infection qui ne veut pas se supprimer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:08:18, on 11/02/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\\WINDOWS\\System32\\smss.exe
D:\\WINDOWS\\system32\\csrss.exe
D:\\WINDOWS\\system32\\winlogon.exe
D:\\WINDOWS\\system32\\services.exe
D:\\WINDOWS\\system32\\lsass.exe
D:\\WINDOWS\\system32\\svchost.exe
D:\\WINDOWS\\system32\\svchost.exe
D:\\WINDOWS\\System32\\svchost.exe
D:\\WINDOWS\\system32\\svchost.exe
D:\\WINDOWS\\system32\\svchost.exe
D:\\WINDOWS\\system32\\svchost.exe
D:\\Program Files\\Alwil Software\\Avast4\\aswUpdSv.exe
D:\\Program Files\\Alwil Software\\Avast4\\ashServ.exe
D:\\WINDOWS\\system32\\spoolsv.exe
D:\\WINDOWS\\system32\\WgaTray.exe
D:\\WINDOWS\\Explorer.EXE
D:\\Program Files\\Hotkey\\Hotkey.exe
D:\\Program Files\\USB Keyboard Driver\\kb_2k.exe
D:\\Program Files\\FlashGet\\FlashGet.exe
D:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe
D:\\PROGRA~1\\SPYWAR~1\\SpywareTerminatorShield.exe
D:\\Program Files\\Spyware Doctor\\pctsTray.exe
D:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe
D:\\Program Files\\Lavasoft\\Ad-Aware\\AAWTray.exe
D:\\Program Files\\Nokia\\Nokia PC Suite 7\\PCSuite.exe
D:\\Program Files\\Messenger\\msmsgs.exe
D:\\WINDOWS\\system32\\sistray.exe
D:\\Program Files\\WIDCOMM\\Logiciel Bluetooth\\bin\\btwdins.exe
D:\\Program Files\\Java\\jre6\\bin\\jqs.exe
D:\\Program Files\\Spyware Doctor\\pctsAuxs.exe
D:\\Program Files\\Spyware Doctor\\pctsSvc.exe
D:\\Program Files\\Spyware Terminator\\sp_rsser.exe
D:\\WINDOWS\\system32\\svchost.exe
D:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe
D:\\Program Files\\Alwil Software\\Avast4\\ashWebSv.exe
D:\\Program Files\\PC Connectivity Solution\\ServiceLayer.exe
D:\\WINDOWS\\system32\\wbem\\wmiapsrv.exe
D:\\WINDOWS\\System32\\alg.exe
D:\\Program Files\\PC Connectivity Solution\\Transports\\NclUSBSrv.exe
D:\\Program Files\\PC Connectivity Solution\\Transports\\NclRSSrv.exe
D:\\Program Files\\PC Connectivity Solution\\Transports\\NclBCBTSrv.exe
D:\\WINDOWS\\system32\\wuauclt.exe
D:\\Documents and Settings\\med\\Bureau\\algerian newspapers by bouzaloufe.exe.exe
D:\\DOCUME~1\\med\\LOCALS~1\\Temp\\RarSFX0\\Algerian Newspapers by BouzalouFe.exe
D:\\Program Files\\Alwil Software\\Avast4\\ashSimpl.exe
D:\\Program Files\\Alwil Software\\Avast4\\ashSimpl.exe
D:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe
D:\\WINDOWS\\system32\\wbem\\wmiprvse.exe

R1 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60446
R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60446
R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60446
R0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60446
R0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60446
R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - D:\\PROGRA~1\\Crawler\\ctbr.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\\Program Files\\Fichiers communs\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - D:\\PROGRA~1\\Crawler\\ctbr.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\\Program Files\\FlashGet\\jccatch.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\\Program Files\\Real\\RealPlayer\\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\\Program Files\\Java\\jre6\\bin\\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\\Program Files\\Google\\GoogleToolbarNotifier\\5.0.926.3450\\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\\Program Files\\Java\\jre6\\bin\\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\\Program Files\\Java\\jre6\\lib\\deploy\\jqs\\ie\\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\\Program Files\\FlashGet\\getflash.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - D:\\PROGRA~1\\Crawler\\ctbr.dll
O4 - HKLM\\..\\Run: [Hotkey] D:\\Program Files\\Hotkey\\Hotkey.exe
O4 - HKLM\\..\\Run: [USB Keyboard] D:\\Program Files\\USB Keyboard Driver\\kb_2k.exe
O4 - HKLM\\..\\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\\..\\Run: [Flashget] D:\\Program Files\\FlashGet\\FlashGet.exe /min
O4 - HKLM\\..\\Run: [TkBellExe] "D:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe" -osboot
O4 - HKLM\\..\\Run: [SpywareTerminator] "D:\\PROGRA~1\\SPYWAR~1\\SpywareTerminatorShield.exe"
O4 - HKLM\\..\\Run: [UserFaultCheck] %systemroot%\\system32\\dumprep 0 -u
O4 - HKLM\\..\\Run: [ISTray] "D:\\Program Files\\Spyware Doctor\\pctsTray.exe"
O4 - HKLM\\..\\Run: [avast!] D:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe
O4 - HKLM\\..\\Run: [Ad-Watch] D:\\Program Files\\Lavasoft\\Ad-Aware\\AAWTray.exe
O4 - HKLM\\..\\Run: [KernelFaultCheck] %systemroot%\\system32\\dumprep 0 -k
O4 - HKCU\\..\\Run: [PC Suite Tray] "D:\\Program Files\\Nokia\\Nokia PC Suite 7\\PCSuite.exe" -onlytray
O4 - HKCU\\..\\Run: [MSMSGS] "D:\\Program Files\\Messenger\\msmsgs.exe" /background
O4 - Global Startup: Utility Tray.lnk = D:\\WINDOWS\\system32\\sistray.exe
O8 - Extra context menu item: &Tout télécharger avec FlashGet - D:\\Program Files\\FlashGet\\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - D:\\Program Files\\FlashGet\\jc_link.htm
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\\Program Files\\WIDCOMM\\Logiciel Bluetooth\\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\\Program Files\\WIDCOMM\\Logiciel Bluetooth\\btsendto_ie.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\\Program Files\\FlashGet\\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\\Program Files\\FlashGet\\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\\Program Files\\Messenger\\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\\Program Files\\Messenger\\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\\windows\\system32\\nwprovau.dll
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{A2107830-9FA5-4B1A-9BF2-281816EB9EE3}: NameServer = 208.67.222.222 208.67.220.220
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\\PROGRA~1\\FICHIE~1\\Skype\\SKYPE4~1.DLL
O18 - Protocol: tbr - (no CLSID) - (no file)
O20 - Winlogon Notify: SafenSec - D:\\WINDOWS\\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\\Program Files\\Alwil Software\\Avast4\\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\\Program Files\\Alwil Software\\Avast4\\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\\Program Files\\Alwil Software\\Avast4\\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\\Program Files\\WIDCOMM\\Logiciel Bluetooth\\bin\\btwdins.exe
O23 - Service: Google Software Updater (gusvc) - Google - D:\\Program Files\\Google\\Common\\Google Updater\\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\\Program Files\\Java\\jre6\\bin\\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - D:\\Program Files\\Lavasoft\\Ad-Aware\\AAWService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\\Program Files\\Spyware Doctor\\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\\Program Files\\Spyware Doctor\\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - D:\\Program Files\\PC Connectivity Solution\\ServiceLayer.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\\Program Files\\Spyware Terminator\\sp_rsser.exe
O24 - Desktop Component 0: (no name) - http://upload.wikimedia.org/wikipedia/commons/thumb/5/59/Khaled-binwalid-mosque2.jpg/180px-Khaled-binwalid-mosque2.jpg

--
End of file - 8847 bytes
aidez-moi s.v.p j 'ai plus de song.............des adwares qui ne veulent pas partir............mon pc bloque toujours.je ne sais pas quoi faire!?..........voici les menaces: spyware known_Bad_Sites-......trogen generic.........

Bonjour,

Ton rapport hijackthis montre une barre d'outil néfaste (CrawlerToolbar). Elle s'est installée avec SpywareTerminator sous le nom trompeur de "Web Guard Security"... Je vais t'aider à la supprimer.

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.

• Lance l'installation du programme en exécutant le fichier téléchargé.
• Double-clique maintenant sur le raccourci de Toolbar-S&D.
• Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
• Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
• Poste le rapport généré. (C:\TB.txt)

-----------\\ ToolBar S&D 1.2.8 XP/Vista

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( Thu 02/12/2009|21:48 )

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\ADMINI~1\My Documents\Downloads\Compressed\ozomedia 8 _ setup\SIAF12_Crack OZO 8
C:\DOCUME~1\ADMINI~1\My Documents\Downloads\Compressed\ozomedia 8 _ setup\SIAF12_Crack OZO 8.rar
C:\DOCUME~1\ADMINI~1\My Documents\Downloads\Compressed\ozomedia 8 _ setup\SIAF12_Crack OZO 8\SIAF12_Crack OZO 8.exe
C:\DOCUME~1\ADMINI~1\My Documents\Downloads\Compressed\ozomedia 8 _ setup\SIAF12_Crack OZO 8\ ïںëں¢ ںé¢«¤ïé.txt
C:\DOCUME~1\ADMINI~1\Recent\SIAF12_Crack OZO 8.lnk

1 - "C:\ToolBar SD\TB_1.txt" - Thu 02/12/2009|21:48 - Option : [1]

-----------\\ Fin du rapport a 21:48:48.32

j ai ue un grand probleme.............mon pc ne voulait plus demmarer.........un message venait disant;.windows ne a pas pu demmarer car le fichier suivant est manquant : systeme32/drivers/ntsf ....vous pouvez tanter avec le cd.rom d insttalation de windows...........c etait pas possible .le programme d installation ne trouve pas le fichier .erreur n 4

Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1755
Windows 5.1.2600 Service Pack 2

12-02-2009 22:35:41
mbam-log-2009-02-12 (22-35-41).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 102248
Temps écoulé: 19 minute(s), 18 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\Administrator\Application Data\Desktopicon\eBayShortcuts.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cmdow.exe (Malware.Tool) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\videocore.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
je demande si se sont des virus et malwares qui ont provoker ces dommages ou c est autre chose? il y a plus de song?

Voila une probable explication de tes problèmes :

Citation :: C:\DOCUME~1\ADMINI~1\My Documents\Downloads\Compressed\ozomedia 8 _ setup\SIAF12_Crack OZO 8
C:\DOCUME~1\ADMINI~1\My Documents\Downloads\Compressed\ozomedia 8 _ setup\SIAF12_Crack OZO 8.rar
C:\DOCUME~1\ADMINI~1\My Documents\Downloads\Compressed\ozomedia 8 _ setup\SIAF12_Crack OZO 8\SIAF12_Crack OZO 8.exe
C:\DOCUME~1\ADMINI~1\My Documents\Downloads\Compressed\ozomedia 8 _ setup\SIAF12_Crack OZO 8\ ïںëں¢ ںé¢«¤ïé.txt

Les cracks installent très souvent des infections : le danger des cracks. Il faut les bannir complément...

Une fois que ce sera fait, passe à la suite stp :

• Télécharge Random's System Information Tool (RSIT) de random/random, et enregistre le sur ton Bureau.
• Double clique sur RSIT.exe pour lancer l'outil.
• Clique sur ' continue ' à l'écran Disclaimer.
• Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
• Une fois le scan terminé, deux rapports vont apparaitre. Poste le contenu de log.txt

info.txt logfile of random's system information tool 1.05 2009-02-13 21:44:20

======Uninstall list======

-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E06E4F4E-72D6-4497-BFFD-BCB43077C2F4}\setup.exe" -l0x9 -uninst
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
aljazeera news-->C:\Program Files\aljazeera news\Uninstal.exe
AntiCrash 3.6.1-->"C:\Program Files\Dachshund Software\AntiCrash\Uninstall.exe" "C:\Program Files\Dachshund Software\AntiCrash\install.log"
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Conjugaison-->MsiExec.exe /I{057AA4D8-559F-42B1-98A0-508303834B2E}
Easy Video to Audio Converter 1.2.8-->"C:\Program Files\Easy Video to Audio Converter\unins000.exe"
enhanced keyboard driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{79C25975-740E-436E-9327-C164831ADCE7}\setup.exe"
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
GTA San Andreas-->C:\Game\GTA-SA~1\UNWISE.EXE C:\Game\GTA-SA~1\INSTALL.LOG
GTA Vice City-->C:\PROGRA~1\ROCKST~1\GRANDT~1\UNWISE.EXE C:\PROGRA~1\ROCKST~1\GRANDT~1\INSTALL.LOG
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotkey 2.0-->"C:\Program Files\Hotkey\unins000.exe"
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Keyboard driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A64FA784-7795-11D8-86F5-0050BF6C9337}\Setup.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7-->"C:\WINDOWS\$NtUninstallWdf01007$\spuninst\spuninst.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110401-6000-11D3-8CFE-0150048383C9}
Mozilla Firefox (3.0.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MP3 Player Utilities 4.00-->MsiExec.exe /I{7784A172-61F1-445E-8368-601607E0DD22}
MSN Messenger 7.5-->MsiExec.exe /I{4AED0FF6-03EB-11DA-BFBD-00065BBDC0B5}
MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
Multimedia Keyboard Driver-->C:\PROGRA~1\MULTIK~1\UNWISE.EXE C:\PROGRA~1\MULTIK~1\INSTALL.LOG
Nokia Connectivity Cable Driver-->MsiExec.exe /X{15AC0C5D-A6FB-4CE2-8CD0-28179EEB5625}
Nokia PC Suite-->C:\Documents and Settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Nokia_PC_Suite_7_1_18_0_ara_web.exe
Nokia PC Suite-->MsiExec.exe /I{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}
PC Connectivity Solution-->MsiExec.exe /I{D848D140-41C3-4A53-86D8-E866A100B4CD}
ProjectWhois-->C:\Program Files\Domain Tools\ProjectWhois\ProjectWhoisUninstall.exe
Quote For Today: FREEWARE-->C:\Program Files\NauzNet Solutions\Quote For Today\FREEWARE\Uninstall.exe
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x9 -removeonly
SiS VGA Utilities-->Rundll32 SiSInst.dll,Uninstall VGA,R,oem1.inf
SiSAGP driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DC226AC9-0314-496C-BE6A-B6A132628466}\setup.exe" -l0x9
Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Spyware Terminator-->"C:\Program Files\Spyware Terminator\unins000.exe"
SpywareBlaster 4.1-->"C:\Program Files\SpywareBlaster\unins000.exe"
SuperCopier2-->"C:\Program Files\SuperCopier2\SC2Uninst.exe"
Unlocker 1.8.7-->C:\Program Files\Unlocker\uninst.exe
VideoLAN VLC media player 0.8.6f-->C:\Program Files\VideoLAN\VLC\uninstall.exe
WIDCOMM Bluetooth Software-->MsiExec.exe /X{3F4EC965-28EF-45C3-B063-04B25D4E9679}
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
أرشيف وينرار-->C:\Program Files\WinRAR\uninstall.exe
أوزو ميديا لتحويل الصوتيات والفيديو 8-->"C:\Program Files\Ozone\Audio Converter\unins000.exe"
حزمة برامج تشغيل Windows - Nokia Modem (10/27/2008 3.9)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_79486EC6AA0D1732FB17E5167077C07ECAE1B870\nokia_bluetooth.inf
حزمة برامج تشغيل Windows - Nokia Modem (10/27/2008 7.01.0.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_247189AEBF39EB69A7C75429610DFED2F2EDC1B6\nokbtmdm.inf
حزمة برامج تشغيل Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccsmcfd_A3B3916E5D8138F59EE218321B27B044D3B18294\pccsmcfd.inf

=====HijackThis Backups=====

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1231891963203
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - HKCU\..\Run: [IDMan] C:\Program Files\internet download manager\IDMan.exe /onboot
O4 - Global Startup: Bluetooth.lnk = ?
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O24 - Desktop Component 0: (no name) - http://vb.vip600.com/clientscript/yui/yahoo-dom-event/yahoo-dom-event.js?v=374
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')

Securitycenter WMI appears to be broken

System event log

Computer Name: LATANSALLAH
Event Code: 6006
Message: The Event log service was stopped.

Record Number: 640
Source Name: EventLog
Time Written: 20090112144001.000000+060
Event Type: information
User:

Computer Name: LATANSALLAH
Event Code: 20159
Message: The connection to easy made by user soughi57 using device PPPoE5-0 was disconnected.

Record Number: 639
Source Name: RemoteAccess
Time Written: 20090112143958.000000+060
Event Type: information
User:

Computer Name: LATANSALLAH
Event Code: 20158
Message: The user soughi57 successfully established a connection to easy using the device PPPoE5-0.

Record Number: 638
Source Name: RemoteAccess
Time Written: 20090112141449.000000+060
Event Type: information
User:

Computer Name: LATANSALLAH
Event Code: 7036
Message: The Computer Browser service entered the ‏‏متوقف state.

Record Number: 637
Source Name: Service Control Manager
Time Written: 20090112141427.000000+060
Event Type: information
User:

Computer Name: LATANSALLAH
Event Code: 7036
Message: The Remote Access Connection Manager service entered the ‏‏قيد التشغيل state.

Record Number: 636
Source Name: Service Control Manager
Time Written: 20090112141427.000000+060
Event Type: information
User:

Application event log

Computer Name: LATANSALLAH
Event Code: 1000
Message: ‏‏تم تحميل عدادات الأداء الخاصة بخدمة WmiApRpl (WmiApRpl)‎ بنجاح.
تحتوي "بيانات التسجيل" على قيم الفهرس الجديدة التي تم
تعيينها لهذه الخدمة.

Record Number: 5
Source Name: LoadPerf
Time Written: 20090106132647.000000+060
Event Type: information
User:

Computer Name: LATANSALLAH
Event Code: 1001
Message: ‏‏تمت إزالة عدادات الأداء الخاصة بخدمة WmiApRpl (WmiApRpl)‎ بنجاح.
تحتوي "بيانات التسجيل" على القيم الجديدة إدخالات التسجيل لــ "العداد الأخير"
و"التعليمات الأخيرة".

Record Number: 4
Source Name: LoadPerf
Time Written: 20090106132647.000000+060
Event Type: information
User:

Computer Name: LATANSALLAH
Event Code: 1000
Message: ‏‏تم تحميل عدادات الأداء الخاصة بخدمة WmiApRpl (WmiApRpl)‎ بنجاح.
تحتوي "بيانات التسجيل" على قيم الفهرس الجديدة التي تم
تعيينها لهذه الخدمة.

Record Number: 3
Source Name: LoadPerf
Time Written: 20090106132647.000000+060
Event Type: information
User:

Computer Name: LATANSALLAH
Event Code: 1000
Message: ‏‏تم تحميل عدادات الأداء الخاصة بخدمة TermService (Terminal Services)‎ بنجاح.
تحتوي "بيانات التسجيل" على قيم الفهرس الجديدة التي تم
تعيينها لهذه الخدمة.

Record Number: 2
Source Name: LoadPerf
Time Written: 20090106132644.000000+060
Event Type: information
User:

Computer Name: LATANSALLAH
Event Code: 1000
Message: ‏‏تم تحميل عدادات الأداء الخاصة بخدمة RemoteAccess (Routing and Remote Access)‎ بنجاح.
تحتوي "بيانات التسجيل" على قيم الفهرس الجديدة التي تم
تعيينها لهذه الخدمة.

Record Number: 1
Source Name: LoadPerf
Time Written: 20090106132619.000000+060
Event Type: information
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 6 Stepping 5, GenuineIntel
"PROCESSOR_REVISION"=0605
"NUMBER_OF_PROCESSORS"=2
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

-----------------EOF-----------------

Logfile of random's system information tool 1.05 (written by random/random)
Run by Administrator at 2009-02-13 21:44:15
Microsoft Windows XP Professional Service Pack 2
System drive C: has 39 GB (84%) free of 47 GB
Total RAM: 1471 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:44:19, on 13-02-2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\USB Keyboard Driver\kb_2k.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\Integrator.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Administrator\سطح المكتب\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\Administrator.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\internet download manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [USB Keyboard] C:\Program Files\USB Keyboard Driver\kb_2k.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\internet download manager\IDMan.exe /onboot
O4 - Startup: AntiCrash.lnk = C:\Program Files\Dachshund Software\AntiCrash\AntiCrash.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\internet download manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\internet download manager\IEExt.htm
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: أضف إلى قائمة الإعلان السوداء - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: إبراز - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: إفتح كلّ الوصلات في هذه الصفحة - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: إمنع كلّ الصور التي في نفس الخادم - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: افتح في متصفح الرائد مكرر - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: بحث - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=26688
O17 - HKLM\System\CCS\Services\Tcpip\..\{9F02399F-E16A-47E7-8A67-A7140F08D879}: NameServer = 208.67.222.222 208.67.220.220
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: SafenSec - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 6586 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - C:\Program Files\internet download manager\IDMIECC.dll [2005-12-21 61440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-07-07 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-01-14 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-01-14 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-01-14 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"USB Keyboard"=C:\Program Files\USB Keyboard Driver\kb_2k.exe [2004-03-30 155648]
"SiSPower"=C:\WINDOWS\system32\SiSPower.dll [2006-06-28 49152]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-06-20 577536]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2008-11-26 81000]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2009-01-25 1783808]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2009-01-06 180269]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2009-02-11 399504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"=C:\Program Files\SuperCopier2\SuperCopier2.exe [2006-07-07 1052672]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-07-07 2156368]
"IDMan"=C:\Program Files\internet download manager\IDMan.exe [2005-11-29 2195456]

C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe

C:\Documents and Settings\Administrator\قائمة ابدأ\البرامج\بدء التشغيل
AntiCrash.lnk - C:\Program Files\Dachshund Software\AntiCrash\AntiCrash.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SafenSec]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2004-08-04 239104]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
nwprovau

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NofolderOptions"=0
"NoRun"=0
"NoFind"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoFolderOptions"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e78d854-de21-11dd-a07f-001bb960272a}]
shell\AutoRun\command - F:\start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70214b7b-df4e-11dd-a083-001bb960272a}]
shell\AutoRun\command - RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sdcvhost.exe
shell\open\command - RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sdcvhost.exe

======List of files/folders created in the last 1 months======

2009-02-13 21:44:15 ----DC---- C:\rsit
2009-02-12 21:47:52 ----AC---- C:\TB.txt
2009-02-12 21:47:22 ----DC---- C:\ToolBar SD
2009-02-12 21:42:12 ----D---- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2009-02-12 21:42:06 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-02-12 21:42:06 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-02-11 17:24:38 ----AC---- C:\BIOSLOCK.INI
2009-02-11 00:42:47 ----DC---- C:\a17c314ec2b617a3adc7
2009-02-03 09:32:03 ----A---- C:\WINDOWS\system32\winitn.dll
2009-02-03 09:32:03 ----A---- C:\WINDOWS\system32\viscomwave.dll
2009-02-03 09:32:03 ----A---- C:\WINDOWS\system32\viscomtran.dll
2009-02-03 09:32:03 ----A---- C:\WINDOWS\system32\viscomsamplerate.dll
2009-02-03 09:32:02 ----A---- C:\WINDOWS\system32\viscomrmenc.dll
2009-02-03 09:32:02 ----A---- C:\WINDOWS\system32\viscomqtenc.dll
2009-02-03 09:32:02 ----A---- C:\WINDOWS\system32\viscomqtde.dll
2009-02-03 09:32:02 ----A---- C:\WINDOWS\system32\viscomm4aenc.dll
2009-02-03 09:32:02 ----A---- C:\WINDOWS\system32\viscomframe.dll
2009-02-03 09:32:02 ----A---- C:\WINDOWS\system32\viscomflvenc.dll
2009-02-03 09:32:02 ----A---- C:\WINDOWS\system32\viscomflvdec.dll
2009-02-03 09:32:01 ----A---- C:\WINDOWS\system32\viscomdata3.dll
2009-02-03 09:32:01 ----A---- C:\WINDOWS\system32\viscomdata2.dll
2009-02-03 09:32:01 ----A---- C:\WINDOWS\system32\viscomdata1.dll
2009-02-03 09:31:59 ----A---- C:\WINDOWS\system32\viscomavi.dll
2009-02-03 09:31:59 ----A---- C:\WINDOWS\system32\viscomaudioencoder.dll
2009-02-03 09:31:59 ----A---- C:\WINDOWS\system32\viscomaudiodata.dll
2009-02-03 09:31:59 ----A---- C:\WINDOWS\system32\viscomamrenc.dll
2009-02-03 09:31:59 ----A---- C:\WINDOWS\system32\kakle.dll
2009-02-03 09:31:58 ----A---- C:\WINDOWS\system32\viscom3gpenc.dll
2009-02-03 09:31:57 ----A---- C:\WINDOWS\system32\videotrans.dll
2009-02-03 09:31:57 ----A---- C:\WINDOWS\system32\videoformat.dll
2009-02-03 09:31:56 ----A---- C:\WINDOWS\system32\ALOWMVFile.dll
2009-02-03 09:31:55 ----A---- C:\WINDOWS\system32\videoencode.dll
2009-02-03 09:31:55 ----A---- C:\WINDOWS\system32\ssvideo.dll
2009-02-03 09:31:55 ----A---- C:\WINDOWS\system32\NMSDVDXU.dll
2009-02-03 09:31:55 ----A---- C:\WINDOWS\system32\ALOWMAFile2.dll
2009-02-03 09:31:55 ----A---- C:\WINDOWS\system32\ALOVideoFile.dll
2009-02-03 09:31:55 ----A---- C:\WINDOWS\system32\ALOVideoCoreM.dll
2009-02-03 09:31:54 ----A---- C:\WINDOWS\system32\ALOVideoCompress.dll
2009-02-03 09:31:54 ----A---- C:\WINDOWS\system32\ALOQuickTimeFile.dll
2009-02-03 09:31:54 ----A---- C:\WINDOWS\system32\ALOAVIFile.dll
2009-02-03 09:31:53 ----A---- C:\WINDOWS\system32\maag.dll
2009-02-03 09:31:53 ----A---- C:\WINDOWS\system32\dkll.dll
2009-02-03 09:31:53 ----A---- C:\WINDOWS\system32\ckll.dll
2009-02-03 09:31:53 ----A---- C:\WINDOWS\system32\ALOAudioFormatSettings3.dll
2009-02-03 09:31:53 ----A---- C:\WINDOWS\system32\ALOAudioFile2.dll
2009-02-03 09:31:53 ----A---- C:\WINDOWS\system32\agsaamh.dll
2009-02-03 09:31:53 ----A---- C:\WINDOWS\system32\agsaame.dll
2009-02-03 09:31:52 ----A---- C:\WINDOWS\system32\coredata.dll
2009-02-03 09:31:52 ----A---- C:\WINDOWS\system32\bkll.dll
2009-02-03 09:31:52 ----A---- C:\WINDOWS\system32\ALOAudioCompress3.dll
2009-02-03 09:31:52 ----A---- C:\WINDOWS\system32\akll.dll
2009-02-03 09:31:52 ----A---- C:\WINDOWS\system32\agsaamj.dll
2009-02-03 09:31:52 ----A---- C:\WINDOWS\system32\agsaamd.dll
2009-02-03 09:31:52 ----A---- C:\WINDOWS\system32\agsaamb.dll
2009-02-03 09:31:52 ----A---- C:\WINDOWS\system32\agsaama.dll
2009-02-03 09:31:51 ----A---- C:\WINDOWS\system32\ALOAudioCompress2.dll
2009-02-03 09:31:51 ----A---- C:\WINDOWS\system32\agsaami.dll
2009-02-03 09:31:51 ----A---- C:\WINDOWS\system32\agsaamg.dll
2009-02-03 09:31:51 ----A---- C:\WINDOWS\system32\agsaamc.dll
2009-02-03 09:31:44 ----A---- C:\WINDOWS\system32\coodest.dll
2009-02-03 09:31:43 ----A---- C:\WINDOWS\system32\lame_enc.dll
2009-02-03 09:31:12 ----A---- C:\WINDOWS\system32\osenxpsuite2005.dll
2009-02-03 09:31:05 ----A---- C:\WINDOWS\system32\msvcr70.dll
2009-02-03 09:31:04 ----A---- C:\WINDOWS\system32\msvcp70.dll
2009-02-03 09:31:03 ----A---- C:\WINDOWS\system32\mfc70.dll
2009-02-03 09:30:56 ----D---- C:\WINDOWS\system32\RMBin
2009-02-03 09:30:55 ----D---- C:\Program Files\Ozone
2009-02-02 22:29:23 ----DC---- C:\rms
2009-02-01 12:45:48 ----DC---- C:\TEMP
2009-02-01 12:44:18 ----D---- C:\Program Files\Easy Video to Audio Converter
2009-01-31 07:55:27 ----A---- C:\WINDOWS\MediaManager.INI
2009-01-31 01:09:04 ----DC---- C:\AnMingringtone
2009-01-30 19:54:13 ----D---- C:\Program Files\MP3 Player Utilities 4.00
2009-01-29 23:31:28 ----DC---- C:\0eb5b9d0b5970b47a7fb3354819823
2009-01-29 20:30:26 ----D---- C:\Program Files\Domain Tools
2009-01-29 13:01:47 ----AH---- C:\Documents and Settings\Administrator\Application Data\dach100.dll
2009-01-28 23:50:25 ----N---- C:\WINDOWS\system32\spmsgXP_2k3.dll
2009-01-28 23:50:21 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-01-28 23:50:20 ----HDC---- C:\WINDOWS\$NtUninstallWdf01007$
2009-01-28 22:51:39 ----D---- C:\Documents and Settings\Administrator\Application Data\PC Suite
2009-01-28 22:51:39 ----D---- C:\Documents and Settings\Administrator\Application Data\Nokia
2009-01-28 22:51:38 ----D---- C:\Documents and Settings\All Users\Application Data\PC Suite
2009-01-28 22:50:04 ----D---- C:\Program Files\Common Files\PCSuite
2009-01-28 22:49:59 ----D---- C:\Program Files\Common Files\Nokia
2009-01-28 22:49:48 ----D---- C:\Program Files\DIFX
2009-01-28 22:49:33 ----D---- C:\Program Files\PC Connectivity Solution
2009-01-28 22:49:17 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-01-28 22:49:17 ----A---- C:\WINDOWS\system32\wdfcoinstaller01007.dll
2009-01-28 22:49:17 ----A---- C:\WINDOWS\system32\nmwcdcocls.dll
2009-01-28 22:49:13 ----A---- C:\WINDOWS\system32\nmwcdcls.dll
2009-01-28 22:49:12 ----D---- C:\Program Files\Nokia
2009-01-28 22:47:57 ----D---- C:\Documents and Settings\All Users\Application Data\Installations
2009-01-25 20:10:57 ----D---- C:\Program Files\SpywareBlaster
2009-01-25 19:21:20 ----D---- C:\Program Files\WinClamAVShield
2009-01-25 19:18:53 ----D---- C:\Documents and Settings\Administrator\Application Data\Spyware Terminator
2009-01-25 19:18:51 ----D---- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2009-01-25 19:18:50 ----D---- C:\Program Files\Spyware Terminator
2009-01-25 18:28:18 ----D---- C:\Program Files\Trend Micro
2009-01-23 21:53:24 ----A---- C:\WINDOWS\win32pad.ini
2009-01-23 21:48:09 ----A---- C:\WINDOWS\system32\tmp.txt
2009-01-23 21:48:05 ----AC---- C:\rapport.txt
2009-01-23 21:41:05 ----A---- C:\WINDOWS\system32\WS2Fix.exe
2009-01-23 21:41:05 ----A---- C:\WINDOWS\system32\VCCLSID.exe
2009-01-23 21:41:05 ----A---- C:\WINDOWS\system32\VACFix.exe
2009-01-23 21:41:05 ----A---- C:\WINDOWS\system32\swxcacls.exe
2009-01-23 21:41:05 ----A---- C:\WINDOWS\system32\swsc.exe
2009-01-23 21:41:05 ----A---- C:\WINDOWS\system32\swreg.exe
2009-01-23 21:41:05 ----A---- C:\WINDOWS\system32\SrchSTS.exe
2009-01-23 21:41:05 ----A---- C:\WINDOWS\system32\Process.exe
2009-01-23 21:41:05 ----A---- C:\WINDOWS\system32\o4Patch.exe
2009-01-23 21:41:05 ----A---- C:\WINDOWS\system32\IEDFix.C.exe
2009-01-23 21:41:05 ----A---- C:\WINDOWS\system32\dumphive.exe
2009-01-23 21:41:05 ----A---- C:\WINDOWS\system32\Agent.OMZ.Fix.exe
2009-01-23 21:41:05 ----A---- C:\WINDOWS\system32\404Fix.exe
2009-01-22 12:14:31 ----DC---- C:\59b854fb4e375c28207e
2009-01-21 18:08:56 ----AHC---- C:\DH Temp.tmp
2009-01-21 17:54:22 ----D---- C:\Program Files\Dachshund Software
2009-01-21 12:42:57 ----D---- C:\Program Files\NauzNet Solutions
2009-01-18 17:25:59 ----DC---- C:\Downloads
2009-01-16 15:08:26 ----D---- C:\Program Files\Rockstar Games
2009-01-14 21:48:46 ----SHDC---- C:\Config.Msi
2009-01-14 21:41:44 ----D---- C:\Program Files\Conjugaison
2009-01-14 21:39:45 ----D---- C:\Program Files\Unlocker
2009-01-14 21:39:45 ----D---- C:\Documents and Settings\Administrator\Application Data\Desktopicon
2009-01-14 19:55:41 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-01-14 19:55:25 ----D---- C:\Program Files\Common Files\Adobe
2009-01-14 19:55:25 ----D---- C:\Program Files\Adobe
2009-01-14 16:24:06 ----DC---- C:\Avant Browser
2009-01-14 02:58:08 ----D---- C:\WINDOWS\Sun
2009-01-14 02:57:32 ----A---- C:\WINDOWS\system32\javaws.exe
2009-01-14 02:57:32 ----A---- C:\WINDOWS\system32\javaw.exe
2009-01-14 02:57:32 ----A---- C:\WINDOWS\system32\java.exe
2009-01-14 02:57:32 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-01-14 02:57:14 ----D---- C:\Program Files\Java
2009-01-14 02:37:22 ----D---- C:\Documents and Settings\Administrator\Application Data\Sun
2009-01-14 00:53:25 ----D---- C:\Program Files\Common Files\Skype

======List of files/folders modified in the last 1 months======

2009-02-13 21:21:41 ----D---- C:\WINDOWS\Temp
2009-02-13 21:21:40 ----D---- C:\WINDOWS\system32
2009-02-13 21:21:40 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-02-13 21:17:44 ----D---- C:\Program Files\Mozilla Firefox
2009-02-13 21:16:51 ----D---- C:\Documents and Settings\Administrator\Application Data\DMCache
2009-02-12 22:43:22 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-02-12 22:41:52 ----A---- C:\WINDOWS\system32\win32pad.ini
2009-02-12 21:59:06 ----D---- C:\WINDOWS\system32\drivers
2009-02-12 21:42:06 ----RD---- C:\Program Files
2009-02-12 20:49:03 ----D---- C:\WINDOWS
2009-02-11 17:03:22 ----SHD---- C:\System Volume Information
2009-02-10 01:31:15 ----D---- C:\Documents and Settings\Administrator\Application Data\Skype
2009-02-10 00:01:38 ----D---- C:\Documents and Settings\Administrator\Application Data\skypePM
2009-02-09 22:38:52 ----D---- C:\WINDOWS\system32\CatRoot2
2009-02-09 22:08:11 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-02-03 17:34:00 ----D---- C:\Documents and Settings\Administrator\Application Data\Avant Browser
2009-02-03 09:31:51 ----D---- C:\WINDOWS\system
2009-02-01 12:49:40 ----D---- C:\WINDOWS\RegisteredPackages
2009-01-31 07:59:18 ----D---- C:\WINDOWS\inf
2009-01-31 07:53:54 ----SHD---- C:\WINDOWS\Installer
2009-01-29 19:58:21 ----SD---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2009-01-28 22:50:04 ----D---- C:\Program Files\Common Files
2009-01-28 22:49:00 ----D---- C:\WINDOWS\WinSxS
2009-01-28 22:46:26 ----A---- C:\WINDOWS\IDMan.INI
2009-01-25 21:39:33 ----D---- C:\Program Files\SuperCopier2
2009-01-25 18:35:05 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-01-24 13:21:55 ----D---- C:\Documents and Settings
2009-01-18 20:07:25 ----A---- C:\WINDOWS\ntbtlog.txt
2009-01-14 19:58:45 ----D---- C:\Documents and Settings\Administrator\Application Data\Adobe
2009-01-14 00:53:29 ----D---- C:\Program Files\Skype

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-11-26 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-11-26 111184]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-11-26 50864]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 39936]
R1 SiSkp;SiSkp; C:\WINDOWS\system32\DRIVERS\srvkp.sys [2006-06-28 16768]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-11-26 94032]
R2 NwlnkIpx;NWLink IPX/SPX/NetBIOS Compatible Transport Protocol; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2004-08-04 88448]
R2 NwlnkNb;NWLink NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2001-09-19 63232]
R2 NwlnkSpx;NWLink SPX/SPXII Protocol; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2001-09-19 55936]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2006-06-27 3972672]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-11-26 23152]
R3 btaudio;Bluetooth Audio Device; C:\WINDOWS\system32\drivers\btaudio.sys [2005-08-29 428269]
R3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2005-08-29 30363]
R3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2005-08-29 853258]
R3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2005-08-29 148360]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2005-08-29 64344]
R3 NWRDR;NetWare Rdr; C:\WINDOWS\system32\DRIVERS\nwrdr.sys [2004-08-04 163584]
R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2006-06-29 258560]
R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2004-08-03 32768]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-04 17024]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-09-15 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-09-15 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 mchInjDrv;mchInjDrv; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mc21.tmp []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-11-26 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-11-26 155160]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2005-08-29 266295]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-01-14 152984]
R2 NWCWorkstation;Client Service for NetWare; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2009-01-25 570880]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-11-26 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-11-26 352920]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]

-----------------EOF-----------------

Cette ligne est inquiétante : S4 mchInjDrv;mchInjDrv; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mc21.tmp

Elle indique la présence d'une infection qui dérobe des mots de passe... Quand nous l'aurons supprimé, il faudra que tu changes tous tes mots de passe importants !

Il y a également une infection de disque amovible, moins importante.

Télécharge Flash Disinfector (de sUBs) sur ton Bureau (ton antivirus risque de le détecter à tord, désactive le si c'est le cas)
• Double clique dessus pour le lancer
• Une fenêtre "Start Flash Disinfector" va apparaître --> branche tous tes disques amovibles (clés USB, lecteurs mp3, disques durs externes, iPod...) et clique sur OK.
• Tes icônes vont disparaitre, c'est normal, ne touche à rien pendant la désinfection.
• Lorsque le message "Finish" apparaît, clique sur OK.

/!\ A l'attention de ceux qui passent sur ce sujet /!\
Le logiciel qui suit n'est pas à utiliser à la légère ! Ne le faites que si un helpeur du forum qui connait bien cet outil vous l'a recommandé.

On va utiliser Combofix pour finir la désinfection. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts... Fais exactement ce qui suit :

Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !). Pour cela, fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " et tape C-Fix dans dans la fenêtre qui s'ouvre, puis choisis le Bureau comme destination : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation qui pourraient gêner fortement l'outil...Tu les réactiveras donc après !

Dans ton cas, il s'agit d'Avast (fais un clic-droit sur l'icone près de l'horloge et clique sur « Arrêter la protection résidente »), du TeaTimer de Spybot (Lance Spybot → clique sur Mode → coche Mode avancé → Outils → Résident → décoche la case Résident Tea Timer → ferme Spybot) et de SpywareTerminator.

==> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

Tuto ici pour installer la Console de récupération (important en cas de problème) : http://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :

Double-clique sur C-Fix.exe (= combofix.exe ) .

Appuie sur une touche pour démarrer le scan .

Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp

ComboFix 09-02-12.03 - Administrator 02/14/2009 11:36:00.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.1471.952 [GMT 1:00]
Running from: c:\documents and settings\Administrator\سطح المكتب\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
The following files were disabled during the run:
c:\program files\SuperCopier2\SC2Hook.dll

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Application Data\dach100.dll
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\agsaame.dll
c:\windows\system32\ALOAudioFile2.dll
c:\windows\system32\ALOAVIFile.dll
c:\windows\system32\ALOQuickTimeFile.dll
c:\windows\system32\ALOVideoCoreM.dll
c:\windows\system32\ALOWMAFile2.dll
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\kakle.dll
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\videoformat.dll
c:\windows\system32\winitn.dll
c:\windows\system32\WS2Fix.exe

.
((((((((((((((((((((((((( Files Created from 2009-01-14 to 2009-02-14 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-14 10:39 --------- d-----w c:\documents and settings\Administrator\Application Data\Spyware Terminator
2009-02-14 10:38 --------- d-----w c:\program files\microsoft frontpage
2009-02-14 10:38 --------- d-----w c:\documents and settings\Administrator\Application Data\DMCache
2009-02-14 10:37 --------- d-----w c:\program files\SuperCopier2
2009-02-13 23:05 --------- d-----w c:\documents and settings\Administrator\Application Data\Avant Browser
2009-02-13 22:02 --------- d-----w c:\documents and settings\Administrator\Application Data\Skype
2009-02-13 21:42 --------- d-----w c:\program files\AMT
2009-02-12 21:35 --------- d-----w c:\documents and settings\Administrator\Application Data\Desktopicon
2009-02-12 20:59 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-12 20:42 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-12 20:42 --------- d-----w c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-02-12 19:50 --------- d-----w c:\program files\Spyware Terminator
2009-02-11 10:52 --------- d-----w c:\documents and settings\All Users\Application Data\Spyware Terminator
2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-02-09 23:01 --------- d-----w c:\documents and settings\Administrator\Application Data\skypePM
2009-02-09 21:08 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-03 08:47 --------- d-----w c:\program files\SpywareBlaster
2009-02-03 08:31 94,208 ----a-w c:\windows\system32\viscomaudiodata.dll
2009-02-03 08:31 90,112 ----a-w c:\windows\system32\ssvideo.dll
2009-02-03 08:31 6,963,712 ----a-w c:\windows\system32\videotrans.dll
2009-02-03 08:31 344,064 ----a-w c:\windows\system32\dkll.dll
2009-02-03 08:31 196,608 ----a-w c:\windows\system32\maag.dll
2009-02-03 08:31 18,599,936 ----a-w c:\windows\system32\videoencode.dll
2009-02-03 08:31 18,595,840 ----a-w c:\windows\system32\coredata.dll
2009-02-03 08:31 110,592 ----a-w c:\windows\system32\viscomaudioencoder.dll
2009-02-03 08:31 1,986,560 ----a-w c:\windows\system32\akll.dll
2009-02-03 08:31 1,462,272 ----a-w c:\windows\system32\viscom3gpenc.dll
2009-02-03 08:31 1,454,080 ----a-w c:\windows\system32\viscomamrenc.dll
2009-02-03 08:31 1,212,416 ----a-w c:\windows\system32\ckll.dll
2009-02-03 08:31 1,128,128 ----a-w c:\windows\system32\NMSDVDXU.dll
2009-02-03 08:30 --------- d-----w c:\program files\Ozone
2009-02-01 11:46 --------- d-----w c:\program files\Easy Video to Audio Converter
2009-01-31 06:51 --------- d-----w c:\program files\MP3 Player Utilities 4.00
2009-01-29 19:30 --------- d-----w c:\program files\Domain Tools
2009-01-28 22:51 --------- d-----w c:\documents and settings\Administrator\Application Data\PC Suite
2009-01-28 22:51 --------- d-----w c:\documents and settings\Administrator\Application Data\Nokia
2009-01-28 22:50 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-01-28 22:50 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-01-28 21:51 --------- d-----w c:\documents and settings\All Users\Application Data\PC Suite
2009-01-28 21:50 --------- d-----w c:\program files\Nokia
2009-01-28 21:50 --------- d-----w c:\program files\Common Files\PCSuite
2009-01-28 21:50 --------- d-----w c:\program files\Common Files\Nokia
2009-01-28 21:49 --------- d-----w c:\program files\PC Connectivity Solution
2009-01-28 21:49 --------- d-----w c:\program files\DIFX
2009-01-28 21:47 --------- d-----w c:\documents and settings\All Users\Application Data\Installations
2009-01-25 19:10 --------- d-----w c:\program files\WinClamAVShield
2009-01-25 18:18 141,312 ----a-w c:\windows\system32\drivers\sp_rsdrv2.sys
2009-01-25 17:28 --------- d-----w c:\program files\Trend Micro
2009-01-21 16:54 --------- d-----w c:\program files\Dachshund Software
2009-01-21 11:42 --------- d-----w c:\program files\NauzNet Solutions
2009-01-17 22:04 --------- d-----w c:\program files\Conjugaison
2009-01-16 14:08 --------- d-----w c:\program files\Rockstar Games
2009-01-14 20:39 --------- d-----w c:\program files\Unlocker
2009-01-14 18:55 --------- d-----w c:\program files\Common Files\Adobe
2009-01-14 01:57 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-01-14 01:57 --------- d-----w c:\program files\Java
2009-01-13 23:53 --------- d-----w c:\program files\Skype
2009-01-13 23:53 --------- d-----w c:\program files\Common Files\Skype
2009-01-13 22:04 --------- d-----w c:\program files\WIDCOMM
2009-01-13 20:43 --------- d-----w c:\program files\internet download manager
2009-01-13 20:35 --------- d-----w c:\program files\Microsoft.NET
2009-01-13 13:13 --------- d-----w c:\documents and settings\Administrator\Application Data\IDM
2009-01-13 07:05 533,767,544 ----a-w c:\program files\office2007b2tr-kb000000-fullfile-fr-fr.exe
2009-01-10 23:14 --------- d-----w c:\program files\Pyramids v1.0
2009-01-10 23:12 --------- d-----w c:\program files\WZebra V2.21
2009-01-10 23:09 --------- d-----w c:\program files\Real
2009-01-10 23:05 --------- d-----w c:\program files\Core Concepts
2009-01-10 23:03 172,032 ----a-w c:\windows\system32\cncs32.dll
2009-01-10 23:02 --------- d-----w c:\program files\LaserTank
2009-01-10 22:40 --------- d-----w c:\program files\The Curse Of Ra
2009-01-10 22:39 --------- d-----w c:\program files\Bugatron
2009-01-10 22:38 --------- d-----w c:\program files\Battlejeep 0.99b
2009-01-10 22:37 --------- d-----w c:\program files\Arkanoid2000
2009-01-10 21:42 --------- d-----w c:\program files\Drengin.net
2009-01-10 21:38 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-06 22:25 --------- d-----w c:\program files\aljazeera news
2009-01-06 21:51 --------- d-----w c:\program files\Google
2009-01-06 21:46 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-06 21:17 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-01-06 21:06 --------- d-----w c:\documents and settings\Administrator\Application Data\vlc
2009-01-06 21:04 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2009-01-06 21:02 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-01-06 21:00 --------- d-----w c:\program files\VideoLAN
2009-01-06 18:54 --------- d-----w c:\program files\Alwil Software
2009-01-06 16:20 --------- d-----w c:\program files\Realtek Sound Manager
2009-01-06 16:20 --------- d-----w c:\program files\Realtek AC97
2009-01-06 16:20 --------- d-----w c:\program files\AvRack
2009-01-06 15:59 --------- d-----w c:\documents and settings\Administrator\Application Data\URSoft
2009-01-06 15:19 --------- d-----w c:\program files\SiS VGA Utilities V3.75
2009-01-06 15:15 --------- d-----w c:\program files\sisagp
2009-01-06 15:15 --------- d-----w c:\program files\Common Files\InstallShield
2009-01-06 14:47 --------- d-----w c:\program files\USB Keyboard Driver
2009-01-06 14:46 --------- d-----w c:\program files\MultiKeyboard Driver
2009-01-06 14:46 --------- d-----w c:\program files\Hotkey
2009-01-06 14:46 --------- d-----w c:\program files\EnhanceKeyboard
2009-01-06 12:34 --------- d-----w c:\program files\Common Files\xing shared
2009-01-06 12:34 --------- d-----w c:\program files\Common Files\Real
2009-01-06 12:33 --------- d-----w c:\program files\MSN Messenger
2009-01-06 12:32 --------- d-----w c:\program files\Your Uninstaller 2006

------- Sigcheck -------

04/12/2006 11:53 PM 1150464 ed5c9dc44b07b7169b4d4968ec2abb28 c:\windows\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [07/07/2006 05:45 PM 1052672]
"IDMan"="c:\program files\internet download manager\IDMan.exe" [11/29/2005 12:52 PM 2195456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"USB Keyboard"="c:\program files\USB Keyboard Driver\kb_2k.exe" [03/30/2004 08:57 PM 155648]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [11/26/2008 06:18 PM 81000]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [01/25/2009 07:18 PM 1783808]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [01/06/2009 01:34 PM 180269]
"SiSPower"="SiSPower.dll" [06/28/2006 08:05 PM 49152 c:\windows\system32\SiSPower.dll]
"SoundMan"="SOUNDMAN.EXE" [06/20/2006 10:42 PM 577536 c:\windows\soundman.exe]

c:\documents and settings\Administrator\çں‍ê، ں §ڑ\ںé ©ںê¤\ §ک ںé¢¬نïé\
AntiCrash.lnk - c:\program files\Dachshund Software\AntiCrash\AntiCrash.exe [2002-12-17 2301798]

c:\documents and settings\All Users\çں‍ê، ں §ڑ\ںé ©ںê¤\ §ک ںé¢¬نïé\
Utility Tray.lnk - c:\windows\system32\sistray.exe [2009-01-06 262144]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-06 111184]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2009-01-25 141312]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-06 20560]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - HELPSVC
*Deregistered* - mchInjDrv

NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
TrkWks
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
BITS
ShellHWDetection
WmdmPmSN

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{293adfe7-fa12-11dd-afdc-224e55955002}]
\Shell\AutoRun\command - wscript.exe .\.vbs
\Shell\open\command - wscript.exe .\.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e78d854-de21-11dd-a07f-001bb960272a}]
\Shell\AutoRun\command - F:\start.exe
.
- - - - ORPHANS REMOVED - - - -

Notify-SafenSec - (no file)

------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mWindow Title =
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Download All Links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
TCP: {9F02399F-E16A-47E7-8A67-A7140F08D879} = 208.67.222.222 208.67.220.220
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\wf5h48aw.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-14 11:39:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\mc21.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):ce,23,bd,5a,0a,9e,d5,56,3c,b0,4b,f8,ff,2d,02,a4,ae,1d,80,a1,6e,
e7,89,44,00,36,bf,45,77,83,28,fa,55,26,f3,5d,a5,a0,e1,07,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{76d306e0-b591-43b1-8ea1-be71771eaab9}]
@Denied: (Full) (Everyone)
"Model"=dword:00000023
"Therad"=dword:0000001f
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,ab,9e,50,1b,eb,77,d1,ab,b5,66,4a,d0,23,02,d0,61,d1,48,b3,70,7f,ce,\
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\Integrator.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Completion time: 02/14/2009 11:42:17 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-14 10:42:13

Pre-Run: 40,991,272,960 bytes free
Post-Run: 40,984,223,744 bytes free

287

voila le rapport de C-fix..................que faut il faire apres? le song n toujour pas la............

un autre probleme...c est que la 2 partition en francais ne veut plus demarrer.un message apparait avec une croix rouge qui dit:
Isass.exe-erreur systeme
nom d objet introuvable
j ai 2 partitions C et D .......

C A Y EST LE SONG EST A JOUR

/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour nani37, il n'est pas transposable sur un autre ordinateur !

Toujours avec toutes les protections désactivées, fais ceci :

• Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
• Copie/colle dans le bloc-notes ce qui entre dans le cadre code ci-dessous (à partir de "File::")

Code:: File::
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mc21.tmp

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{293adfe7-fa12-11dd-afdc-224e55955002}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e78d854-de21-11dd-a07f-001bb960272a}]

Driver::
mchInjDrv

• Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
• Quitte le Bloc Notes

• Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) comme indiqué ici :

infection qui ne veut pas se supprimer Img-2258535my8h

• Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
• Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
• Si le fichier ne s'ouvre pas, il se trouve ici → C:\ComboFix.txt

Copie/colle dans le bloc-notes ce qui entre dans le cadre code ci-dessous (à partir de "File::")
j ai pas bien saisie .............excusez moi j ai du mal a comprendre...............expliquez un peu plus.........

j ai pas de bloc note sur mon PC j ai un agenda a la place

voila le rapport.............enfin j ai réussie peut-être
ComboFix 09-02-12.03 - Administrator 02/14/2009 23:29:38.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.1471.867 [GMT 1:00]
Running from: c:\documents and settings\Administrator\سطح المكتب\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\سطح المكتب\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\docume~1\ADMINI~1\LOCALS~1\Temp\mc21.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Application Data\dach100.dll
c:\windows\system32\agsaame.dll
c:\windows\system32\ALOAudioFile2.dll
c:\windows\system32\ALOAVIFile.dll
c:\windows\system32\ALOQuickTimeFile.dll
c:\windows\system32\ALOVideoCoreM.dll
c:\windows\system32\ALOWMAFile2.dll
c:\windows\system32\kakle.dll
c:\windows\system32\winitn.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MCHINJDRV
-------\Service_mchInjDrv

((((((((((((((((((((((((( Files Created from 2009-01-14 to 2009-02-14 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-14 22:32 --------- d-----w c:\documents and settings\Administrator\Application Data\DMCache
2009-02-14 22:31 --------- d-----w c:\program files\SuperCopier2
2009-02-14 21:38 --------- d-----w c:\program files\Spyware Terminator
2009-02-14 21:38 --------- d-----w c:\documents and settings\Administrator\Application Data\Spyware Terminator
2009-02-14 21:28 --------- d-----w c:\program files\Crawler
2009-02-14 21:09 --------- d-----w c:\program files\Supbn
2009-02-14 19:22 --------- d-----w c:\program files\AMT
2009-02-14 19:22 --------- d-----w c:\documents and settings\All Users\Application Data\Spyware Terminator
2009-02-14 17:21 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-14 12:10 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-14 10:38 --------- d-----w c:\program files\microsoft frontpage
2009-02-13 23:05 --------- d-----w c:\documents and settings\Administrator\Application Data\Avant Browser
2009-02-13 22:02 --------- d-----w c:\documents and settings\Administrator\Application Data\Skype
2009-02-12 21:35 --------- d-----w c:\documents and settings\Administrator\Application Data\Desktopicon
2009-02-12 20:59 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-12 20:42 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-12 20:42 --------- d-----w c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-02-09 23:01 --------- d-----w c:\documents and settings\Administrator\Application Data\skypePM
2009-02-03 08:47 --------- d-----w c:\program files\SpywareBlaster
2009-02-03 08:31 94,208 ----a-w c:\windows\system32\viscomaudiodata.dll
2009-02-03 08:31 90,112 ----a-w c:\windows\system32\ssvideo.dll
2009-02-03 08:31 6,963,712 ----a-w c:\windows\system32\videotrans.dll
2009-02-03 08:31 344,064 ----a-w c:\windows\system32\dkll.dll
2009-02-03 08:31 196,608 ----a-w c:\windows\system32\maag.dll
2009-02-03 08:31 18,599,936 ----a-w c:\windows\system32\videoencode.dll
2009-02-03 08:31 18,595,840 ----a-w c:\windows\system32\coredata.dll
2009-02-03 08:31 110,592 ----a-w c:\windows\system32\viscomaudioencoder.dll
2009-02-03 08:31 1,986,560 ----a-w c:\windows\system32\akll.dll
2009-02-03 08:31 1,462,272 ----a-w c:\windows\system32\viscom3gpenc.dll
2009-02-03 08:31 1,454,080 ----a-w c:\windows\system32\viscomamrenc.dll
2009-02-03 08:31 1,212,416 ----a-w c:\windows\system32\ckll.dll
2009-02-03 08:31 1,128,128 ----a-w c:\windows\system32\NMSDVDXU.dll
2009-02-03 08:30 --------- d-----w c:\program files\Ozone
2009-02-01 11:46 --------- d-----w c:\program files\Easy Video to Audio Converter
2009-01-31 06:51 --------- d-----w c:\program files\MP3 Player Utilities 4.00
2009-01-29 19:30 --------- d-----w c:\program files\Domain Tools
2009-01-28 22:51 --------- d-----w c:\documents and settings\Administrator\Application Data\PC Suite
2009-01-28 22:51 --------- d-----w c:\documents and settings\Administrator\Application Data\Nokia
2009-01-28 22:50 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-01-28 22:50 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-01-28 21:51 --------- d-----w c:\documents and settings\All Users\Application Data\PC Suite
2009-01-28 21:50 --------- d-----w c:\program files\Nokia
2009-01-28 21:50 --------- d-----w c:\program files\Common Files\PCSuite
2009-01-28 21:50 --------- d-----w c:\program files\Common Files\Nokia
2009-01-28 21:49 --------- d-----w c:\program files\PC Connectivity Solution
2009-01-28 21:49 --------- d-----w c:\program files\DIFX
2009-01-28 21:47 --------- d-----w c:\documents and settings\All Users\Application Data\Installations
2009-01-25 19:10 --------- d-----w c:\program files\WinClamAVShield
2009-01-25 18:18 141,312 ----a-w c:\windows\system32\drivers\sp_rsdrv2.sys
2009-01-25 17:28 --------- d-----w c:\program files\Trend Micro
2009-01-21 16:54 --------- d-----w c:\program files\Dachshund Software
2009-01-21 11:42 --------- d-----w c:\program files\NauzNet Solutions
2009-01-17 22:04 --------- d-----w c:\program files\Conjugaison
2009-01-16 14:08 --------- d-----w c:\program files\Rockstar Games
2009-01-14 20:39 --------- d-----w c:\program files\Unlocker
2009-01-14 18:55 --------- d-----w c:\program files\Common Files\Adobe
2009-01-14 01:57 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-01-14 01:57 --------- d-----w c:\program files\Java
2009-01-13 23:53 --------- d-----w c:\program files\Skype
2009-01-13 23:53 --------- d-----w c:\program files\Common Files\Skype
2009-01-13 22:04 --------- d-----w c:\program files\WIDCOMM
2009-01-13 20:43 --------- d-----w c:\program files\internet download manager
2009-01-13 20:35 --------- d-----w c:\program files\Microsoft.NET
2009-01-13 13:13 --------- d-----w c:\documents and settings\Administrator\Application Data\IDM
2009-01-13 07:05 533,767,544 ----a-w c:\program files\office2007b2tr-kb000000-fullfile-fr-fr.exe
2009-01-10 23:14 --------- d-----w c:\program files\Pyramids v1.0
2009-01-10 23:12 --------- d-----w c:\program files\WZebra V2.21
2009-01-10 23:09 --------- d-----w c:\program files\Real
2009-01-10 23:05 --------- d-----w c:\program files\Core Concepts
2009-01-10 23:03 172,032 ----a-w c:\windows\system32\cncs32.dll
2009-01-10 23:02 --------- d-----w c:\program files\LaserTank
2009-01-10 22:40 --------- d-----w c:\program files\The Curse Of Ra
2009-01-10 22:39 --------- d-----w c:\program files\Bugatron
2009-01-10 22:38 --------- d-----w c:\program files\Battlejeep 0.99b
2009-01-10 22:37 --------- d-----w c:\program files\Arkanoid2000
2009-01-10 21:42 --------- d-----w c:\program files\Drengin.net
2009-01-10 21:38 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-06 22:25 --------- d-----w c:\program files\aljazeera news
2009-01-06 21:51 --------- d-----w c:\program files\Google
2009-01-06 21:46 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-06 21:06 --------- d-----w c:\documents and settings\Administrator\Application Data\vlc
2009-01-06 21:04 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2009-01-06 21:02 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-01-06 21:00 --------- d-----w c:\program files\VideoLAN
2009-01-06 18:54 --------- d-----w c:\program files\Alwil Software
2009-01-06 16:20 --------- d-----w c:\program files\Realtek Sound Manager
2009-01-06 16:20 --------- d-----w c:\program files\Realtek AC97
2009-01-06 16:20 --------- d-----w c:\program files\AvRack
2009-01-06 15:59 --------- d-----w c:\documents and settings\Administrator\Application Data\URSoft
2009-01-06 15:19 --------- d-----w c:\program files\SiS VGA Utilities V3.75
2009-01-06 15:15 --------- d-----w c:\program files\sisagp
2009-01-06 15:15 --------- d-----w c:\program files\Common Files\InstallShield
2009-01-06 14:47 --------- d-----w c:\program files\USB Keyboard Driver
2009-01-06 14:46 --------- d-----w c:\program files\MultiKeyboard Driver
2009-01-06 14:46 --------- d-----w c:\program files\Hotkey
2009-01-06 14:46 --------- d-----w c:\program files\EnhanceKeyboard
2009-01-06 12:34 --------- d-----w c:\program files\Common Files\xing shared
2009-01-06 12:34 --------- d-----w c:\program files\Common Files\Real
.

------- Sigcheck -------

04/12/2006 11:53 PM 1150464 ed5c9dc44b07b7169b4d4968ec2abb28 c:\windows\explorer.exe
.
((((((((((((((((((((((((((((( SnapShot@Sat 02-14-2009_11.40.58.00 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-09 19:03:27 331,776 ----a-w c:\windows\system32\agsaama.dll
+ 2009-02-14 17:26:15 331,776 ----a-w c:\windows\system32\agsaama.dll
- 2009-02-09 19:03:27 538,624 ----a-w c:\windows\system32\agsaamb.dll
+ 2009-02-14 17:26:16 538,624 ----a-w c:\windows\system32\agsaamb.dll
- 2009-02-09 19:03:27 372,736 ----a-w c:\windows\system32\agsaamc.dll
+ 2009-02-14 17:26:17 372,736 ----a-w c:\windows\system32\agsaamc.dll
- 2009-02-09 19:03:27 544,256 ----a-w c:\windows\system32\agsaamd.dll
+ 2009-02-14 17:26:17 544,256 ----a-w c:\windows\system32\agsaamd.dll
- 2009-02-09 19:03:28 753,664 ----a-w c:\windows\system32\agsaamg.dll
+ 2009-02-14 17:26:18 753,664 ----a-w c:\windows\system32\agsaamg.dll
- 2009-02-09 19:03:29 626,688 ----a-w c:\windows\system32\agsaamh.dll
+ 2009-02-14 17:26:19 626,688 ----a-w c:\windows\system32\agsaamh.dll
- 2009-02-09 19:03:29 90,112 ----a-w c:\windows\system32\agsaami.dll
+ 2009-02-14 17:26:20 90,112 ----a-w c:\windows\system32\agsaami.dll
- 2009-02-09 19:03:30 2,846,720 ----a-w c:\windows\system32\agsaamj.dll
+ 2009-02-14 17:26:21 2,846,720 ----a-w c:\windows\system32\agsaamj.dll
- 2009-02-09 19:03:25 778,240 ----a-w c:\windows\system32\ALOAudioCompress2.dll
+ 2009-02-14 17:26:04 778,240 ----a-w c:\windows\system32\ALOAudioCompress2.dll
- 2009-02-09 19:03:26 2,846,720 ----a-w c:\windows\system32\ALOAudioCompress3.dll
+ 2009-02-14 17:26:05 2,846,720 ----a-w c:\windows\system32\ALOAudioCompress3.dll
- 2009-02-09 19:03:27 90,112 ----a-w c:\windows\system32\ALOAudioFormatSettings3.dll
+ 2009-02-14 17:26:05 90,112 ----a-w c:\windows\system32\ALOAudioFormatSettings3.dll
- 2009-02-09 19:03:28 780,288 ----a-w c:\windows\system32\ALOVideoCompress.dll
+ 2009-02-14 17:26:06 780,288 ----a-w c:\windows\system32\ALOVideoCompress.dll
- 2009-02-09 19:03:29 188,416 ----a-w c:\windows\system32\ALOVideoFile.dll
+ 2009-02-14 17:26:07 188,416 ----a-w c:\windows\system32\ALOVideoFile.dll
- 2009-02-09 19:03:29 215,552 ----a-w c:\windows\system32\ALOWMVFile.dll
+ 2009-02-14 17:26:07 215,552 ----a-w c:\windows\system32\ALOWMVFile.dll
- 2008-11-26 17:21:30 1,236,208 ----a-w c:\windows\system32\aswBoot.exe
+ 2009-02-05 21:11:35 1,256,296 ----a-w c:\windows\system32\aswBoot.exe
- 2008-11-26 17:15:10 97,480 ----a-w c:\windows\system32\AvastSS.scr
+ 2009-02-05 21:04:45 97,480 ----a-w c:\windows\system32\AvastSS.scr
- 2009-02-09 19:03:30 1,245,184 ----a-w c:\windows\system32\bkll.dll
+ 2009-02-14 17:26:07 1,245,184 ----a-w c:\windows\system32\bkll.dll
- 2008-11-26 17:15:35 26,944 ----a-w c:\windows\system32\drivers\aavmker4.sys
+ 2009-02-05 21:05:11 26,944 ----a-w c:\windows\system32\drivers\aavmker4.sys
- 2008-11-26 17:17:25 20,560 ----a-w c:\windows\system32\drivers\aswFsBlk.sys
+ 2009-02-05 21:07:12 20,560 ----a-w c:\windows\system32\drivers\aswFsBlk.sys
- 2008-11-26 17:18:25 93,296 ----a-w c:\windows\system32\drivers\aswmon.sys
+ 2009-02-05 21:08:19 93,296 ----a-w c:\windows\system32\drivers\aswmon.sys
- 2008-11-26 17:18:18 94,032 ----a-w c:\windows\system32\drivers\aswmon2.sys
+ 2009-02-05 21:08:10 94,032 ----a-w c:\windows\system32\drivers\aswmon2.sys
- 2008-11-26 17:16:29 23,152 ----a-w c:\windows\system32\drivers\aswRdr.sys
+ 2009-02-05 21:06:10 23,152 ----a-w c:\windows\system32\drivers\aswRdr.sys
- 2008-11-26 17:17:36 111,184 ----a-w c:\windows\system32\drivers\aswSP.sys
+ 2009-02-05 21:07:23 114,768 ----a-w c:\windows\system32\drivers\aswSP.sys
- 2008-11-26 17:16:38 50,864 ----a-w c:\windows\system32\drivers\aswTdi.sys
+ 2009-02-05 21:06:20 51,376 ----a-w c:\windows\system32\drivers\aswTdi.sys
- 2009-02-14 09:21:30 34,114 ----a-w c:\windows\system32\perfc001.dat
+ 2009-02-14 17:24:50 34,114 ----a-w c:\windows\system32\perfc001.dat
- 2009-02-14 09:21:30 34,124 ----a-w c:\windows\system32\perfc009.dat
+ 2009-02-14 17:24:50 34,124 ----a-w c:\windows\system32\perfc009.dat
- 2009-02-14 09:21:30 235,892 ----a-w c:\windows\system32\perfh001.dat
+ 2009-02-14 17:24:50 235,892 ----a-w c:\windows\system32\perfh001.dat
- 2009-02-14 09:21:30 293,544 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-14 17:24:50 293,544 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-14 22:31:48 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_3b8.dat
+ 2009-02-14 22:32:51 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_614.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [07/07/2006 05:45 PM 1052672]
"IDMan"="c:\program files\internet download manager\IDMan.exe" [11/29/2005 12:52 PM 2195456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"USB Keyboard"="c:\program files\USB Keyboard Driver\kb_2k.exe" [03/30/2004 08:57 PM 155648]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [02/05/2009 10:08 PM 81000]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [01/25/2009 07:18 PM 1783808]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [01/06/2009 01:34 PM 180269]
"SiSPower"="SiSPower.dll" [06/28/2006 08:05 PM 49152 c:\windows\system32\SiSPower.dll]
"SoundMan"="SOUNDMAN.EXE" [06/20/2006 10:42 PM 577536 c:\windows\soundman.exe]

c:\documents and settings\Administrator\çں‍ê، ں §ڑ\ںé ©ںê¤\ §ک ںé¢¬نïé\
AntiCrash.lnk - c:\program files\Dachshund Software\AntiCrash\AntiCrash.exe [2002-12-17 2301798]

c:\documents and settings\All Users\çں‍ê، ں §ڑ\ںé ©ںê¤\ §ک ںé¢¬نïé\
Utility Tray.lnk - c:\windows\system32\sistray.exe [2009-01-06 262144]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SafenSec]
[BU]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-06 114768]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2009-01-25 141312]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-06 20560]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MCHINJDRV
*Deregistered* - mchInjDrv

NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
TrkWks
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
BITS
ShellHWDetection
WmdmPmSN

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\start.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mWindow Title =
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Download All Links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{035E680E-B668-472F-91F3-E850BCC5051F} - c:\program files\Crawler\Notes\CNotes.exe
TCP: {9F02399F-E16A-47E7-8A67-A7140F08D879} = 208.67.222.222 208.67.220.220
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\wf5h48aw.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-14 23:33:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):ce,23,bd,5a,0a,9e,d5,56,3c,b0,4b,f8,ff,2d,02,a4,ae,1d,80,a1,6e,
e7,89,44,00,36,bf,45,77,83,28,fa,55,26,f3,5d,a5,a0,e1,07,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{76d306e0-b591-43b1-8ea1-be71771eaab9}]
@Denied: (Full) (Everyone)
"Model"=dword:00000023
"Therad"=dword:0000001f
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,ab,9e,50,1b,eb,77,d1,ab,b5,66,4a,d0,23,02,d0,61,d1,48,b3,70,7f,ce,\
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\Integrator.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 02/14/2009 23:36:04 - machine was rebooted [Administrator]
ComboFix-quarantined-files.txt 2009-02-14 22:35:59
ComboFix2.txt 2009-02-14 10:42:19

Pre-Run: 40,875,515,904 bytes free
Post-Run: 40,879,407,104 bytes free

334

La suppression du service infectieux s'est bien passé Smile

Poste un nouveau rapport hijackthis stp

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:57:45, on 16-02-2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\USB Keyboard Driver\kb_2k.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\Integrator.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\internet download manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [USB Keyboard] C:\Program Files\USB Keyboard Driver\kb_2k.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Flashget] "C:\Program Files\FlashGet\FlashGet.exe" /min
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\internet download manager\IDMan.exe /onboot
O4 - Startup: AntiCrash.lnk = C:\Program Files\Dachshund Software\AntiCrash\AntiCrash.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\internet download manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\internet download manager\IEExt.htm
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: أضف إلى قائمة الإعلان السوداء - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: إبراز - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: إفتح كلّ الوصلات في هذه الصفحة - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: إمنع كلّ الصور التي في نفس الخادم - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: افتح في متصفح الرائد مكرر - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: بحث - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: Desktop Notes - {035E680E-B668-472F-91F3-E850BCC5051F} - C:\Program Files\Crawler\Notes\CNotes.exe
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=26688
O17 - HKLM\System\CCS\Services\Tcpip\..\{9F02399F-E16A-47E7-8A67-A7140F08D879}: NameServer = 208.67.222.222 208.67.220.220
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: SafenSec - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: UPS - Unknown owner - C:\WINDOWS\System32\ups.exe (file missing)

--
End of file - 7613 bytes

Très bien, ton ordinateur n'est plus infecté ! Tu peux maintenant changer tes mots de passe important.

Avant de retourner surfer sur internet, il y a quelques petites choses que tu dois faire pour finir le nettoyage et améliorer sensiblement la sécurité de ton ordinateur, ça t'évitera peut-être de devoir revenir ici avec une nouvelle infection dans le futur Wink

Mais sache qu'aucun logiciel de sécurité ne te protègera à 100%, ce qui fait la différence, c'est ta vigilance lorsque tu télécharges ou installes quelque chose : pour en savoir plus, je t'invite à bien lire la page indiquée tout en bas de ce message (6).

1) Sécurise ton ordinateur

• Anti-virus :
Avast était un antivirus convenable il y a quelques années, mais il est dépassé aujourd'hui. Il existe d'autres antivirus gratuits plus efficaces (Antivir ou AVG)
Désinstalle Avast : Commence par supprimer ce qu'il y a en quarantaine, puis fais clic droit sur l'icone d'Avast près de l'horloge --> désactive la protection résidente. Puis Menu démarrer --> Panneau de configuration --> ajout/suppression de programmes --> désinstalle Avast.
Si ça ne fonctionne pas, consulte ce lien : Désinstallation d'Avast

Si tu choisis Antivir pour le remplacer, télécharge le ici.

• Anti-spyware :
* Installe Spyware Blaster : il ne prend pas de mémoire, c'est juste un logiciel qui vaccine ton pc contre certaines infections. Il faut le mettre à jour manuellement (« Updates »), tous les 15 jours environ, et activer toutes les protections (« Enable all protection »)
* En complément, garde MalwareBytes pour son scan de nettoyage performant.

• Pour naviguer sur internet plus en sécurité et à l’abri des publicités, je te conseille vivement d’installer et d'utiliser le navigateur Firefox 3 avec deux extensions :
AdBlockPlus pour bloquer les publicités ;
WOT, pour t'avertir des sites web dangereux.

• Internet Explorer n'est pas à jour, c'est une grosse faille de sécurité !
Menu démarrer --> Windows update --> recherche et installe toutes les mises à jour importantes.
Si Internet Explorer n'y est pas, télécharge et installe IE 7 depuis ce lien : http://www.microsoft.com/windows/products/winfamily/ie/default.mspx

• Java n'est pas à jour, c'est une faille de sécurité.
Il faut d'abord désinstaller l'ancienne version : Ouvre le menu démarrer --> panneau de configuration --> ajout/suppression de programmes --> sélectionne toutes les versions de java présentes et désinstalle les.
Ensuite, télécharge et installe la nouvelle version depuis le site officiel de java : http://java.com/fr/

2) Relance Hijackthis (pour la dernière fois), choisis "scan system only" et coche les lignes suivantes qui sont inutiles :

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [IDMan] C:\Program Files\internet download manager\IDMan.exe /onboot

Coche également toutes les lignes commençant par 016

Ensuite, clique sur "Fix checked"

3) Télécharge ToolsCleaner sur ton Bureau pour nettoyer l'ordi de tous les outils qu'on a utilisé : ToolsCleaner
Lance le, clique sur Recherche et laisse le scan se finir, puis clique sur Suppression pour nettoyer.
Tu peux aussi supprimer les fichiers temporaires.
Ensuite, supprime manuellement ToolsCleaner (mets le à la corbeille).
S'il ne supprime pas tout, supprime manuellement ce qui reste.

4) Télécharge et installe CCleaner (si ce n’est déjà fait) : http://www.ccleaner.com/download/builds/downloading-slim

Lance CCleaner
Option --> avancé --> décoche « effacer uniquement les fichiers plus vieux que 48h »
Puis nettoyeur --> Analyse > Lancer le nettoyage, puis sur OK dans la fenêtre qui s' affiche.
Enfin, registre --> corrige toutes les erreurs, et recommence jusqu'à ce qu'il ne trouve plus d'erreurs.

(Tu peux garder ce logiciel et l'utiliser régulièrement).

5) Pour finir le nettoyage, il faut purger la restauration du système.

• Fais un clic droit sur poste de travail (qui est sur ton Bureau ou dans le menu démarrer), puis propriétés.
• Sélectionne l'onglet restauration du système
• Coche l'option Désactiver la restauration du système sur tous les lecteurs
• Clique sur OK.

Puis refais la manipulation inverse pour réactiver la restauration système.

6) Je t'invite enfin à visiter cette page qui t'apportera des informations de prévention et de protection contre les infections (environ 15 minutes de lecture très instructive et utile) : Prévention et sécurité sur internet

Bonne lecture, bon courage, et n'hésite pas à poser des questions en cas de besoin Wink

[28-03-2007 12:52:07] - virus trouver : e:\AUTORUN.INF
[28-03-2007 12:52:09] - virus Supprimer avec succès
[28-03-2007 12:52:12] - virus trouver : e:\AUTORUN.INF
voila un rapport fait par evosla anti virus........j ais fait tous ce que vous m avez dit ......mais j ais encore des problèmes.......
1-la partition D ne veut plus démarrer un message dit que Isass.exe-erreur système nom d objet introuvable.
j ai essayée de la repparer avec le cd d installation sans resultat car le fichier suivant est manquant..systeme32/drivers/Ntfs.sys.
c est le message qui me vient.........
un autre mss.le fichier setupdel.sys. n a pas pu etrecharger le code d erreur 4
yb a t il une sollution?........j e vous remerci de votre patience......et merci 1000 fois pour vos aides............je suis fidel a ce forum........

Est-ce que tu avais bien lancé Flash Dinsinfector, comme je te l'avais indiqué avant le scan Combofix ? Il permet de désinfecter tous tes disques de ce genre d'infection, et surtout il devrait les vacciner pour empêcher qu'elle ne revienne :

Télécharge Flash Disinfector (de sUBs) sur ton Bureau (ton antivirus risque de le détecter à tord, désactive le si c'est le cas)
• Double clique dessus pour le lancer
• Une fenêtre "Start Flash Disinfector" va apparaître --> branche tous tes disques amovibles (clés USB, lecteurs mp3, disques durs externes, iPod...) et clique sur OK.
• Tes icônes vont disparaitre, c'est normal, ne touche à rien pendant la désinfection.
• Lorsque le message "Finish" apparaît, clique sur OK.

» virus a supprimer
» infection?
» infection et ralentissement
» infection trojan