Divers problèmes - Infection ?

Section d'analyse de rapports et de désinfection : malwares en tous genre et autres indésirables. Demandes de nettoyage uniquement. Prise en charge restreinte : équipe spécialisée.

Modérateur: Modérateurs

Règles du forum :arrow: Les désinfections sont prises en charge par un groupe spécifique, tout le monde ne peut pas intervenir pour désinfecter les machines (règles).
:arrow: Les procédures sont sur-mesure, ne faites pas la même chose chez vous (explications).
:arrow: Un topic par machine, chacun crée le sien. ;)

Re: Divers problèmes - Infection ?

Messagepar PascalB » 08 Jan 2011 16:01

D'accord. Je fais ça de suite, merci.
PascalB
Libellulien Junior
Libellulien Junior
 
Messages: 144
Inscription: 07 Déc 2010 17:50

Re: Divers problèmes - Infection ?

Messagepar PascalB » 08 Jan 2011 16:10

Donc... comme au début du topic, il bloque à 80%... => Recherche Master Boot Record Infection (MBR)(O80)

Obligé de reboot. :(
PascalB
Libellulien Junior
Libellulien Junior
 
Messages: 144
Inscription: 07 Déc 2010 17:50

Re: Divers problèmes - Infection ?

Messagepar nardino » 08 Jan 2011 19:13

Bonsoir,

Essaie avec OTL.
Télécharge OTL de OldTimer :
http://oldtimer.geekstogo.com/OTL.exe

Installe le fichier OTL.exe dans un dossier que tu crées avec le même nom sur le bureau.
Clique sur OTL.exe
Coche :
-Scan all users
-Minimal Output
-LOP Check
-Purity Check

Process, Services, Drivers, Standard Registry et Extra Registry doivent être sur [Use SafeList]

Clique sur le bouton [Run Scan] en haut en bleu.
L'analyse va prendre une ou deux minutes.
Une fois celle-ci terminée un raport va s'ouvrir
Tu le postes par copier-coller dans ta réponse et tu le refermes.
Tu fermes aussi le fichier Extras.txt dans la barre des tâches, il sera demandé en cas de nécessité.
Il sera sauvegardé dans le dossier que tu as créé sous OTL.txt avec le fichier Extras.txt

Remarque:
Sous Vista il faut procéder à l'élévation des privilèges.
Clic droit sur OTL.exe et Exécuter en tant qu'administrateur dans le menu contextuel.
@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: Divers problèmes - Infection ?

Messagepar PascalB » 08 Jan 2011 21:33

OTL logfile created on: 08.01.2011 21:30:11 - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\administrator\Bureau\OTL
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000100C | Country: Suisse | Language: FRS | Date Format: dd.MM.yyyy

477.00 Mb Total Physical Memory | 177.00 Mb Available Physical Memory | 37.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 25.74 Gb Total Space | 13.16 Gb Free Space | 51.11% Space Free | Partition Type: FAT32
Drive D: | 26.22 Gb Total Space | 12.64 Gb Free Space | 48.18% Space Free | Partition Type: FAT32

Computer Name: LYON | User Name: administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\administrator\Bureau\OTL\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Acer\eManager\anbmServ.exe (OSA Technologies Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\administrator\Bureau\OTL\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (PEVSystemStart) -- C:\ComboFix\PEV.cfx File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (anbmService) -- C:\Acer\eManager\anbmServ.exe (OSA Technologies Inc.)
SRV - (ose) -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (dtscsi) -- C:\WINDOWS\System32\Drivers\dtscsi.sys ()
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (NTIDrvr) -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (osaio) -- C:\WINDOWS\system32\drivers\osaio.sys (OSA Technologies, An Avocent Company)
DRV - (SiS315) -- C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp) -- C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (osanbm) -- C:\WINDOWS\system32\drivers\osanbm.sys (Windows (R) 2000 DDK provider)
DRV - (AR5211) -- C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (UBHelper) -- C:\WINDOWS\System32\drivers\UBHelper.sys ()
DRV - (HSFHWSIS) -- C:\WINDOWS\system32\drivers\HSFHWSIS.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (DKbFltr) -- C:\WINDOWS\system32\drivers\DKbFltr.SYS (Dritek System Inc.)
DRV - (SISNICXP) -- C:\WINDOWS\system32\drivers\sisnicxp.sys (SiS Corporation)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (SISAGP) -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1161013204-3124289045-2251734291-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com
IE - HKU\S-1-5-21-1161013204-3124289045-2251734291-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "about:blank"

FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2006.08.12 18:08:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2006.08.12 18:08:42 | 000,000,000 | ---D | M]

[2010.04.06 21:42:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\administrator\Application Data\Mozilla\Extensions
[2006.08.12 18:08:54 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\administrator\Application Data\Mozilla\Firefox\Profiles\31etqchs.default\extensions
[2006.08.12 18:08:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2009.08.05 09:57:32 | 000,000,748 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\MediaDICO-fr.xml
[2009.08.05 09:57:32 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml
[2009.08.05 09:57:32 | 000,000,757 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml
[2009.08.05 09:57:32 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml
[2009.08.05 09:57:32 | 000,000,652 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml

O1 HOSTS File: ([2004.08.05 05:00:00 | 000,000,790 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1161013204-3124289045-2251734291-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1161013204-3124289045-2251734291-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microso ... 9386753445 (MUWebControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - Reg Error: Key error. File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Fichiers communs\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.08.06 20:34:30 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.01.08 21:28:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator\Bureau\OTL
[2011.01.08 16:11:00 | 000,000,000 | -HSD | C] -- C:\FOUND.016
[2011.01.08 15:56:44 | 000,000,000 | -HSD | C] -- C:\FOUND.015
[2011.01.07 16:14:20 | 000,000,000 | -HSD | C] -- C:\FOUND.014
[2011.01.07 00:41:24 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2011.01.07 00:35:54 | 000,000,000 | -HSD | C] -- C:\FOUND.013
[2011.01.05 15:07:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator\Bureau
[2011.01.05 14:51:43 | 000,000,000 | -HSD | C] -- C:\FOUND.003
[2011.01.05 10:39:12 | 000,000,000 | -HSD | C] -- C:\FOUND.012
[2011.01.05 10:11:02 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndproxy.sys
[2011.01.05 01:04:20 | 000,000,000 | -HSD | C] -- C:\FOUND.011
[2011.01.05 00:27:12 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wab.exe
[2011.01.05 00:23:10 | 000,000,000 | -HSD | C] -- C:\FOUND.010
[2011.01.04 18:44:07 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011.01.03 18:52:56 | 000,000,000 | -HSD | C] -- C:\FOUND.009
[2010.12.16 09:47:52 | 001,345,624 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\administrator\Bureau\TDSSKiller.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.01.08 21:25:04 | 000,001,068 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.01.08 16:11:28 | 000,001,064 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.01.08 16:11:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.01.08 16:11:06 | 500,748,288 | -HS- | M] () -- C:\hiberfil.sys
[2011.01.08 16:01:54 | 000,000,574 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
[2011.01.08 16:01:54 | 000,000,569 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk
[2011.01.07 16:03:36 | 004,149,824 | R--- | M] () -- C:\Documents and Settings\administrator\Bureau\ComboFix.exe
[2011.01.07 00:37:46 | 001,232,020 | ---- | M] () -- C:\Documents and Settings\administrator\Bureau\tdsskiller.zip
[2011.01.07 00:36:08 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.01.05 10:42:30 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.01.05 10:08:06 | 000,177,856 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.01.04 18:44:10 | 000,000,332 | RHS- | M] () -- C:\boot.ini
[2011.01.03 19:16:18 | 000,000,235 | ---- | M] () -- C:\WINDOWS\FlashSaver.dat
[2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.12.20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.12.16 09:47:52 | 001,345,624 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\administrator\Bureau\TDSSKiller.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.01.07 00:37:36 | 001,232,020 | ---- | C] () -- C:\Documents and Settings\administrator\Bureau\tdsskiller.zip
[2011.01.05 21:08:21 | 004,149,824 | R--- | C] () -- C:\Documents and Settings\administrator\Bureau\ComboFix.exe
[2011.01.05 01:15:30 | 000,001,355 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2011.01.05 00:23:18 | 500,748,288 | -HS- | C] () -- C:\hiberfil.sys
[2011.01.04 18:44:09 | 000,000,216 | ---- | C] () -- C:\Boot.bak
[2011.01.04 18:44:08 | 000,263,488 | RHS- | C] () -- C:\cmldr
[2008.06.01 12:48:48 | 000,000,502 | ---- | C] () -- C:\WINDOWS\dcd.ini
[2007.11.23 14:38:07 | 000,000,731 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2007.11.23 14:37:46 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2006.12.24 18:25:45 | 000,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html
[2006.08.14 10:29:27 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006.08.13 20:52:08 | 000,000,385 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006.08.12 13:51:10 | 000,223,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\dtscsi.sys
[2006.08.12 13:49:37 | 000,643,072 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2006.08.12 13:49:37 | 000,096,384 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd2541.sys
[2006.08.12 05:00:05 | 000,000,494 | ---- | C] () -- C:\WINDOWS\System32\eRLog.ini
[2006.08.12 04:46:21 | 000,002,772 | ---- | C] () -- C:\WINDOWS\AntiV.INI
[2005.12.01 00:24:56 | 000,037,754 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005.08.09 08:54:00 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005.08.09 08:51:42 | 000,000,319 | ---- | C] () -- C:\WINDOWS\uninstall.ini
[2005.08.09 08:51:42 | 000,000,033 | ---- | C] () -- C:\WINDOWS\Acer.ini
[2005.08.06 20:34:54 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2005.08.06 20:16:04 | 000,100,873 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2005.08.06 20:09:22 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005.03.28 00:45:26 | 000,000,097 | ---- | C] () -- C:\WINDOWS\ALaunch.ini
[2005.03.03 23:51:52 | 000,083,997 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini
[2004.12.17 01:14:44 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2004.09.06 23:23:16 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2004.08.05 05:00:00 | 000,003,712 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2002.03.21 15:39:02 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
[2001.07.05 09:19:12 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini

========== LOP Check ==========

[2006.08.13 23:53:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ACD Systems
[2007.12.12 15:45:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NtiDvdCopy
[2006.08.13 20:59:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jeannine\Application Data\uTorrent
[2006.08.13 23:19:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jeannine\Application Data\ACD Systems
[2008.06.01 12:46:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jeannine\Application Data\Directories CD
[2008.06.01 12:48:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jeannine\Application Data\DirectoriesAG
[2006.08.12 14:11:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\administrator\Application Data\uTorrent
[2006.08.12 15:23:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\administrator\Application Data\ACD Systems

========== Purity Check ==========



< End of report >


Voilà, merci bien !

PS : Il faut penser à update le message concernant ce soft étant donné qu'il est en FR maintenant et donc les gens qui ne parlent pas Anglais auront du mal à traduire les options qu'il faut cocher ;)

Merci encore.
PascalB
Libellulien Junior
Libellulien Junior
 
Messages: 144
Inscription: 07 Déc 2010 17:50

Re: Divers problèmes - Infection ?

Messagepar nardino » 08 Jan 2011 22:42

Bonjour

C'est rectifié pour OTL, merci de l'avoir signalé.
Tu le relances et dans le cadre Personnalisation tu colles :
:OTL
[2011.01.08 16:11:00 | 000,000,000 | -HSD | C] -- C:\FOUND.016
[2011.01.08 15:56:44 | 000,000,000 | -HSD | C] -- C:\FOUND.015
[2011.01.07 16:14:20 | 000,000,000 | -HSD | C] -- C:\FOUND.014
[2011.01.07 00:35:54 | 000,000,000 | -HSD | C] -- C:\FOUND.013
[2011.01.05 14:51:43 | 000,000,000 | -HSD | C] -- C:\FOUND.003
[2011.01.05 10:39:12 | 000,000,000 | -HSD | C] -- C:\FOUND.012
[2011.01.05 01:04:20 | 000,000,000 | -HSD | C] -- C:\FOUND.011
[2011.01.05 00:23:10 | 000,000,000 | -HSD | C] -- C:\FOUND.010
[2011.01.03 18:52:56 | 000,000,000 | -HSD | C] -- C:\FOUND.009

Clique sur Correction
Poste le rapport
Puis à nouveau tu colles
/md5start
dtscsi.sys
sptd.sys
sptd2541.sys
/md5stop
Tu cliques sur Analyse rapide.
Poste le rapport.
@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: Divers problèmes - Infection ?

Messagepar PascalB » 09 Jan 2011 03:07

Biswar !

Voilà :)

========== OTL ==========
C:\FOUND.016 folder moved successfully.
C:\FOUND.015 folder moved successfully.
C:\FOUND.014 folder moved successfully.
C:\FOUND.013 folder moved successfully.
C:\FOUND.003 folder moved successfully.
C:\FOUND.012 folder moved successfully.
C:\FOUND.011 folder moved successfully.
C:\FOUND.010 folder moved successfully.
C:\FOUND.009 folder moved successfully.

OTL by OldTimer - Version 3.2.20.1 log created on 01092011_030343


Et puis ...

OTL logfile created on: 09.01.2011 03:04:39 - Run 2
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\administrator\Bureau\OTL
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000100C | Country: Suisse | Language: FRS | Date Format: dd.MM.yyyy

477.00 Mb Total Physical Memory | 178.00 Mb Available Physical Memory | 37.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 25.74 Gb Total Space | 13.20 Gb Free Space | 51.29% Space Free | Partition Type: FAT32
Drive D: | 26.22 Gb Total Space | 12.64 Gb Free Space | 48.18% Space Free | Partition Type: FAT32

Computer Name: LYON | User Name: administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\administrator\Bureau\OTL\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Acer\eManager\anbmServ.exe (OSA Technologies Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\administrator\Bureau\OTL\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (PEVSystemStart) -- C:\ComboFix\PEV.cfx File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (anbmService) -- C:\Acer\eManager\anbmServ.exe (OSA Technologies Inc.)
SRV - (ose) -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (dtscsi) -- C:\WINDOWS\System32\Drivers\dtscsi.sys ()
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (NTIDrvr) -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (osaio) -- C:\WINDOWS\system32\drivers\osaio.sys (OSA Technologies, An Avocent Company)
DRV - (SiS315) -- C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp) -- C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (osanbm) -- C:\WINDOWS\system32\drivers\osanbm.sys (Windows (R) 2000 DDK provider)
DRV - (AR5211) -- C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (UBHelper) -- C:\WINDOWS\System32\drivers\UBHelper.sys ()
DRV - (HSFHWSIS) -- C:\WINDOWS\system32\drivers\HSFHWSIS.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (DKbFltr) -- C:\WINDOWS\system32\drivers\DKbFltr.SYS (Dritek System Inc.)
DRV - (SISNICXP) -- C:\WINDOWS\system32\drivers\sisnicxp.sys (SiS Corporation)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (SISAGP) -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "about:blank"

FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2006.08.12 18:08:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2006.08.12 18:08:42 | 000,000,000 | ---D | M]

[2010.04.06 21:42:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\administrator\Application Data\Mozilla\Extensions
[2006.08.12 18:08:54 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\administrator\Application Data\Mozilla\Firefox\Profiles\31etqchs.default\extensions
[2006.08.12 18:08:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2009.08.05 09:57:32 | 000,000,748 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\MediaDICO-fr.xml
[2009.08.05 09:57:32 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml
[2009.08.05 09:57:32 | 000,000,757 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml
[2009.08.05 09:57:32 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml
[2009.08.05 09:57:32 | 000,000,652 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml

O1 HOSTS File: ([2004.08.05 05:00:00 | 000,000,790 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microso ... 9386753445 (MUWebControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - Reg Error: Key error. File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Fichiers communs\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.08.06 20:34:30 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.01.09 03:03:43 | 000,000,000 | ---D | C] -- C:\_OTL
[2011.01.08 21:28:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator\Bureau\OTL
[2011.01.07 00:41:24 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2011.01.05 15:07:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator\Bureau
[2011.01.04 18:44:07 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010.12.16 09:47:52 | 001,345,624 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\administrator\Bureau\TDSSKiller.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.01.09 03:02:24 | 000,001,064 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.01.09 03:02:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.01.09 03:02:08 | 500,748,288 | -HS- | M] () -- C:\hiberfil.sys
[2011.01.08 21:34:02 | 000,001,068 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.01.08 16:01:54 | 000,000,574 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
[2011.01.08 16:01:54 | 000,000,569 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk
[2011.01.07 16:03:36 | 004,149,824 | R--- | M] () -- C:\Documents and Settings\administrator\Bureau\ComboFix.exe
[2011.01.07 00:37:46 | 001,232,020 | ---- | M] () -- C:\Documents and Settings\administrator\Bureau\tdsskiller.zip
[2011.01.07 00:36:08 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.01.05 10:42:30 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.01.05 10:08:06 | 000,177,856 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.01.04 18:44:10 | 000,000,332 | RHS- | M] () -- C:\boot.ini
[2011.01.03 19:16:18 | 000,000,235 | ---- | M] () -- C:\WINDOWS\FlashSaver.dat
[2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.12.20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.12.16 09:47:52 | 001,345,624 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\administrator\Bureau\TDSSKiller.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.01.07 00:37:36 | 001,232,020 | ---- | C] () -- C:\Documents and Settings\administrator\Bureau\tdsskiller.zip
[2011.01.05 21:08:21 | 004,149,824 | R--- | C] () -- C:\Documents and Settings\administrator\Bureau\ComboFix.exe
[2011.01.05 01:15:30 | 000,001,355 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2011.01.05 00:23:18 | 500,748,288 | -HS- | C] () -- C:\hiberfil.sys
[2011.01.04 18:44:09 | 000,000,216 | ---- | C] () -- C:\Boot.bak
[2011.01.04 18:44:08 | 000,263,488 | RHS- | C] () -- C:\cmldr
[2008.06.01 12:48:48 | 000,000,502 | ---- | C] () -- C:\WINDOWS\dcd.ini
[2007.11.23 14:38:07 | 000,000,731 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2007.11.23 14:37:46 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2006.12.24 18:25:45 | 000,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html
[2006.08.14 10:29:27 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006.08.13 20:52:08 | 000,000,385 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006.08.12 13:51:10 | 000,223,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\dtscsi.sys
[2006.08.12 13:49:37 | 000,643,072 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2006.08.12 13:49:37 | 000,096,384 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd2541.sys
[2006.08.12 05:00:05 | 000,000,494 | ---- | C] () -- C:\WINDOWS\System32\eRLog.ini
[2006.08.12 04:46:21 | 000,002,772 | ---- | C] () -- C:\WINDOWS\AntiV.INI
[2005.12.01 00:24:56 | 000,037,754 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005.08.09 08:54:00 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005.08.09 08:51:42 | 000,000,319 | ---- | C] () -- C:\WINDOWS\uninstall.ini
[2005.08.09 08:51:42 | 000,000,033 | ---- | C] () -- C:\WINDOWS\Acer.ini
[2005.08.06 20:34:54 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2005.08.06 20:16:04 | 000,100,873 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2005.08.06 20:09:22 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005.03.28 00:45:26 | 000,000,097 | ---- | C] () -- C:\WINDOWS\ALaunch.ini
[2005.03.03 23:51:52 | 000,083,997 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini
[2004.12.17 01:14:44 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2004.09.06 23:23:16 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2004.08.05 05:00:00 | 000,003,712 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2002.03.21 15:39:02 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
[2001.07.05 09:19:12 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini

========== LOP Check ==========

[2006.08.13 23:53:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ACD Systems
[2007.12.12 15:45:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NtiDvdCopy
[2006.08.12 14:11:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\administrator\Application Data\uTorrent
[2006.08.12 15:23:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\administrator\Application Data\ACD Systems

========== Purity Check ==========



========== Custom Scans ==========



< MD5 for: DTSCSI.SYS >
[2006.08.12 13:51:12 | 000,223,128 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\dtscsi.sys

< MD5 for: SPTD.SYS >
[2006.08.12 13:49:38 | 000,643,072 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys

< MD5 for: SPTD2541.SYS >
[2008.12.30 14:28:32 | 000,096,384 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd2541.sys

< End of report >


Thanks :)
PascalB
Libellulien Junior
Libellulien Junior
 
Messages: 144
Inscription: 07 Déc 2010 17:50

Re: Divers problèmes - Infection ?

Messagepar PascalB » 10 Jan 2011 22:30

C'est tout bon ? :supers:
PascalB
Libellulien Junior
Libellulien Junior
 
Messages: 144
Inscription: 07 Déc 2010 17:50

Re: Divers problèmes - Infection ?

Messagepar nardino » 10 Jan 2011 22:35

Bonsoir
Il y a un truc qui me chiffonne, j'étudie la question. (Les trois dernières lignes.)
@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: Divers problèmes - Infection ?

Messagepar PascalB » 10 Jan 2011 22:56

Ah okay ^^ Oui je vois, le fait qu'il soit impossible d'obtenir les MD5 ? Je peux essayer de voir manuellement si tu veux !
PascalB
Libellulien Junior
Libellulien Junior
 
Messages: 144
Inscription: 07 Déc 2010 17:50

Re: Divers problèmes - Infection ?

Messagepar nardino » 10 Jan 2011 23:57

Bonsoir
Si cela t'est possible, ok. :supers:
@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: Divers problèmes - Infection ?

Messagepar PascalB » 11 Jan 2011 00:44

Bon bah cela s'explique, aucune information sur ces fichiers.
PascalB
Libellulien Junior
Libellulien Junior
 
Messages: 144
Inscription: 07 Déc 2010 17:50

Re: Divers problèmes - Infection ?

Messagepar nardino » 11 Jan 2011 16:18

Bonjour
Peux-tu désinstaller ton programme de virtualisation de lecteur CD ?
@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: Divers problèmes - Infection ?

Messagepar PascalB » 11 Jan 2011 21:22

Oui et ensuite ?

:) :supers:
PascalB
Libellulien Junior
Libellulien Junior
 
Messages: 144
Inscription: 07 Déc 2010 17:50

Re: Divers problèmes - Infection ?

Messagepar nardino » 11 Jan 2011 22:48

Bonjour
Refais un rapport OTL.
@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: Divers problèmes - Infection ?

Messagepar PascalB » 11 Jan 2011 23:12

OTL logfile created on: 11.01.2011 23:10:11 - Run 3
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\administrator\Bureau\OTL
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000100C | Country: Suisse | Language: FRS | Date Format: dd.MM.yyyy

477.00 Mb Total Physical Memory | 206.00 Mb Available Physical Memory | 43.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 25.74 Gb Total Space | 13.16 Gb Free Space | 51.14% Space Free | Partition Type: FAT32
Drive D: | 26.22 Gb Total Space | 12.64 Gb Free Space | 48.18% Space Free | Partition Type: FAT32

Computer Name: LYON | User Name: administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\administrator\Bureau\OTL\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Acer\eManager\anbmServ.exe (OSA Technologies Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\administrator\Bureau\OTL\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (PEVSystemStart) -- C:\ComboFix\PEV.cfx File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (anbmService) -- C:\Acer\eManager\anbmServ.exe (OSA Technologies Inc.)
SRV - (ose) -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (dtscsi) -- C:\WINDOWS\System32\Drivers\dtscsi.sys (DT Soft Ltd.)
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (NTIDrvr) -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (osaio) -- C:\WINDOWS\system32\drivers\osaio.sys (OSA Technologies, An Avocent Company)
DRV - (SiS315) -- C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp) -- C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (osanbm) -- C:\WINDOWS\system32\drivers\osanbm.sys (Windows (R) 2000 DDK provider)
DRV - (AR5211) -- C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (UBHelper) -- C:\WINDOWS\System32\drivers\UBHelper.sys ()
DRV - (HSFHWSIS) -- C:\WINDOWS\system32\drivers\HSFHWSIS.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (DKbFltr) -- C:\WINDOWS\system32\drivers\DKbFltr.SYS (Dritek System Inc.)
DRV - (SISNICXP) -- C:\WINDOWS\system32\drivers\sisnicxp.sys (SiS Corporation)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (SISAGP) -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "about:blank"

FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2006.08.12 18:08:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2006.08.12 18:08:42 | 000,000,000 | ---D | M]

[2010.04.06 21:42:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\administrator\Application Data\Mozilla\Extensions
[2006.08.12 18:08:54 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\administrator\Application Data\Mozilla\Firefox\Profiles\31etqchs.default\extensions
[2006.08.12 18:08:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2009.08.05 09:57:32 | 000,000,748 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\MediaDICO-fr.xml
[2009.08.05 09:57:32 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml
[2009.08.05 09:57:32 | 000,000,757 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml
[2009.08.05 09:57:32 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml
[2009.08.05 09:57:32 | 000,000,652 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml

O1 HOSTS File: ([2004.08.05 05:00:00 | 000,000,790 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microso ... 9386753445 (MUWebControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - Reg Error: Key error. File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Fichiers communs\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.08.06 20:34:30 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.01.11 00:38:52 | 000,000,000 | -HSD | C] -- C:\FOUND.003
[2011.01.09 03:03:43 | 000,000,000 | ---D | C] -- C:\_OTL
[2011.01.08 21:28:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator\Bureau\OTL
[2011.01.07 00:41:24 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2011.01.05 15:07:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator\Bureau
[2011.01.05 10:11:02 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndproxy.sys
[2011.01.05 00:27:12 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wab.exe
[2011.01.04 18:44:07 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010.12.16 09:47:52 | 001,345,624 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\administrator\Bureau\TDSSKiller.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.01.11 23:05:04 | 000,001,064 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.01.11 23:04:46 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.01.11 23:04:44 | 500,748,288 | -HS- | M] () -- C:\hiberfil.sys
[2011.01.11 21:34:04 | 000,001,068 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.01.11 00:39:08 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.01.09 07:29:44 | 000,016,384 | R--- | M] () -- C:\32788R22FWJFW
[2011.01.09 03:09:56 | 004,150,950 | R--- | M] () -- C:\Documents and Settings\administrator\Bureau\ComboFix.exe
[2011.01.09 03:09:18 | 000,016,384 | --S- | M] () -- C:\ComboFix
[2011.01.08 16:01:54 | 000,000,574 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
[2011.01.08 16:01:54 | 000,000,569 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk
[2011.01.07 00:37:46 | 001,232,020 | ---- | M] () -- C:\Documents and Settings\administrator\Bureau\tdsskiller.zip
[2011.01.05 10:42:30 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.01.05 10:08:06 | 000,177,856 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.01.04 18:44:10 | 000,000,332 | RHS- | M] () -- C:\boot.ini
[2011.01.03 19:16:18 | 000,000,235 | ---- | M] () -- C:\WINDOWS\FlashSaver.dat
[2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.12.20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.12.16 09:47:52 | 001,345,624 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\administrator\Bureau\TDSSKiller.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.01.09 03:10:01 | 000,016,384 | R--- | C] () -- C:\32788R22FWJFW
[2011.01.09 03:09:17 | 000,016,384 | --S- | C] () -- C:\ComboFix
[2011.01.07 00:37:36 | 001,232,020 | ---- | C] () -- C:\Documents and Settings\administrator\Bureau\tdsskiller.zip
[2011.01.05 21:08:21 | 004,150,950 | R--- | C] () -- C:\Documents and Settings\administrator\Bureau\ComboFix.exe
[2011.01.05 01:15:30 | 000,001,355 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2011.01.05 00:23:18 | 500,748,288 | -HS- | C] () -- C:\hiberfil.sys
[2011.01.04 18:44:09 | 000,000,216 | ---- | C] () -- C:\Boot.bak
[2011.01.04 18:44:08 | 000,263,488 | RHS- | C] () -- C:\cmldr
[2008.06.01 12:48:48 | 000,000,502 | ---- | C] () -- C:\WINDOWS\dcd.ini
[2007.11.23 14:38:07 | 000,000,731 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2007.11.23 14:37:46 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2006.12.24 18:25:45 | 000,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html
[2006.08.14 10:29:27 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006.08.13 20:52:08 | 000,000,385 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006.08.12 13:49:37 | 000,643,072 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2006.08.12 13:49:37 | 000,096,384 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd2541.sys
[2006.08.12 05:00:05 | 000,000,494 | ---- | C] () -- C:\WINDOWS\System32\eRLog.ini
[2006.08.12 04:46:21 | 000,002,772 | ---- | C] () -- C:\WINDOWS\AntiV.INI
[2005.12.01 00:24:56 | 000,037,754 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005.08.09 08:54:00 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005.08.09 08:51:42 | 000,000,319 | ---- | C] () -- C:\WINDOWS\uninstall.ini
[2005.08.09 08:51:42 | 000,000,033 | ---- | C] () -- C:\WINDOWS\Acer.ini
[2005.08.06 20:34:54 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2005.08.06 20:16:04 | 000,100,873 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2005.08.06 20:09:22 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005.03.28 00:45:26 | 000,000,097 | ---- | C] () -- C:\WINDOWS\ALaunch.ini
[2005.03.03 23:51:52 | 000,083,997 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini
[2004.12.17 01:14:44 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2004.09.06 23:23:16 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2004.08.05 05:00:00 | 000,003,712 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2002.03.21 15:39:02 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
[2001.07.05 09:19:12 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini

< End of report >
PascalB
Libellulien Junior
Libellulien Junior
 
Messages: 144
Inscription: 07 Déc 2010 17:50

Re: Divers problèmes - Infection ?

Messagepar nardino » 12 Jan 2011 09:52

Bonjour
Vérifie l'absence des ces deux fichiers
C:\WINDOWS\System32\Drivers\dtscsi.sys
C:\WINDOWS\System32\Drivers\sptd.sys
@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: Divers problèmes - Infection ?

Messagepar PascalB » 12 Jan 2011 10:24

Y avait 2 fichiers vides de 0 Ko sans extension avec ces noms, je les ai virés sans problème.

Merci, j'attends les ordres :supers:
PascalB
Libellulien Junior
Libellulien Junior
 
Messages: 144
Inscription: 07 Déc 2010 17:50

Re: Divers problèmes - Infection ?

Messagepar nardino » 12 Jan 2011 11:02

Bonjour
Faisons le point.
Quels sont les éventuels problèmes encore présents ?
@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: Divers problèmes - Infection ?

Messagepar PascalB » 12 Jan 2011 13:41

Je sais pas, ça fait depuis le début que y avait que le clavier/pad qui dérangeaient vraiment. Le reste pas trop. Le problème c'est qu'entre temps on a trouvé plein de trucs donc est-ce que le fait que ça aille bien veut dire que la machine est clean, je sais pas :?
PascalB
Libellulien Junior
Libellulien Junior
 
Messages: 144
Inscription: 07 Déc 2010 17:50

Re: Divers problèmes - Infection ?

Messagepar nardino » 12 Jan 2011 22:35

Bonsoir
Nous allons maintenant nettoyer les outils utilisés.
**Suppression de ZHPDiag**
Explication en image.
**Suppression de Combofix**
Dans le menu Démarrer :
    -Sous XP > Exécuter > tape combofix /uninstall valide par Entrer ou OK
    -Sous Vista> Dans la barre Rechercher ou Exécuter > tape combofix /uninstall valide par Entrer ou OK
Un message t'avertira de la bonne suppression de l'outil
Supprime le rapport C:\Combofix.txt
**Suppression de TDSSKiller**
Supprime le fichier téléchargé et le rapport enregistré en C.
** Suppression de Ad-Remover**
Clique sur le bouton Désinstaller
**Suppression de OTL**
Lance OTL et clique sur le bouton [Purge outils].
**Création d'un point sain de restauration système**
Désactive la restauration système comme indiqué sur ce lien :
Et réactive-la pour recréer automatiquement un point sain de toute infection.
**Informations**
Les dangers du P2P
Conseils de prévention (fichier pdf nécessitant Adobe reader ou Foxit Reader ou PDFXViewer)
Le danger des cracks

**Fermeture du sujet**
Tu peux éditer le titre de ta question de base et y ajouter [résolu].

@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Précédente

Retourner vers Désinfections et demandes d'analyse

Qui est en ligne

Utilisateurs parcourant ce forum: Aucun utilisateur enregistré et 0 invités