Virus win32.Bagle ?? • page 2

[Mike_bungle]

Voici les résultats des différents scans:

1 - Malwarebytes' Anti-Malware
Malwarebytes' Anti-Malware 1.26
Version de la base de données: 1112
Windows 5.1.2600 Service Pack 2

04/09/2008 19:20:08
mbam-log-2008-09-04 (19-20-08).txt

Type de recherche: Examen complet (C:|D:|E:|F:|N:|)
Eléments examinés: 175026
Temps écoulé: 1 hour(s), 10 minute(s), 50 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
D:System Volume Information\_restore{F8CC8EEF-C64D-4D69-BCC0-D15E9FD80919}RP6A0000639.exe (Trojan.Downloader) -> Quarantined and deleted successfully.


2 - DiagHelp

Option 1:
DiagHelp version v1.4 - http://www.malekal.com
excute le 04/09/2008 à 19:22:41,17


Liste des derniers fichies modifies/crees dans windirsystem32 et prefetch
C:WINDOWSprefetchXP-ANTISPY.EXE-1F0298B8.pf -->22/04/2008 19:24:56
C:WINDOWSprefetchUNPNP.EXE-03BA34DA.pf -->22/04/2008 19:24:41
C:WINDOWSprefetchNOTEPAD.EXE-08F3A979.pf -->22/04/2008 19:24:04
C:WINDOWSprefetchIZARC.EXE-3361A68A.pf -->22/04/2008 19:18:14
C:WINDOWSprefetchSETUP.EXE-393E66AE.pf -->22/04/2008 19:16:02
C:WINDOWSprefetchRUNDLL32.EXE-5C5FFFE7.pf -->22/04/2008 19:15:34
C:WINDOWSprefetchIS-L740U.TMP-3AC1BB17.pf -->22/04/2008 19:13:07
C:WINDOWSprefetchIZARC34.1.6.EXE-1CA9FD3A.pf -->22/04/2008 19:13:02
C:WINDOWSprefetchWSCNTFY.EXE-314E7AE5.pf -->22/04/2008 18:53:46
C:WINDOWSprefetchRUNDLL32.EXE-5769A7F5.pf -->22/04/2008 18:52:50

C:WINDOWSSystem32driversfidbox2.dat -->04/09/2008 19:21:36
C:WINDOWSSystem32driversfidbox.dat -->04/09/2008 19:18:41
C:WINDOWSSystem32driversfidbox2.idx -->04/09/2008 00:31:12
C:WINDOWSSystem32driversfidbox.idx -->04/09/2008 00:31:12
C:WINDOWSSystem32driversmbamswissarmy.sys -->02/09/2008 00:16:46
C:WINDOWSSystem32driversmbam.sys -->02/09/2008 00:16:40
C:WINDOWSSystem32driversgmer.sys -->31/08/2008 18:28:29

C:WINDOWSSystem32jupdate-1.6.0_07-b06.log -->03/09/2008 22:42:48
C:WINDOWSSystem32PerfStringBackup.INI -->02/09/2008 00:48:13
C:WINDOWSSystem32perfh00C.dat -->02/09/2008 00:48:13
C:WINDOWSSystem32perfh009.dat -->02/09/2008 00:48:13
C:WINDOWSSystem32perfc00C.dat -->02/09/2008 00:48:13
C:WINDOWSSystem32perfc009.dat -->02/09/2008 00:48:13
C:WINDOWSSystem32AS-E5N70T30NDG6.dll -->28/08/2008 18:48:20
C:WINDOWSSystem32wpa.dbl -->28/08/2008 17:13:53
C:WINDOWSSystem32CmdLineExt.dll -->19/08/2008 19:41:38
C:WINDOWSSystem32javaws.exe -->10/06/2008 02:32:34
C:WINDOWSSystem32javacpl.cpl -->10/06/2008 02:32:34
C:WINDOWSSystem32javaw.exe -->10/06/2008 01:21:04
C:WINDOWSSystem32java.exe -->10/06/2008 01:21:01
C:WINDOWSSystem32spupdwxp.log -->25/05/2008 20:04:40
C:WINDOWSSystem32lsdelete.exe -->16/05/2008 11:58:04
C:WINDOWSSystem32FNTCACHE.DAT -->13/05/2008 18:53:05
C:WINDOWSSystem32jupdate-1.6.0_05-b13.log -->23/04/2008 19:24:23
C:WINDOWSSystem32jupdate-1.5.0_06-b05.log -->22/04/2008 23:01:12
C:WINDOWSSystem32
vapps.xml -->22/04/2008 22:40:17
C:WINDOWSSystem32h323log.txt -->21/04/2008 22:50:58
C:WINDOWSSystem32wmpscheme.xml -->21/04/2008 22:31:29
C:WINDOWSSystem32$winnt$.inf -->21/04/2008 22:10:23
C:WINDOWSSystem32CONFIG.NT -->21/04/2008 22:08:47
C:WINDOWSSystem32
scompat.tlb -->21/04/2008 22:08:45
C:WINDOWSSystem32amcompat.tlb -->21/04/2008 22:08:45

C:WINDOWSsetupapi.log -->04/09/2008 18:30:27
C:WINDOWSWindowsUpdate.log -->04/09/2008 17:33:56
C:WINDOWS.log -->04/09/2008 17:28:39
C:WINDOWSwiaservc.log -->04/09/2008 17:27:51
C:WINDOWSwiadebug.log -->04/09/2008 17:27:51
C:WINDOWSootstat.dat -->04/09/2008 17:27:18
C:WINDOWSsystem.ini -->03/09/2008 20:00:14
C:WINDOWSgmer.ini -->03/09/2008 19:48:42
C:WINDOWS
tbtlog.txt -->02/09/2008 20:48:30
C:WINDOWSNeroDigital.ini -->02/09/2008 16:33:21
C:WINDOWSSti_Trace.log -->30/08/2008 21:19:25
C:WINDOWSgmer_uninstall.cmd -->30/08/2008 16:46:08
C:WINDOWSgmer.dll -->30/08/2008 16:46:08
C:WINDOWSWMSysPr9.prx -->26/05/2008 18:22:21
C:WINDOWSALCFDRTM.VER -->14/05/2008 21:41:46

winlogon.exe
Verified: Signed
svchost.exe
Verified: Signed
ws2_32.dll
Verified: Signed
user32.dll
Verified: Signed
tcpip.sys
Verified: Signed
ndis.sys
Verified: Signed
null.sys
Verified: Signed


ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 2044
Command line: C:WINDOWSExplorer.EXE

Base Size Version Path
*** Loaded C:WINDOWSsystem32kernel32.dll differs from file image:
*** File timestamp: Fri Aug 20 01:09:14 2004
*** Loaded image timestamp: Fri Aug 20 01:09:15 2004
*** Loaded C:WINDOWSsystem32SHDOCVW.dll differs from file image:
*** File timestamp: Fri Aug 20 01:09:02 2004
*** Loaded image timestamp: Fri Aug 20 01:11:16 2004
0x76f80000 0x7f000 2001.12.4414.0258 C:WINDOWSsystem32CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:WINDOWSsystem32COMRes.dll
0x67500000 0x11000 1.00.0006.0411 C:Program FilesKasperskyscrchpg.dll
0x76010000 0x65000 6.02.3104.0000 C:WINDOWSsystem32MSVCP60.dll
0x4c5a0000 0x18000 9.00.0000.3250 C:PROGRA~1WINDOW~3wmpband.dll
0x76ac0000 0x11000 3.05.2284.0000 C:WINDOWSsystem32ATL.DLL
0x745e0000 0x2c6000 3.01.4000.2435 C:WINDOWSsystem32msi.dll
0x10000000 0x13000 7.05.0001.0036 C:Program FilesLogiciels sécurité internetAVG Anti-Spyware 7.5shellexecutehook.dll
*** Loaded C:WINDOWSsystem32RASAPI32.DLL differs from file image:
*** File timestamp: Fri Aug 20 01:08:49 2004
*** Loaded image timestamp: Fri Aug 20 01:13:31 2004
0x61300000 0xa000 6.00.0001.0411 C:Program FilesKasperskyadialhk.dll
0x01560000 0x12000 1.01.0000.0000 C:Program FilesLogiciels sécurité internetMalwarebytes' Anti-Malwarembamext.dll
0x01b30000 0x2c000 C:Program FilesWinRAR arext.dll
0x67800000 0xa000 6.00.0001.0411 C:Program FilesKasperskyShellEx.dll
0x024e0000 0x89000 C:PROGRA~1IZArcIZArcCM.dll
0x01b90000 0x2a000 7.05.0001.0036 C:Program FilesLogiciels sécurité internetAVG Anti-Spyware 7.5context.dll
0x01cc0000 0x1c000 1.01.0225.0000 C:WINDOWSsystem32CmdLineExt.dll
0x027e0000 0x3d000 3.525.1117.0000 C:WINDOWSsystem32ODBC32.dll
0x02920000 0x18000 3.525.1117.0000 C:WINDOWSsystem32odbcint.dll
0x00b80000 0x1c000 7.00.0000.0000 C:Program FilesAdobeAcrobat 7.0ActiveXPDFShell.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 976
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x81000 ??C:WINDOWSsystem32winlogon.exe
*** Loaded C:WINDOWSsystem32kernel32.dll differs from file image:
*** File timestamp: Fri Aug 20 01:09:14 2004
*** Loaded image timestamp: Fri Aug 20 01:09:15 2004
0x74730000 0x3d000 3.525.1117.0000 C:WINDOWSsystem32ODBC32.dll
0x20000000 0x18000 3.525.1117.0000 C:WINDOWSsystem32odbcint.dll
0x10000000 0x1a000 C:WINDOWSsystem32AS-E5N70T30NDG6.dll
0x76010000 0x65000 6.02.3104.0000 C:WINDOWSsystem32MSVCP60.dll
0x01e90000 0x17000 6.00.0001.0411 C:WINDOWSsystem32klogon.dll
0x76f80000 0x7f000 2001.12.4414.0258 C:WINDOWSsystem32CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:WINDOWSsystem32COMRes.dll
*** Loaded C:WINDOWSsystem32RASAPI32.DLL differs from file image:
*** File timestamp: Fri Aug 20 01:08:49 2004
*** Loaded image timestamp: Fri Aug 20 01:13:31 2004
0x61300000 0xa000 6.00.0001.0411 C:Program FilesKasperskyadialhk.dll


Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 4CFC-F7E8

Répertoire de C:WINDOWSsystem32

19/08/2004 16:09 6 144 csrss.exe
1 fichier(s) 6 144 octets
0 Rép(s) 14 497 554 432 octets libres

Contenu de Downloaded Program Files
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 4CFC-F7E8

Répertoire de C:WINDOWSDownloaded Program Files

03/09/2008 20:40 <REP> .
03/09/2008 20:40 <REP> ..
27/02/2008 15:59 290 816 auc_lib.dll
27/02/2008 15:59 541 ca.pub
27/02/2008 15:59 495 616 daas_s.dll
21/04/2008 22:08 65 desktop.ini
15/06/2006 18:33 1 132 192 EPUWALcontrol.dll
24/03/2008 19:33 1 527 056 FP_AX_CAB_INSTALLER.exe
27/02/2008 16:00 262 144 fscax.dll
27/02/2008 15:59 614 fscax.inf
27/02/2008 15:59 588 392 gatelauncher.exe
16/05/2007 08:22 399 gp.inf
16/05/2007 08:22 166 512 gp.ocx
18/10/2007 10:04 341 296 HPDEXAXO.dll
18/10/2007 10:00 217 HPDEXAXO.inf
30/12/2007 12:02 378 ImageUploader5.inf
30/12/2007 12:02 3 008 016 ImageUploader5.ocx
20/01/2000 15:25 1 162 Microsoft XML Parser for Java.osd
20/06/2006 15:44 379 704 MsnPUpld.dll
19/06/2006 14:40 393 MsnPUpld.inf
28/11/2003 00:13 869 nsvplayx_vp3_mp3.inf
20/06/2006 15:44 117 560 PURen-us.dll
09/01/2007 08:30 110 592 PURfr-fr.dll
28/03/2008 21:33 144 QTPlugin.inf
24/03/2008 19:18 247 swflash.inf
28/05/2008 16:54 267 568 sysreqlab3.dll
28/05/2008 15:06 667 SysReqLab3.osd
25 fichier(s) 8 693 160 octets

Total des fichiers listés :
25 fichier(s) 8 693 160 octets
2 Rép(s) 14 497 550 336 octets libres

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..


Liste des fichiers en exception sur le pare-feu XP SP2

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Logiciels P2P\uTorrent\uTorrent.exe"="C:\Program Files\Logiciels P2P\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"



exports des policies
REGEDIT4

[system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"DisableRegistryTools"=dword:00000000
"HideLegacyLogonScripts"=dword:00000000
"HideLogoffScripts"=dword:00000000
"RunLogonScriptSync"=dword:00000001
"RunStartupScriptSync"=dword:00000000
"HideStartupScripts"=dword:00000000



Export des clefs sensibles..
Rechercher adresses sensibles dans le fichier HOSTS...
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-04 19:25:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:f9,8c,e2,de,aa,96,ca,e3,cd,22,4c,4a,2c,a9,d7,93,59,6f,26,d2,18,..
"p0"="C:Program FilesDAEMON Tools Lite"

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA40000001]
"a0"=hex:20,01,00,00,f4,20,29,aa,b4,6b,ec,9a,5c,2f,79,19,08,4c,ef,18,9a,..
"khjeh"=hex:dd,9a,bd,3d,f7,e9,9e,e2,5f,fb,9f,d5,57,17,de,3a,ab,dd,d7,aa,e9,..

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40]
"khjeh"=hex:fc,9c,22,8d,77,8b,0d,9b,d0,dd,b5,15,0a,ed,56,1d,38,95,17,17,e4,..
[HKEY_LOCAL_MACHINESYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:f9,8c,e2,de,aa,96,ca,e3,cd,22,4c,4a,2c,a9,d7,93,59,6f,26,d2,18,..
"p0"="C:Program FilesDAEMON Tools Lite"

[HKEY_LOCAL_MACHINESYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001]
"a0"=hex:20,01,00,00,f4,20,29,aa,b4,6b,ec,9a,5c,2f,79,19,08,4c,ef,18,9a,..
"khjeh"=hex:dd,9a,bd,3d,f7,e9,9e,e2,5f,fb,9f,d5,57,17,de,3a,ab,dd,d7,aa,e9,..

[HKEY_LOCAL_MACHINESYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40]
"khjeh"=hex:fc,9c,22,8d,77,8b,0d,9b,d0,dd,b5,15,0a,ed,56,1d,38,95,17,17,e4,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden services: 0
hidden files: 0


KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
616 - avp.exe
704 - guard.exe
752 - avp.exe
800 - nvsvc32.exe
948 - csrss.exe
976 - winlogon.exe
1020 - services.exe
1032 - lsass.exe
1440 - svchost.exe
1820 - aawservice.exe
2044 - explorer.exe
2992 - iexplore.exe
3128 - cmd.exe

Total number of processes = 14
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D7000 - WINDOWSsystem32
toskrnl.exe
806EC000 - WINDOWSsystem32hal.dll
F7D2F000 - WINDOWSsystem32KDCOM.DLL
F7C3F000 - WINDOWSsystem32BOOTVID.dll
F770E000 - spzl.sys
F7D31000 - WINDOWSSystem32DriversWMILIB.SYS
F76F6000 - WINDOWSSystem32DriversSCSIPORT.SYS
F76C7000 - ACPI.sys
F76B6000 - pci.sys
F782F000 - ohci1394.sys
F783F000 - WINDOWSSystem32DRIVERS1394BUS.SYS
F784F000 - isapnp.sys
F7DF7000 - pciide.sys
F7AAF000 - WINDOWSSystem32DRIVERSPCIIDEX.SYS
F785F000 - MountMgr.sys
F7697000 - ftdisk.sys
F7D33000 - dmload.sys
F7671000 - dmio.sys
F7AB7000 - PartMgr.sys
F786F000 - VolSnap.sys
F7659000 - atapi.sys
F7643000 - SI3112r.sys
F7ABF000 - iteraid.sys
F787F000 - disk.sys
F788F000 - WINDOWSSystem32DRIVERSCLASSPNP.SYS
F7624000 - fltmgr.sys
F7612000 - sr.sys
F7C43000 - SiWinAcc.sys
F75FB000 - KSecDD.sys
F756E000 - Ntfs.sys
F7541000 - NDIS.sys
F7AC7000 - nv_agp.sys
F7526000 - Mup.sys
F7509000 - kl1.sys
F7ACF000 - WINDOWSsystem32driversTDI.SYS
F78CF000 - SystemRootSystem32DRIVERSamdk7.sys
F7B1F000 - SystemRootSystem32DRIVERSusbohci.sys
F7455000 - SystemRootSystem32DRIVERSUSBPORT.SYS
F7B27000 - SystemRootSystem32DRIVERSusbehci.sys
F7441000 - SystemRootSystem32DRIVERSNVENET.sys
F7B37000 - SystemRootsystem32drivers
vax.sys
F73D2000 - SystemRootsystem32driversALCXWDM.SYS
F73AE000 - SystemRootsystem32driversportcls.sys
F78DF000 - SystemRootsystem32driversdrmk.sys
F738B000 - SystemRootsystem32driversks.sys
F7328000 - SystemRootsystem32driversALCXSENS.SYS
F78EF000 - SystemRootSystem32DRIVERSmf.sys
F730A000 - SystemRootSystem32DRIVERSe1000325.sys
F78FF000 - SystemRootSystem32DRIVERScdrom.sys
F790F000 - SystemRootSystem32DRIVERS edbook.sys
F791F000 - SystemRootSystem32DRIVERSimapi.sys
F792F000 - SystemRootSystem32DRIVERS
ic1394.sys
F6BF2000 - SystemRootsystem32DRIVERS
v4_mini.sys
F6BDE000 - SystemRootsystem32DRIVERSVIDEOPRT.SYS
F6BA7000 - SystemRootSystem32Driversavplv48l.SYS
F7BD7000 - SystemRootSystem32DRIVERSfdc.sys
F6B96000 - SystemRootSystem32DRIVERSserial.sys
F7D13000 - SystemRootSystem32DRIVERSserenum.sys
F6B82000 - SystemRootSystem32DRIVERSparport.sys
F793F000 - SystemRootSystem32DRIVERSi8042prt.sys
F7BEF000 - SystemRootSystem32DRIVERSkbdclass.sys
F7E77000 - SystemRootsystem32driversmsmpu401.sys
F7D1B000 - SystemRootSystem32DRIVERSgameenum.sys
F7E7A000 - SystemRootSystem32DRIVERSaudstub.sys
F794F000 - SystemRootSystem32DRIVERS asl2tp.sys
F7D23000 - SystemRootSystem32DRIVERS
distapi.sys
F6B6B000 - SystemRootSystem32DRIVERS
diswan.sys
F795F000 - SystemRootSystem32DRIVERS aspppoe.sys
F796F000 - SystemRootSystem32DRIVERS aspptp.sys
F6B5A000 - SystemRootSystem32DRIVERSpsched.sys
F797F000 - SystemRootSystem32DRIVERSmsgpc.sys
F7C0F000 - SystemRootSystem32DRIVERSptilink.sys
F7C1F000 - SystemRootSystem32DRIVERS aspti.sys
F6A89000 - SystemRootSystem32DRIVERS dpdr.sys
F798F000 - SystemRootSystem32DRIVERS ermdd.sys
F7C2F000 - SystemRootSystem32DRIVERSmouclass.sys
F7D41000 - SystemRootSystem32DRIVERSswenum.sys
F6A55000 - SystemRootSystem32DRIVERSupdate.sys
F74D1000 - SystemRootSystem32DRIVERSmssmbios.sys
F799F000 - SystemRootSystem32DRIVERSusbhub.sys
F7D45000 - SystemRootSystem32DRIVERSUSBD.SYS
F79AF000 - SystemRootSystem32DriversNDProxy.SYS
F6976000 - SystemRootsystem32driversadm8830.sys
F7484000 - SystemRootSystem32DRIVERSadmjoy.sys
F7B2F000 - SystemRootSystem32DRIVERSflpydisk.sys
F7D51000 - SystemRootSystem32DriversFs_Rec.SYS
F7EE4000 - SystemRootSystem32DriversNull.SYS
F7D55000 - SystemRootSystem32DriversBeep.SYS
F7EE6000 - SystemRootSystem32DRIVERSAvgAsCln.sys
F7B4F000 - SystemRootSystem32driversvga.sys
F7D59000 - SystemRootSystem32Driversmnmdd.SYS
F7D5D000 - SystemRootSystem32DRIVERSRDPCDD.sys
F7B5F000 - SystemRootSystem32DriversMsfs.SYS
F7B6F000 - SystemRootSystem32DriversNpfs.SYS
F7D0F000 - SystemRootSystem32DRIVERS asacd.sys
F47BB000 - SystemRootSystem32DRIVERSipsec.sys
F4763000 - SystemRootSystem32DRIVERS cpip.sys
F4713000 - SystemRootSystem32DRIVERS
etbt.sys
F46F2000 - SystemRootSystem32DRIVERSipnat.sys
F7A0F000 - SystemRootSystem32DRIVERSwanarp.sys
F46D0000 - SystemRootSystem32driversafd.sys
F7A1F000 - SystemRootSystem32DRIVERSarp1394.sys
F7A2F000 - SystemRootSystem32DRIVERS
etbios.sys
F6A3D000 - SystemRootsystem32DRIVERShidusb.sys
F7A3F000 - SystemRootsystem32DRIVERSHIDCLASS.SYS
F7B8F000 - SystemRootsystem32DRIVERSHIDPARSE.SYS
F46A4000 - SystemRootSystem32DRIVERS dbss.sys
F4635000 - SystemRootSystem32DRIVERSmrxsmb.sys
F45FA000 - ??C:WINDOWSsystem32driversklif.sys
F7A6F000 - SystemRootSystem32DriversFips.SYS
F7F18000 - ??C:Program FilesLogiciels sécurité internetAVG Anti-Spyware 7.5guard.sys
F7BBF000 - SystemRootSystem32DRIVERSUSBSTOR.SYS
F6912000 - SystemRootSystem32DRIVERSmouhid.sys
F7A9F000 - SystemRootSystem32DriversCdfs.SYS
F451A000 - SystemRootSystem32Driversdump_atapi.sys
F7D7D000 - SystemRootSystem32Driversdump_WMILIB.SYS
BF800000 - SystemRootSystem32win32k.sys
F7BE7000 - SystemRootSystem32watchdog.sys
F7CDF000 - SystemRootSystem32driversDxapi.sys
BF9C1000 - SystemRootSystem32driversdxg.sys
F7E70000 - SystemRootSystem32driversdxgthk.sys
BF9D3000 - SystemRootSystem32
v4_disp.dll
BAEF4000 - SystemRootSystem32DRIVERS
disuio.sys
BAC7B000 - SystemRootsystem32driverswdmaud.sys
F6AFA000 - SystemRootsystem32driverssysaudio.sys
BA9A1000 - SystemRootSystem32DRIVERSmrxdav.sys
F7DDB000 - SystemRootSystem32DriversParVdm.SYS
BA76E000 - SystemRootSystem32DRIVERSsrv.sys
B9AB5000 - SystemRootsystem32driverskmixer.sys
F7E0E000 - SystemRootSystem32DRIVERSKProcCheck.sys

Total number of drivers = 130

Liste des programmes installes

2350
2350_Help
2350Trb
Ad-Aware
Adobe Acrobat 5.0
Adobe Flash Player ActiveX
Adobe Reader 7.1.0 - Français
AiO_Scan
AiOSoftware
Archiveur WinRAR
Audacity 1.2.6
AVG Anti-Spyware 7.5
Beijing 2008
BSPlayer
BufferChm
CCleaner (remove only)
Destinations
Director
eMule
Enable S3 for USB Device
Fax
Frets On Fire
getPlus(R)_ocx
GIMP 2.4.6
Google Earth
Guitar Hero III
Guitar Pro 5.0
HijackThis 1.99.1
HP Extended Capabilities 4.7
HP Image Zone 4.7
HP Image Zone Express
HP Product Assistant
HP Product Detection
HP PSC & OfficeJet 4.7
HP Software Update
HPSystemDiagnostics
Intel(R) PRO Network Adapters and Drivers
Intel(R) PROSet
IZArc 3.4.1.6
J2SE Runtime Environment 5.0 Update 6
Java(TM) 6 Update 5
Java(TM) 6 Update 7
K-Lite Codec Pack 3.9.0 Full
Kaspersky Internet Security 6.0
Kaspersky Internet Security 6.0
Last.fm 1.5.1.30182
LSPFix
Malwarebytes' Anti-Malware
MarketResearch
Microsoft Office XP Professional
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Media Video 9 VCM
mIRC
Nero 6 Ultra Edition
NVIDIA Drivers
NVIDIA GART Driver
NVIDIA nForce Drivers
PKR
ProductContext
QFolder
Readme
Realtek AC'97 Audio
Scan
ScannerCopy
SoulSeek Client 156c
Spyware Doctor 6.0
System Requirements Lab
TrayApp
TVUPlayer 2.3.6.1
Unload
VideoLAN VLC media player 0.8.6d
WebFldrs XP
WebReg
Winamax Poker (remove only)
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows XP Service Pack 2
Xbox 360 Controller for Windows



Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 4CFC-F7E8

Répertoire de C:Program Files

31/08/2008 19:14 <REP> .
31/08/2008 19:14 <REP> ..
22/04/2008 22:15 <REP> Adobe
16/08/2008 12:19 <REP> Audacity
31/08/2008 19:14 93 827 885 AVP.6.411_08.31_19.14_61c.SRV.dmp
22/04/2008 01:02 <REP> AvRack
27/05/2008 22:16 <REP> BSplayer
21/04/2008 22:06 <REP> ComPlus Applications
15/08/2008 20:16 <REP> DAEMON Tools Lite
03/09/2008 19:59 <REP> Fichiers communs
22/04/2008 22:14 <REP> Free
21/04/2008 23:51 <REP> Gigabyte
12/06/2008 20:18 <REP> GIMP-2.0
23/07/2008 19:41 <REP> Google
11/05/2008 01:06 <REP> Guitar Pro 5
03/05/2008 17:01 <REP> Hewlett-Packard
03/05/2008 17:01 <REP> HP
21/04/2008 22:37 <REP> Intel
21/04/2008 23:59 <REP> Internet Explorer
22/04/2008 19:13 <REP> IZArc
03/09/2008 22:42 <REP> Java
31/08/2008 19:13 <REP> Kaspersky
14/06/2008 01:59 <REP> Last.fm
26/04/2008 19:06 <REP> Logiciels compactés
15/07/2008 18:38 <REP> Logiciels de Video
23/05/2008 23:49 <REP> Logiciels P2P
04/09/2008 18:06 <REP> Logiciels sécurité internet
30/08/2008 16:25 <REP> LSPFix
22/04/2008 00:02 <REP> Messenger
21/04/2008 22:08 <REP> microsoft frontpage
22/04/2008 01:08 <REP> Microsoft Office
25/05/2008 22:57 <REP> Microsoft Silverlight
21/04/2008 23:59 <REP> Movie Maker
25/08/2008 18:27 <REP> MP3Gain
21/04/2008 22:05 <REP> MSN
21/04/2008 22:05 <REP> MSN Gaming Zone
13/05/2008 21:01 <REP> MSN Messenger
22/04/2008 21:48 <REP> Nero 6
21/04/2008 23:57 <REP> NetMeeting
22/04/2008 22:38 <REP> NVIDIA
21/04/2008 23:57 <REP> Outlook Express
08/05/2008 00:47 <REP> QuickTime
22/04/2008 01:02 <REP> Realtek Sound Manager
26/05/2004 14:17 724 992 redeye.exe
21/04/2008 22:05 <REP> Services en ligne
17/06/2008 19:13 <REP> SystemRequirementsLab
11/05/2008 00:44 <REP> Tabs
08/05/2008 17:40 <REP> TVUPlayer
22/04/2008 22:32 <REP> VLC
06/05/2008 19:34 <REP> Windows Media Player
21/04/2008 23:57 <REP> Windows NT
25/08/2008 18:37 <REP> WinRAR
21/04/2008 22:08 <REP> xerox
2 fichier(s) 94 552 877 octets
51 Rép(s) 14 492 651 520 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 4CFC-F7E8

Répertoire de C:Program Filesfichiers communs

03/09/2008 19:59 <REP> .
03/09/2008 19:59 <REP> ..
22/07/2008 22:03 <REP> Adobe
22/04/2008 21:48 <REP> Ahead
22/04/2008 01:09 <REP> Designer
19/08/2008 19:43 <REP> DirectX
03/05/2008 17:00 <REP> Hewlett-Packard
03/05/2008 17:01 <REP> HP
22/04/2008 22:39 <REP> InstallShield
22/04/2008 23:00 <REP> Java
22/04/2008 01:09 <REP> Microsoft Shared
21/04/2008 22:06 <REP> MSSoap
15/05/2008 23:07 <REP> NSV
21/04/2008 22:46 <REP> ODBC
21/04/2008 22:06 <REP> Services
21/04/2008 22:46 <REP> SpeechEngines
22/04/2008 01:08 <REP> System
28/08/2008 19:58 <REP> Wise Installation Wizard
0 fichier(s) 0 octets
18 Rép(s) 14 492 647 424 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 4CFC-F7E8

Répertoire de C:Program Filesfichiers communsMicrosoft SharedWeb Folders

22/04/2008 01:09 <REP> .
22/04/2008 01:09 <REP> ..
22/04/2008 01:09 <REP> 1033
22/04/2008 01:09 <REP> 1036
15/02/2001 05:45 1 318 912 MSONSEXT.DLL
13/02/2001 08:23 58 784 MSOSV.DLL
03/06/1999 14:09 122 937 MSOWS409.DLL
07/03/2001 09:00 127 033 MSOWS40c.DLL
06/08/2000 09:04 401 462 MSVCP60.DLL
22/01/2001 03:25 69 632 PKMAXCTL.DLL
22/01/2001 03:25 872 448 PKMCDO.DLL
22/01/2001 03:25 159 744 PKMCORE.DLL
07/02/2001 09:59 106 496 PKMFORMS.DLL
12/02/2001 04:03 684 032 PKMRES.DLL
22/01/2001 03:25 28 672 PKMSSTLB.DLL
22/01/2001 03:25 40 960 PKMTEMPL.DLL
22/01/2001 03:25 24 576 PKMTRACE.DLL
22/01/2001 03:25 86 016 PKMWS.DLL
22/01/2001 03:25 237 568 PROMDEMO.DLL
22/01/2001 03:25 184 320 SECMGR.DLL
22/01/2001 03:25 323 584 VAIDDMGR.DLL
22/01/2001 03:25 32 768 VAIMEM.DLL
18 fichier(s) 4 879 944 octets
4 Rép(s) 14 492 647 424 octets libres




c:Documents and SettingsADRIENApplication DataAdobeAcrobat7.0UpdaterAdbeRdr709_fr_FR.exe
c:Documents and SettingsADRIENApplication DataAdobeAcrobat7.0UpdaterAdbeRdr710_fr_FR.exe
c:Documents and SettingsADRIENApplication DataMicrosoftInstaller{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}ARPPRODUCTICON.exe
c:Documents and SettingsADRIENBureauantivir.exe
c:Documents and SettingsADRIENBureauComboFi.exe
c:Documents and SettingsADRIENBureauLieba.EXE
c:Documents and SettingsADRIENBureauslsk.exe
c:Documents and SettingsADRIENBureauWindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
c:Documents and SettingsADRIENBureauSDFixcatchme.exe
c:Documents and SettingsADRIENBureauSDFixappsCghtme.exe
c:Documents and SettingsADRIENBureauSDFixappscliptext.exe
c:Documents and SettingsADRIENBureauSDFixappsCsweg.exe
c:Documents and SettingsADRIENBureauSDFixappsdownload.exe
c:Documents and SettingsADRIENBureauSDFixappsERUNT.EXE
c:Documents and SettingsADRIENBureauSDFixappsFixPath.exe
c:Documents and SettingsADRIENBureauSDFixappsgrep.exe
c:Documents and SettingsADRIENBureauSDFixappsisadmin.exe
c:Documents and SettingsADRIENBureauSDFixappsLS.exe
c:Documents and SettingsADRIENBureauSDFixappsMD5File.exe
c:Documents and SettingsADRIENBureauSDFixappsmoveex.exe
c:Documents and SettingsADRIENBureauSDFixappsProcess.exe
c:Documents and SettingsADRIENBureauSDFixappsprocs.exe
c:Documents and SettingsADRIENBureauSDFixappspsservice.exe
c:Documents and SettingsADRIENBureauSDFixappsRestartIt!.exe
c:Documents and SettingsADRIENBureauSDFixappssc.exe
c:Documents and SettingsADRIENBureauSDFixappssed.exe
c:Documents and SettingsADRIENBureauSDFixappsSF.exe
c:Documents and SettingsADRIENBureauSDFixappsshutdown.exe
c:Documents and SettingsADRIENBureauSDFixappsswsc.exe
c:Documents and SettingsADRIENBureauSDFixappsunzip.exe
c:Documents and SettingsADRIENBureauSDFixappsvfind.exe
c:Documents and SettingsADRIENBureauSDFixappsWINMSG.EXE
c:Documents and SettingsADRIENBureauSDFixappszip.exe
c:Documents and SettingsADRIENBureauSDFixappsReplace egedit.exe
c:Documents and SettingsADRIENLocal SettingsApplication DataLast.fmClientUpdaterd.exe
c:Documents and SettingsADRIENLocal Settings empOnlineScannerAnti-Virusfsgk32.exe
c:Documents and SettingsADRIENLocal Settings empOnlineScannerAnti-Virusfssm32.exe
c:Documents and SettingsADRIENLocal Settings empOnlineScannerupdatesfsav_betafsgk32.exe
c:Documents and SettingsADRIENLocal Settings empOnlineScannerupdatesfsav_betafssm32.exe
c:Documents and SettingsAll UsersApplication DataLast.fmClientUninstWMPunins000.exe
c:Documents and SettingsAll UsersApplication DataLavasoftAd-AwareUpdateaaw2008_upd.exe
c:Documents and SettingsADRIENApplication DataMicrosoftIdentityCRLProductionppcrlconfig.dll
c:Documents and SettingsAll UsersApplication DataGrisoftAVG Anti-Spyware 7.5Downloadshelp.dll
c:Documents and SettingsAll UsersApplication DataKaspersky LabAVP6Basesavcmhk4.dll
c:Documents and SettingsAll UsersApplication DataMicrosoftIdentityCRLproductionppcrlconfig.dll

****** Fin du rapport DiagHelp
Veuillez svp envoyer le fichier C:upload_moi_AS-E5N70T30NDG6.tar.gz a l'adresse http://upload.malekal.com


Option 2:
FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
http://www.foundstone.com

Pid Process Port Proto Path
2272 -> 1025 TCP
1276 -> 135 TCP
4 System -> 139 TCP
0 System -> 3012 TCP
0 System -> 3016 TCP
0 System -> 3017 TCP
0 System -> 3018 TCP
4 System -> 445 TCP
752 avp -> 1110 TCP C:Program FilesKasperskyavp.exe

2272 -> 1055 UDP
1276 -> 445 UDP
4 System -> 1074 UDP
0 System -> 137 UDP
0 System -> 138 UDP
0 System -> 1812 UDP
0 System -> 2937 UDP
0 System -> 4500 UDP
4 System -> 500 UDP
752 avp -> 1028 UDP C:Program FilesKasperskyavp.exe



PsList 1.26 - Process Information Lister
Copyright (C) 1999-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

Process information for AS-E5N70T30NDG6:

Name Pid Pri Thd Hnd VM WS Priv
Idle 0 0 1 0 0 16 0
System 4 8 65 523 1904 252 0
smss 848 11 3 22 3828 400 168
csrss 948 13 12 433 25056 4092 1648
winlogon 976 13 22 15051 58732 9216 7876
services 1020 9 15 274 36992 4352 2000
spoolsv 280 8 10 114 42576 4968 3020
guard 704 8 9 82 70852 20208 43016
avp 752 8 0 657 245624 8804 64608
nvsvc32 800 8 3 121 35188 4288 2472
svchost 900 8 6 123 36320 4300 2352
svchost 1180 8 17 191 60896 4912 2948
svchost 1276 8 10 261 37912 7108 1740
svchost 1440 8 64 1334 131092 25396 12732
wscntfy 2148 8 1 27 25796 1940 468
svchost 1500 8 6 87 29896 3268 1264
svchost 1720 8 6 116 33596 3924 1380
aawservice 1820 8 7 66 147764 2940 17816
alg 2272 8 6 104 32936 3524 1096
lsass 1032 9 18 348 40864 920 3652
explorer 2044 8 16 525 85828 31072 16432
cmd 316 8 1 21 13888 1712 1484
pslist 3932 13 2 72 17784 1656 696
sstray 536 8 1 33 24392 2112 480
rundll32 588 8 1 34 32348 3704 2276
jusched 596 8 1 25 27664 2340 656
hpwuSchd2 608 8 1 57 30712 3624 912
avp 616 8 0 204 52360 2012 5128
iexplore 2992 8 11 527 160972 3120 19516

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
explorer.exe pid: 2044
Command line: C:WINDOWSExplorer.EXE

Base Size Version Path
*** Loaded C:WINDOWSsystem32kernel32.dll differs from file image:
*** File timestamp: Fri Aug 20 01:09:14 2004
*** Loaded image timestamp: Fri Aug 20 01:09:15 2004
*** Loaded C:WINDOWSsystem32SHDOCVW.dll differs from file image:
*** File timestamp: Fri Aug 20 01:09:02 2004
*** Loaded image timestamp: Fri Aug 20 01:11:16 2004
0x76f80000 0x7f000 2001.12.4414.0258 C:WINDOWSsystem32CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:WINDOWSsystem32COMRes.dll
0x67500000 0x11000 1.00.0006.0411 C:Program FilesKasperskyscrchpg.dll
0x76010000 0x65000 6.02.3104.0000 C:WINDOWSsystem32MSVCP60.dll
0x4c5a0000 0x18000 9.00.0000.3250 C:PROGRA~1WINDOW~3wmpband.dll
0x76ac0000 0x11000 3.05.2284.0000 C:WINDOWSsystem32ATL.DLL
0x745e0000 0x2c6000 3.01.4000.2435 C:WINDOWSsystem32msi.dll
0x10000000 0x13000 7.05.0001.0036 C:Program FilesLogiciels sécurité internetAVG Anti-Spyware 7.5shellexecutehook.dll
*** Loaded C:WINDOWSsystem32RASAPI32.DLL differs from file image:
*** File timestamp: Fri Aug 20 01:08:49 2004
*** Loaded image timestamp: Fri Aug 20 01:13:31 2004
0x61300000 0xa000 6.00.0001.0411 C:Program FilesKasperskyadialhk.dll
0x01560000 0x12000 1.01.0000.0000 C:Program FilesLogiciels sécurité internetMalwarebytes' Anti-Malwarembamext.dll
0x01b30000 0x2c000 C:Program FilesWinRAR arext.dll
0x67800000 0xa000 6.00.0001.0411 C:Program FilesKasperskyShellEx.dll
0x024e0000 0x89000 C:PROGRA~1IZArcIZArcCM.dll
0x01b90000 0x2a000 7.05.0001.0036 C:Program FilesLogiciels sécurité internetAVG Anti-Spyware 7.5context.dll
0x01cc0000 0x1c000 1.01.0225.0000 C:WINDOWSsystem32CmdLineExt.dll
0x027e0000 0x3d000 3.525.1117.0000 C:WINDOWSsystem32ODBC32.dll
0x02920000 0x18000 3.525.1117.0000 C:WINDOWSsystem32odbcint.dll
0x00b80000 0x1c000 7.00.0000.0000 C:Program FilesAdobeAcrobat 7.0ActiveXPDFShell.dll
0x32520000 0x12000 10.00.2609.0000 C:Program FilesMicrosoft OfficeOffice10msohev.dll
0x60980000 0x7000 3.01.4000.1823 C:WINDOWSsystem32MSISIP.DLL
0x74e10000 0x10000 5.06.0000.8820 C:WINDOWSSystem32wshext.dll
0x73d20000 0xfe000 6.02.4131.0000 C:WINDOWSsystem32MFC42.DLL
0x61d70000 0xe000 6.00.8665.0000 C:WINDOWSsystem32MFC42LOC.DLL
0x59000000 0xe000 5.06.0000.6626 C:WINDOWSSystem32wshFR.DLL
0x365a0000 0x15000 10.00.2625.0000 C:PROGRA~1MICROS~2Office10MCPS.DLL

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
winlogon.exe pid: 976
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x81000 ??C:WINDOWSsystem32winlogon.exe
*** Loaded C:WINDOWSsystem32kernel32.dll differs from file image:
*** File timestamp: Fri Aug 20 01:09:14 2004
*** Loaded image timestamp: Fri Aug 20 01:09:15 2004
0x74730000 0x3d000 3.525.1117.0000 C:WINDOWSsystem32ODBC32.dll
0x20000000 0x18000 3.525.1117.0000 C:WINDOWSsystem32odbcint.dll
0x10000000 0x1a000 C:WINDOWSsystem32AS-E5N70T30NDG6.dll
0x76010000 0x65000 6.02.3104.0000 C:WINDOWSsystem32MSVCP60.dll
0x01e90000 0x17000 6.00.0001.0411 C:WINDOWSsystem32klogon.dll
0x76f80000 0x7f000 2001.12.4414.0258 C:WINDOWSsystem32CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:WINDOWSsystem32COMRes.dll
*** Loaded C:WINDOWSsystem32RASAPI32.DLL differs from file image:
*** File timestamp: Fri Aug 20 01:08:49 2004
*** Loaded image timestamp: Fri Aug 20 01:13:31 2004
0x61300000 0xa000 6.00.0001.0411 C:Program FilesKasperskyadialhk.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
iexplore.exe pid: 2992
Command line: "C:Program FilesInternet ExplorerIEXPLORE.EXE"

Base Size Version Path
*** Loaded C:WINDOWSsystem32kernel32.dll differs from file image:
*** File timestamp: Fri Aug 20 01:09:14 2004
*** Loaded image timestamp: Fri Aug 20 01:09:15 2004
*** Loaded C:WINDOWSsystem32SHDOCVW.dll differs from file image:
*** File timestamp: Fri Aug 20 01:09:02 2004
*** Loaded image timestamp: Fri Aug 20 01:11:16 2004
0x67500000 0x11000 1.00.0006.0411 C:Program FilesKasperskyscrchpg.dll
0x76010000 0x65000 6.02.3104.0000 C:WINDOWSsystem32MSVCP60.dll
0x76f80000 0x7f000 2001.12.4414.0258 C:WINDOWSsystem32CLBCATQ.DLL
0x77000000 0xd4000 2001.12.4414.0258 C:WINDOWSsystem32COMRes.dll
0x6d7c0000 0x7b000 6.00.0070.0006 C:Program FilesJavajre1.6.0_07inssv.dll
0x7c340000 0x56000 7.10.3052.0004 C:Program FilesJavajre1.6.0_07inMSVCR71.dll
*** Loaded C:WINDOWSsystem32RASAPI32.DLL differs from file image:
*** File timestamp: Fri Aug 20 01:08:49 2004
*** Loaded image timestamp: Fri Aug 20 01:13:31 2004
0x61300000 0xa000 6.00.0001.0411 C:Program FilesKasperskyadialhk.dll
0x74630000 0x27000 3.10.0349.0000 C:WINDOWSSystem32msls31.dll
0x32520000 0x12000 10.00.2609.0000 C:Program FilesMicrosoft OfficeOffice10msohev.dll
0x75be0000 0x6e000 5.06.0000.8820 C:WINDOWSsystem32jscript.dll
0x67000000 0x9000 6.00.0001.0411 C:Program FilesKasperskyklscav.dll
0x66600000 0x12000 6.00.0001.0411 C:Program FilesKasperskyprremote.dll
0x64d00000 0x48000 6.00.0001.0411 C:Program FilesKasperskyprloader.dll
0x64a00000 0x31000 6.00.0001.0411 C:Program FilesKasperskyprkernel.ppl
0x66200000 0x47000 6.00.0001.0411 c:program fileskasperskyparams.ppl
0x66900000 0x8000 6.00.0001.0411 c:program fileskasperskypxstub.ppl
0x67f00000 0x7000 6.00.0001.0411 c:program fileskaspersky empfile.ppl
0x10000000 0x1c000 7.00.0000.0000 C:Program FilesAdobeAcrobat 7.0ActiveXPDFShell.dll
0x65b00000 0x12000 6.00.0001.0411 c:program fileskaspersky
fio.ppl
0x63a00000 0x7000 6.00.0001.0411 c:program fileskasperskyfsdrvplgn.ppl
0x62600000 0x82000 6.00.0001.0411 c:program fileskasperskyasegui.ppl
0x69500000 0x8000 6.00.0001.0411 c:program fileskasperskywinreg.ppl
0x30000000 0x3af000 9.00.0124.0000 C:WINDOWSsystem32MacromedFlashFlash9f.ocx
0x76ac0000 0x11000 3.05.2284.0000 C:WINDOWSSystem32ATL.DLL
0x72a70000 0x18000 6.00.2600.0000 C:WINDOWSsystem32plugin.ocx
0x74730000 0x3d000 3.525.1117.0000 C:WINDOWSsystem32ODBC32.dll
0x02030000 0x18000 3.525.1117.0000 C:WINDOWSsystem32odbcint.dll
0x506a0000 0x6c000 5.04.3790.2180 C:WINDOWSsystem32wuapi.dll

ListDLLs v2.25 - DLL lister for Win9x/NT
Copyright (C) 1997-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------------------------------------------------------------
services.exe pid: 1020
Command line: C:WINDOWSsystem32services.exe

Base Size Version Path
*** Loaded C:WINDOWSsystem32kernel32.dll differs from file image:
*** File timestamp: Fri Aug 20 01:09:14 2004
*** Loaded image timestamp: Fri Aug 20 01:09:15 2004
0x76010000 0x65000 6.02.3104.0000 C:WINDOWSsystem32MSVCP60.dll
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 4CFC-F7E8

Répertoire de C:Program Files

31/08/2008 19:14 <REP> .
31/08/2008 19:14 <REP> ..
22/04/2008 22:15 <REP> Adobe
16/08/2008 12:19 <REP> Audacity
31/08/2008 19:14 93 827 885 AVP.6.411_08.31_19.14_61c.SRV.dmp
22/04/2008 01:02 <REP> AvRack
27/05/2008 22:16 <REP> BSplayer
21/04/2008 22:06 <REP> ComPlus Applications
15/08/2008 20:16 <REP> DAEMON Tools Lite
03/09/2008 19:59 <REP> Fichiers communs
22/04/2008 22:14 <REP> Free
21/04/2008 23:51 <REP> Gigabyte
12/06/2008 20:18 <REP> GIMP-2.0
23/07/2008 19:41 <REP> Google
11/05/2008 01:06 <REP> Guitar Pro 5
03/05/2008 17:01 <REP> Hewlett-Packard
03/05/2008 17:01 <REP> HP
21/04/2008 22:37 <REP> Intel
21/04/2008 23:59 <REP> Internet Explorer
22/04/2008 19:13 <REP> IZArc
03/09/2008 22:42 <REP> Java
31/08/2008 19:13 <REP> Kaspersky
14/06/2008 01:59 <REP> Last.fm
26/04/2008 19:06 <REP> Logiciels compactés
15/07/2008 18:38 <REP> Logiciels de Video
23/05/2008 23:49 <REP> Logiciels P2P
04/09/2008 18:06 <REP> Logiciels sécurité internet
30/08/2008 16:25 <REP> LSPFix
22/04/2008 00:02 <REP> Messenger
21/04/2008 22:08 <REP> microsoft frontpage
22/04/2008 01:08 <REP> Microsoft Office
25/05/2008 22:57 <REP> Microsoft Silverlight
21/04/2008 23:59 <REP> Movie Maker
25/08/2008 18:27 <REP> MP3Gain
21/04/2008 22:05 <REP> MSN
21/04/2008 22:05 <REP> MSN Gaming Zone
13/05/2008 21:01 <REP> MSN Messenger
22/04/2008 21:48 <REP> Nero 6
21/04/2008 23:57 <REP> NetMeeting
22/04/2008 22:38 <REP> NVIDIA
21/04/2008 23:57 <REP> Outlook Express
08/05/2008 00:47 <REP> QuickTime
22/04/2008 01:02 <REP> Realtek Sound Manager
26/05/2004 14:17 724 992 redeye.exe
21/04/2008 22:05 <REP> Services en ligne
17/06/2008 19:13 <REP> SystemRequirementsLab
11/05/2008 00:44 <REP> Tabs
08/05/2008 17:40 <REP> TVUPlayer
22/04/2008 22:32 <REP> VLC
06/05/2008 19:34 <REP> Windows Media Player
21/04/2008 23:57 <REP> Windows NT
25/08/2008 18:37 <REP> WinRAR
21/04/2008 22:08 <REP> xerox
2 fichier(s) 94 552 877 octets
51 Rép(s) 14 492 274 688 octets libres
C:Documents and SettingsADRIENApplication DataAdobeAcrobat7.0UpdaterAdbeRdr709_fr_FR.exe
C:Documents and SettingsADRIENApplication DataAdobeAcrobat7.0UpdaterAdbeRdr710_fr_FR.exe
C:Documents and SettingsADRIENApplication DataMicrosoftInstaller{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}ARPPRODUCTICON.exe
C:Documents and SettingsADRIENBureauantivir.exe
C:Documents and SettingsADRIENBureauComboFi.exe
C:Documents and SettingsADRIENBureauLieba.EXE
C:Documents and SettingsADRIENBureauslsk.exe
C:Documents and SettingsADRIENBureauWindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
C:Documents and SettingsADRIENBureauSDFixcatchme.exe
C:Documents and SettingsADRIENBureauSDFixappsCghtme.exe
C:Documents and SettingsADRIENBureauSDFixappscliptext.exe
C:Documents and SettingsADRIENBureauSDFixappsCsweg.exe
C:Documents and SettingsADRIENBureauSDFixappsdownload.exe
C:Documents and SettingsADRIENBureauSDFixappsERUNT.EXE
C:Documents and SettingsADRIENBureauSDFixappsFixPath.exe
C:Documents and SettingsADRIENBureauSDFixappsgrep.exe
C:Documents and SettingsADRIENBureauSDFixappsisadmin.exe
C:Documents and SettingsADRIENBureauSDFixappsLS.exe
C:Documents and SettingsADRIENBureauSDFixappsMD5File.exe
C:Documents and SettingsADRIENBureauSDFixappsmoveex.exe
C:Documents and SettingsADRIENBureauSDFixappsProcess.exe
C:Documents and SettingsADRIENBureauSDFixappsprocs.exe
C:Documents and SettingsADRIENBureauSDFixappspsservice.exe
C:Documents and SettingsADRIENBureauSDFixappsRestartIt!.exe
C:Documents and SettingsADRIENBureauSDFixappssc.exe
C:Documents and SettingsADRIENBureauSDFixappssed.exe
C:Documents and SettingsADRIENBureauSDFixappsSF.exe
C:Documents and SettingsADRIENBureauSDFixappsshutdown.exe
C:Documents and SettingsADRIENBureauSDFixappsswsc.exe
C:Documents and SettingsADRIENBureauSDFixappsunzip.exe
C:Documents and SettingsADRIENBureauSDFixappsvfind.exe
C:Documents and SettingsADRIENBureauSDFixappsWINMSG.EXE
C:Documents and SettingsADRIENBureauSDFixappszip.exe
C:Documents and SettingsADRIENBureauSDFixappsReplace egedit.exe
C:Documents and SettingsADRIENLocal SettingsApplication DataLast.fmClientUpdaterd.exe
C:Documents and SettingsADRIENLocal Settings empOnlineScannerAnti-Virusfsgk32.exe
C:Documents and SettingsADRIENLocal Settings empOnlineScannerAnti-Virusfssm32.exe
C:Documents and SettingsADRIENLocal Settings empOnlineScannerupdatesfsav_betafsgk32.exe
C:Documents and SettingsADRIENLocal Settings empOnlineScannerupdatesfsav_betafssm32.exe
C:Documents and SettingsAll UsersApplication DataLast.fmClientUninstWMPunins000.exe
C:Documents and SettingsAll UsersApplication DataLavasoftAd-AwareUpdateaaw2008_upd.exe


Option 3:
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-04 19:30:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:f9,8c,e2,de,aa,96,ca,e3,cd,22,4c,4a,2c,a9,d7,93,59,6f,26,d2,18,..
"p0"="C:Program FilesDAEMON Tools Lite"

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA40000001]
"a0"=hex:20,01,00,00,f4,20,29,aa,b4,6b,ec,9a,5c,2f,79,19,08,4c,ef,18,9a,..
"khjeh"=hex:dd,9a,bd,3d,f7,e9,9e,e2,5f,fb,9f,d5,57,17,de,3a,ab,dd,d7,aa,e9,..

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40]
"khjeh"=hex:fc,9c,22,8d,77,8b,0d,9b,d0,dd,b5,15,0a,ed,56,1d,38,95,17,17,e4,..
[HKEY_LOCAL_MACHINESYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:f9,8c,e2,de,aa,96,ca,e3,cd,22,4c,4a,2c,a9,d7,93,59,6f,26,d2,18,..
"p0"="C:Program FilesDAEMON Tools Lite"

[HKEY_LOCAL_MACHINESYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001]
"a0"=hex:20,01,00,00,f4,20,29,aa,b4,6b,ec,9a,5c,2f,79,19,08,4c,ef,18,9a,..
"khjeh"=hex:dd,9a,bd,3d,f7,e9,9e,e2,5f,fb,9f,d5,57,17,de,3a,ab,dd,d7,aa,e9,..

[HKEY_LOCAL_MACHINESYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40]
"khjeh"=hex:fc,9c,22,8d,77,8b,0d,9b,d0,dd,b5,15,0a,ed,56,1d,38,95,17,17,e4,..

scanning hidden registry entries ...

scanning hidden files ...

C:WINDOWS empcch~63f7de15e.htp
read file error: C:WINDOWS empcch~63f7de15e.htp, Le fichier spécifié est introuvable.
C:WINDOWS empcch~63f7de567.htp
read file error: C:WINDOWS empcch~63f7de567.htp, Le fichier spécifié est introuvable.

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 2

[r@in | b0w]

Bonjour.

Rien de bien neuf vis à vis de tes rapports.

1_ Tu peux suivre notre dossier Nettoyage pour alléger un peu ton Windows.

Je vois par exemple que tu as Spyware Doctor & AVG Anti-spyware installés, ils font double-emploi. Tu ne dois en garder qu'un des deux.

De plus, si tu penses garder MalwareBytes' Anti-Malware, tu peux les désinstaller tous les deux ainsi qu'Ad-Aware puisque Mbam supprime tous les malwares (adware, spyware...).

J'ai remarqué que tu avais des codecs vidéos. Si tu lis tes vidéos avec VLC, tu peux supprimer ce pack car VLC intègre déjà tous les codecs.

2_ Est-ce que tu peux me dire à quoi correspond ce fichier:

C:Documents and SettingsADRIENBureauantivir.exe

Je dirai que c'est un programme que tu as renommé, peut-être HiJackThis?

Si non, tu vas sur http://www.virustotal.com/fr/ puis tu cliques sur Parcourir.
Tu sélectionnes le fichier C:Documents and SettingsADRIENBureauantivir.exe que tu auras localiser précédemment et tu cliques sur Ouvrir.

Tu cliques ensuite sur Envoyer le fichier.

A la fin de l'analyse, tu cliques sur Formaté en haut à gauche puis, dans la nouvelle fenêtre, tu cliques sur le bouton pour faire apparaître le rapport dans la fenêtre en question.

Tu sélectionnes ce rapport puis fais un copier-coller et tu le colles dans ton prochain message.

3_ Tu arrives à démarrer en Mode sans échec en passant par la touche [F8] au démarrage?

Si oui, tu cliques ensuite sur Démarrer puis Tous les programmes, Accessoires et finalement Invite de commandes ou, si l'Invite de commandes n'est pas là, tu vas toujours dans Accessoires puis Outils système et enfin Invite de commandes.

Tu copies-colles chaque ligne en les validant une par une par [Entrée]:

Code: Tout sélectionner

del C:WINDOWSsystem32mdelk.exe
del C:WINDOWSsystem32wintems.exe
del C:WINDOWSsystem32hldrrr.exe

Tu redémarres en Mode normal et tu relances Elibagla.

S'il y a des messages d'erreurs lors des commandes, tu rapportes ces messages.

[Mike_bungle]

Antivir c'est un anti-virus que j'avais téléchargé après conseil sur l'autre forum je crois. Mais impossible de l'installer, il se ferme direct.

J'ai quand même tenté de le vérifier avec VirusTotal mais le fichier est trop gros.

Ensuite j'ai tenté de supprimer les 3 fichiers que tu m'as indiqué en mode sans echec mais il ne les trouve pas. J'ai regardé moi-même dans le répertoire System32 je ne les vois pas (les fichiers cachés sont pourtant visibles).

[r@in | b0w]

Bonjour.

Si l'invite de commandes ne trouve pas les fichiers, c'est qu'ils n'existent pas.

Tu n'as donc pas de Bagle.

Tentes de désinstaller HiJackThis puis de le télécharger à nouveau pour voir si cela est différent.