05:23 . 2010-01-06 16:48 -------- d-----w- c:\program files\Inkscape
2010-03-30 05:19 . 2009-12-26 10:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-30 05:17 . 2010-02-15 06:37 -------- d-----w- c:\program files\Chinese Chess Stoneman
2010-03-30 04:29 . 2010-01-31 10:05 1385744 ----a-w- c:\windows\system32\Msvbvm60.dll
2010-03-23 21:33 . 2010-01-30 18:24 -------- d-----w- c:\program files\uTorrent
2010-03-23 17:13 . 2010-03-23 17:13 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-03-23 17:01 . 2009-12-26 10:06 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-23 16:59 . 2010-03-23 16:59 -------- d-----w- c:\program files\Adobe Media Player
2010-03-23 16:48 . 2010-03-23 16:48 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-03-23 16:25 . 2010-03-23 16:22 -------- d-----w- c:\program files\Conquest
2010-03-21 19:18 . 2009-12-26 10:06 -------- d-----w- c:\program files\Windows Media Connect 2
2010-03-21 19:18 . 2009-12-26 10:06 -------- d-----w- c:\program files\Microsoft Works
2010-03-21 19:18 . 2010-03-20 21:38 -------- d-----w- c:\program files\DivX
2010-03-20 21:43 . 2010-03-20 21:37 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2010-03-20 21:42 . 2010-03-20 21:42 56766 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-03-20 21:41 . 2010-03-20 21:41 56978 ----a-w- c:\documents and settings\All Users\Application Data\DivX\WebPlayer\Uninstaller.exe
2010-03-20 21:41 . 2010-03-20 21:41 53600 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Update\Uninstaller.exe
2010-03-20 21:41 . 2010-03-20 21:41 57409 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ControlPanel\Uninstaller.exe
2010-03-20 21:41 . 2010-03-20 21:41 52963 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-03-20 21:41 . 2010-03-20 21:41 54073 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Qt4.5\Uninstaller.exe
2010-03-20 21:41 . 2010-03-20 21:41 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-03-20 21:37 . 2010-03-20 21:42 754984 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll
2010-03-20 21:36 . 2010-03-20 21:42 986904 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe
2010-03-20 19:35 . 2010-03-20 19:35 48 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-03-20 19:30 . 2010-03-20 19:30 -------- d-----r- c:\program files\Skype
2010-03-20 19:30 . 2010-03-20 19:30 -------- d-----w- c:\program files\Common Files\Skype
2010-03-20 19:30 . 2010-03-20 19:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-03-17 16:07 . 2010-03-17 16:06 -------- d-----w- c:\program files\Free Video Converter
2010-03-17 16:07 . 2010-03-17 16:06 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\FreeVideoConverter
2010-03-16 06:43 . 2010-03-16 06:43 1403389 ----a-w- c:\documents and settings\Thuy Doan\Application Data\WarZone\WarZoneInstall.exe
2010-03-16 06:43 . 2010-03-16 06:42 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\WarZone
2010-03-16 06:41 . 2010-03-16 06:41 -------- d-----w- c:\program files\Common Files\Idu
2010-03-16 06:40 . 2010-03-16 06:40 -------- d-----w- c:\program files\Microprose
2010-03-12 16:06 . 2009-12-30 20:39 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\FileZilla
2010-03-11 12:38 . 2010-03-11 12:38 832512 ------w- c:\windows\system32\wininet.dll
2010-03-11 12:38 . 2010-03-11 12:38 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-11 12:38 . 2010-03-11 12:38 17408 ----a-w- c:\windows\system32\corpol.dll
2010-03-10 13:52 . 2010-03-10 13:52 -------- d-----w- c:\documents and settings\Thuy Doan\Application Data\Foxit
2010-03-09 11:09 . 2010-03-09 11:09 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-03-05 16:02 . 2010-03-05 16:02 10134 ----a-r- c:\documents and settings\Thuy Doan\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2010-03-05 16:02 . 2010-03-05 16:02 -------- d-----w- c:\program files\Microsoft WSE
2010-03-05 15:50 . 2010-03-05 15:50 -------- d-----w- c:\program files\Electronic Arts
2010-02-25 17:22 . 2009-12-26 10:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-02-12 04:33 . 2010-02-12 04:33 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2010-02-11 12:02 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2010-01-31 10:25 . 2010-01-31 10:25 170 ----a-w- c:\program files\1bomb.ini
2008-04-15 12:00 . 2008-04-15 12:00 45056 --sh--r- c:\windows\system32\Setup\MPClient.exe
2008-04-15 12:00 . 2008-04-15 12:00 36864 --sh--r- c:\windows\system32\Setup\MPSvc.exe
2008-04-15 12:00 . 2010-01-09 11:49 28672 --sh--r- c:\windows\system32\Setup\zf32.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Thuy Doan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-21 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-15 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-15 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-15 131072]
"HP BTW Detect Program"="c:\program files\HP\HPBTWD.exe" [2009-03-30 319488]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-01-16 1418536]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-06-29 458844]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-07-06 737280]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-04-14 2790472]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-03-05 1135912]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Microprose\\Risk II\\RISKII.EXE"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [2009-08-25 21488]
R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [2009-08-25 15856]
R0 SysCow;SysCow;c:\windows\system32\drivers\syscow32x.sys [2009-07-02 103792]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-04-24 162768]
R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [2009-08-25 25584]
R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2009-06-02 457200]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-04-24 19024]
R2 BOTService;BOTService;c:\program files\Roxio\BackOnTrack\Instant Restore\BOTService.exe [2009-07-09 199152]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-08-25 113664]
S3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [2009-03-31 39424]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [2009-08-25 160256]
S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
.
Contenu du dossier 'Tâches planifiées'

2010-04-24 c:\windows\Tasks\BackOnTrack Instant Restore Idle.job
- c:\program files\Roxio\BackOnTrack\Instant Restore\RstIdle.exe [2009-07-09 11:09]

2010-04-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154108922-552443303-2849269232-1005Core.job
- c:\documents and settings\Thuy Doan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-21 03:25]

2010-04-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154108922-552443303-2849269232-1005UA.job
- c:\documents and settings\Thuy Doan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-21 03:25]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_CA&c=94&bd=Pavilion&pf=cnnb
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: localhost
FF - ProfilePath - c:\documents and settings\Thuy Doan\Application Data\Mozilla\Firefox\Profiles\oam08gym.default\
FF - plugin: c:\documents and settings\Thuy Doan\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKCU-Run-Microsoft Office quick launch - c:\program files\Microsoft Office\Office11\OSA.exe
HKCU-Run-AdobeBridge - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-24 17:14
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys SahdIa32.sys iaStor.sys >>UNKNOWN [0x85BBF8C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf75ccf28
\Driver\ACPI -> ACPI.sys @ 0xf745fcb8
\Driver\iaStor -> iaStor.sys @ 0xf7399352
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->NDIS: Broadcom 802.11b/g WLAN -> SendCompleteHandler -> NDIS.sys @ 0xf7249bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7256a21
SendHandler -> NDIS.sys @ 0xf723487b
user & kernel MBR OK

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(676)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Heure de fin: 2010-04-24 17:18:43
ComboFix-quarantined-files.txt 2010-04-24 21:18

Avant-CF: 78 546 599 936 bytes free
Après-CF: 78 517 985 280 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - D2F0772FD7CB79865F4CFF1EC616F1D5

Je télécharge les updates que me propose windows.

mes trois navigateurs : IE, Mozilla, Google Chrome

Avec google, lorsque je fais une recherche, je choisis une page et on m'amène à d'autres pages,

Peut-être que ça vient avec mon ordinateur portable ? Je fais des conversations avec Yahoo messenger des fois.

non, qu'est-ce ?

Selon la compagnie, ce serait des logiciels pour la conversation en ligne ?

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 5.0.0.2 2009.02.27 -
AntiVir 7.9.0.107 2009.03.09 -
Authentium 5.1.0.4 2009.03.09 -
Avast 4.8.1335.0 2009.03.09 -
AVG 8.0.0.237 2009.03.09 -
BitDefender 7.2 2009.03.10 -
CAT-QuickHeal 10.00 2009.03.10 -
ClamAV 0.94.1 2009.03.10 -
Comodo 1037 2009.03.09 -
DrWeb 4.44.0.09170 2009.03.10 -
eSafe 7.0.17.0 2009.03.09 -
eTrust-Vet 31.6.6388 2009.03.09 -
F-Prot 4.4.4.56 2009.03.09 -
F-Secure 8.0.14470.0 2009.03.10 -
Fortinet 3.117.0.0 2009.03.10 -
GData 19 2009.03.10 -
Ikarus T3.1.1.45.0 2009.03.10 -
K7AntiVirus 7.10.665 2009.03.10 -
Kaspersky 7.0.0.125 2009.03.10 -
McAfee 5548 2009.03.09 -
McAfee+Artemis 5548 2009.03.09 -
Microsoft 1.4405 2009.03.10 -
NOD32 3922 2009.03.09 -
Norman 2009.03.09 -
nProtect 2009.1.8.0 2009.03.10 -
Panda 10.0.0.10 2009.03.09 -
PCTools 4.4.2.0 2009.03.09 -
Prevx1 V2 2009.03.10 -
Rising 21.20.11.00 2009.03.10 -
SecureWeb-Gateway 6.0.0 2009.03.09 -
Sophos 4.39.0 2009.03.10 -
Sunbelt 3.2.1858.2 2009.03.10 -
Symantec 1.4.4.12 2009.03.10 -
TheHacker 6.3.3.0.278 2009.03.10 -
TrendMicro 8.700.0.1004 2009.03.10 -
VBA32 3.12.10.1 2009.03.10 -
ViRobot 2009.3.10.1642 2009.03.10 -
VirusBuster 4.5.11.0 2009.03.09 -

Information additionnelle
File size: 21488 bytes
MD5   : 0b2d5d2341437d7d7e1a6c7bbce3786a
SHA1  : e80bfc5d04dc75fc66c1707b8a11fc8b15f05060
SHA256: e28f6ff902963cd725ce8deda6a96aeddc108533baec3110380227992bf3c2cf
PEInfo: PE Structure information<br> <br> ( base data )<br> entrypointaddress.: 0x60C2<br> timedatestamp.....: 0x49068D4E (Tue Oct 28 04:55:58 2008)<br> machinetype.......: 0x14C (Intel I386)<br> <br> ( 7 sections )<br> name viradd virsiz rawdsiz ntrpy md5<br> .text 0x1000 0x18AC 0x1A00 6.27 7f859da8b9a0ec177b0d4ce8272d7fb8<br>.rdata 0x3000 0x18C 0x200 4.13 b54c8420853106d4db824abef78b906a<br>.data 0x4000 0x20 0x200 0.31 e56217727bbf173d0f495c367ffc4f17<br>PAGE 0x5000 0xA58 0xC00 5.58 72d357bbc9f31db5c8c168239836c62e<br>INIT 0x6000 0x5FC 0x600 5.55 48091d9da973fb50f1eb098472f7ef0d<br>.rsrc 0x7000 0x300 0x400 2.53 3bcb76c550ad20a357dec90d1a61e1f1<br>.reloc 0x8000 0x1FE 0x200 5.27 aa3cf4503469c957e8dcc6ef9ea9a2f9<br> <br> ( 0 imports )<br> <br> <br> ( 0 exports )<br>
TrID  : File type identification<br>Win64 Executable Generic (95.5%)<br>Generic Win/DOS Executable (2.2%)<br>DOS Executable Generic (2.2%)<br>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: 384:RIbysyLwad/dIk52kLRoJz1dpKaJ7w1JnkhSKYJLWq1bk6jJj:Oes4waLI+ZQhBJckIDL7bkmJj
PEiD  : -
RDS   : NSRL Reference Data Set<br>-

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.04.17 -
AhnLab-V3 5.0.0.2 2010.04.16 -
AntiVir 7.10.6.115 2010.04.16 -
Antiy-AVL 2.0.3.7 2010.04.16 -
Authentium 5.2.0.5 2010.04.16 -
Avast 4.8.1351.0 2010.04.16 -
Avast5 5.0.332.0 2010.04.16 -
AVG 9.0.0.787 2010.04.16 -
BitDefender 7.2 2010.04.17 -
CAT-QuickHeal 10.00 2010.04.17 -
ClamAV 0.96.0.3-git 2010.04.17 -
Comodo 4622 2010.04.17 -
DrWeb 5.0.2.03300 2010.04.17 -
eSafe 7.0.17.0 2010.04.15 -
eTrust-Vet 35.2.7430 2010.04.16 -
F-Prot 4.5.1.85 2010.04.16 -
F-Secure 9.0.15370.0 2010.04.16 -
Fortinet 4.0.14.0 2010.04.16 -
GData 19 2010.04.17 -
Ikarus T3.1.1.80.0 2010.04.17 -
Jiangmin 13.0.900 2010.04.17 -
Kaspersky 7.0.0.125 2010.04.17 -
McAfee 5.400.0.1158 2010.04.17 -
McAfee-GW-Edition 6.8.5 2010.04.17 -
Microsoft 1.5605 2010.04.17 -
NOD32 5035 2010.04.16 -
Norman 6.04.11 2010.04.16 -
nProtect 2010-04-16.01 2010.04.16 -
Panda 10.0.2.7 2010.04.16 -
PCTools 7.0.3.5 2010.04.17 -
Prevx 3.0 2010.04.17 -
Rising 22.43.05.03 2010.04.17 -
Sophos 4.52.0 2010.04.17 -
Sunbelt 6186 2010.04.17 -
Symantec 20091.2.0.41 2010.04.17 -
TheHacker 6.5.2.0.263 2010.04.16 -
TrendMicro 9.120.0.1004 2010.04.15 -
VBA32 3.12.12.4 2010.04.15 -
ViRobot 2010.4.17.2281 2010.04.17 -
VirusBuster 5.0.27.0 2010.04.16 -

Information additionnelle
File size: 737280 bytes
MD5   : 2ee2b4bd9407c19c8e3794f2a1b4a0d0
SHA1  : 5b3fef93f8f1956913485793d9579e1a8d69cb86
SHA256: feba327f2faa3201d69d5660a5118c6cec6b921f104a21aa0d84faa3fd431a1d
PEInfo: PE Structure information<br> <br> ( base data )<br> entrypointaddress.: 0x23886<br> timedatestamp.....: 0x4A524B44 (Mon Jul 6 21:06:44 2009)<br> machinetype.......: 0x14C (Intel I386)<br> <br> ( 4 sections )<br> name viradd virsiz rawdsiz ntrpy md5<br> .text 0x1000 0x3BB05 0x3C000 6.62 7d02f6442493fe6c6a4f3a662385b3af<br>.rdata 0x3D000 0x1338E 0x14000 5.45 ef75cbaf0380d4cf27290e4699652042<br>.data 0x51000 0x6214 0x3000 3.44 686c74a8dbcfdc079f549ed32211dc21<br>.rsrc 0x58000 0x5F648 0x60000 5.69 34b1aae292ff9e7c16c843a75f876898<br> <br> ( 10 imports )<br> <br>> advapi32.dll: RegEnumKeyA, RegDeleteKeyA, RegCreateKeyExA, RegCreateKeyA, RegOpenKeyA, RegSetValueExA, RegQueryValueExA, RegCloseKey, RegDeleteValueA, RegOpenKeyExA, RegQueryValueA<br>> gdi32.dll: SelectObject, CreatePolygonRgn, GetClipBox, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, GetTextExtentPoint32A, DeleteDC, GetStockObject, CreatePen, CreateSolidBrush, CreateFontIndirectA, BitBlt, CreateBitmapIndirect, GetObjectA, GetPixel, CreateCompatibleDC, SetPixel, DeleteObject, GetMapMode, CreateCompatibleBitmap, CreateBitmap, MoveToEx, LineTo, SetMapMode, SetBkMode, RestoreDC, SaveDC, GetDeviceCaps, SetBkColor, SetTextColor<br>> kernel32.dll: LocalReAlloc, DeleteCriticalSection, TlsFree, GlobalFlags, InterlockedIncrement, GetCPInfo, GetOEMCP, GetThreadLocale, GetCurrentDirectoryA, ReadFile, WriteFile, SetFilePointer, FlushFileBuffers, GetFullPathNameA, SetErrorMode, GetSystemTimeAsFileTime, HeapFree, TlsSetValue, HeapReAlloc, VirtualAlloc, GetCommandLineA, GetProcessHeap, GetStartupInfoA, RtlUnwind, RaiseException, ExitProcess, ExitThread, CreateThread, HeapSize, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetACP, IsValidCodePage, LCMapStringA, LCMapStringW, HeapDestroy, HeapCreate, VirtualFree, GetStdHandle, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetTimeZoneInformation, GetDriveTypeA, GetConsoleCP, GetConsoleMode, GetStringTypeA, GetStringTypeW, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetEnvironmentVariableA, TlsAlloc, InitializeCriticalSection, GlobalHandle, GlobalReAlloc, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalAlloc, GetPrivateProfileStringA, WritePrivateProfileStringA, SuspendThread, SetEvent, GetCurrentThread, ConvertDefaultLocale, EnumResourceLanguagesA, GetLocaleInfoA, lstrcmpA, GetCurrentProcessId, InterlockedDecrement, GetModuleFileNameW, GlobalAlloc, FormatMessageA, LocalFree, MulDiv, FindFirstFileA, FileTimeToLocalFileTime, FileTimeToSystemTime, FindNextFileA, FindClose, GlobalLock, GlobalUnlock, GlobalFree, FreeResource, GetCurrentThreadId, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, FreeLibrary, SetLastError, lstrcmpW, MultiByteToWideChar, CompareStringW, InterlockedExchange, CompareStringA, GetVersion, CreateEventA, ResetEvent, SetThreadPriority, WaitForSingleObject, TerminateThread, ResumeThread, Sleep, DeviceIoControl, CloseHandle, CreateFileA, lstrcpyA, GetUserDefaultUILanguage, GetSystemDefaultLangID, EnumUILanguagesA, GetCurrentProcess, IsWow64Process, GetNativeSystemInfo, GetVersionExA, FindResourceExA, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, LoadLibraryA, FindResourceA, LoadResource, LockResource, SizeofResource, WideCharToMultiByte, GetLastError, lstrlenA, CreateProcessA, HeapAlloc<br>> oleaut32.dll: -, -, -<br>> shell32.dll: Shell_NotifyIconA<br>> shlwapi.dll: PathFindExtensionA, PathFindFileNameA<br>> user32.dll: GetWindowDC, BeginPaint, EndPaint, GetWindowThreadProcessId, PostQuitMessage, ValidateRect, TranslateMessage, GetMessageA, SetCursor, DestroyMenu, WindowFromPoint, GetSysColorBrush, LoadCursorA, UnregisterClassA, ReleaseDC, GetDC, GrayStringA, DrawTextExA, TabbedTextOutA, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, ModifyMenuA, GetMenuState, EnableMenuItem, CheckMenuItem, GetDesktopWindow, GetActiveWindow, CreateDialogIndirectParamA, GetNextDlgTabItem, EndDialog, IsWindowEnabled, ShowWindow, SetWindowTextA, IsDialogMessageA, SendDlgItemMessageA, WinHelpA, GetCapture, SetWindowsHookExA, CallNextHookEx, GetClassLongA, GetClassNameA, SetPropA, GetPropA, RemovePropA, GetWindowTextLengthA, GetWindowTextA, GetForegroundWindow, GetLastActivePopup, SetActiveWindow, DispatchMessageA, GetDlgItem, GetTopWindow, DestroyWindow, UnhookWindowsHookEx, GetMessageTime, GetMessagePos, PeekMessageA, MapWindowPoints, TrackPopupMenu, GetKeyState, IsWindowVisible, UpdateWindow, GetMenu, GetMenuItemID, GetMenuItemCount, MessageBoxA, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, AdjustWindowRectEx, GetParent, GetDlgCtrlID, DefWindowProcA, CallWindowProcA, GetWindow, MoveWindow, SetWindowPlacement, GetWindowPlacement, OffsetRect, IsWindow, IsIconic, LoadIconA, SetWindowRgn, SetMenuDefaultItem, GetSubMenu, DrawIcon, GetSystemMetrics, SystemParametersInfoA, IntersectRect, CopyRect, SetTimer, KillTimer, GetSysColor, InflateRect, SetRect, LoadMenuA, LoadMenuIndirectA, FindWindowA, ReleaseCapture, PtInRect, GetCursorPos, GetClientRect, SetCapture, FillRect, DrawFocusRect, DrawTextA, InvalidateRect, ScreenToClient, ClientToScreen, GetFocus, SendMessageA, LoadBitmapA, GetWindowRect, SetWindowLongA, RegisterWindowMessageA, GetWindowLongA, EnableWindow, PostMessageA, BringWindowToTop, SetForegroundWindow, SetFocus, SetWindowPos<br>> version.dll: GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA<br>> winmm.dll: waveOutClose, waveInOpen, waveInStart, waveInStop, waveInClose, waveOutReset, waveInReset, waveInPrepareHeader, waveInUnprepareHeader, waveInAddBuffer, waveOutWrite, waveOutPrepareHeader, waveOutUnprepareHeader, waveOutOpen<br>> winspool.drv: OpenPrinterA, ClosePrinter, DocumentPropertiesA<br> <br> ( 0 exports )<br>
TrID  : File type identification<br>Win64 Executable Generic (59.6%)<br>Win32 Executable MS Visual C++ (generic) (26.2%)<br>Win32 Executable Generic (5.9%)<br>Win32 Dynamic Link Library (generic) (5.2%)<br>Generic Win/DOS Executable (1.3%)
ssdeep: 12288:qOCoI18ZH5N2GrE5+BLBOBjqXflu3G4rHbjAlnMlZgmLI:xvIFGrE5wLBOBjqXflu3G4rHHAOnLI
sigcheck: publisher....: Andrea Electronics Corporation<br>copyright....: Copyright (c) 1999-2009, Andrea Electronics Corporation<br>product......: AEFltrs Application<br>description..: AEFltrs MFC Application<br>original name: AEFltrs.EXE<br>internal name: AEFltrs<br>file version.: 5, 0, 0, 5<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
PEiD  : -
RDS   : NSRL Reference Data Set<br>-

Kill'em by g3n-h@ckm@n 1.7.2.1

User : Thuy Doan (Administrators)
Update on 22/04/2010 by g3n-h@ckm@n ::::: 16.15
Start at: 22:37:30 | 2010-04-22

Intel(R) Atom(TM) CPU N270 @ 1.60GHz
Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : avast! Antivirus 5.0.83886587 [ Enabled | Updated ]

C:\ -> Local Fixed Disk | 149,04 Go (76,48 Go free) | NTFS
D:\ -> Removable Disk | 959,97 Mo (122,27 Mo free) | FAT

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\wdm\STacSV.exe
C:\Program Files\Alwil Software\Avast5\setup\avast.setup
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\1.txt

Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\WINDOWS\system32\drivers\wudfpf.sys
Quarantined & Deleted !! : C:\WINDOWS\system32\drivers\wudfrd.sys
Quarantined & Deleted !! : C:\WINDOWS\System32\Process.exe
Quarantined & Deleted !! : C:\WINDOWS\System32\SrchSTS.exe
Quarantined & Deleted !! : C:\Documents and Settings\Thuy Doan\Application Data\wklnhst.dat

==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges
Deleted : HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : HKCR\CLSID\{ca3eb689-8f09-4026-aa10-b9534c691ce0}
Deleted : HKCR\Interface\{4897bba6-48d9-468c-8efa-846275d7701b}
Deleted : HKCR\TypeLib\{4509d3cc-b642-4745-b030-645b79522c6d}
Deleted : HKCR\urlsearchhook.toolbarurlsearchhook
Deleted : HKCR\urlsearchhook.toolbarurlsearchhook.1
Deleted : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_BHDRVX86
Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_BHDRVX86
=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/?gws_rd=ssl
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

===============
Security Center
===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 1 (0x1)
FirewallOverride REG_DWORD 1 (0x1)
UacDisableNotify REG_DWORD 0 (0x0)

========
Services
=========

Ndisuio : Start = 3
EapHost : Start = 2
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
================

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

List'em by g3n-h@ckm@n 1.7.2.1

User : Thuy Doan (Administrators)
Update on 22/04/2010 by g3n-h@ckm@n ::::: 16.15
Start at: 20:30:19 | 2010-04-22

Intel(R) Atom(TM) CPU N270 @ 1.60GHz
Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Disabled
AV : avast! Antivirus 5.0.83886587 [ (!) Disabled | Updated ]

C:\ -> Local Fixed Disk | 149,04 Go (76,6 Go free) | NTFS
D:\ -> Removable Disk | 959,97 Mo (122,27 Mo free) | FAT

Boot: Normal

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\wdm\STacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\HP\HPBTWD.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
Microsoft Office quick launch REG_SZ C:\Program Files\Microsoft Office\Office11\OSA.exe
AdobeBridge REG_SZ
Google Update REG_SZ "C:\Documents and Settings\Thuy Doan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\AdobeUpdater

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
IgfxTray REG_SZ C:\WINDOWS\system32\igfxtray.exe
HotKeysCmds REG_SZ C:\WINDOWS\system32\hkcmd.exe
Persistence REG_SZ C:\WINDOWS\system32\igfxpers.exe
HP BTW Detect Program REG_SZ C:\Program Files\HP\HPBTWD.exe
SynTPEnh REG_SZ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
SysTrayApp REG_EXPAND_SZ %ProgramFiles%\IDT\WDM\sttray.exe
AESTFltr REG_EXPAND_SZ %SystemRoot%\system32\AESTFltr.exe /NoDlg
HP REG_SZ C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
WirelessAssistant REG_SZ C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
Adobe ARM REG_SZ "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
avast5 REG_SZ C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
DivXUpdate REG_SZ "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
AdobeCS4ServiceManager REG_SZ "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
EnableLUA REG_DWORD 1 (0x1)

===============

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 145 (0x91)

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 1 (0x1)

===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ MINH
DefaultUserName REG_SZ Thuy Doan
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD 0 (0x0)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 0 (0x0)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 1 (0x1)
AltDefaultUserName REG_SZ Thuy Doan
AltDefaultDomainName REG_SZ MINH
Background REG_SZ 0 0 0
System REG_SZ

===============

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe REG_SZ C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe:*:Disabled:Java(TM) Platform SE binary
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE REG_SZ C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe REG_SZ C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
C:\Program Files\uTorrent\uTorrent.exe REG_SZ C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
C:\Program Files\LimeWire\LimeWire.exe REG_SZ C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
C:\Program Files\Microprose\Risk II\RISKII.EXE REG_SZ C:\Program Files\Microprose\Risk II\RISKII.EXE:*:Enabled:Risk II
C:\WINDOWS\system32\dplaysvr.exe REG_SZ C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper
C:\Program Files\Skype\Plugin Manager\skypePM.exe REG_SZ C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe REG_SZ C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4
C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

===============
ActivX controls
===============

[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{20A60F0D-9AFA-4515-A0FD-83BD84642501}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D6F45B3-9043-443D-A792-115447494D24}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

==============
BHO :
======

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

===
DNS
===

DNS Server Search Order: 24.200.243.189
HKLM\SYSTEM\CCS\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{BE5BFF9A-23FA-4D30-AB6A-9C377895BCAC}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189

================
Internet Explorer :
================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_EXPAND_SZ %SystemRoot%\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.ca/?gws_rd=ssl
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ

========
Services
========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

========
Safemode
========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!

=========
Atapi.sys
=========

C:\WINDOWS\system32\drivers\atapi.sys :
MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

=======
Drive :
=======

Windows Disk Defragmenter
Copyright (c) 2001 Microsoft Corp. and Executive Software International, Inc.

Analysis Report
149 GB Total, 76,59 GB (51%) Free, 24% Fragmented (48% file fragmentation)

You should defragment this volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\1.txt
Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Present !! : C:\WINDOWS\System32\drivers\wudfpf.sys
Present !! : C:\WINDOWS\System32\drivers\wudfrd.sys"
Present !! : C:\WINDOWS\System32\Process.exe
Present !! : C:\WINDOWS\System32\SrchSTS.exe
Present !! : C:\Documents and Settings\Thuy Doan\Application Data\wklnhst.dat
Present !! : C:\Documents and Settings\Thuy Doan\Application Data\wklnhst.dat

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges
Present !! : HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop
Present !! : HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges
Present !! : HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : HKCR\CLSID\{ca3eb689-8f09-4026-aa10-b9534c691ce0}
Present !! : HKCR\Interface\{4897bba6-48d9-468c-8efa-846275d7701b}
Present !! : HKCR\TypeLib\{4509d3cc-b642-4745-b030-645b79522c6d}
Present !! : HKCR\urlsearchhook.toolbarurlsearchhook
Present !! : HKCR\urlsearchhook.toolbarurlsearchhook.1
Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_BHDRVX86
Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_BHDRVX86
Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_BHDRVX86

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-22 21:30:31
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys SahdIa32.sys iaStor.sys >>UNKNOWN [0x865668C8]<<
kernel: MBR read successfully
user & kernel MBR OK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 0 (0x0)
FirewallOverride REG_DWORD 0 (0x0)
UacDisableNotify REG_DWORD 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 21:30:34,42

Fichier msconfig32.sys reçu le 2010.04.22 23:50:36 (UTC)
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.04.22 -
AhnLab-V3 5.0.0.2 2010.04.22 -
AntiVir 8.2.1.220 2010.04.22 -
Antiy-AVL 2.0.3.7 2010.04.21 -
Authentium 5.2.0.5 2010.04.22 -
Avast 4.8.1351.0 2010.04.22 -
Avast5 5.0.332.0 2010.04.22 -
AVG 9.0.0.787 2010.04.22 -
BitDefender 7.2 2010.04.23 -
CAT-QuickHeal 10.00 2010.04.22 -
ClamAV 0.96.0.3-git 2010.04.23 -
Comodo 4668 2010.04.23 -
DrWeb 5.0.2.03300 2010.04.23 -
eSafe 7.0.17.0 2010.04.22 -
eTrust-Vet 35.2.7444 2010.04.22 -
F-Prot 4.5.1.85 2010.04.22 -
F-Secure 9.0.15370.0 2010.04.22 -
Fortinet 4.0.14.0 2010.04.21 -
GData 21 2010.04.23 -
Ikarus T3.1.1.80.0 2010.04.22 -
Jiangmin 13.0.900 2010.04.22 -
Kaspersky 7.0.0.125 2010.04.23 -
McAfee 5.400.0.1158 2010.04.23 -
McAfee-GW-Edition 6.8.5 2010.04.22 -
Microsoft 1.5703 2010.04.22 -
NOD32 5051 2010.04.22 -
Norman 6.04.11 2010.04.22 -
nProtect 2010-04-22.01 2010.04.22 -
Panda 10.0.2.7 2010.04.22 -
PCTools 7.0.3.5 2010.04.23 -
Rising 22.44.03.04 2010.04.22 -
Sophos 4.53.0 2010.04.23 -
Sunbelt 6210 2010.04.23 -
Symantec 20091.2.0.41 2010.04.23 -
TheHacker 6.5.2.0.267 2010.04.22 -
TrendMicro 9.120.0.1004 2010.04.22 -
TrendMicro-HouseCall 9.120.0.1004 2010.04.23 -
VBA32 3.12.12.4 2010.04.22 -
ViRobot 2010.4.22.2290 2010.04.22 -
VirusBuster 5.0.27.0 2010.04.22 -
Information additionnelle
File size: 5212 bytes
MD5...: f49b6e81b2343568c026564d9dee59b8
SHA1..: 4c98912128b3bdda23b5307190aec6d33a02b2b3
SHA256: 005ffba3c3e2932bee126a0cba8f40d347cf4a7b2d82374038936e6902ae049a
ssdeep: 96:UGh5q+BgAukYJDH5HJJvIAP5QzsCQtYuUv4wUmy8F3x:75pgAudb5H/vI0OsV<br>YuKUmyA3x<br>
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
trid..: DOS Executable Generic (100.0%)

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.04.22 -
AhnLab-V3 5.0.0.2 2010.04.22 -
AntiVir 8.2.1.220 2010.04.22 -
Antiy-AVL 2.0.3.7 2010.04.21 -
Authentium 5.2.0.5 2010.04.22 -
Avast 4.8.1351.0 2010.04.22 -
Avast5 5.0.332.0 2010.04.22 -
AVG 9.0.0.787 2010.04.22 -
BitDefender 7.2 2010.04.23 -
CAT-QuickHeal 10.00 2010.04.22 -
ClamAV 0.96.0.3-git 2010.04.23 -
Comodo 4668 2010.04.23 -
DrWeb 5.0.2.03300 2010.04.23 -
eSafe 7.0.17.0 2010.04.22 -
eTrust-Vet 35.2.7444 2010.04.22 -
F-Prot 4.5.1.85 2010.04.22 -
F-Secure 9.0.15370.0 2010.04.22 -
Fortinet 4.0.14.0 2010.04.21 -
GData 21 2010.04.23 -
Ikarus T3.1.1.80.0 2010.04.22 -
Jiangmin 13.0.900 2010.04.22 -
Kaspersky 7.0.0.125 2010.04.23 -
McAfee 5.400.0.1158 2010.04.23 -
McAfee-GW-Edition 6.8.5 2010.04.22 -
Microsoft 1.5703 2010.04.22 -
NOD32 5051 2010.04.22 -
Norman 6.04.11 2010.04.22 -
nProtect 2010-04-22.01 2010.04.22 -
Panda 10.0.2.7 2010.04.22 -
PCTools 7.0.3.5 2010.04.23 -
Rising 22.44.03.04 2010.04.22 -
Sophos 4.53.0 2010.04.23 -
Sunbelt 6210 2010.04.23 -
Symantec 20091.2.0.41 2010.04.23 -
TheHacker 6.5.2.0.267 2010.04.22 -
TrendMicro 9.120.0.1004 2010.04.22 -
TrendMicro-HouseCall 9.120.0.1004 2010.04.23 -
VBA32 3.12.12.4 2010.04.22 -
ViRobot 2010.4.22.2290 2010.04.22 -
VirusBuster 5.0.27.0 2010.04.22 -

Information additionnelle
File size: 5212 bytes
MD5...: f49b6e81b2343568c026564d9dee59b8
SHA1..: 4c98912128b3bdda23b5307190aec6d33a02b2b3
SHA256: 005ffba3c3e2932bee126a0cba8f40d347cf4a7b2d82374038936e6902ae049a
ssdeep: 96:UGh5q+BgAukYJDH5HJJvIAP5QzsCQtYuUv4wUmy8F3x:75pgAudb5H/vI0OsV<br>YuKUmyA3x<br>
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
trid..: DOS Executable Generic (100.0%)

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
Process firefox.exe killed successfully!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-154108922-552443303-2849269232-1005\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\snp2uvc deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
========== FILES ==========
C:\Documents and Settings\Thuy Doan\Local Settings\Application Data\RJAhr0NY5OVC moved successfully.
C:\Documents and Settings\All Users\Application Data\RJAhr0NY5OVC moved successfully.
C:\Documents and Settings\Thuy Doan\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#SharedObjects\bin-debug\AppContainer_en_US_prod.swf folder moved successfully.
C:\Documents and Settings\Thuy Doan\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#SharedObjects\bin-debug folder moved successfully.
C:\Documents and Settings\Thuy Doan\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#SharedObjects folder moved successfully.
C:\Documents and Settings\Thuy Doan\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store folder moved successfully.
C:\Documents and Settings\Thuy Doan\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: Administrator.MINH
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1770733 bytes
->Flash cache emptied: 321 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 321 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 50805 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Thuy Doan
->Temp folder emptied: 324086672 bytes
->Temporary Internet Files folder emptied: 77172558 bytes
->Java cache emptied: 31764442 bytes
->FireFox cache emptied: 85380274 bytes
->Google Chrome cache emptied: 94999141 bytes
->Flash cache emptied: 93250 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 76817 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 203392 bytes
Windows Temp folder emptied: 1784924 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 23974710 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 2279020599 bytes

Total Files Cleaned = 2 785,00 mb

OTL by OldTimer - Version 3.2.2.0 log created on 04222010_195828

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

J'ai encore des mauvaises redirections google

OTL : http://www.cijoint.fr/cjlink.php?file=cj201004/cijAk0Vmk6.txt
Extras : http://www.cijoint.fr/cjlink.php?file=cj201004/cijX6qJGBz.txt

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 13:00:36, on 2010-04-22
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\wdm\STacSV.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\HP\HPBTWD.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.myfastwebsearch.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.aol.ca/
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files\MSN\Toolbar\3.0.0560.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0560.0\msneshellx.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HP BTW Detect Program] C:\Program Files\HP\HPBTWD.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
O4 - HKLM\..\Run: [HP] C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Office quick launch] C:\Program Files\Microsoft Office\Office11\OSA.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Thuy Doan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/fr/uno1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Roxio SAIB Service (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) - Unknown owner - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: BOTService - Sonic Solutions - C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\STacSV.exe

j'ai pas beaucoup de place dans mon budget, mais est-ce que je devrais acheter la license de malwarebytes?

Merci beaucoup beaucoup et énormément de ton temps. L'ordi n'a pas de problème visible pour le moment.

tu me dis de demander confirmation à qui?

http://www.cijoint.fr/cjlink.php?file=cj201004/cijEFTKkNX.txt

ça marche pas plus en mode sans échec

je ne sais pas si le fichier est important à supprimer, voici une impression d'écran

https://drive.google.com/file/d/0BymQNKubCfpyN2U3ZDA3YzYtYTkwMy00MjQ2LWJiOWMtYmE0NGRiMzcyY2Q4/view?usp=drive_open&hl=en