Modérateur: Modérateurs
par PascalB » 08 Jan 2011 16:01
par PascalB » 08 Jan 2011 16:10
par nardino » 08 Jan 2011 19:13
par PascalB » 08 Jan 2011 21:33
OTL logfile created on: 08.01.2011 21:30:11 - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\administrator\Bureau\OTL
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000100C | Country: Suisse | Language: FRS | Date Format: dd.MM.yyyy
477.00 Mb Total Physical Memory | 177.00 Mb Available Physical Memory | 37.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 25.74 Gb Total Space | 13.16 Gb Free Space | 51.11% Space Free | Partition Type: FAT32
Drive D: | 26.22 Gb Total Space | 12.64 Gb Free Space | 48.18% Space Free | Partition Type: FAT32
Computer Name: LYON | User Name: administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\administrator\Bureau\OTL\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Acer\eManager\anbmServ.exe (OSA Technologies Inc.)
========== Modules (SafeList) ==========
MOD - C:\Documents and Settings\administrator\Bureau\OTL\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (PEVSystemStart) -- C:\ComboFix\PEV.cfx File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (anbmService) -- C:\Acer\eManager\anbmServ.exe (OSA Technologies Inc.)
SRV - (ose) -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (dtscsi) -- C:\WINDOWS\System32\Drivers\dtscsi.sys ()
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (NTIDrvr) -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (osaio) -- C:\WINDOWS\system32\drivers\osaio.sys (OSA Technologies, An Avocent Company)
DRV - (SiS315) -- C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp) -- C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (osanbm) -- C:\WINDOWS\system32\drivers\osanbm.sys (Windows (R) 2000 DDK provider)
DRV - (AR5211) -- C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (UBHelper) -- C:\WINDOWS\System32\drivers\UBHelper.sys ()
DRV - (HSFHWSIS) -- C:\WINDOWS\system32\drivers\HSFHWSIS.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (DKbFltr) -- C:\WINDOWS\system32\drivers\DKbFltr.SYS (Dritek System Inc.)
DRV - (SISNICXP) -- C:\WINDOWS\system32\drivers\sisnicxp.sys (SiS Corporation)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (SISAGP) -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1161013204-3124289045-2251734291-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com
IE - HKU\S-1-5-21-1161013204-3124289045-2251734291-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2006.08.12 18:08:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2006.08.12 18:08:42 | 000,000,000 | ---D | M]
[2010.04.06 21:42:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\administrator\Application Data\Mozilla\Extensions
[2006.08.12 18:08:54 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\administrator\Application Data\Mozilla\Firefox\Profiles\31etqchs.default\extensions
[2006.08.12 18:08:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2009.08.05 09:57:32 | 000,000,748 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\MediaDICO-fr.xml
[2009.08.05 09:57:32 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml
[2009.08.05 09:57:32 | 000,000,757 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml
[2009.08.05 09:57:32 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml
[2009.08.05 09:57:32 | 000,000,652 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml
O1 HOSTS File: ([2004.08.05 05:00:00 | 000,000,790 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1161013204-3124289045-2251734291-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1161013204-3124289045-2251734291-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microso ... 9386753445 (MUWebControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - Reg Error: Key error. File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Fichiers communs\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.08.06 20:34:30 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011.01.08 21:28:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator\Bureau\OTL
[2011.01.08 16:11:00 | 000,000,000 | -HSD | C] -- C:\FOUND.016
[2011.01.08 15:56:44 | 000,000,000 | -HSD | C] -- C:\FOUND.015
[2011.01.07 16:14:20 | 000,000,000 | -HSD | C] -- C:\FOUND.014
[2011.01.07 00:41:24 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2011.01.07 00:35:54 | 000,000,000 | -HSD | C] -- C:\FOUND.013
[2011.01.05 15:07:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator\Bureau
[2011.01.05 14:51:43 | 000,000,000 | -HSD | C] -- C:\FOUND.003
[2011.01.05 10:39:12 | 000,000,000 | -HSD | C] -- C:\FOUND.012
[2011.01.05 10:11:02 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndproxy.sys
[2011.01.05 01:04:20 | 000,000,000 | -HSD | C] -- C:\FOUND.011
[2011.01.05 00:27:12 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wab.exe
[2011.01.05 00:23:10 | 000,000,000 | -HSD | C] -- C:\FOUND.010
[2011.01.04 18:44:07 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011.01.03 18:52:56 | 000,000,000 | -HSD | C] -- C:\FOUND.009
[2010.12.16 09:47:52 | 001,345,624 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\administrator\Bureau\TDSSKiller.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011.01.08 21:25:04 | 000,001,068 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.01.08 16:11:28 | 000,001,064 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.01.08 16:11:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.01.08 16:11:06 | 500,748,288 | -HS- | M] () -- C:\hiberfil.sys
[2011.01.08 16:01:54 | 000,000,574 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
[2011.01.08 16:01:54 | 000,000,569 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk
[2011.01.07 16:03:36 | 004,149,824 | R--- | M] () -- C:\Documents and Settings\administrator\Bureau\ComboFix.exe
[2011.01.07 00:37:46 | 001,232,020 | ---- | M] () -- C:\Documents and Settings\administrator\Bureau\tdsskiller.zip
[2011.01.07 00:36:08 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.01.05 10:42:30 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.01.05 10:08:06 | 000,177,856 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.01.04 18:44:10 | 000,000,332 | RHS- | M] () -- C:\boot.ini
[2011.01.03 19:16:18 | 000,000,235 | ---- | M] () -- C:\WINDOWS\FlashSaver.dat
[2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.12.20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.12.16 09:47:52 | 001,345,624 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\administrator\Bureau\TDSSKiller.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011.01.07 00:37:36 | 001,232,020 | ---- | C] () -- C:\Documents and Settings\administrator\Bureau\tdsskiller.zip
[2011.01.05 21:08:21 | 004,149,824 | R--- | C] () -- C:\Documents and Settings\administrator\Bureau\ComboFix.exe
[2011.01.05 01:15:30 | 000,001,355 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2011.01.05 00:23:18 | 500,748,288 | -HS- | C] () -- C:\hiberfil.sys
[2011.01.04 18:44:09 | 000,000,216 | ---- | C] () -- C:\Boot.bak
[2011.01.04 18:44:08 | 000,263,488 | RHS- | C] () -- C:\cmldr
[2008.06.01 12:48:48 | 000,000,502 | ---- | C] () -- C:\WINDOWS\dcd.ini
[2007.11.23 14:38:07 | 000,000,731 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2007.11.23 14:37:46 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2006.12.24 18:25:45 | 000,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html
[2006.08.14 10:29:27 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006.08.13 20:52:08 | 000,000,385 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006.08.12 13:51:10 | 000,223,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\dtscsi.sys
[2006.08.12 13:49:37 | 000,643,072 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2006.08.12 13:49:37 | 000,096,384 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd2541.sys
[2006.08.12 05:00:05 | 000,000,494 | ---- | C] () -- C:\WINDOWS\System32\eRLog.ini
[2006.08.12 04:46:21 | 000,002,772 | ---- | C] () -- C:\WINDOWS\AntiV.INI
[2005.12.01 00:24:56 | 000,037,754 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005.08.09 08:54:00 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005.08.09 08:51:42 | 000,000,319 | ---- | C] () -- C:\WINDOWS\uninstall.ini
[2005.08.09 08:51:42 | 000,000,033 | ---- | C] () -- C:\WINDOWS\Acer.ini
[2005.08.06 20:34:54 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2005.08.06 20:16:04 | 000,100,873 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2005.08.06 20:09:22 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005.03.28 00:45:26 | 000,000,097 | ---- | C] () -- C:\WINDOWS\ALaunch.ini
[2005.03.03 23:51:52 | 000,083,997 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini
[2004.12.17 01:14:44 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2004.09.06 23:23:16 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2004.08.05 05:00:00 | 000,003,712 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2002.03.21 15:39:02 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
[2001.07.05 09:19:12 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
========== LOP Check ==========
[2006.08.13 23:53:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ACD Systems
[2007.12.12 15:45:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NtiDvdCopy
[2006.08.13 20:59:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jeannine\Application Data\uTorrent
[2006.08.13 23:19:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jeannine\Application Data\ACD Systems
[2008.06.01 12:46:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jeannine\Application Data\Directories CD
[2008.06.01 12:48:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jeannine\Application Data\DirectoriesAG
[2006.08.12 14:11:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\administrator\Application Data\uTorrent
[2006.08.12 15:23:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\administrator\Application Data\ACD Systems
========== Purity Check ==========
< End of report >
par nardino » 08 Jan 2011 22:42
:OTL
[2011.01.08 16:11:00 | 000,000,000 | -HSD | C] -- C:\FOUND.016
[2011.01.08 15:56:44 | 000,000,000 | -HSD | C] -- C:\FOUND.015
[2011.01.07 16:14:20 | 000,000,000 | -HSD | C] -- C:\FOUND.014
[2011.01.07 00:35:54 | 000,000,000 | -HSD | C] -- C:\FOUND.013
[2011.01.05 14:51:43 | 000,000,000 | -HSD | C] -- C:\FOUND.003
[2011.01.05 10:39:12 | 000,000,000 | -HSD | C] -- C:\FOUND.012
[2011.01.05 01:04:20 | 000,000,000 | -HSD | C] -- C:\FOUND.011
[2011.01.05 00:23:10 | 000,000,000 | -HSD | C] -- C:\FOUND.010
[2011.01.03 18:52:56 | 000,000,000 | -HSD | C] -- C:\FOUND.009
Tu cliques sur Analyse rapide./md5start
dtscsi.sys
sptd.sys
sptd2541.sys
/md5stop
par PascalB » 09 Jan 2011 03:07
========== OTL ==========
C:\FOUND.016 folder moved successfully.
C:\FOUND.015 folder moved successfully.
C:\FOUND.014 folder moved successfully.
C:\FOUND.013 folder moved successfully.
C:\FOUND.003 folder moved successfully.
C:\FOUND.012 folder moved successfully.
C:\FOUND.011 folder moved successfully.
C:\FOUND.010 folder moved successfully.
C:\FOUND.009 folder moved successfully.
OTL by OldTimer - Version 3.2.20.1 log created on 01092011_030343
OTL logfile created on: 09.01.2011 03:04:39 - Run 2
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\administrator\Bureau\OTL
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000100C | Country: Suisse | Language: FRS | Date Format: dd.MM.yyyy
477.00 Mb Total Physical Memory | 178.00 Mb Available Physical Memory | 37.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 25.74 Gb Total Space | 13.20 Gb Free Space | 51.29% Space Free | Partition Type: FAT32
Drive D: | 26.22 Gb Total Space | 12.64 Gb Free Space | 48.18% Space Free | Partition Type: FAT32
Computer Name: LYON | User Name: administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\administrator\Bureau\OTL\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Acer\eManager\anbmServ.exe (OSA Technologies Inc.)
========== Modules (SafeList) ==========
MOD - C:\Documents and Settings\administrator\Bureau\OTL\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (PEVSystemStart) -- C:\ComboFix\PEV.cfx File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (anbmService) -- C:\Acer\eManager\anbmServ.exe (OSA Technologies Inc.)
SRV - (ose) -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (dtscsi) -- C:\WINDOWS\System32\Drivers\dtscsi.sys ()
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (NTIDrvr) -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (osaio) -- C:\WINDOWS\system32\drivers\osaio.sys (OSA Technologies, An Avocent Company)
DRV - (SiS315) -- C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp) -- C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (osanbm) -- C:\WINDOWS\system32\drivers\osanbm.sys (Windows (R) 2000 DDK provider)
DRV - (AR5211) -- C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (UBHelper) -- C:\WINDOWS\System32\drivers\UBHelper.sys ()
DRV - (HSFHWSIS) -- C:\WINDOWS\system32\drivers\HSFHWSIS.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (DKbFltr) -- C:\WINDOWS\system32\drivers\DKbFltr.SYS (Dritek System Inc.)
DRV - (SISNICXP) -- C:\WINDOWS\system32\drivers\sisnicxp.sys (SiS Corporation)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (SISAGP) -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2006.08.12 18:08:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2006.08.12 18:08:42 | 000,000,000 | ---D | M]
[2010.04.06 21:42:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\administrator\Application Data\Mozilla\Extensions
[2006.08.12 18:08:54 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\administrator\Application Data\Mozilla\Firefox\Profiles\31etqchs.default\extensions
[2006.08.12 18:08:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2009.08.05 09:57:32 | 000,000,748 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\MediaDICO-fr.xml
[2009.08.05 09:57:32 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml
[2009.08.05 09:57:32 | 000,000,757 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml
[2009.08.05 09:57:32 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml
[2009.08.05 09:57:32 | 000,000,652 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml
O1 HOSTS File: ([2004.08.05 05:00:00 | 000,000,790 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microso ... 9386753445 (MUWebControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - Reg Error: Key error. File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Fichiers communs\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.08.06 20:34:30 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011.01.09 03:03:43 | 000,000,000 | ---D | C] -- C:\_OTL
[2011.01.08 21:28:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator\Bureau\OTL
[2011.01.07 00:41:24 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2011.01.05 15:07:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator\Bureau
[2011.01.04 18:44:07 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010.12.16 09:47:52 | 001,345,624 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\administrator\Bureau\TDSSKiller.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011.01.09 03:02:24 | 000,001,064 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.01.09 03:02:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.01.09 03:02:08 | 500,748,288 | -HS- | M] () -- C:\hiberfil.sys
[2011.01.08 21:34:02 | 000,001,068 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.01.08 16:01:54 | 000,000,574 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
[2011.01.08 16:01:54 | 000,000,569 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk
[2011.01.07 16:03:36 | 004,149,824 | R--- | M] () -- C:\Documents and Settings\administrator\Bureau\ComboFix.exe
[2011.01.07 00:37:46 | 001,232,020 | ---- | M] () -- C:\Documents and Settings\administrator\Bureau\tdsskiller.zip
[2011.01.07 00:36:08 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.01.05 10:42:30 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.01.05 10:08:06 | 000,177,856 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.01.04 18:44:10 | 000,000,332 | RHS- | M] () -- C:\boot.ini
[2011.01.03 19:16:18 | 000,000,235 | ---- | M] () -- C:\WINDOWS\FlashSaver.dat
[2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.12.20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.12.16 09:47:52 | 001,345,624 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\administrator\Bureau\TDSSKiller.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011.01.07 00:37:36 | 001,232,020 | ---- | C] () -- C:\Documents and Settings\administrator\Bureau\tdsskiller.zip
[2011.01.05 21:08:21 | 004,149,824 | R--- | C] () -- C:\Documents and Settings\administrator\Bureau\ComboFix.exe
[2011.01.05 01:15:30 | 000,001,355 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2011.01.05 00:23:18 | 500,748,288 | -HS- | C] () -- C:\hiberfil.sys
[2011.01.04 18:44:09 | 000,000,216 | ---- | C] () -- C:\Boot.bak
[2011.01.04 18:44:08 | 000,263,488 | RHS- | C] () -- C:\cmldr
[2008.06.01 12:48:48 | 000,000,502 | ---- | C] () -- C:\WINDOWS\dcd.ini
[2007.11.23 14:38:07 | 000,000,731 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2007.11.23 14:37:46 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2006.12.24 18:25:45 | 000,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html
[2006.08.14 10:29:27 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006.08.13 20:52:08 | 000,000,385 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006.08.12 13:51:10 | 000,223,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\dtscsi.sys
[2006.08.12 13:49:37 | 000,643,072 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2006.08.12 13:49:37 | 000,096,384 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd2541.sys
[2006.08.12 05:00:05 | 000,000,494 | ---- | C] () -- C:\WINDOWS\System32\eRLog.ini
[2006.08.12 04:46:21 | 000,002,772 | ---- | C] () -- C:\WINDOWS\AntiV.INI
[2005.12.01 00:24:56 | 000,037,754 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005.08.09 08:54:00 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005.08.09 08:51:42 | 000,000,319 | ---- | C] () -- C:\WINDOWS\uninstall.ini
[2005.08.09 08:51:42 | 000,000,033 | ---- | C] () -- C:\WINDOWS\Acer.ini
[2005.08.06 20:34:54 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2005.08.06 20:16:04 | 000,100,873 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2005.08.06 20:09:22 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005.03.28 00:45:26 | 000,000,097 | ---- | C] () -- C:\WINDOWS\ALaunch.ini
[2005.03.03 23:51:52 | 000,083,997 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini
[2004.12.17 01:14:44 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2004.09.06 23:23:16 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2004.08.05 05:00:00 | 000,003,712 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2002.03.21 15:39:02 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
[2001.07.05 09:19:12 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
========== LOP Check ==========
[2006.08.13 23:53:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ACD Systems
[2007.12.12 15:45:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NtiDvdCopy
[2006.08.12 14:11:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\administrator\Application Data\uTorrent
[2006.08.12 15:23:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\administrator\Application Data\ACD Systems
========== Purity Check ==========
========== Custom Scans ==========
< MD5 for: DTSCSI.SYS >
[2006.08.12 13:51:12 | 000,223,128 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\dtscsi.sys
< MD5 for: SPTD.SYS >
[2006.08.12 13:49:38 | 000,643,072 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys
< MD5 for: SPTD2541.SYS >
[2008.12.30 14:28:32 | 000,096,384 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd2541.sys
< End of report >
par nardino » 10 Jan 2011 22:35
par PascalB » 10 Jan 2011 22:56
par nardino » 10 Jan 2011 23:57
par PascalB » 11 Jan 2011 00:44
par nardino » 11 Jan 2011 16:18
par PascalB » 11 Jan 2011 23:12
OTL logfile created on: 11.01.2011 23:10:11 - Run 3
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\administrator\Bureau\OTL
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000100C | Country: Suisse | Language: FRS | Date Format: dd.MM.yyyy
477.00 Mb Total Physical Memory | 206.00 Mb Available Physical Memory | 43.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 25.74 Gb Total Space | 13.16 Gb Free Space | 51.14% Space Free | Partition Type: FAT32
Drive D: | 26.22 Gb Total Space | 12.64 Gb Free Space | 48.18% Space Free | Partition Type: FAT32
Computer Name: LYON | User Name: administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\administrator\Bureau\OTL\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Acer\eManager\anbmServ.exe (OSA Technologies Inc.)
========== Modules (SafeList) ==========
MOD - C:\Documents and Settings\administrator\Bureau\OTL\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (PEVSystemStart) -- C:\ComboFix\PEV.cfx File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (anbmService) -- C:\Acer\eManager\anbmServ.exe (OSA Technologies Inc.)
SRV - (ose) -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (dtscsi) -- C:\WINDOWS\System32\Drivers\dtscsi.sys (DT Soft Ltd.)
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (NTIDrvr) -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (osaio) -- C:\WINDOWS\system32\drivers\osaio.sys (OSA Technologies, An Avocent Company)
DRV - (SiS315) -- C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp) -- C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (osanbm) -- C:\WINDOWS\system32\drivers\osanbm.sys (Windows (R) 2000 DDK provider)
DRV - (AR5211) -- C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (UBHelper) -- C:\WINDOWS\System32\drivers\UBHelper.sys ()
DRV - (HSFHWSIS) -- C:\WINDOWS\system32\drivers\HSFHWSIS.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (DKbFltr) -- C:\WINDOWS\system32\drivers\DKbFltr.SYS (Dritek System Inc.)
DRV - (SISNICXP) -- C:\WINDOWS\system32\drivers\sisnicxp.sys (SiS Corporation)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (SISAGP) -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2006.08.12 18:08:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2006.08.12 18:08:42 | 000,000,000 | ---D | M]
[2010.04.06 21:42:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\administrator\Application Data\Mozilla\Extensions
[2006.08.12 18:08:54 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\administrator\Application Data\Mozilla\Firefox\Profiles\31etqchs.default\extensions
[2006.08.12 18:08:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2009.08.05 09:57:32 | 000,000,748 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\MediaDICO-fr.xml
[2009.08.05 09:57:32 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml
[2009.08.05 09:57:32 | 000,000,757 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml
[2009.08.05 09:57:32 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml
[2009.08.05 09:57:32 | 000,000,652 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml
O1 HOSTS File: ([2004.08.05 05:00:00 | 000,000,790 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microso ... 9386753445 (MUWebControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - Reg Error: Key error. File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Fichiers communs\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.08.06 20:34:30 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011.01.11 00:38:52 | 000,000,000 | -HSD | C] -- C:\FOUND.003
[2011.01.09 03:03:43 | 000,000,000 | ---D | C] -- C:\_OTL
[2011.01.08 21:28:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator\Bureau\OTL
[2011.01.07 00:41:24 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2011.01.05 15:07:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\administrator\Bureau
[2011.01.05 10:11:02 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndproxy.sys
[2011.01.05 00:27:12 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wab.exe
[2011.01.04 18:44:07 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010.12.16 09:47:52 | 001,345,624 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\administrator\Bureau\TDSSKiller.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011.01.11 23:05:04 | 000,001,064 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.01.11 23:04:46 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.01.11 23:04:44 | 500,748,288 | -HS- | M] () -- C:\hiberfil.sys
[2011.01.11 21:34:04 | 000,001,068 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.01.11 00:39:08 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.01.09 07:29:44 | 000,016,384 | R--- | M] () -- C:\32788R22FWJFW
[2011.01.09 03:09:56 | 004,150,950 | R--- | M] () -- C:\Documents and Settings\administrator\Bureau\ComboFix.exe
[2011.01.09 03:09:18 | 000,016,384 | --S- | M] () -- C:\ComboFix
[2011.01.08 16:01:54 | 000,000,574 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
[2011.01.08 16:01:54 | 000,000,569 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk
[2011.01.07 00:37:46 | 001,232,020 | ---- | M] () -- C:\Documents and Settings\administrator\Bureau\tdsskiller.zip
[2011.01.05 10:42:30 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.01.05 10:08:06 | 000,177,856 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.01.04 18:44:10 | 000,000,332 | RHS- | M] () -- C:\boot.ini
[2011.01.03 19:16:18 | 000,000,235 | ---- | M] () -- C:\WINDOWS\FlashSaver.dat
[2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.12.20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.12.16 09:47:52 | 001,345,624 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\administrator\Bureau\TDSSKiller.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011.01.09 03:10:01 | 000,016,384 | R--- | C] () -- C:\32788R22FWJFW
[2011.01.09 03:09:17 | 000,016,384 | --S- | C] () -- C:\ComboFix
[2011.01.07 00:37:36 | 001,232,020 | ---- | C] () -- C:\Documents and Settings\administrator\Bureau\tdsskiller.zip
[2011.01.05 21:08:21 | 004,150,950 | R--- | C] () -- C:\Documents and Settings\administrator\Bureau\ComboFix.exe
[2011.01.05 01:15:30 | 000,001,355 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2011.01.05 00:23:18 | 500,748,288 | -HS- | C] () -- C:\hiberfil.sys
[2011.01.04 18:44:09 | 000,000,216 | ---- | C] () -- C:\Boot.bak
[2011.01.04 18:44:08 | 000,263,488 | RHS- | C] () -- C:\cmldr
[2008.06.01 12:48:48 | 000,000,502 | ---- | C] () -- C:\WINDOWS\dcd.ini
[2007.11.23 14:38:07 | 000,000,731 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2007.11.23 14:37:46 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2006.12.24 18:25:45 | 000,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html
[2006.08.14 10:29:27 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006.08.13 20:52:08 | 000,000,385 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006.08.12 13:49:37 | 000,643,072 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2006.08.12 13:49:37 | 000,096,384 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd2541.sys
[2006.08.12 05:00:05 | 000,000,494 | ---- | C] () -- C:\WINDOWS\System32\eRLog.ini
[2006.08.12 04:46:21 | 000,002,772 | ---- | C] () -- C:\WINDOWS\AntiV.INI
[2005.12.01 00:24:56 | 000,037,754 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005.08.09 08:54:00 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005.08.09 08:51:42 | 000,000,319 | ---- | C] () -- C:\WINDOWS\uninstall.ini
[2005.08.09 08:51:42 | 000,000,033 | ---- | C] () -- C:\WINDOWS\Acer.ini
[2005.08.06 20:34:54 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2005.08.06 20:34:08 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2005.08.06 20:16:04 | 000,100,873 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2005.08.06 20:09:22 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005.03.28 00:45:26 | 000,000,097 | ---- | C] () -- C:\WINDOWS\ALaunch.ini
[2005.03.03 23:51:52 | 000,083,997 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini
[2004.12.17 01:14:44 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2004.09.06 23:23:16 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2004.08.05 05:00:00 | 000,003,712 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2002.03.21 15:39:02 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
[2001.07.05 09:19:12 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
< End of report >
par nardino » 12 Jan 2011 09:52
par PascalB » 12 Jan 2011 10:24
par nardino » 12 Jan 2011 11:02
par PascalB » 12 Jan 2011 13:41
par nardino » 12 Jan 2011 22:35