Virus win32

merci beaucoup! voici le rapport, que dois-je faire ensuite?


----------------- FindyKill V4.711 ------------------

* User : Flavie - GUILMIN-5367723
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 05/01/09 par Chiquitine29
* Recherche effectuée à 20:16:50 le 13/01/2009
* Windows XP - Internet Explorer 7.0.5730.13

((((((((((((((((( *** Recherche *** ))))))))))))))))))


--------------- [ Processus actifs ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\S3trayp.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe

--------------- [ Fichiers/Dossiers infectieux ] ----------------


»»»» Presence des fichiers dans C:


»»»» Presence des fichiers dans C:\WINDOWS


»»»» Presence des fichiers dans C:\WINDOWS\Prefetch

Found ! - C:\WINDOWS\prefetch\198843.EXE-321B7606.pf
Found ! - C:\WINDOWS\prefetch\76625.EXE-223731F0.pf
Found ! - C:\WINDOWS\prefetch\83578.EXE-1151A795.pf
Found ! - C:\WINDOWS\prefetch\87406.EXE-2FC7B36A.pf
Found ! - C:\WINDOWS\prefetch\95906.EXE-16187F73.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-26B0F96F.pf
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf
Found ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-00CC0D96.pf
Found ! - C:\WINDOWS\Prefetch\KEY_GENERATOR.EXE-1CB78081.pf

»»»» Presence des fichiers dans C:\WINDOWS\system32

Found ! [13/01/2009 20:02] - C:\WINDOWS\system32\mdelk.exe
Found ! [13/01/2009 20:02] - C:\WINDOWS\system32\wintems.exe
Found ! [13/01/2009 20:03] - C:\WINDOWS\system32\ban_list.txt

»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers


»»»» Presence des fichiers dans C:\Documents and Settings\Flavie\Application Data

Found ! [13/01/2009 20:04] - "C:\Documents and Settings\Flavie\Application Data\m\flec006.exe"
Found ! [13/01/2009 20:04] - "C:\Documents and Settings\Flavie\Application Data\m\list.oct"
Found ! [13/01/2009 20:04] - "C:\Documents and Settings\Flavie\Application Data\m\data.oct"
Found ! [13/01/2009 20:04] - "C:\Documents and Settings\Flavie\Application Data\m\srvlist.oct"
Found ! [13/01/2009 20:05] - "C:\Documents and Settings\Flavie\Application Data\m\shared"
Found ! [11/01/2009 20:55] - "C:\Documents and Settings\Flavie\Application Data\m"
Found ! [11/01/2009 20:52] - "C:\Documents and Settings\Flavie\Application Data\drivers"
Found ! [13/01/2009 20:02] - "C:\Documents and Settings\Flavie\Application Data\drivers\srosa.sys"
Found ! [13/01/2009 20:02] - "C:\Documents and Settings\Flavie\Application Data\drivers\srosa2.sys"
Found ! [07/03/2006 02:02] - "C:\Documents and Settings\Flavie\Application Data\drivers\winupgro.exe"
Found ! [13/01/2009 20:06] - "C:\Documents and Settings\Flavie\Application Data\drivers\downld"

»»»» Presence des fichiers dans C:\DOCUME~1\Flavie\LOCALS~1\Temp


»»»» Presence des fichiers dans C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5

Found ! [11/01/2009 21:14] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\096RCDMR\b64[1].jpg
Found ! [13/01/2009 20:06] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\096RCDMR\b64_1[1].jpg
Found ! [11/01/2009 21:14] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\0PIJWTIZ\b64[1].jpg
Found ! [11/01/2009 21:10] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\0PIJWTIZ\b64_1[1].jpg
Found ! [11/01/2009 23:12] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\0PIJWTIZ\b64_1[2].jpg
Found ! [11/01/2009 20:54] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\0TINCHEN\b64_1[1].jpg
Found ! [11/01/2009 21:10] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\0TINCHEN\b64_2[1].jpg
Found ! [11/01/2009 21:02] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\0TINCHEN\b64_3[1].jpg
Found ! [11/01/2009 21:57] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\89QB816R\b64[1].jpg
Found ! [11/01/2009 21:37] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\8JHRUYJP\b64_2[1].jpg
Found ! [11/01/2009 20:53] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\8JHRUYJP\b64_3[1].jpg
Found ! [11/01/2009 20:54] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\C16V81QZ\b64[1].jpg
Found ! [13/01/2009 20:03] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\G9A38HU3\file[1].txt
Found ! [11/01/2009 21:02] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\GTIN4T6J\b64[1].jpg
Found ! [11/01/2009 23:09] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\GTIN4T6J\b64_1[1].jpg
Found ! [11/01/2009 21:13] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\GTIN4T6J\b64_3[1].jpg
Found ! [11/01/2009 21:09] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\K5YFG527\b64[1].jpg
Found ! [11/01/2009 21:16] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\K5YFG527\b64_1[1].jpg
Found ! [11/01/2009 21:04] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\K5YFG527\b64_2[1].jpg
Found ! [11/01/2009 21:16] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\O5MBW9YF\b64_2[1].jpg
Found ! [13/01/2009 20:06] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\O5MBW9YF\b64_2[2].jpg
Found ! [11/01/2009 21:29] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\O5MBW9YF\b64_3[1].jpg
Found ! [11/01/2009 23:05] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\O5MBW9YF\b64_3[2].jpg
Found ! [11/01/2009 23:12] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\OP6N8HYF\b64_2[1].jpg
Found ! [11/01/2009 21:07] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\OP6N8HYF\b64_3[1].jpg
Found ! [13/01/2009 20:02] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\OP6N8HYF\b64_3[2].jpg
Found ! [11/01/2009 21:14] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\P7379TCE\b64_1[1].jpg
Found ! [11/01/2009 20:55] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\P7379TCE\mxd[1].jpg
Found ! [11/01/2009 23:06] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\P7379TCE\mxd[2].jpg
Found ! [11/01/2009 23:09] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\P7379TCE\mxd[3].jpg
Found ! [11/01/2009 21:35] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\Q95QFYHW\b64[1].jpg
Found ! [11/01/2009 23:05] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\Q95QFYHW\b64[2].jpg
Found ! [11/01/2009 21:57] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\Q95QFYHW\b64_1[1].jpg
Found ! [11/01/2009 21:56] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\Q95QFYHW\b64_3[1].jpg
Found ! [11/01/2009 21:08] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\SX6FG5I7\b64_1[1].jpg
Found ! [11/01/2009 21:29] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\SX6FG5I7\b64_1[2].jpg
Found ! [11/01/2009 21:29] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\XMW3S297\b64[1].jpg
Found ! [13/01/2009 20:04] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\XMW3S297\b64[2].jpg
Found ! [11/01/2009 21:02] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\XMW3S297\b64_1[1].jpg
Found ! [11/01/2009 21:37] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\XMW3S297\b64_1[2].jpg
Found ! [11/01/2009 22:00] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\XMW3S297\b64_2[1].jpg
Found ! [11/01/2009 21:07] - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\XMW3S297\b64_3[1].jpg

--------------- [ Registre / Startup ] ----------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
RTHDCPL=RTHDCPL.EXE
Alcmtr=ALCMTR.EXE
VTTimer=VTTimer.exe
S3Trayp=S3trayp.exe
OpwareSE2="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
Installed=1
NoChange=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1

[HKEY_CURRENT_USER\software\local appwizard-generated applications\key_generator]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\MsnMsgr]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]

--------------- [ Registre / Clés infectieuses ] ----------------


Found ! - HKEY_USERS\S-1-5-21-793523957-2005341952-1581636013-1004\Software\Local AppWizard-Generated Applications\key_generator
Found ! - HKEY_USERS\S-1-5-21-793523957-2005341952-1581636013-1004\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_USERS\S-1-5-21-793523957-2005341952-1581636013-1004\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-793523957-2005341952-1581636013-1004\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-793523957-2005341952-1581636013-1004\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-793523957-2005341952-1581636013-1004\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-793523957-2005341952-1581636013-1004\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-793523957-2005341952-1581636013-1004\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\key_generator
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR

/!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
/!\ Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

--------------- [ Etat / Services ] ----------------

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot

/!\ Mode sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal

/!\ Mode sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network

/!\ Mode sans echec non fonctionnel !!



+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

/!\ Ndisuio - Type de démarrage = 4

EapHost - Type de démarrage = 3

/!\ Ip6Fw - Type de démarrage = 4

/!\ SharedAccess - Type de démarrage = 4

/!\ wuauserv - Type de démarrage = 4

/!\ wscsvc - Type de démarrage = 4


--------------- [ Recherche dans supports amovibles] ----------------


+- Informations :

C: - Lecteur fixe


+- presence des fichiers :



--------------- [ Registre / Mountpoint2 ] ----------------


-> Not found !


------------------- ! Fin du rapport ! --------------------

voilà:
----------------- FindyKill V4.711 ------------------

* User : Flavie - -5367723
* executed from : C:\Program Files\FindyKill
* Update on 05/01/09 par Chiquitine29
* Start at 21:11:57 the 13/01/2009
* Windows XP - Internet Explorer 7.0.5730.13


((((((((((((((( *** deleting *** ))))))))))))))))))


--------------- [ Active Processes ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe

--------------- [ Infected files / folders ] ----------------


»»»» Supression files in C:


»»»» Supression files in C:\WINDOWS


»»»» Supression files in C:\WINDOWS\Prefetch


»»»» Supression files in C:\WINDOWS\system32


»»»» Supression files in C:\WINDOWS\system32\drivers


»»»» Supression files in C:\Documents and Settings\Flavie\Application Data

Deleted ! - "C:\Documents and Settings\Flavie\Application Data\drivers\downld"
Deleted ! - "C:\Documents and Settings\Flavie\Application Data\drivers"

»»»» Supression files in C:\DOCUME~1\Flavie\LOCALS~1\Temp


»»»» Supression files in C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5

Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\096RCDMR\b64[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\096RCDMR\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\0PIJWTIZ\b64[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\0PIJWTIZ\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\0PIJWTIZ\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\0TINCHEN\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\0TINCHEN\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\0TINCHEN\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\89QB816R\b64[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\8JHRUYJP\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\8JHRUYJP\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\C16V81QZ\b64[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\G9A38HU3\file[1].txt
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\GTIN4T6J\b64[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\GTIN4T6J\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\GTIN4T6J\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\K5YFG527\b64[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\K5YFG527\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\K5YFG527\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\O5MBW9YF\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\O5MBW9YF\b64_2[2].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\O5MBW9YF\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\O5MBW9YF\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\OP6N8HYF\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\OP6N8HYF\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\OP6N8HYF\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\P7379TCE\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\P7379TCE\mxd[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\P7379TCE\mxd[2].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\P7379TCE\mxd[3].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\Q95QFYHW\b64[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\Q95QFYHW\b64[2].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\Q95QFYHW\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\Q95QFYHW\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\SX6FG5I7\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\SX6FG5I7\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\XMW3S297\b64[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\XMW3S297\b64[2].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\XMW3S297\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\XMW3S297\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\XMW3S297\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Flavie\Local Settings\Temporary Internet Files\Content.IE5\XMW3S297\b64_3[1].jpg

--------------- [ Registry / Infected keys ] ----------------

Deleted ! - HKEY_CURRENT_USER\Software\bisoft
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mdelk.exe
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wintems.exe
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\flec006.exe
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hldrrr.exe
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winfilse.exe
Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winupgro.exe
Deleted ! - HKEY_USERS\S-1-5-21-793523957-2005341952-1581636013-1004\Software\Local AppWizard-Generated Applications\MsnMsgr

--------------- [ States / Restarting of services ] ----------------



+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

EapHost - Type of startup = 2

Ip6Fw - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2


--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Lecteur fixe


+- deleting files :


--------------- [ Registry / Mountpoint2 ] ----------------


-> Not found !


--------------- [ Searching Other Infections ] ----------------

Suspect ! - 64527b0f63971478d1a24717d806e0d9 C:\Program Files\AVS4YOU\AVSSoftwareNavigator\AVS4YOUSoftwareNavigator.exe
Suspect ! - d2128b8ce0d598304d9e8bb7559231ed C:\Program Files\AVS4YOU\AVSVideoConverter6\AVSVideoConverter.exe
Suspect ! - 17edef0b1b14d618ccbd9a8f89f02a36 C:\Program Files\AVS4YOU\Registration.exe
Suspect ! - 0028fa999180fad745b7f23872278941 C:\Program Files\AxBx\Multi Virus Cleaner 2008\MVC.exe
Suspect ! - 96011d5a12161242d8c4eeba20e1fe0b C:\Program Files\Fichiers communs\AVSMedia\BurnerService\AVSVideoBurner.exe
Suspect ! - 646c16dfb50b7f7ed4a13558612be4e5 C:\Program Files\Fichiers communs\AVSMedia\MobileUploader\AVSMobileUploader.exe
Suspect ! - ebe38e2fcd97bfaf184cd5386100b529 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
Suspect ! - ebe38e2fcd97bfaf184cd5386100b529 C:\RECYCLER\S-1-5-21-793523957-2005341952-1581636013-1004\Dc238.91\key_generator.exe

--------------- [ Searching Cracks / Keygen ] ----------------



---------------- ! End of report ! ------------------

ComboFix 09-01-13.03 - Flavie 2009-01-13 21:49:42.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1918.1591 [GMT 1:00]
Lancé depuis: c:\documents and settings\Flavie\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Flavie\Bureau\WinXP_FR_PER_BF.EXE
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Flavie\Application Data\drivers\downld
c:\program files\Windows Live\Messenger\MsnMsgr.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-12-13 au 2009-01-13 ))))))))))))))))))))))))))))))))))))
.

2009-01-13 21:14 . 2009-01-13 21:50 <REP> d--h----- c:\documents and settings\Flavie\Application Data\drivers
2009-01-13 20:07 . 2009-01-13 21:13 <REP> d-------- c:\program files\FindyKill
2009-01-11 22:49 . 2009-01-11 23:16 <REP> d-------- c:\program files\AxBx
2008-12-31 10:01 . 2008-10-16 21:18 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll
2008-12-31 10:01 . 2007-04-17 10:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat
2008-12-31 10:01 . 2007-03-08 06:10 1,048,576 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui
2008-12-31 10:01 . 2008-10-16 21:18 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll
2008-12-31 10:01 . 2008-10-16 21:18 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll
2008-12-31 10:01 . 2008-10-16 21:18 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll
2008-12-31 10:01 . 2008-10-16 21:18 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll
2008-12-31 10:01 . 2008-10-16 21:18 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll
2008-12-31 10:01 . 2008-10-16 14:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe
2008-12-23 18:51 . 2008-04-13 19:33 159,232 --a------ c:\windows\system32\ptpusd.dll
2008-12-23 18:51 . 2001-08-23 17:47 5,632 --a------ c:\windows\system32\ptpusb.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-11 22:14 --------- d-----w c:\program files\Windows Live
2009-01-11 21:47 --------- d-----w c:\program files\eMule
2009-01-11 21:29 --------- d-----w c:\program files\Bonjour
2009-01-11 21:04 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-11 19:56 --------- d-----w c:\documents and settings\Flavie\Application Data\DivX
2009-01-09 20:43 --------- d-----w c:\documents and settings\Flavie\Application Data\Canon
2008-12-21 15:01 --------- d-----w c:\documents and settings\Flavie\Application Data\skypePM
2008-11-13 19:28 --------- d-----w c:\documents and settings\Flavie\Application Data\Media Player Classic
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 20:18 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-09-01 17:41 15,397 ----a-w c:\program files\settings.dat
2008-06-03 14:58 17,080 ----a-w c:\documents and settings\Flavie\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-10 c:\windows\RTHDCPL.exe]
"VTTimer"="VTTimer.exe" [2006-09-21 c:\windows\system32\VTTimer.exe]
"S3Trayp"="S3trayp.exe" [2007-06-11 c:\windows\system32\S3Trayp.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [2008-05-21 714240]
S3 P1130VID;Creative WebCam NX Pro;c:\windows\system32\drivers\P1130Vid.sys [2008-07-26 90357]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{24bf8cb7-2796-11dd-956d-806d6172696f}]
\Shell\AutoRun\command - D:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ed46b97-67af-11dd-a08c-001d927ddcda}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c598716f-2bf8-11dd-a030-001d927ddcda}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d5813d61-2a7b-11dd-a02e-001d927ddcda}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-13 21:50:18
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-01-13 21:50:55
ComboFix-quarantined-files.txt 2009-01-13 20:50:53

Avant-CF: 462 168 920 064 octets libres
Après-CF: 462,167,412,736 octets libres

WinXP_FR_PER_BF.EXE
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

132 --- E O F --- 2008-12-31 18:22:04

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:59:15, on 13/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\sol.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

Malwarebytes' Anti-Malware 1.32
Version de la base de données: 1648
Windows 5.1.2600 Service Pack 3

13/01/2009 22:36:51
mbam-log-2009-01-13 (22-36-51).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 77621
Temps écoulé: 21 minute(s), 48 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 12

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{AF3AC665-D406-4F6C-A510-700EE3103D40}\RP209\A0016411.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AF3AC665-D406-4F6C-A510-700EE3103D40}\RP209\A0016649.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AF3AC665-D406-4F6C-A510-700EE3103D40}\RP209\A0016700.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AF3AC665-D406-4F6C-A510-700EE3103D40}\RP209\A0016714.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AF3AC665-D406-4F6C-A510-700EE3103D40}\RP209\A0016824.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AF3AC665-D406-4F6C-A510-700EE3103D40}\RP209\A0016838.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AF3AC665-D406-4F6C-A510-700EE3103D40}\RP209\A0016961.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AF3AC665-D406-4F6C-A510-700EE3103D40}\RP213\A0018247.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AF3AC665-D406-4F6C-A510-700EE3103D40}\RP213\A0018341.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AF3AC665-D406-4F6C-A510-700EE3103D40}\RP213\A0018354.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AF3AC665-D406-4F6C-A510-700EE3103D40}\RP216\A0018465.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AF3AC665-D406-4F6C-A510-700EE3103D40}\RP216\A0018476.sys (Worm.Bagel) -> Quarantined and deleted successfully.

le 1er rapport

Logfile of random's system information tool 1.05 (written by random/random)
Run by Flavie at 2009-01-13 22:43:38
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 441 GB (92%) free of 477 GB
Total RAM: 1918 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:43:41, on 13/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\S3trayp.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Flavie\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Flavie.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

le 2eme rapport

info.txt logfile of random's system information tool 1.05 2009-01-13 22:43:42

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CA9EC1C6-3B51-11D6-B1A9-BCD2747AA951}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D43F13A1-1E39-4BD4-9682-DF889FE75421}\setup.exe" -l0x40c
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 7.0.7 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70700000002}
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
AVS Video Converter 6-->"C:\Program Files\AVS4YOU\AVSVideoConverter6\unins000.exe"
AVS4YOU Software Navigator 1.2-->"C:\Program Files\AVS4YOU\AVSSoftwareNavigator\unins000.exe"
Bonjour-->MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
Canon MP Navigator 2.0-->"C:\Program Files\Canon\MP Navigator 2.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 2.0\uninst.ini
Canon MP150-->"C:\WINDOWS\system32\CanonMP Uninstaller Information\{CA9A3609-3ECC-4574-8824-A8161A71A603}\DelDrv.exe" /U:{CA9A3609-3ECC-4574-8824-A8161A71A603} /L0x000c
Canon Utilities Easy-PhotoPrint-->C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Creative PC-CAM Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D43F13A1-1E39-4BD4-9682-DF889FE75421}\setup.exe" -l0x40c /remove
Creative WebCam Monitor-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CA9EC1C6-3B51-11D6-B1A9-BCD2747AA951}\setup.exe" -l0x40c /remove
Creative WebCam NX Pro Driver (1.00.06.0512)-->C:\WINDOWS\CtDrvIns.exe -uninstall -script Pd1130.uns -unsext NT -plugin P1130Pin.dll -pluginres P1130Pin.crl
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Easy-WebPrint-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"
eMule-->"C:\Program Files\eMule\Uninstall.exe"
FindyKill-->C:\Program Files\FindyKill\Uninstal.exe
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
iTunes-->MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Logiciels Quadratus-->C:\WINDOWS\IsUn040c.exe -fC:\quadra\QPRG.isu
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Manuel d'utilisation de Creative WebCam NX Pro (Français)-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Creative\Creative WebCam NX Pro\Manuel d'utilisation de Creative WebCam NX Pro\French\CTManual.isu"
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office PowerPoint Viewer 2003-->MsiExec.exe /X{90AF040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office XP Professional avec FrontPage-->MsiExec.exe /I{9028040C-6000-11D3-8CFE-0050048383C9}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Multi Virus Cleaner 2008-->"C:\Program Files\AxBx\Multi Virus Cleaner 2008\unins000.exe"
OmniPage SE 2.0-->MsiExec.exe /I{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}
PC SECURITY TEST 2008-->"C:\Program Files\AxBx\PC Security Test 2008\unins000.exe"
PDFCreator Toolbar-->"C:\WINDOWS\PDFCreator_Toolbar_Uninstaller_4953.exe" _?=C:\Program Files\PDFCreator Toolbar
PDFCreator-->C:\Program Files\PDFCreator\unins000.exe
QuickTime-->MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c -removeonly
VIA Display Driver 6.14.10.0102-->C:\PROGRA~1\S3\UChromeP\s3minset.exe /u UChromeP.uns
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"

======Security center information======

AV: Avira AntiVir PersonalEdition Classic

System event log

Computer Name: GUILMIN-5367723
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service de la passerelle de la couche Application.

Record Number: 10812
Source Name: Service Control Manager
Time Written: 20090109192801.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: GUILMIN-5367723
Event Code: 7036
Message: Le service Service de découvertes SSDP est entré dans l'état : en cours d'exécution.

Record Number: 10811
Source Name: Service Control Manager
Time Written: 20090109192800.000000+060
Event Type: Informations
User:

Computer Name: GUILMIN-5367723
Event Code: 7036
Message: Le service Service de l'iPod est entré dans l'état : en cours d'exécution.

Record Number: 10810
Source Name: Service Control Manager
Time Written: 20090109192800.000000+060
Event Type: Informations
User:

Computer Name: GUILMIN-5367723
Event Code: 7036
Message: Le service NLA (Network Location Awareness) est entré dans l'état : en cours d'exécution.

Record Number: 10809
Source Name: Service Control Manager
Time Written: 20090109192800.000000+060
Event Type: Informations
User:

Computer Name: GUILMIN-5367723
Event Code: 7036
Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : en cours d'exécution.

Record Number: 10808
Source Name: Service Control Manager
Time Written: 20090109192800.000000+060
Event Type: Informations
User:

Application event log

Computer Name: GUILMIN-5367723
Event Code: 1000
Message: Application défaillante iexplore.exe, version 6.0.2900.5512, module défaillant flash10a.ocx, version 10.0.12.36, adresse de défaillance 0x000882df.

Record Number: 2903
Source Name: Application Error
Time Written: 20081118204248.000000+060
Event Type: erreur
User:

Computer Name: GUILMIN-5367723
Event Code: 1001
Message: Détecteur d'erreurs 969191550.

Record Number: 2902
Source Name: Application Error
Time Written: 20081118203453.000000+060
Event Type: erreur
User:

Computer Name: GUILMIN-5367723
Event Code: 1000
Message: Application défaillante iexplore.exe, version 6.0.2900.5512, module défaillant flash10a.ocx, version 10.0.12.36, adresse de défaillance 0x000882df.

Record Number: 2901
Source Name: Application Error
Time Written: 20081118203451.000000+060
Event Type: erreur
User:

Computer Name: GUILMIN-5367723
Event Code: 1001
Message: Détecteur d'erreurs 969191550.

Record Number: 2900
Source Name: Application Error
Time Written: 20081118203318.000000+060
Event Type: erreur
User:

Computer Name: GUILMIN-5367723
Event Code: 1000
Message: Application défaillante iexplore.exe, version 6.0.2900.5512, module défaillant flash10a.ocx, version 10.0.12.36, adresse de défaillance 0x000882df.

Record Number: 2899
Source Name: Application Error
Time Written: 20081118203314.000000+060
Event Type: erreur
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\QuickTime\QTSystem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

-------------- UsbFix V2.414 ---------------

* User : Flavie - GUILMIN-5367723
* Outils mis a jours le 09/01/2009 par Chiquitine29 et Chimay8
* Recherche effectuée à 22:58:21 le 13/01/2009
* Windows Xp - Internet Explorer 7.0.5730.13


--------------- [ Processus actifs ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avwsc.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE

--------------- [ Informations lecteurs ] ----------------

C: - Lecteur fixe


--------------- [ Lecteur C ] ----------------

C: - Lecteur fixe


+- Listing des fichiers présents :

[21/05/2008 23:54][--a------] C:\AUTOEXEC.BAT
[13/04/2008 08:43][-rahs----] C:\NTDETECT.COM
[13/01/2009 21:49][-rahs----] C:\boot.ini
[13/01/2009 21:50][--a------] C:\ComboFix.txt
[13/01/2009 21:50][--a------] C:\FindyKill.txt
[13/01/2009 21:50][--a------] C:\UsbFix.txt
[21/05/2008 23:54][--a------] C:\CONFIG.SYS
[21/05/2008 23:54][--a------] C:\IO.SYS
[21/05/2008 23:54][--a------] C:\MSDOS.SYS
[21/05/2008 23:54][--a------] C:\pagefile.sys

--------------- [ Registre / Startup ] ----------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.google.fr/?gws_rd=ssl"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
RTHDCPL=RTHDCPL.EXE
VTTimer=VTTimer.exe
S3Trayp=S3trayp.exe
OpwareSE2="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
Installed=1
NoChange=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1

--------------- [ Registre / Mountpoint2 ] ----------------

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{24bf8cb7-2796-11dd-956d-806d6172696f}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2ed46b97-67af-11dd-a08c-001d927ddcda}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c598716f-2bf8-11dd-a030-001d927ddcda}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d5813d61-2a7b-11dd-a02e-001d927ddcda}\Shell\AutoRun\command

--------------- [ Nettoyage des disques ] ----------------


--------------- [ Resumé ] ----------------

-> /!\ Le resultat doit etre interprété par un spécialiste /!\

[21/05/2008 23:54][--a------] C:\AUTOEXEC.BAT
[13/04/2008 08:43][-rahs----] C:\NTDETECT.COM
[13/01/2009 21:49][-rahs----] C:\boot.ini

--------------- [ Vaccination ] ----------------

B:\autorun.inf -> Dossier autorun.inf crée par UsbFix !
C:\autorun.inf -> Dossier autorun.inf crée par UsbFix !

--------------- ! Fin du rapport ! ----------------

re, voilà le résultat du rsit

Logfile of random's system information tool 1.05 (written by random/random)
Run by Flavie at 2009-01-13 23:07:00
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 441 GB (92%) free of 477 GB
Total RAM: 1918 MB (80% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:07:03, on 13/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\S3trayp.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Flavie\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Flavie.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

je n'arrive pas à te poster le dernier rapport!!!

Malwarebytes' Anti-Malware 1.32
Version de la base de données: 1648
Windows 5.1.2600 Service Pack 3

14/01/2009 21:18:39
mbam-log-2009-01-14 (21-18-39).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 78471
Temps écoulé: 13 minute(s), 50 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)