Logiciel malveillant

salut ! le voiçi le rapport .


[b]SDFix: Version 1.240 [/b]
Run by mamoud on 20/11/2008 at 12:22

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:



[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-20 12:32:23
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\\Program Files\\DAP\\DAP.exe"="C:\\Program Files\\DAP\\DAP.exe:*:Enabled:Download Accelerator Plus (DAP)"
"C:\\Program Files\\Fichiers communs\\Nero\\Nero Web\\SetupX.exe"="C:\\Program Files\\Fichiers communs\\Nero\\Nero Web\\SetupX.exe:*:Enabled:Nero ControlCenter"
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"D:\\Program Files\\iTunes\\iTunes.exe"="D:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Sat 12 Apr 2008 197,415,200 A..H. --- "C:\Downloads\logit\Nero-8.3.2.1_fra_trial.exe"
Fri 26 Sep 2008 6,108,728 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Fri 7 Nov 2008 0 ...H. --- "C:\Documents and Settings\brahim\Mes documents\~WRL0002.tmp"
Fri 20 Jun 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sun 10 Aug 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8171d23d6d072d8b50d065ca55a754fb\BIT1C.tmp"
Fri 8 Aug 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT1.tmp"

[b]Finished![/b]

RE ...!!

le lien ne fonctionne pas voilà ce qui s'affiche




The requested URL /random/RSIT.exe(RSIT) was not found on this server.Apache/2.2.3 (CentOS) Server at images.malwareremoval.com Port 80

RE.. les voiçi


info.txt logfile of random

's system information tool 1.04 2008-11-20 14:07:39

======Uninstall list======

-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adabas D 13.01.00-->MsiExec.exe /X{5C52CED3-D45C-4DA9-932F-B91BD44BB461}
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Apple Mobile Device Support-->MsiExec.exe /I{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Assistant de connexion Windows Live-->MsiExec.exe /I{8984E374-6C93-427C-A3B9-AD92472FDCA0}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Choice Guard-->MsiExec.exe /I{EBD5E7A9-DBB8-4E24-AE3A-CF9390AF1CCB}
Contacts-->MsiExec.exe /I{C6BDA6E5-B391-4CE5-8D86-B53AC96FFE03}
Download Accelerator Plus (DAP)-->C:\PROGRA~1\DAP\DAPREMOVE.EXE
DynGate-->"C:\Program Files\DynGate\uninstall.exe"
Galerie de photos Windows Live (bêta)-->MsiExec.exe /X{B229A0D2-F322-4A30-8E0F-F4AEA3000A14}
Google Earth Pro-->MsiExec.exe /X{9578C0CD-8108-4379-9026-4601F59859A0}
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Huawei SmartAX MT810-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}\Setup.exe" -l0x40c -L0x40c
iTunes-->MsiExec.exe /I{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843}
Java(TM) 6 Update 10-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
K-Lite Mega Codec Pack 3.5.3-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Messenger Plus! Live-->"D:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Encarta 2007 - Collection-->MsiExec.exe /I{07180000-E9B4-4DF6-A845-CAAFD093E477}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook Connector-->MsiExec.exe /I{95120000-011F-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Search Enhancement Pack-->MsiExec.exe /I{A853BEB2-B270-4645-AAAA-9D83C2233BD3}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Mozilla Firefox (2.0.0.18)-->C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 6.0 Parser-->MsiExec.exe /I{AEB9948B-4FF2-47C9-990E-47014492A0FE}
MyHeritage Family Tree Builder-->E:\MyHeritage\Bin\Uninstall.exe
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
OpenOffice.org Installer 1.0-->MsiExec.exe /X{3A2AF807-9F9F-43C9-A24A-17B617238B74}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
PC Camera-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{088B7BF8-AC95-4348-B77B-619AEB3A74A5} /l1036
PhotoFiltre-->"E:\Program Files\PhotoFiltre\Uninst.exe"
Picasa 2-->"C:\Program Files\Picasa2\Uninstall.exe"
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x40c REMOVE -removeonly
REALTEK Gigabit and Fast Ethernet NIC Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94FB906A-CF42-4128-A509-D353026A607E}\setup.exe" -l0x40c REMOVE
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Spyware Doctor 6.0-->C:\Program Files\Spyware Doctor\unins000.exe /LOG
TeamViewer 3-->C:\Program Files\TeamViewer3\uninstall.exe
TeamViewer-->D:\Program Files\TeamViewer\uninstall.exe
VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
VIA Platform Device Manager-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}
VideoLAN VLC media player 0.8.6f-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Live Bêta (tous les programmes)-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Bêta (tous les programmes)-->MsiExec.exe /I{9C4AB6FB-43CD-4ADF-8B59-6C52A6B74324}
Windows Live Call-->MsiExec.exe /I{868EC13B-52DA-43B9-8C05-50CD897674DF}
Windows Live Contrôle parental-->MsiExec.exe /X{EE02C20E-E82B-4693-8106-862D6F6DB6E5}
Windows Live Mail-->MsiExec.exe /I{DA0FC90D-5D87-445E-90B4-B938C57FE16F}
Windows Live Messenger-->MsiExec.exe /X{F72F8316-91E8-4C80-9E39-EBE933E1EDFB}
Windows Live Toolbar Beta-->MsiExec.exe /X{F096941B-2D07-48A0-A9D7-54B254CFABCA}
Windows Live Writer-->MsiExec.exe /X{8FD194E6-C4B1-4AFA-BC74-7773FF9BAB4C}
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Yahoo! ¤u¨ã¦C-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
Yahoo! Extras-->C:\PROGRA~1\YAHOO!\COMMON\unyext.exe
Yahoo! Install Manager-->C:\WINDOWS\system32\regsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL
Yahoo! Internet Mail-->C:\WINDOWS\system32\regsvr32 /u /s C:\PROGRA~1\YAHOO!\COMMON\ymmapi.dll
Yahoo! Messenger-->C:\PROGRA~1\YAHOO!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\YAHOO!\MESSEN~1\INSTALL.LOG

======Hosts File======

127.0.0.1 localhost

======Security center information======

AV: avast! antivirus 4.8.1229 [VPS 081119-0]

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\QuickTime\QTSystem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0409
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------







Logfile of random's system information tool 1.04 (written by random/random)
Run by mamoud at 2008-11-20 14:06:37
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 3 GB (17%) free of 20 GB
Total RAM: 447 MB (12% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:07:35, on 20/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Athan\Athan.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Encarta\Microsoft Encarta 2007 - Collection\EDICT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\DAP\DAP.EXE
E:\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\mamoud.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [E07FDXRC_16857812] "C:\Program Files\Microsoft Encarta\Microsoft Encarta 2007 - Collection\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://D:\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://D:\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://D:\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://D:\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{171C3080-3410-48EC-AB99-AAAB7C43FC07}: NameServer = 41.221.20.4 193.251.169.165
O17 - HKLM\System\CS1\Services\Tcpip\..\{171C3080-3410-48EC-AB99-AAAB7C43FC07}: NameServer = 41.221.20.4 193.251.169.165
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

voilà !


-----------\\ ToolBar S&D 1.2.4 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.06GHz )
BIOS : Award Modular BIOS v6.00PG
USER : mamoud ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 081119-0] 4.8.1229 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:19 Go (Free:3 Go)
D:\ (Local Disk) - FAT32 - Total:19 Go (Free:17 Go)
E:\ (Local Disk) - NTFS - Total:35 Go (Free:30 Go)
F:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
Option : [1] ( 20/11/2008|14:25 )

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ Extensions

(brahim) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

(mamoud) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\windows\\system32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\windows\\system32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr/"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !


1 - "C:\ToolBar SD\TB_1.txt" - 20/11/2008|14:28 - Option : [1]

-----------\\ Fin du rapport a 14:28:10,03

salut voilà le resultat !


========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll NOT unregistered.
c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll moved successfully.
========== COMMANDS ==========
Explorer started successfully
File delete failed. C:\DOCUME~1\mamoud\LOCALS~1\Temp\hsperfdata_mamoud\1024 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\mamoud\LOCALS~1\Temp\~DF40C4.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_508.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_720.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
File delete failed. C:\Documents and Settings\mamoud\Application Data\Sun\Java\Deployment\cache\6.0\53\f6c6435-71accbe8 scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\mamoud\Application Data\Sun\Java\Deployment\cache\6.0\41\1fe7bee9-70b2280d scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\mamoud\Application Data\Sun\Java\Deployment\cache\6.0\41\30a9f469-76462652 scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\mamoud\Application Data\Sun\Java\Deployment\cache\6.0\37\51a7b1a5-59ad742f scheduled to be deleted on reboot.
Java cache emptied.
File delete failed. C:\Documents and Settings\mamoud\Local Settings\Application Data\Mozilla\Firefox\Profiles\lkyaylx6.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\mamoud\Local Settings\Application Data\Mozilla\Firefox\Profiles\lkyaylx6.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\mamoud\Local Settings\Application Data\Mozilla\Firefox\Profiles\lkyaylx6.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\mamoud\Local Settings\Application Data\Mozilla\Firefox\Profiles\lkyaylx6.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\mamoud\Local Settings\Application Data\Mozilla\Firefox\Profiles\lkyaylx6.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11202008_151438

Files moved on Reboot...
File C:\DOCUME~1\mamoud\LOCALS~1\Temp\hsperfdata_mamoud\1024 not found!
C:\DOCUME~1\mamoud\LOCALS~1\Temp\~DF40C4.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
C:\WINDOWS\temp\Perflib_Perfdata_508.dat moved successfully.
File C:\WINDOWS\temp\Perflib_Perfdata_720.dat not found!
C:\Documents and Settings\mamoud\Application Data\Sun\Java\Deployment\cache\6.0\53\f6c6435-71accbe8 moved successfully.
C:\Documents and Settings\mamoud\Application Data\Sun\Java\Deployment\cache\6.0\41\1fe7bee9-70b2280d moved successfully.
C:\Documents and Settings\mamoud\Application Data\Sun\Java\Deployment\cache\6.0\41\30a9f469-76462652 moved successfully.
C:\Documents and Settings\mamoud\Application Data\Sun\Java\Deployment\cache\6.0\37\51a7b1a5-59ad742f moved successfully.
C:\Documents and Settings\mamoud\Local Settings\Application Data\Mozilla\Firefox\Profiles\lkyaylx6.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\mamoud\Local Settings\Application Data\Mozilla\Firefox\Profiles\lkyaylx6.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\mamoud\Local Settings\Application Data\Mozilla\Firefox\Profiles\lkyaylx6.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\mamoud\Local Settings\Application Data\Mozilla\Firefox\Profiles\lkyaylx6.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\mamoud\Local Settings\Application Data\Mozilla\Firefox\Profiles\lkyaylx6.default\XUL.mfl moved successfully.

voilà !


Logfile of random's system information tool 1.04 (written by random/random)
Run by mamoud at 2008-11-20 15:43:22
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 4 GB (18%) free of 20 GB
Total RAM: 447 MB (25% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:43:39, on 20/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Athan\Athan.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Encarta\Microsoft Encarta 2007 - Collection\EDICT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\DAP\DAP.EXE
E:\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\mamoud.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [E07FDXRC_16857812] "C:\Program Files\Microsoft Encarta\Microsoft Encarta 2007 - Collection\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://D:\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://D:\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://D:\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://D:\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{171C3080-3410-48EC-AB99-AAAB7C43FC07}: NameServer = 41.221.20.4 193.251.169.165
O17 - HKLM\System\CS1\Services\Tcpip\..\{171C3080-3410-48EC-AB99-AAAB7C43FC07}: NameServer = 41.221.20.4 193.251.169.165
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

salut , c'est dommage de nous quitter , je te remercie pour ton aide

salut !

dsl j'ai pas trouvé le rapport UsbFix j'ai fais tout ce que tu m'as dit

Re..!

voilà les deux rapports




-------------- UsbFix V2.410 ---------------

* User : mamoud - MAMOUD-7854F0BF
* Outils mis a jours le 20/11/2008 par Chiquitine29 et Chimay8
* Recherche effectuée à 19:10:27 le 20/11/2008
* Windows Xp - Internet Explorer 6.0.2900.2180


--------------- [ Processus actifs ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\DOCUME~1\mamoud\LOCALS~1\Temp\1.tmp\b2e.exe

--------------- [ Informations lecteurs ] ----------------

C: - Lecteur fixe

D: - Lecteur fixe

E: - Lecteur fixe


--------------- [ Lecteur C ] ----------------

C: - Lecteur fixe


+- Listing des fichiers présents :

[06/04/2008 18:48][--a------] C:\AUTOEXEC.BAT
[04/08/2004 03:38][-rahs----] C:\NTDETECT.COM
[04/08/2008 17:16][---hs----] C:\boot.ini
[04/08/2008 17:16][---hs----] C:\rollback.ini
[20/11/2008 14:28][--a------] C:\TB.txt
[20/11/2008 14:28][--a------] C:\UsbFix.txt
[06/04/2008 18:48][--a------] C:\CONFIG.SYS
[06/04/2008 18:48][--a------] C:\IO.SYS
[06/04/2008 18:48][--a------] C:\MSDOS.SYS
[06/04/2008 18:48][--a------] C:\pagefile.sys

--------------- [ Lecteur D ] ----------------

D: - Lecteur fixe


+- Listing des fichiers présents :


--------------- [ Lecteur E ] ----------------

E: - Lecteur fixe


+- Listing des fichiers présents :

[13/04/2008 23:09][--a------] E:\bittorrent_bittorrent_6.0.3_anglais_11039.exe
[13/04/2008 23:09][--a------] E:\ccsetup213.exe
[13/04/2008 23:09][--a------] E:\CIS_Setup_3.5.53896.424_XP_Vista_x32.exe
[13/04/2008 23:09][--a------] E:\FirefoxGoogleToolbarSetup.exe
[13/04/2008 23:09][--a------] E:\GoogleEarthWinProSetup.exe
[13/04/2008 23:09][--a------] E:\hamachi-p2p.exe
[13/04/2008 23:09][--a------] E:\ImportContacts.exe
[13/04/2008 23:09][--a------] E:\Installation_WLMessenger2008.exe
[13/04/2008 23:09][--a------] E:\Installation_WLMessenger2009.exe
[13/04/2008 23:09][--a------] E:\iTunes801Setup.exe
[13/04/2008 23:09][--a------] E:\jxpiinstall.exe
[13/04/2008 23:09][--a------] E:\MsgPlusLive-460(1).exe
[13/04/2008 23:09][--a------] E:\MsgPlusLive-460.exe
[13/04/2008 23:09][--a------] E:\MsgPlusLive-470.exe
[13/04/2008 23:09][--a------] E:\nutrilog_130.exe
[13/04/2008 23:09][--a------] E:\OTMoveIt3.exe
[13/04/2008 23:09][--a------] E:\RSIT.exe
[13/04/2008 23:09][--a------] E:\SDFix.exe
[13/04/2008 23:09][--a------] E:\setup.exe
[13/04/2008 23:09][--a------] E:\smart-encryptor-setup.exe
[13/04/2008 23:09][--a------] E:\TeamViewer_Setup_fr.exe
[13/04/2008 23:09][--a------] E:\ToolBarSD.exe
[13/04/2008 23:09][--a------] E:\UsbFix.exe
[13/04/2008 23:09][--a------] E:\WindowsInstaller-KB893803-v2-x86.exe
[13/04/2008 23:09][--a------] E:\wlsetup-web.exe
[13/04/2008 23:09][--a------] E:\wssetup.exe

--------------- [ Registre / Startup ] ----------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]

Yahoo! Pager="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
E07FDXRC_16857812="C:\Program Files\Microsoft Encarta\Microsoft Encarta 2007 - Collection\EDICT.EXE" -m
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]

avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
Athan=C:\Program Files\Athan\Athan.exe
ISTray="C:\Program Files\Spyware Doctor\pctsTray.exe"
iTunesHelper="D:\Program Files\iTunes\iTunesHelper.exe"
SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"

--------------- [ Registre / Mountpoint2 ] ----------------

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0465ded2-571c-11dd-9974-4d6564696130}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0465ded2-571c-11dd-9974-4d6564696130}\Shell\open\Command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12c28f9c-5692-11dd-9972-4d6564696130}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12c28f9c-5692-11dd-9972-4d6564696130}\Shell\open\Command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{85e05fbc-0404-11dd-9864-0016e6593623}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{85e05fbc-0404-11dd-9864-0016e6593623}\Shell\open\Command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c21ac206-a51c-11dd-a578-4d6564696130}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c21ac206-a51c-11dd-a578-4d6564696130}\Shell\open\Command

--------------- [ Nettoyage des disques ] ----------------

Supprimé ! - [07/08/2008 19:30][--a------] C:\WINDOWS\system32\tmp.reg
Supprimé ! - [25/04/2008 17:55][--a------] E:\setup.exe

--------------- [ Resumé ] ----------------

-> /!\ Le resultat doit etre interprété par un spécialiste /!\

[06/04/2008 18:48][--a------] C:\AUTOEXEC.BAT
[04/08/2004 03:38][-rahs----] C:\NTDETECT.COM
[04/08/2008 17:16][---hs----] C:\boot.ini
[04/08/2008 17:16][---hs----] C:\rollback.ini
[13/04/2008 23:09][--a------] E:\bittorrent_bittorrent_6.0.3_anglais_11039.exe
[13/04/2008 23:09][--a------] E:\ccsetup213.exe
[13/04/2008 23:09][--a------] E:\CIS_Setup_3.5.53896.424_XP_Vista_x32.exe
[13/04/2008 23:09][--a------] E:\FirefoxGoogleToolbarSetup.exe
[13/04/2008 23:09][--a------] E:\GoogleEarthWinProSetup.exe
[13/04/2008 23:09][--a------] E:\hamachi-p2p.exe
[13/04/2008 23:09][--a------] E:\ImportContacts.exe
[13/04/2008 23:09][--a------] E:\Installation_WLMessenger2008.exe
[13/04/2008 23:09][--a------] E:\Installation_WLMessenger2009.exe
[13/04/2008 23:09][--a------] E:\iTunes801Setup.exe
[13/04/2008 23:09][--a------] E:\jxpiinstall.exe
[13/04/2008 23:09][--a------] E:\MsgPlusLive-460(1).exe
[13/04/2008 23:09][--a------] E:\MsgPlusLive-460.exe
[13/04/2008 23:09][--a------] E:\MsgPlusLive-470.exe
[13/04/2008 23:09][--a------] E:\nutrilog_130.exe
[13/04/2008 23:09][--a------] E:\OTMoveIt3.exe
[13/04/2008 23:09][--a------] E:\RSIT.exe
[13/04/2008 23:09][--a------] E:\SDFix.exe
[13/04/2008 23:09][--a------] E:\smart-encryptor-setup.exe
[13/04/2008 23:09][--a------] E:\TeamViewer_Setup_fr.exe
[13/04/2008 23:09][--a------] E:\ToolBarSD.exe
[13/04/2008 23:09][--a------] E:\UsbFix.exe
[13/04/2008 23:09][--a------] E:\WindowsInstaller-KB893803-v2-x86.exe
[13/04/2008 23:09][--a------] E:\wlsetup-web.exe
[13/04/2008 23:09][--a------] E:\wssetup.exe

--------------- ! Fin du rapport ! ----------------




Logfile of random's system information tool 1.04 (written by random/random)
Run by mamoud at 2008-11-20 19:28:40
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 4 GB (18%) free of 20 GB
Total RAM: 447 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:28:52, on 20/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wuauclt.exe
E:\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\mamoud.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [E07FDXRC_16857812] "C:\Program Files\Microsoft Encarta\Microsoft Encarta 2007 - Collection\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://D:\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://D:\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://D:\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://D:\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{171C3080-3410-48EC-AB99-AAAB7C43FC07}: NameServer = 41.221.20.4 193.251.169.165
O17 - HKLM\System\CS1\Services\Tcpip\..\{171C3080-3410-48EC-AB99-AAAB7C43FC07}: NameServer = 41.221.20.4 193.251.169.165
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

bonsoir ,


voilà 6 rapport au lieu de 7 impossible d'analysé le [ E:\nutrilog_130.exe ] ça bloque

C:\rollback.ini


AhnLab-V3 2008.11.21.0 2008.11.20 -
AntiVir 7.9.0.34 2008.11.20 -
Authentium 5.1.0.4 2008.11.20 -
Avast 4.8.1281.0 2008.11.20 -
AVG 8.0.0.199 2008.11.20 -
BitDefender 7.2 2008.11.20 -
CAT-QuickHeal 10.00 2008.11.20 -
ClamAV 0.94.1 2008.11.20 -
DrWeb 4.44.0.09170 2008.11.20 -
eSafe 7.0.17.0 2008.11.19 -
eTrust-Vet 31.6.6219 2008.11.20 -
Ewido 4.0 2008.11.20 -
F-Prot 4.4.4.56 2008.11.20 -
F-Secure 8.0.14332.0 2008.11.20 -
Fortinet 3.117.0.0 2008.11.20 -
GData 19 2008.11.20 -
Ikarus T3.1.1.45.0 2008.11.20 -
K7AntiVirus 7.10.529 2008.11.20 -
Kaspersky 7.0.0.125 2008.11.20 -
McAfee 5439 2008.11.19 -
Microsoft 1.4104 2008.11.20 -
NOD32 3627 2008.11.20 -
Norman 5.80.02 2008.11.20 -
Panda 9.0.0.4 2008.11.20 -
PCTools 4.4.2.0 2008.11.20 -
Prevx1 V2 2008.11.20 -
Rising 21.04.32.00 2008.11.20 -
SecureWeb-Gateway 6.7.6 2008.11.20 -
Sophos 4.35.0 2008.11.20 -
Sunbelt 3.1.1801.2 2008.11.14 -
Symantec 10 2008.11.20 -
TheHacker 6.3.1.1.159 2008.11.19 -
TrendMicro 8.700.0.1004 2008.11.20 -
VBA32 3.12.8.9 2008.11.20 -
ViRobot 2008.11.18.1474 2008.11.18 -
VirusBuster 4.5.11.0 2008.11.20 -
Information additionnelle
File size: 1113 bytes
MD5...: 57f4627c7be9e09f5b231c5074d817c9
SHA1..: 5fd7bf23852c505012e0ea29eeb1c3256b3e82ca
SHA256: 0f105f7c947a8f06f1c17c309be3757c74cd91325c433efab9648771bb87fecc
SHA512: 7fadbc620d6998c84ba91a6d59125b1604115f854f9e7bf16cabef166b6b6359
048049443a9a6b34364289c3f3c0f079286c09c47e1a0d5a2f5c0b7eebcfcc8c
PEiD..: -
TrID..: File type identification
file seems to be plain text/ASCII (0.0%)
PEInfo: -



E:\ImportContacts.exe



AhnLab-V3 2008.11.21.0 2008.11.20 -
AntiVir 7.9.0.34 2008.11.20 -
Authentium 5.1.0.4 2008.11.20 -
Avast 4.8.1281.0 2008.11.20 -
AVG 8.0.0.199 2008.11.20 -
BitDefender 7.2 2008.11.20 -
CAT-QuickHeal 10.00 2008.11.20 -
ClamAV 0.94.1 2008.11.20 -
DrWeb 4.44.0.09170 2008.11.20 -
eSafe 7.0.17.0 2008.11.19 -
eTrust-Vet 31.6.6219 2008.11.20 -
Ewido 4.0 2008.11.20 -
F-Prot 4.4.4.56 2008.11.20 -
F-Secure 8.0.14332.0 2008.11.20 -
Fortinet 3.117.0.0 2008.11.20 -
GData 19 2008.11.20 -
Ikarus T3.1.1.45.0 2008.11.20 -
K7AntiVirus 7.10.529 2008.11.20 -
Kaspersky 7.0.0.125 2008.11.20 -
McAfee 5439 2008.11.19 -
Microsoft 1.4104 2008.11.20 -
NOD32 3627 2008.11.20 -
Norman 5.80.02 2008.11.20 -
Panda 9.0.0.4 2008.11.20 -
PCTools 4.4.2.0 2008.11.20 -
Prevx1 V2 2008.11.20 -
Rising 21.04.32.00 2008.11.20 -
SecureWeb-Gateway 6.7.6 2008.11.20 -
Sophos 4.35.0 2008.11.20 -
Sunbelt 3.1.1801.2 2008.11.14 -
Symantec 10 2008.11.20 -
TheHacker 6.3.1.1.159 2008.11.19 -
TrendMicro 8.700.0.1004 2008.11.20 -
VBA32 3.12.8.9 2008.11.20 -
ViRobot 2008.11.18.1474 2008.11.18 -
VirusBuster 4.5.11.0 2008.11.20 -
Information additionnelle
File size: 293248 bytes
MD5...: 94300cf50a464e47f1fd34db21be428e
SHA1..: bffab604d9fc273f427e6de48d721f342a121b7d
SHA256: 5ecea6ba477608dd85e5078e37581e61106e308d73352822bed9e5c17b9110f9
SHA512: 7f33549ca372944b3614261bfaf8aa1be21b91725e129aa1a78d01ffbe96a245
9438ca2386ae5f8279b7ea2c45423e7a29ad7be3974cab1565aca519b3cf4a9b
PEiD..: -
TrID..: File type identification
Win64 Executable Generic (59.6%)
Win32 Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)
Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable (1.3%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x101314f
timedatestamp.....: 0x46b288cf (Fri Aug 03 01:45:51 2007)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x16e56 0x17000 6.37 3b97cdc0947247120f8921b096d297b1
.data 0x18000 0x1f20 0xc00 4.36 a17160b9a143fcbef5a524a5bf3b6148
.rsrc 0x1a000 0x2e000 0x2d400 7.26 286fbe556bc88d7592ff67ee22e1b110

( 10 imports )
> ADVAPI32.dll: RegSetValueExW, RegCloseKey, RegOpenKeyExW, RegCreateKeyExW, RegQueryValueExW, RegDeleteValueW
> KERNEL32.dll: WideCharToMultiByte, GetLastError, lstrlenW, lstrlenA, GetEnvironmentVariableW, LocalAlloc, InterlockedDecrement, FreeLibrary, GetProcAddress, LoadLibraryW, InterlockedExchange, Sleep, ReadFile, GetFileSize, CreateFileW, WriteFile, GetSystemTime, FileTimeToSystemTime, CreateDirectoryW, RemoveDirectoryW, FindClose, FindNextFileW, DeleteFileW, SetCurrentDirectoryW, GetCurrentDirectoryW, FindFirstFileW, WaitForSingleObject, CreateEventW, GetModuleFileNameW, SuspendThread, ResumeThread, LocalFree, CreateThread, TerminateThread, CloseHandle, ExitThread, MultiByteToWideChar, FindResourceExW, FindResourceW, lstrcpynW, LoadResource, SizeofResource, GetACP, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, GetStartupInfoA, InterlockedCompareExchange, GetProcessHeap, LockResource, HeapReAlloc, HeapFree, HeapAlloc, HeapDestroy, DeleteCriticalSection, InitializeCriticalSection, LeaveCriticalSection, EnterCriticalSection, RaiseException, GetVersionExA, GetThreadLocale, GetLocaleInfoA, HeapSize
> GDI32.dll: SelectObject, StretchBlt, CreatePen, MoveToEx, LineTo, SetBkMode, SetTextColor, DeleteDC, CreateSolidBrush, DeleteObject, CreateFontIndirectW, CreateCompatibleDC
> USER32.dll: UnregisterClassA, GetClassInfoW, PostMessageW, LoadIconW, SendMessageW, SetWindowTextW, LoadStringW, GetDlgItem, SetFocus, KillTimer, EndDialog, EndPaint, FillRect, MessageBoxW, InvalidateRect, OffsetRect, DrawTextW, InflateRect, DrawFocusRect, RegisterClassW, SetForegroundWindow, LoadBitmapW, CharUpperA, CharLowerW, GetParent, FindWindowW, DialogBoxParamW, GetWindowTextLengthW, ShowWindow, SetTimer, EnableWindow, GetWindowTextW, BeginPaint, GetWindowRect
> MSVCR80.dll: _strdup, __3@YAXPAX@Z, wcsstr, memcpy_s, _CxxThrowException, memmove_s, free, calloc, malloc, __2@YAPAXI@Z, __CxxFrameHandler3, memset, ___V@YAXPAX@Z, _wsplitpath, strstr, _vsnprintf_s, mbstowcs, memcpy, iswspace, _vsnwprintf_s, fprintf, fclose, iswdigit, iswalpha, _wtoi, _wcsdup, _wfopen, wcschr, _amsg_exit, __getmainargs, _cexit, _exit, _XcptFilter, _ismbblead, exit, _acmdln, _initterm, _initterm_e, _configthreadlocale, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, _encode_pointer, __set_app_type, _except_handler4_common, _terminate@@YAXXZ, _unlock, __dllonexit, _lock, _onexit, _decode_pointer, _invoke_watson, _controlfp_s, __type_info_dtor_internal_method@type_info@@QAEXXZ, _crt_debugger_hook, _fcloseall
> ole32.dll: CoInitialize, CoTaskMemFree, CoCreateInstance, OleRun, CoInitializeEx, CoUninitialize
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -
> COMCTL32.dll: -
> WININET.dll: InternetOpenW, HttpSendRequestExA, InternetWriteFile, HttpEndRequestW, InternetQueryDataAvailable, InternetReadFile, InternetConnectW, HttpOpenRequestW, HttpAddRequestHeadersA, InternetCloseHandle
> MAPI32.dll: -, -, -, -, -, -, -

( 0 exports )



E:\jxpiinstall.exe



AhnLab-V3 - - -
AntiVir - - -
Authentium - - -
Avast - - -
AVG - - -
BitDefender - - -
CAT-QuickHeal - - -
ClamAV - - -
DrWeb - - -
eSafe - - -
eTrust-Vet - - -
Ewido - - -
F-Prot - - -
F-Secure - - Suspicious:W32/ConHook!Gemini
Fortinet - - -
GData - - -
Ikarus - - -
K7AntiVirus - - -
Kaspersky - - -
McAfee - - -
Microsoft - - -
NOD32 - - -
Norman - - -
Panda - - -
PCTools - - -
Prevx1 - - -
Rising - - -
SecureWeb-Gateway - - -
Sophos - - -
Sunbelt - - -
Symantec - - -
TheHacker - - -
TrendMicro - - -
VBA32 - - suspected of Win32.Trojan.Downloader (http://...)
ViRobot - - -
VirusBuster - - -
Information additionnelle
MD5: c9fe8f52f2967064a360215d24d1fc3d
SHA1: 1c142afc962f8f48bb0e073a5cb48bf5d8c85449
SHA256: 3895a431c8b4361d3d89d35ec134f50fa9ce88aa534031bffb2b2e4199934998

SHA512: 81ca68e977eaf664aa78bf4da0e353818e91488e2f02ac828c85bc054a9132b68cfd3ebdd4ccbb992e02b4e0a548fd13298fe825062dea3109e7b95892f7267a


E:\wlsetup-web.exe


AhnLab-V3 2008.11.21.0 2008.11.20 -
AntiVir 7.9.0.34 2008.11.20 -
Authentium 5.1.0.4 2008.11.20 -
Avast 4.8.1281.0 2008.11.20 -
AVG 8.0.0.199 2008.11.20 -
BitDefender 7.2 2008.11.20 -
CAT-QuickHeal 10.00 2008.11.20 -
ClamAV 0.94.1 2008.11.20 -
DrWeb 4.44.0.09170 2008.11.20 -
eSafe 7.0.17.0 2008.11.19 -
eTrust-Vet 31.6.6219 2008.11.20 -
Ewido 4.0 2008.11.20 -
F-Prot 4.4.4.56 2008.11.20 -
F-Secure 8.0.14332.0 2008.11.20 -
Fortinet 3.117.0.0 2008.11.20 -
GData 19 2008.11.20 -
Ikarus T3.1.1.45.0 2008.11.20 -
K7AntiVirus 7.10.529 2008.11.20 -
Kaspersky 7.0.0.125 2008.11.20 -
McAfee 5440 2008.11.20 -
Microsoft 1.4104 2008.11.20 -
NOD32 3627 2008.11.20 -
Norman 5.80.02 2008.11.20 -
Panda 9.0.0.4 2008.11.20 -
PCTools 4.4.2.0 2008.11.20 -
Prevx1 V2 2008.11.20 -
Rising 21.04.32.00 2008.11.20 -
SecureWeb-Gateway 6.7.6 2008.11.20 -
Sophos 4.35.0 2008.11.20 -
Sunbelt 3.1.1801.2 2008.11.14 -
Symantec 10 2008.11.20 -
TheHacker 6.3.1.1.159 2008.11.19 -
TrendMicro 8.700.0.1004 2008.11.20 -
VBA32 3.12.8.9 2008.11.20 -
ViRobot 2008.11.18.1474 2008.11.18 -
VirusBuster 4.5.11.0 2008.11.20 -
Information additionnelle
File size: 1031680 bytes
MD5...: 776dfa5e0688f60c05f3ee25b1ff92c7
SHA1..: d1b2bc3b312033935e3fad0202e84b2eba4b4537
SHA256: 1b48558eb2eef7d1fe3d773de5ed49254baf6c270dd9f887c0c817bb337b85b0
SHA512: 2b2ed8790617ecd3ef254169fcbc8280aad17e510113b3cdfd7d1339a66a3244
e8deefd2c3a7c2c6ff381fc7e92435637aabf342995124c3929b7ea6c9315df5
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x423f48
timedatestamp.....: 0x48c0bc21 (Fri Sep 05 04:57:05 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x98c52 0x98e00 6.39 ced0560b82f30713be9de8a5c2315dc9
.data 0x9a000 0x6498 0x3200 4.35 88af1395b42950ad9a6d5847c90a4792
.rsrc 0xa1000 0x531c0 0x53200 7.25 159b7e4144bd8555db8aaf952c21c3cc
.reloc 0xf5000 0xa350 0xa400 5.67 75197d3b87547c5ed2a0ea596bc685d8

( 26 imports )
> ADVAPI32.dll: RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegOpenKeyExW, RegSetValueExW, RegQueryInfoKeyW, RegEnumKeyExW, IsValidSid, CopySid, GetLengthSid, SetSecurityInfo, ConvertStringSecurityDescriptorToSecurityDescriptorW, CreateWellKnownSid, CryptReleaseContext, CryptAcquireContextW, CryptDestroyHash, CryptGetHashParam, CryptHashData, CryptCreateHash, UnregisterTraceGuids, TraceEvent, GetTraceLoggerHandle, RegisterTraceGuidsW, CryptGenRandom, DuplicateToken, DuplicateTokenEx, OpenProcessToken, RevertToSelf, OpenThreadToken, ImpersonateLoggedOnUser, ConvertSidToStringSidW, GetTokenInformation, GetUserNameW, SetNamedSecurityInfoW, GetSecurityDescriptorOwner, GetSecurityDescriptorDacl, RegQueryValueExW
> KERNEL32.dll: OpenFileMappingW, GetFileAttributesExW, FreeLibraryAndExitThread, DuplicateHandle, InitializeCriticalSectionAndSpinCount, GetSystemTime, SystemTimeToFileTime, GetComputerNameW, CopyFileW, CompareFileTime, GetVersionExW, GlobalMemoryStatusEx, GetSystemDefaultUILanguage, GetSystemDefaultLCID, GetComputerNameExW, MoveFileExW, GetEnvironmentVariableW, CopyFileExW, OpenProcess, GetTempPathA, GetFullPathNameA, DeleteFileA, GetFileInformationByHandle, FileTimeToLocalFileTime, FileTimeToDosDateTime, GetFileAttributesA, GetLocalTime, ReadFile, GetFullPathNameW, CreateProcessW, GetExitCodeProcess, ResetEvent, GlobalFree, CreateWaitableTimerW, WaitForMultipleObjects, GetExitCodeThread, GetTempPathW, SetWaitableTimer, TerminateThread, MulDiv, GetUserDefaultLangID, GetFileSize, CreateFileMappingW, MapViewOfFile, UnmapViewOfFile, QueueUserAPC, SetFilePointerEx, GetFileSizeEx, CreateThread, InterlockedCompareExchange, LocalAlloc, SetFileAttributesW, GetLongPathNameW, GetFileAttributesW, CreateDirectoryW, GetPrivateProfileStringW, WritePrivateProfileStringW, FileTimeToSystemTime, SetThreadPriority, GetThreadPriority, CreateFileW, DeviceIoControl, DeleteFileW, GetTempFileNameW, FindNextFileW, FindFirstFileW, FindClose, EnumResourceNamesW, GetSystemInfo, VerifyVersionInfoW, ExpandEnvironmentStringsW, FindResourceExW, CompareStringA, FlushFileBuffers, CreateFileA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, GetConsoleMode, GetConsoleCP, SetFilePointer, GetStringTypeW, GetStringTypeA, LoadLibraryA, HeapSize, Sleep, VirtualAlloc, LCMapStringW, WideCharToMultiByte, LCMapStringA, IsDebuggerPresent, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetOEMCP, GetCPInfo, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, VirtualFree, HeapCreate, HeapDestroy, GetCurrentThread, GetCurrentThreadId, SetLastError, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, GetStartupInfoA, GetFileType, SetHandleCount, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, UnhandledExceptionFilter, GetModuleFileNameA, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleA, GetProcAddress, HeapReAlloc, GetStartupInfoW, GetShortPathNameW, LockResource, CreateEventW, GetDiskFreeSpaceExW, SetEvent, GetProcessHeap, HeapAlloc, HeapFree, GetVersionExA, GetThreadLocale, GetLocaleInfoA, GetACP, QueueUserWorkItem, CompareStringW, GetModuleHandleW, FindResourceW, LoadResource, SizeofResource, MultiByteToWideChar, HeapSetInformation, GetSystemDirectoryW, LoadLibraryW, GetCommandLineW, LoadLibraryExW, lstrcmpiW, LeaveCriticalSection, EnterCriticalSection, lstrlenW, GetModuleFileNameW, CreateMutexW, OpenMutexW, WaitForSingleObject, FormatMessageW, GetLastError, LocalFree, InterlockedDecrement, InterlockedIncrement, DeleteCriticalSection, InitializeCriticalSection, RaiseException, InterlockedExchange, FreeLibrary, ExitThread, ReleaseMutex, CloseHandle, RemoveDirectoryW
> GDI32.dll: CreateCompatibleDC, ExcludeClipRect, BitBlt, DeleteDC, Rectangle, SetBkMode, SetViewportOrgEx, GetStockObject, SetTextColor, SetBkColor, CreatePen, CreateSolidBrush, SaveDC, RestoreDC, CreateFontIndirectW, GetObjectW, DeleteObject, GetTextMetricsW, SelectObject, CreateRectRgn, GetClipRgn, IntersectClipRect
> USER32.dll: GetSysColor, MessageBoxIndirectW, RedrawWindow, MessageBeep, SetWindowLongW, FillRect, InflateRect, GetWindowLongW, AdjustWindowRectEx, GetSystemMetrics, DrawTextW, LoadIconW, EndDialog, MsgWaitForMultipleObjectsEx, TranslateMessage, DispatchMessageW, PeekMessageW, UnregisterClassA, LoadStringW, CharNextW, ExitWindowsEx, SetCursor, LoadCursorW, DefWindowProcW, CopyRect, SendMessageW, DestroyWindow, IsWindow, GetWindowRect, SetRect, KillTimer, SetTimer, PostQuitMessage, SetForegroundWindow, GetForegroundWindow, IsWindowVisible, EndPaint, BeginPaint, CreateWindowExW, ReleaseDC, GetDC, SetWindowTextW, SetWindowPos, FindWindowExW, GetDesktopWindow, GetClassNameW, GetWindowTextW, GetWindowTextLengthW, DrawIconEx, GetClassLongW, RegisterWindowMessageW, DefDlgProcW, EnableWindow, SetLayeredWindowAttributes, GetLayeredWindowAttributes, DestroyAcceleratorTable, IsDialogMessageW, TranslateAcceleratorW, GetMessageW, CreateAcceleratorTableW, SetFocus, MapWindowPoints, CreateDialogIndirectParamW, DialogBoxIndirectParamW, TrackMouseEvent, GetDCEx, SetWindowRgn, PostThreadMessageW, GetWindowThreadProcessId, GetSystemMenu, EnableMenuItem, GetShellWindow, EnumWindows, MsgWaitForMultipleObjects, RegisterClassExW, PtInRect, GetDlgItem, IsDlgButtonChecked, GetMessagePos, CheckDlgButton, ShowWindow, GetParent, GetClientRect, PostMessageW, IsWindowEnabled, UpdateWindow, GetSysColorBrush
> SensApi.dll: IsNetworkAlive
> urlmon.dll: CreateAsyncBindCtx, CoInternetGetSession, CreateURLMoniker
> msi.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> COMCTL32.dll: -, -, -, -
> WINTRUST.dll: WinVerifyTrustEx, WTHelperProvDataFromStateData, WTHelperGetProvSignerFromChain
> USERENV.dll: UnloadUserProfile
> SETUPAPI.dll: SetupIterateCabinetW
> Secur32.dll: GetUserNameExW
> CRYPT32.dll: CryptBinaryToStringW, CryptStringToBinaryW, CertVerifyCertificateChainPolicy
> UxTheme.dll: SetWindowTheme
> PSAPI.DLL: EnumProcessModules, GetModuleBaseNameW, GetModuleFileNameExW, EnumProcesses
> SHLWAPI.dll: PathFindFileNameW, -, StrStrIW, StrFormatByteSizeW, PathIsDirectoryW, PathIsRelativeW, UrlCreateFromPathW, SHCreateStreamOnFileW, PathFindExtensionW, StrRChrW, PathFileExistsW, PathCreateFromUrlW, PathAppendW, SHCreateStreamOnFileEx, UrlCanonicalizeW, PathFindFileNameA, SHCreateStreamOnFileA, PathRemoveFileSpecW, PathRemoveBackslashW, StrCmpNW
> WININET.dll: InternetCreateUrlW, InternetCombineUrlW, InternetCrackUrlW
> gdiplus.dll: GdiplusShutdown, GdiplusStartup, GdipDeleteGraphics, GdipGetImageWidth, GdipGetImageHeight, GdipCreateFromHDC, GdipDrawImageRectI, GdipDrawImageRectRectI, GdipFree, GdipAlloc, GdipCreateFontFamilyFromName, GdipDeleteFontFamily, GdipDeleteFont, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateFromHWND, GdipCreateFont, GdipGetLogFontW, GdipCloneImage, GdipDrawImageRectRect, GdipDrawImageI, GdipDrawImagePointRectI
> WINHTTP.dll: WinHttpSetStatusCallback, WinHttpQueryDataAvailable, WinHttpReceiveResponse, WinHttpConnect, WinHttpOpen, WinHttpWriteData, WinHttpAddRequestHeaders, WinHttpTimeFromSystemTime, WinHttpSetCredentials, WinHttpGetProxyForUrl, WinHttpDetectAutoProxyConfigUrl, WinHttpGetDefaultProxyConfiguration, WinHttpGetIEProxyConfigForCurrentUser, WinHttpCrackUrl, WinHttpQueryHeaders, WinHttpOpenRequest, WinHttpSetOption, WinHttpSendRequest, WinHttpReadData, WinHttpCloseHandle
> Cabinet.dll: -, -, -, -
> ntdll.dll: VerSetConditionMask, RtlUnwind
> VERSION.dll: GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW
> WSOCK32.dll: -, -, -, -, -
> SHELL32.dll: SHFileOperationW, SHGetFolderPathAndSubDirW, SHGetFolderPathW, CommandLineToArgvW, SHGetSpecialFolderPathW
> ole32.dll: CoCreateGuid, CoAllowSetForegroundWindow, StringFromGUID2, CoTaskMemAlloc, CoUninitialize, CreateStreamOnHGlobal, CoTaskMemRealloc, CoCreateInstance, CoTaskMemFree, CoInitializeEx, CoCreateFreeThreadedMarshaler, CoSetProxyBlanket
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -

( 0 exports )


E:\wssetup.exe

AhnLab-V3 2008.11.21.0 2008.11.20 -
AntiVir 7.9.0.34 2008.11.20 -
Authentium 5.1.0.4 2008.11.20 -
Avast 4.8.1281.0 2008.11.20 -
AVG 8.0.0.199 2008.11.20 -
BitDefender 7.2 2008.11.20 -
CAT-QuickHeal 10.00 2008.11.20 -
ClamAV 0.94.1 2008.11.20 -
DrWeb 4.44.0.09170 2008.11.20 -
eSafe 7.0.17.0 2008.11.19 -
eTrust-Vet 31.6.6219 2008.11.20 -
Ewido 4.0 2008.11.20 -
F-Prot 4.4.4.56 2008.11.20 -
F-Secure 8.0.14332.0 2008.11.20 -
Fortinet 3.117.0.0 2008.11.20 -
GData 19 2008.11.20 -
Ikarus T3.1.1.45.0 2008.11.20 -
K7AntiVirus 7.10.529 2008.11.20 -
Kaspersky 7.0.0.125 2008.11.20 -
McAfee 5440 2008.11.20 -
Microsoft 1.4104 2008.11.20 -
NOD32 3627 2008.11.20 -
Norman 5.80.02 2008.11.20 -
Panda 9.0.0.4 2008.11.20 -
PCTools 4.4.2.0 2008.11.20 -
Prevx1 V2 2008.11.20 -
Rising 21.04.32.00 2008.11.20 -
SecureWeb-Gateway 6.7.6 2008.11.20 -
Sophos 4.35.0 2008.11.20 -
Sunbelt 3.1.1801.2 2008.11.14 -
Symantec 10 2008.11.20 -
TheHacker 6.3.1.1.159 2008.11.19 -
TrendMicro 8.700.0.1004 2008.11.20 -
VBA32 3.12.8.9 2008.11.20 -
ViRobot 2008.11.18.1474 2008.11.18 -
VirusBuster 4.5.11.0 2008.11.20 -
Information additionnelle
File size: 832023 bytes
MD5...: 4c0a11eaf5f15bd4ae8a741eb93ed790
SHA1..: 899640690834f4b2ad422e1a73f0f57b8d44aa73
SHA256: 343e503010858a07f114f4774ec13b6a2dc49e91201fe5f74705c59a04683c89
SHA512: e18ba9a269a68481ef040691470f6512f9657eb1e8fdb9f92139ca537ded4dbc
2bb3f3441313c6ef130100dd5f187eec69425e616cd75a0c1146f39d913eddf6
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (38.4%)
Win32 Dynamic Link Library (generic) (34.1%)
Win16/32 Executable Delphi generic (9.3%)
Generic Win/DOS Executable (9.0%)
DOS Executable Generic (9.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x409a54
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x916c 0x9200 6.56 f9c9dd3f4dceede0add0e7309253e897
DATA 0xb000 0x24c 0x400 2.73 4a56e30ca4646e6369d96abeacb0e6f0
BSS 0xc000 0xe48 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0xd000 0x950 0xa00 4.43 bb5485bf968b970e5ea81292af2acdba
.tls 0xe000 0x8 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rdata 0xf000 0x18 0x200 0.20 9ba824905bf9c7922b6fc87a38b74366
.reloc 0x10000 0x8b4 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x11000 0x2a00 0x2a00 4.42 62b889218fe4c0924111a475e63511fe

( 8 imports )
> kernel32.dll: DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
> user32.dll: MessageBoxA
> oleaut32.dll: VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
> advapi32.dll: RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
> kernel32.dll: WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
> user32.dll: TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
> comctl32.dll: InitCommonControls
> advapi32.dll: AdjustTokenPrivileges

( 0 exports )


E:\smart-encryptor-setup.exe

AhnLab-V3 2008.11.21.0 2008.11.20 -
AntiVir 7.9.0.34 2008.11.20 -
Authentium 5.1.0.4 2008.11.20 -
Avast 4.8.1281.0 2008.11.20 -
AVG 8.0.0.199 2008.11.20 -
BitDefender 7.2 2008.11.20 -
CAT-QuickHeal 10.00 2008.11.20 -
ClamAV 0.94.1 2008.11.20 -
DrWeb 4.44.0.09170 2008.11.20 -
eSafe 7.0.17.0 2008.11.19 -
eTrust-Vet 31.6.6219 2008.11.20 -
Ewido 4.0 2008.11.20 -
F-Prot 4.4.4.56 2008.11.20 -
F-Secure 8.0.14332.0 2008.11.20 -
Fortinet 3.117.0.0 2008.11.20 -
GData 19 2008.11.20 -
Ikarus T3.1.1.45.0 2008.11.20 -
K7AntiVirus 7.10.529 2008.11.20 -
Kaspersky 7.0.0.125 2008.11.20 -
McAfee 5440 2008.11.20 -
Microsoft 1.4104 2008.11.20 -
NOD32 3627 2008.11.20 -
Norman 5.80.02 2008.11.20 -
Panda 9.0.0.4 2008.11.20 -
PCTools 4.4.2.0 2008.11.20 -
Prevx1 V2 2008.11.20 -
Rising 21.04.32.00 2008.11.20 -
SecureWeb-Gateway 6.7.6 2008.11.20 -
Sophos 4.35.0 2008.11.20 -
Sunbelt 3.1.1801.2 2008.11.14 -
Symantec 10 2008.11.20 -
TheHacker 6.3.1.1.159 2008.11.19 -
TrendMicro 8.700.0.1004 2008.11.20 -
VBA32 3.12.8.9 2008.11.20 suspected of Win32.BrokenEmbeddedSignature (paranoid heuristics)
ViRobot 2008.11.18.1474 2008.11.18 -
VirusBuster 4.5.11.0 2008.11.20 -
Information additionnelle
File size: 647888 bytes
MD5...: a2cc1e7aa3d9592704f69200ee932c39
SHA1..: 32dac929178446c1406d90208d2b181efb8b5b43
SHA256: 71b5f05660d62bd6e3126f5da59f348cc638ffcdb5728c9dc68a4fa2b5e7c8b6
SHA512: a6f93107e7bc4dc2dd80ee643dd0b145f7054924da4fbd37ff27264cef11a914
359ad1b88d803b26ac265a0d749f34cd750bfad0e9b2d0e07c87c57db8d29bad
PEiD..: -
TrID..: File type identification
Inno Setup installer (96.7%)
Generic Win/DOS Executable (1.6%)
DOS Executable Generic (1.6%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x409264
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x899c 0x8a00 6.58 115b61e1c5465331d9474f97dba7cecc
DATA 0xa000 0x248 0x400 2.73 bdcce76ec0f282cbbb668e7d373997fd
BSS 0xb000 0xe50 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0xc000 0x8c2 0xa00 4.24 1620d6ec7f3163d926b520226c9399bd
.tls 0xd000 0x8 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rdata 0xe000 0x18 0x200 0.20 d293bf8d4ebe9826d58e1d27c25fe4b6
.reloc 0xf000 0x844 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x10000 0x2800 0x2800 2.90 fcb65c313e0a63236b0ba5dd98d3f012

( 8 imports )
> kernel32.dll: DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
> user32.dll: MessageBoxA
> oleaut32.dll: VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
> advapi32.dll: RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
> kernel32.dll: WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SetLastError, SetFilePointer, SetErrorMode, RemoveDirectoryA, ReadFile, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, InterlockedExchange, FormatMessageA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
> user32.dll: TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA, CharNextA
> comctl32.dll: InitCommonControls
> advapi32.dll: AdjustTokenPrivileges

( 0 exports )

quel 2 dernier il ya 6/7 des rapports il en manque 1 le
E:\nutrilog_130.exe

Bonjour ske..!


========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
E:\jxpiinstall.exe moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\mamoud\LOCALS~1\Temp\~DFC610.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_538.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_708.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11212008_084558

Files moved on Reboot...
C:\DOCUME~1\mamoud\LOCALS~1\Temp\~DFC610.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!
C:\WINDOWS\temp\Perflib_Perfdata_538.dat moved successfully.
File C:\WINDOWS\temp\Perflib_Perfdata_708.dat not found!







--------------- [ ] ----------------

* User : mamoud - MAMOUD-7854F0BF
* Outils mis a jours le 20/11/2008 par Chiquitine29 et Chimay8
* Vaccination effectuée à 8:52:56 le 21/11/2008
* Windows Xp - Internet Explorer 6.0.2900.2180


--------------- [ Informations lecteurs ] ----------------

C: - Lecteur fixe

D: - Lecteur fixe

E: - Lecteur fixe

G: - Lecteur amovible


--------------- [ Vaccination ] ----------------

C:\autorun.inf -> Dossier autorun.inf crée par UsbFix !
D:\autorun.inf -> Dossier autorun.inf crée par UsbFix !
E:\autorun.inf -> Dossier autorun.inf crée par UsbFix !
G:\autorun.inf -> Dossier autorun.inf crée par UsbFix !

--------------- [ Fin du rapport ] ----------------





Rapport GenProc 2.223 [1] le 21/11/2008 à 8:59:23,00 - Windows XP


# Etape 1 / Télécharge :

- CCleaner https://www.ccleaner.com/ccleaner/download (FileHippo)
Ce logiciel va permettre de supprimer tous les fichiers temporaires.
Lance-le et clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures".
Par la suite, laisse-le avec ses réglages par défaut. Ferme le programme.

- SmitfraudFix http://siri.urz.free.fr/Fix/SmitfraudFix.exe (S!Ri)
Double-clique sur le fichier "smitfraudfix.exe" et choisis l'option 1 ; il va lister tous les éléments nuisibles dans un rapport : poste le maintenant.

- MSNFix http://sosvirus.changelog.fr/MSNFix.zip (!aur3n7) et décompresse-le sur le Bureau.


Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/ ; pour retrouver le rapport, clique sur le raccourci "GenProc" sur ton bureau. Choisis ta session courante *** mamoud ***


# Etape 2/

Double-clique sur le fichier "SmitfraudFix.exe" et choisis l'option 2, réponds oui à tout et laisse-le procéder. Sauvegarde le rapport sur ton bureau.

# Etape 3/

Lance le fichier MSNFix.bat qui se trouve dans le dossier MSNfix, sur le bureau.
- Exécute l'option R.
- Si l'infection est détectée, exécute l'option N.
- Sauvegarde ce rapport sur ton bureau.


# Etape 4/

Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 5/

Redémarre normalement et poste, dans la même réponse :

- Le rapport SmitfraudFix que tu as sauvegardé sur ton bureau ;
- Le contenu du rapport MSNfix situé sur le Bureau ;

Re...



SmitFraudFix v2.376

Rapport fait à 9:46:51,37, 21/11/2008
Executé à partir de C:\Documents and Settings\mamoud\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Athan\Athan.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Encarta\Microsoft Encarta 2007 - Collection\EDICT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\DAP\DAP.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\

C:\autorun.inf PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\mamoud


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\mamoud\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\mamoud\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\mamoud\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\Google\googletoolbar1.dll PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau



»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Program Files\Google\GoogleToolbar1.dll unregistered successfully.
File move failed. C:\Program Files\Google\GoogleToolbar1.dll scheduled to be moved on reboot.
========== COMMANDS ==========
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11212008_101506

Files moved on Reboot...
File C:\Program Files\Google\GoogleToolbar1.dll not found!




read file error: C:\DOCUME~1\mamoud\LOCALS~1\Temp\winlogon.exe, Le fichier spécifié est introuvable.
read file error: C:\DOCUME~1\mamoud\LOCALS~1\Temp\services.exe, Le fichier spécifié est introuvable.
read file error: C:\WINDOWS\system32\cftmon.exe, Le fichier spécifié est introuvable.




Logfile of random's system information tool 1.04 (written by random/random)
Run by mamoud at 2008-11-21 11:02:12
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 3 GB (17%) free of 20 GB
Total RAM: 447 MB (13% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:02:25, on 21/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Athan\Athan.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Encarta\Microsoft Encarta 2007 - Collection\EDICT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
E:\RSIT.exe
C:\Program Files\trend micro\mamoud.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [E07FDXRC_16857812] "C:\Program Files\Microsoft Encarta\Microsoft Encarta 2007 - Collection\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://D:\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://D:\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://D:\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://D:\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

pardon ! le voilà ,




MSNFix 1.749

C:\Documents and Settings\mamoud\Bureau\MSNFix
Fix exécuté le 21/11/2008 - 10:51:21,56 By mamoud
mode sans échec

************************ Recherche les fichiers présents

Aucun Fichier trouvé

************************ Recherche les dossiers présents

Aucun dossier trouvé




************************ Hostsclean

Cleanhosts v 0.1.0.7 By Laurent

-- Backup : C:\WINDOWS\system32\drivers\etc\hosts-20081121105305
-- original size 0.67 Kb / 19 lines
-- Start cleaning Hosts file ....



-- final size 0.67 Kb / 19 lines
-- entry Found : 0 / Entry check : 310

End .............................. 29.72 Secondes

Re...

mon PC Un peu moin lent que d'habitude

salut


voilà le rapport , mais le problème qu'il a pas suprimer ils existent toujour dans le DDet leur racourcis dans le bureau , j'ai redemarrer le PC tjrs la même chose ,



[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\TB.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\SDFIX: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\mamoud\Bureau\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\mamoud\Bureau\UsbFix.lnk: trouvé !
C:\Documents and Settings\mamoud\Bureau\MsnFix: trouvé !
C:\Documents and Settings\mamoud\Bureau\SmitFraudfix: trouvé !
C:\Documents and Settings\mamoud\Bureau\GenProc: trouvé !
C:\Documents and Settings\mamoud\Menu Démarrer\Programmes\UsbFix: trouvé !
C:\Documents and Settings\mamoud\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
C:\Documents and Settings\mamoud\Recent\MSNFix.lnk: trouvé !
C:\Program Files\UsbFix: trouvé !
C:\Program Files\Trend Micro\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\hijackthis.log: trouvé !
C:\Program Files\UsbFix\UsbFix.exe: trouvé !
C:\WINDOWS\msnfix.txt: trouvé !
C:\WINDOWS\system32\*.msnfix: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\mamoud\Bureau\SmitFraudFix.exe: supprimé !
C:\Documents and Settings\mamoud\Recent\MSNFix.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis.exe: supprimé !
C:\TB.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\mamoud\Bureau\UsbFix.lnk: supprimé !
C:\Documents and Settings\mamoud\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
C:\Program Files\Trend Micro\hijackthis.log: supprimé !
C:\Program Files\UsbFix\UsbFix.exe: supprimé !
C:\WINDOWS\msnfix.txt: supprimé !
C:\WINDOWS\system32\*.msnfix: ERREUR DE SUPPRESSION !!
C:\SDFIX: supprimé !
C:\Toolbar SD: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\mamoud\Bureau\MsnFix: supprimé !
C:\Documents and Settings\mamoud\Bureau\SmitFraudfix: supprimé !
C:\Documents and Settings\mamoud\Bureau\GenProc: supprimé !
C:\Documents and Settings\mamoud\Menu Démarrer\Programmes\UsbFix: supprimé !
C:\Program Files\UsbFix: supprimé !

je parles des outils qu'on a utilisés pendant la desinfection ,


alors je continue ???

Re...

Enfin voilà le résultat du scan en ligne , il a falu du temps , En ce qui concerne les outils dont je t'ai parlés sont dans le rapport precedent , soit disant suprimés , mais ils sont toujours existant ,


-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Friday, November 21, 2008 8:08:30 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 21/11/2008
Enregistrements dans la base antivirus Kaspersky : 1256033
-------------------------------------------------------------------------------

Paramètres d'analyse:
Analyser avec la base antivirus suivante: standard
Analyser les archives: vrai
Analyser les bases de messagerie: vrai

Cible de l'analyse - Poste de travail:
A:\
C:\
D:\
E:\
F:\

Statistiques de l'analyse:
Total d'objets analysés: 82564
Nombre de virus trouvés: 1
Nombre d'objets infectés: 1 / 0
Nombre d'objets suspects: 0
Durée de l'analyse: 01:26:12

Nom de l'objet infecté / Nom du virus / Dernière action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat L'objet est verrouillé ignoré
C:\Documents and Settings\brahim\Local Settings\Temporary Internet Files\Content.IE5\A10JIDA5\ads[1].js Infecté : Trojan-Downloader.JS.IstBar.cx ignoré
C:\Documents and Settings\LocalService\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\mamoud\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\mamoud\Local Settings\Application Data\Microsoft\Messenger\MsnMsgr.txt L'objet est verrouillé ignoré
C:\Documents and Settings\mamoud\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\mamoud\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\mamoud\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\mamoud\Local Settings\Historique\History.IE5\MSHist012008112120081122\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\mamoud\Local Settings\temp\~DFA2D4.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\mamoud\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\mamoud\ntuser.dat L'objet est verrouillé ignoré
C:\Documents and Settings\mamoud\NTUSER.DAT.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\mamoud\Tracing\WindowsLiveMessenger-uccapi-0.uccapilog L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log\selfdef.log L'objet est verrouillé ignoré
C:\Program Files\DAP\History\brahim\_lasthist.dat L'objet est verrouillé ignoré
C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
C:\System Volume Information\_restore{A0E36761-79EE-47A6-A057-1C17071B86CD}\RP1\change.log L'objet est verrouillé ignoré
C:\WINDOWS\CSC\00000001 L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\DEFAULT L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\ODiag.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\OSession.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SOFTWARE L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SYSTEM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré
C:\WINDOWS\Temp\Perflib_Perfdata_550.dat L'objet est verrouillé ignoré
C:\WINDOWS\Temp\Perflib_Perfdata_708.dat L'objet est verrouillé ignoré
C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré
C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré
C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré
E:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

Analyse terminée.

voilà..!


========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Documents and Settings\brahim\Local Settings\Temporary Internet Files\Content.IE5\A10JIDA5\ads[1].js moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\mamoud\LOCALS~1\Temp\~DFA2D4.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_550.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_708.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11212008_203050

Files moved on Reboot...
C:\DOCUME~1\mamoud\LOCALS~1\Temp\~DFA2D4.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!
C:\WINDOWS\temp\Perflib_Perfdata_550.dat moved successfully.
File move failed. C:\WINDOWS\temp\Perflib_Perfdata_708.dat scheduled to be moved on reboot.