Infection ????

Bonsoir,

j'ai fait les mises en route de programme comme demandé, pas de problèmes rencontrés...
juste le fait que je ne trouve pas le rapport de mxnfix, mais c'est pas grave, je sais qu'il est passé....

je joins les rapports de combofix et TB, ainsi que le HiJack

Rapport Combofix :

ComboFix 08-12-26.02 - Administrateur 2008-12-26 22:23:10.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.2046.1731 [GMT 1:00]
Lancé depuis: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
AV: AntiVirus Firewall 7.03 *On-access scanning disabled* (Outdated)
FW: AntiVirus Firewall 7.03 *disabled*

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\allldesr.ini
c:\windows\system32\cojgfxbf.ini
c:\windows\system32\cqaqhs.dll
c:\windows\system32\ctbvlajl.ini
c:\windows\system32\dbxkpqbk.dll
c:\windows\system32\dgkctemq.ini
c:\windows\system32\dicmigqf.ini
c:\windows\system32\dxccxb.dll
c:\windows\system32\elvfnwac.dll
c:\windows\system32\fbxfgjoc.dll
c:\windows\system32\ghkfpafy.ini
c:\windows\system32\gnbfwf.dll
c:\windows\system32\guyjkloq.dll
c:\windows\system32\hbpcpb.dll
c:\windows\system32\hcretfwa.dll
c:\windows\system32\idkhjg.dll
c:\windows\system32\ieupdates.exe.tmp
c:\windows\system32\iivaqdwy.dll
c:\windows\system32\iplsojjn.dll
c:\windows\system32\jgsovhns.dll
c:\windows\system32\kblsmajn.ini
c:\windows\system32\kbqpkxbd.ini
c:\windows\system32\keonchqt.ini
c:\windows\system32\krwwunss.dll
c:\windows\system32\lccosn.dll
c:\windows\system32\lenuylel.dll
c:\windows\system32\lifvdrwv.dll
c:\windows\system32\lrxilaqa.ini
c:\windows\system32\mbvudgmr.dll
c:\windows\system32\mcrh.tmp
c:\windows\system32\mhsrudos.ini
c:\windows\system32\nieusumh.dll
c:\windows\system32\nijeyxws.ini
c:\windows\system32\njamslbk.dll
c:\windows\system32\nlqdqtkd.dll
c:\windows\system32\ocvhudfc.ini
c:\windows\system32\peyaqz.dll
c:\windows\system32\phsdonqs.dll
c:\windows\system32\PoXycMoq.ini
c:\windows\system32\PoXycMoq.ini2
c:\windows\system32\qmetckgd.dll
c:\windows\system32\qolkjyug.ini
c:\windows\system32\qoMcyXoP.dll
c:\windows\system32\rgxxtf.dll
c:\windows\system32\skvsrz.dll
c:\windows\system32\snhvosgj.ini
c:\windows\system32\tqhcnoek.dll
c:\windows\system32\vcgqjega.dll
c:\windows\system32\vjxouv.dll
c:\windows\system32\wngbdeaw.dll
c:\windows\system32\wszcvd.dll
c:\windows\system32\wugkna.dll
c:\windows\system32\xdvxvjag.dll
c:\windows\system32\xuingz.dll
c:\windows\system32\yfapfkhg.dll
c:\windows\system32\yrgymn.dll
c:\windows\Tasks\uvptiuug.job

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-26 au 2008-12-26 ))))))))))))))))))))))))))))))))))))
.

2008-12-26 22:05 . 2008-12-26 22:10 <REP> d-------- C:\ToolBar SD
2008-12-18 02:29 . 2008-12-18 02:29 95 --a------ c:\windows\wininit.ini
2008-12-18 01:57 . 2008-12-18 02:34 732,304 --ahs---- c:\windows\system32\wqmafcsu.tmp
2008-12-17 18:28 . 2008-12-18 17:14 <REP> d-------- c:\program files\Spybot - Search & Destroy
2008-12-17 18:27 . 2008-12-17 18:27 <REP> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-12-17 18:27 . 2008-12-17 18:27 <REP> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
2008-12-17 18:27 . 2008-12-17 18:27 <REP> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-12-17 18:26 . 2008-12-17 18:26 <REP> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2008-12-17 18:20 . 2008-12-17 18:33 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-17 17:55 . 2008-12-17 18:14 48,640 --------- C:\bluz.0xe
2008-12-15 22:12 . 2008-12-16 15:38 48,640 --------- C:\waxx.0xe
2008-12-15 22:06 . 2008-12-15 22:06 70,144 --------- c:\windows\system32\byXQKebx.0ll
2008-12-15 22:06 . 2008-12-15 22:06 35,328 --a------ c:\windows\system32\byXNHbBR.0ll
2008-12-15 21:50 . 2008-12-13 01:16 52,786 --------- c:\windows\fxstaller.0xe
2008-12-14 02:27 . 2008-12-14 02:27 5,376 --a------ c:\windows\system32\drivers\MS1000.sys
2008-12-14 02:26 . 2008-12-14 02:28 <REP> d-------- c:\program files\The Cleaner Demo
2008-12-11 21:36 . 2008-10-03 11:03 247,326 --------- c:\windows\system32\dllcache\strmdll.dll
2008-12-06 07:44 . 2008-12-14 02:25 <REP> d-------- c:\program files\programmes divers - codecs
2008-12-05 16:54 . 2008-12-04 21:42 815,104 --a------ c:\windows\system32\xvidcore.dll
2008-12-05 16:54 . 2008-12-04 21:46 180,224 --a------ c:\windows\system32\xvidvfw.dll
2008-11-27 13:50 . 2008-11-27 13:50 <REP> d-------- c:\documents and settings\Administrateur\Application Data\Media Player Classic
2008-11-27 13:50 . 2008-11-27 13:50 <REP> d-------- c:\documents and settings\Administrateur\Application Data\DivX

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-26 21:29 --------- d-----w c:\documents and settings\Administrateur\Application Data\OpenOffice.org2
2008-12-26 21:28 --------- d-----w c:\program files\DNA
2008-12-26 21:28 --------- d-----w c:\documents and settings\Administrateur\Application Data\DNA
2008-12-17 16:56 --------- d-----w c:\program files\Securitoo
2008-12-13 06:27 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-06 14:14 --------- d-----w c:\program files\Winamp
2008-12-05 15:54 --------- d-----w c:\program files\Xvid
2008-12-01 16:33 --------- d-----w c:\program files\eMule
2008-11-25 00:05 --------- d-----w c:\program files\Lavasoft
2008-11-25 00:05 --------- d-----w c:\documents and settings\Administrateur\Application Data\Lavasoft
2008-11-25 00:04 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-11-24 19:42 51,072 ----a-w c:\windows\system32\drivers\fsdfw.sys
2008-11-24 19:42 30,016 ----a-w c:\windows\system32\drivers\fsndis5.sys
2008-11-24 19:31 --------- d-----w c:\documents and settings\All Users\Application Data\F-Secure
2008-11-24 19:30 --------- d-----w c:\documents and settings\All Users\Application Data\fssg
2008-11-24 17:17 --------- d-----w c:\program files\AC3Filter
2008-11-24 17:13 --------- d-----w c:\program files\DivX
2008-11-24 17:02 --------- d-----w c:\program files\Real Alternative
2008-11-24 17:02 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-24 16:57 --------- d-----w c:\program files\QuickTime Alternative
2008-11-24 16:49 --------- d-----w c:\program files\Full Pack Codecs
2008-11-19 22:54 --------- d-----w c:\program files\Microsoft LifeCam
2008-11-16 13:32 --------- d-----w c:\program files\Unlocker
2008-11-15 19:34 --------- d-----w c:\documents and settings\Administrateur\Application Data\LimeWire
2008-11-15 18:14 --------- d-----w c:\program files\LimeWire
2008-11-15 16:06 --------- d-----w c:\program files\iServer_Installer
2008-11-15 16:06 --------- d-----w c:\documents and settings\All Users\Application Data\iProxyInstaller
2008-11-15 11:49 --------- d-----w c:\program files\OrangeHSS
2008-11-13 14:40 --------- d-----w c:\program files\Fichiers communs\France Telecom
2008-11-09 11:38 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2008-11-09 11:38 --------- d-----w c:\documents and settings\Administrateur\Application Data\CyberLink
2008-11-06 16:52 --------- d-----w c:\program files\Office2003
2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx0c.dll
2008-10-28 22:36 823,296 ----a-w c:\windows\system32\divx_xx07.dll
2008-10-28 22:35 815,104 ----a-w c:\windows\system32\divx_xx0a.dll
2008-10-28 22:35 802,816 ----a-w c:\windows\system32\divx_xx11.dll
2008-10-28 22:35 684,032 ----a-w c:\windows\system32\DivX.dll
2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 12:46 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 12:46 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-10-15 16:35 337,408 ------w c:\windows\system32\dllcache\netapi32.dll
2008-10-15 06:34 633,632 ------w c:\windows\system32\dllcache\iexplore.exe
2008-10-15 06:33 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-10-03 10:03 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2007-05-15 20:05 66,672 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2007-05-15 20:05 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2007-05-15 20:05 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2007-05-15 20:05 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2007-05-15 20:05 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2008-03-13 14:16 16,384 --sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat
2008-03-13 14:16 16,384 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
2008-03-13 14:16 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Wallpaper"="c:\program files\Wallpaper\Wallpaper.exe" [2007-08-21 233472]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-15 342848]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-12-06 344064]
"F-Secure Manager"="c:\program files\Securitoo\av_fw\Common\FSM32.EXE" [2008-04-23 182936]
"F-Secure TNB"="c:\program files\Securitoo\av_fw\FSGUI\TNBUtil.exe" [2008-04-23 744032]
"SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 81920]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992]
"News Service"="c:\program files\Securitoo\av_fw\FSGUI\ispnews.exe" [2005-05-31 356352]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"Hard Disk Sentinel"="d:\logiciels\Tous les logiciels\HardDiskSentinel2.05\Portable Hard Disk Sentinel 2.05.exe" [2007-05-14 6637080]
"ORAHSSSessionManager"="c:\program files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2008-10-16 c:\windows\system32\advpack.dll]

c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 2.2.lnk - d:\logiciels\Tous les logiciels\OpenOffice\openoffice\program\quickstart.exe [2007-10-06 393216]
PStart.lnk - d:\logiciels\Tous les logiciels\PStart.exe [2007-10-06 647176]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide du logiciel HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 258048]
WinManager.lnk - c:\program files\Fujitsu Siemens\WinManager\WinManager.exe [2007-11-18 61440]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"StartMenuLogoff"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
2005-01-31 14:13 49152 c:\progra~1\FICHIE~1\stardock\MCPStub.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.ACDV"= ACDV.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
--a------ 2008-10-14 21:38 623992 c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
--a------ 2006-10-17 10:47 87584 c:\program files\Fichiers communs\Acronis\Schedule2\schedhlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]
--a------ 2006-10-18 17:02 1961576 c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-05-11 08:06 40048 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]
--a------ 2007-03-20 15:40 1884160 c:\progra~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-04-14 03:33 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2007-04-03 23:29 165784 c:\program files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2006-12-05 21:55 54832 c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2006-12-06 17:37 69216 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
--a------ 2006-11-10 11:35 90112 c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2005-08-25 14:25 737369 c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
--a------ 2006-10-18 16:58 1185264 c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2006-09-07 18:19 15872 c:\program files\Unlocker\UnlockerAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-03 17:43 69632 c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2006-02-27 16:28 16005120 c:\windows\RTHDCPL.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\FlashFXP\\FlashFXP.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Fichiers communs\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"d:\\eMule\\emule.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2007-11-14 51072]
R0 iastor55;iastor55;c:\windows\system32\drivers\iastor55.sys [2007-06-26 874240]
R1 F-Secure HIPS;F-Secure HIPS;\??\c:\program files\Securitoo\av_fw\HIPS\fshs.sys [2008-11-24 41184]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\c:\program files\CyberLink\PowerDVD\[u]0[/u]00.fcl [2007-10-02 19:50:06 13560]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\c:\program files\Securitoo\av_fw\Anti-Virus\minifilter\fsgk.sys [2007-11-14 62048]
S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\DRIVERS\s816bus.sys [2008-10-25 81832]
S4 F-Secure Filter;F-Secure File System Filter;\??\c:\program files\Securitoo\av_fw\Anti-Virus\Win2K\FSfilter.sys [2007-10-19 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;\??\c:\program files\Securitoo\av_fw\Anti-Virus\Win2K\FSrec.sys [2007-10-19 25184]
.
Contenu du dossier 'Tâches planifiées'

2008-12-26 c:\windows\Tasks\HPpromotions journeysoftware.job
- c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 17:36]

2008-12-26 c:\windows\Tasks\Scheduled scanning task.job
- c:\progra~1\SECURI~1\av_fw\ANTI-V~1\fsav.exe [2008-04-23 17:11]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{0FC626C5-4938-4357-8646-18D2884A5D2E} - (no file)
BHO-{3C1394A5-C3CF-4462-A88C-35EE29B4B548} - (no file)
BHO-{4244EA4F-5855-47B6-952A-B96772A09D07} - (no file)
BHO-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - (no file)
BHO-{75F5E79A-20C6-4818-9400-588A439E915F} - (no file)
BHO-{885A88AF-A780-4ECC-9FF5-F78680AE1F29} - (no file)
BHO-{99A24352-9B03-489A-8CA9-F18752B7ED8F} - (no file)
BHO-{AAD9A642-653E-495D-93FF-E989F7767C6D} - (no file)
BHO-{BF759171-C0E0-492F-A053-39E121280D9A} - (no file)
BHO-{CF669886-D266-4E4F-9820-94D517496752} - (no file)
BHO-{ED750C4F-A948-470A-AD3A-00B878296A64} - c:\windows\system32\qoMcyXoP.dll
BHO-{EE327F06-184B-45EA-8971-2EFE852E0E73} - (no file)
BHO-{F1323481-38ED-48E2-B368-405403C095AE} - (no file)
HKCU-Run-LClock - c:\program files\LClock\LClock.exe
HKCU-Run-Vista Sidebar - c:\program files\Vista Sidebar\sidebar.exe
HKCU-Run-ViStart - c:\program files\ViStart\ViStart.exe
HKCU-Run-VisualTooltip - c:\program files\VisualTooltip\VisualToolTip.exe
HKCU-Run-RocketDock - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
HKLM-Run-<NO NAME> - (no file)
Notify-byXNHbBR - byXNHbBR.dll
MSConfigStartUp-avast! - c:\progra~1\ALWILS~1\Avast4\ashDisp.exe


.
------- Examen supplémentaire -------
.
uStart Page = about:blank
mWindow Title =
IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Sothink SWF Catcher - c:\program files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
LSP: c:\program files\Securitoo\av_fw\FSPS\program\FSLSP.DLL
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-26 22:28:52
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\[u]0[/u]00.fcl"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(968)
c:\windows\system32\Ati2evxx.dll
c:\progra~1\FICHIE~1\Stardock\mcpstub.dll
c:\program files\Securitoo\av_fw\FWES\Program\fsdc.dll

- - - - - - - > 'lsass.exe'(1024)
c:\windows\system32\relog_ap.dll
c:\program files\Securitoo\av_fw\FSPS\program\FSLSP.DLL
c:\program files\Securitoo\av_fw\FWES\Program\fsdc.dll

- - - - - - - > 'csrss.exe'(936)
c:\program files\Securitoo\av_fw\FWES\Program\fsdc.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\ati2evxx.exe
c:\progra~1\FICHIE~1\stardock\SDMCP.exe
c:\program files\Fichiers communs\Acronis\Schedule2\schedul2.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\rundll32.exe
c:\program files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
c:\program files\Securitoo\av_fw\Anti-Virus\fsgk32.exe
c:\program files\Securitoo\av_fw\Common\FSMA32.EXE
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\[u]0[/u]\FTRTSVC.exe
c:\program files\Securitoo\av_fw\Common\FSMB32.EXE
c:\program files\Microsoft LifeCam\MSCamS32.exe
d:\logiciels\Tous les logiciels\OpenOffice\openoffice\program\soffice.exe
c:\program files\Securitoo\av_fw\Common\FCH32.EXE
d:\logiciels\Tous les logiciels\OpenOffice\openoffice\program\soffice.bin
c:\program files\Securitoo\av_fw\Anti-Virus\fsqh.exe
c:\program files\Securitoo\av_fw\Common\FAMEH32.EXE
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\program files\Securitoo\av_fw\FSGUI\fsguidll.exe
c:\program files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
c:\program files\Securitoo\av_fw\FSAUA\program\fsaua.exe
c:\program files\Securitoo\av_fw\Anti-Virus\fssm32.exe
c:\program files\Securitoo\av_fw\FWES\program\fsdfwd.exe
c:\program files\Securitoo\av_fw\FSAUA\program\fsus.exe
c:\program files\Securitoo\av_fw\Anti-Virus\fsav32.exe
c:\program files\Spybot - Search & Destroy\SpybotSD.exe
.
**************************************************************************
.
Heure de fin: 2008-12-26 22:35:08 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-12-26 21:35:00

Avant-CF: 19 197 943 808 octets libres
Après-CF: 19,218,956,288 octets libres

382 --- E O F --- 2008-12-18 01:46:40


Papport TB.txt

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz )
BIOS : Ver 1.00PARTTBL
USER : Administrateur ( Administrator )
BOOT : Fail-safe boot
Antivirus : AntiVirus Firewall 7.03 7.03 (Activated)
Firewall : AntiVirus Firewall 7.03 7.03 (Activated)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:17 Go)
D:\ (Local Disk) - NTFS - Total:72 Go (Free:49 Go)
E:\ (CD or DVD)
F:\ (Local Disk) - NTFS - Total:111 Go (Free:95 Go)
G:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 26/12/2008|22:06 )
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ICD1.tmp

-----------\\ SUPPRESSION

Supprime! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ICD1.tmp

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ Extensions

(Administrateur) - {77b819fa-95ad-4f2c-ac7c-486b356188a9} => ietab
(Administrateur) - {7b821b0e-b102-4f9b-b6e3-433ede1fe379} => torrentbar
(Administrateur) - {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} => adblockplus


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="about:blank"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/"


--------------------\\ Recherche d'autres infections

C:\WINDOWS\system32\PoXycMoq.ini
C:\WINDOWS\system32\PoXycMoq.ini2
C:\WINDOWS\system32\qoMcyXoP.dll
[b]==> VUNDO <==[/b]




1 - "C:\ToolBar SD\TB_1.txt" - 26/12/2008|22:10 - Option : [2]

-----------\\ Fin du rapport a 22:10:46,12

Rapport HiJack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:27:55, on 26/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20935)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\FICHIE~1\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
D:\Logiciels\Tous les logiciels\HardDiskSentinel2.05\Portable Hard Disk Sentinel 2.05.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Wallpaper\Wallpaper.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\4\AlertModule.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Logiciels\Tous les logiciels\PStart.exe
D:\Logiciels\Tous les logiciels\OpenOffice\openoffice\program\soffice.exe
D:\Logiciels\Tous les logiciels\OpenOffice\openoffice\program\soffice.BIN
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exe
C:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exe
C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Securitoo\av_fw\FSAUA\program\fsaua.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
C:\Program Files\Securitoo\av_fw\FSAUA\program\fsus.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://studies.eye-square.info/2008-10-TNS_GYV/SwapMedia/proxy_fr.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Hard Disk Sentinel] D:\Logiciels\Tous les logiciels\HardDiskSentinel2.05\Portable Hard Disk Sentinel 2.05.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: OpenOffice.org 2.2.lnk = D:\Logiciels\Tous les logiciels\OpenOffice\openoffice\program\quickstart.exe
O4 - Startup: PStart.lnk = D:\Logiciels\Tous les logiciels\PStart.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WinManager.lnk = C:\Program Files\Fujitsu Siemens\WinManager\WinManager.exe
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe Version Cue CS3 {fr_FR} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Fichiers communs\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe