Internet tres lent

Bonsoir,

Désolé pour cet envoi tardif.
Voici les rapports
Logfile of random's system information tool 1.06 (written by random/random)
Run by christian at 2009-03-26 20:28:43
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 6 GB (12%) free of 47 GB
Total RAM: 1279 MB (32% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:29:49, on 26/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\christian\Bureau\RSIT.exe
C:\Program Files\trend micro\christian.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSD.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Bonjour,

Je ne trouve pas de trace de l'antivirus etrust. J'ai fait une recherche par l'explorer et il ne trouve rien.

Je ne comprend pas, je ne trouve pas
C:\Program Files\CA\eTrust Antivirus

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) M processor 1.70GHz )
BIOS : PhoenixBIOS 4.0 Release 6.0
USER : christian ( Administrator )
BOOT : Normal boot
Firewall : ZoneAlarm Firewall 7.0.483.000 (Activated)
C:\ (Local Disk) - NTFS - Total:46 Go (Free:5 Go)
D:\ (Local Disk) - NTFS - Total:36 Go (Free:1 Go)
E:\ (Local Disk) - FAT32 - Total:9 Go (Free:3 Go)
F:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 27/03/2009|21:51 )

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\AskBarDis\bar
Supprime! - C:\Program Files\AskBarDis\PopSwatter
Supprime! - C:\Program Files\AskBarDis\unins000.dat
Supprime! - C:\Program Files\AskBarDis\unins000.exe
Supprime! - C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com
Supprime! - C:\WINDOWS\iun6002.exe
Supprime! - C:\Program Files\AskBarDis

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ Extensions

(christian) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(christian) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
(christian) - {73a6fe31-595d-460b-a920-fcc0f8843232} => noscript
(christian) - {E9A1DEE0-C623-4439-8932-001E7D17607D} => ajtoolbar


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr/"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !


1 - "C:\ToolBar SD\TB_1.txt" - 26/03/2009|20:27 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 27/03/2009|18:14 - Option : [1]
3 - "C:\ToolBar SD\TB_3.txt" - 27/03/2009|21:54 - Option : [2]

-----------\\ Fin du rapport a 21:54:15,65

Malwarebytes' Anti-Malware 1.35
Version de la base de données: 1907
Windows 5.1.2600 Service Pack 3

27/03/2009 22:12:20
mbam-log-2009-03-27 (22-12-20).txt

Type de recherche: Examen rapide
Eléments examinés: 98241
Temps écoulé: 7 minute(s), 6 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 11
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{994b5fb4-0103-44a6-b6b3-c73572b362bc} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f608c2d0-846d-4f0e-e47a-88367c887707} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7f3ea905-de65-4d00-bc1f-ff3a77f8ca30} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a26f07f-0d60-4835-91cf-1e1766a0ec56} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{c24d7016-d00f-41ef-9781-984b6b5ff38f} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ec88fcd0-2ed5-4d65-9b4c-71d146b43a2e} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e532cfb1-5edd-4663-8c22-bcd67b5e5bd4} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\ConTest.dll (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\ConTest.dll (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
C:\WINDOWS\BM87d37a9f.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM87d37a9f.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

ComboFix 09-03-27.02 - christian 2009-03-28 12:04:33.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1279.625 [GMT 1:00]
Lancé depuis: c:\documents and settings\christian\Bureau\ComboFix.exe
FW: ZoneAlarm Firewall *disabled*
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\patch.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
E:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_IPRIP
-------\Service_Iprip
-------\Service_PCIDump


((((((((((((((((((((((((((((( Fichiers créés du 2009-02-28 au 2009-03-28 ))))))))))))))))))))))))))))))))))))
.

2009-03-27 22:00 . 2009-03-27 22:00 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-27 22:00 . 2009-03-27 22:00 <REP> d-------- c:\documents and settings\christian\Application Data\Malwarebytes
2009-03-27 22:00 . 2009-03-26 16:49 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-27 22:00 . 2009-03-26 16:49 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-27 06:51 . 2004-10-15 09:20 1,654,784 --a------ c:\windows\system32\W29MLRES.DLL
2009-03-27 06:51 . 2004-01-02 14:58 13 --a------ c:\windows\system32\drivers\verfile.tic
2009-03-26 20:28 . 2009-03-26 20:29 <REP> d-------- C:\rsit
2009-03-26 20:24 . 2009-03-27 21:54 <REP> d-------- C:\ToolBar SD
2009-03-25 21:09 . 2009-03-25 21:09 <REP> d-------- c:\windows\tiinst
2009-03-25 08:25 . 2009-03-25 08:25 <REP> d-------- c:\documents and settings\Invité\Application Data\Windows Desktop Search
2009-03-25 08:24 . 2009-03-25 08:24 <REP> d-------- c:\documents and settings\Invité\Application Data\Intel
2009-03-25 08:23 . 2009-03-22 09:41 <REP> d--h----- c:\documents and settings\Invité\Voisinage réseau
2009-03-25 08:23 . 2009-03-22 09:41 <REP> d--h----- c:\documents and settings\Invité\Voisinage réseau
2009-03-25 08:23 . 2009-03-22 09:41 <REP> d--h----- c:\documents and settings\Invité\Voisinage d'impression
2009-03-25 08:23 . 2009-03-22 09:41 <REP> d--h----- c:\documents and settings\Invité\Voisinage d'impression
2009-03-25 08:23 . 2009-03-22 09:55 <REP> d--h----- c:\documents and settings\Invité\Modèles
2009-03-25 08:23 . 2009-03-22 09:55 <REP> d--h----- c:\documents and settings\Invité\Modèles
2009-03-25 08:23 . 2009-03-25 08:25 <REP> dr------- c:\documents and settings\Invité\Mes documents
2009-03-25 08:23 . 2009-03-25 08:25 <REP> dr------- c:\documents and settings\Invité\Mes documents
2009-03-25 08:23 . 2009-03-22 09:41 <REP> dr------- c:\documents and settings\Invité\Menu Démarrer
2009-03-25 08:23 . 2009-03-22 09:41 <REP> dr------- c:\documents and settings\Invité\Menu Démarrer
2009-03-25 08:23 . 2009-03-25 08:25 <REP> dr------- c:\documents and settings\Invité\Favoris
2009-03-25 08:23 . 2009-03-25 08:25 <REP> dr------- c:\documents and settings\Invité\Favoris
2009-03-25 08:23 . 2009-03-22 09:55 <REP> d-------- c:\documents and settings\Invité\Bureau
2009-03-25 08:23 . 2009-03-22 09:55 <REP> d-------- c:\documents and settings\Invité\Bureau
2009-03-25 08:23 . 2009-03-25 08:23 <REP> d-------- c:\documents and settings\Invité
2009-03-24 17:39 . 2009-03-24 17:39 <REP> d--hs---- c:\documents and settings\Papa\IETldCache
2009-03-23 20:21 . 2009-03-23 20:21 <REP> d--hs---- c:\documents and settings\christian\IECompatCache
2009-03-22 19:08 . 2009-03-22 19:11 <REP> d--h-c--- c:\windows\ie8
2009-03-22 18:03 . 2009-03-22 18:03 <REP> d--hs---- c:\documents and settings\christian\PrivacIE
2009-03-22 17:59 . 2009-03-22 17:59 <REP> d--hs---- c:\documents and settings\LocalService\IETldCache
2009-03-22 17:59 . 2009-03-22 17:59 <REP> d--hs---- c:\documents and settings\christian\IETldCache
2009-03-22 17:56 . 2009-03-22 19:13 <REP> d-------- c:\windows\ie8updates
2009-03-22 17:50 . 2009-02-28 05:55 105,984 -----c--- c:\windows\system32\dllcache\iecompat.dll
2009-03-22 17:02 . 2009-03-22 17:02 <REP> d-------- C:\O2C
2009-03-22 14:54 . 2009-03-22 14:54 <REP> d-------- c:\documents and settings\Maxime\Application Data\Windows Desktop Search
2009-03-22 14:53 . 2009-03-22 14:54 <REP> dr------- c:\documents and settings\Maxime\Favoris
2009-03-22 14:53 . 2009-03-22 15:01 <REP> d-------- c:\documents and settings\Maxime\Bureau
2009-03-22 14:53 . 2009-03-22 14:53 <REP> d-------- c:\documents and settings\Maxime\Application Data\Intel
2009-03-22 14:52 . 2009-03-22 09:41 <REP> d--h----- c:\documents and settings\Maxime\Voisinage réseau
2009-03-22 14:52 . 2009-03-22 09:41 <REP> d--h----- c:\documents and settings\Maxime\Voisinage d'impression
2009-03-22 14:52 . 2009-03-22 09:55 <REP> d--h----- c:\documents and settings\Maxime\Modèles
2009-03-22 14:52 . 2009-03-22 14:54 <REP> dr------- c:\documents and settings\Maxime\Mes documents
2009-03-22 14:52 . 2009-03-22 09:41 <REP> dr------- c:\documents and settings\Maxime\Menu Démarrer
2009-03-22 14:52 . 2009-03-22 14:53 <REP> d-------- c:\documents and settings\Maxime
2009-03-22 12:47 . 2009-03-22 12:47 <REP> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-03-22 12:26 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2009-03-22 12:25 . 2009-03-22 09:41 <REP> d--h----- c:\documents and settings\Papa\Voisinage réseau
2009-03-22 12:25 . 2009-03-22 09:41 <REP> d--h----- c:\documents and settings\Papa\Voisinage d'impression
2009-03-22 12:25 . 2009-03-22 09:55 <REP> d--h----- c:\documents and settings\Papa\Modèles
2009-03-22 12:25 . 2009-03-24 17:39 <REP> dr------- c:\documents and settings\Papa\Mes documents
2009-03-22 12:25 . 2009-03-22 09:41 <REP> dr------- c:\documents and settings\Papa\Menu Démarrer
2009-03-22 12:25 . 2009-03-24 17:39 <REP> dr------- c:\documents and settings\Papa\Favoris
2009-03-22 12:25 . 2009-03-27 23:10 <REP> d-------- c:\documents and settings\Papa\Bureau
2009-03-22 12:25 . 2009-03-22 12:25 <REP> d-------- c:\documents and settings\Papa\Application Data\Windows Desktop Search
2009-03-22 12:25 . 2009-03-22 12:25 <REP> d-------- c:\documents and settings\Papa\Application Data\Intel
2009-03-22 12:25 . 2009-03-24 17:39 <REP> d-------- c:\documents and settings\Papa
2009-03-22 12:23 . 2008-06-14 18:33 272,768 -----c--- c:\windows\system32\dllcache\bthport.sys
2009-03-22 12:20 . 2008-10-16 02:01 1,499,648 -----c--- c:\windows\system32\dllcache\shdocvw.dll
2009-03-22 12:20 . 2009-03-08 04:34 1,206,784 --a--c--- c:\windows\system32\dllcache\urlmon.dll
2009-03-22 12:20 . 2009-03-08 04:34 914,944 --a--c--- c:\windows\system32\dllcache\wininet.dll
2009-03-22 12:18 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2009-03-22 12:18 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-03-22 12:18 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-03-22 12:18 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2009-03-22 12:16 . 2009-03-08 04:41 5,937,152 --a--c--- c:\windows\system32\dllcache\mshtml.dll
2009-03-22 12:13 . 2009-03-22 09:41 <REP> d--h----- c:\documents and settings\Marion\Voisinage réseau
2009-03-22 12:13 . 2009-03-22 09:41 <REP> d--h----- c:\documents and settings\Marion\Voisinage d'impression
2009-03-22 12:13 . 2009-03-22 09:55 <REP> d--h----- c:\documents and settings\Marion\Modèles
2009-03-22 12:13 . 2009-03-22 12:13 <REP> dr------- c:\documents and settings\Marion\Mes documents
2009-03-22 12:13 . 2009-03-22 09:41 <REP> dr------- c:\documents and settings\Marion\Menu Démarrer
2009-03-22 12:13 . 2009-03-22 12:13 <REP> dr------- c:\documents and settings\Marion\Favoris
2009-03-22 12:13 . 2009-03-22 09:55 <REP> d-------- c:\documents and settings\Marion\Bureau
2009-03-22 12:13 . 2009-03-22 12:13 <REP> d-------- c:\documents and settings\Marion\Application Data\Windows Desktop Search
2009-03-22 12:13 . 2009-03-22 12:13 <REP> d-------- c:\documents and settings\Marion\Application Data\Intel
2009-03-22 12:13 . 2009-03-22 12:13 <REP> d-------- c:\documents and settings\Marion
2009-03-22 12:13 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-03-22 12:12 . 2008-12-11 11:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys
2009-03-22 12:12 . 2008-05-01 15:36 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
2009-03-22 12:10 . 2008-04-11 20:05 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2009-03-22 12:07 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2009-03-22 12:07 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2009-03-22 12:05 . 2009-01-09 20:19 1,089,883 -----c--- c:\windows\system32\dllcache\ntprint.cat
2009-03-22 12:02 . 2009-03-22 12:02 <REP> d-------- c:\documents and settings\NetworkService\Menu Démarrer
2009-03-22 11:26 . 2008-04-14 03:33 1,306,624 -----c--- c:\windows\system32\dllcache\msxml6.dll
2009-03-22 11:25 . 2007-06-26 07:00 457,607 -----c--- c:\windows\system32\dllcache\mdlib.wmv
2009-03-22 11:25 . 2008-04-14 03:34 380,928 --a------ c:\windows\system32\irprops.cpl
2009-03-22 11:25 . 2008-04-14 03:31 294,912 -----c--- c:\windows\system32\dllcache\msaud32.acm
2009-03-22 11:25 . 2008-04-14 03:31 290,816 -----c--- c:\windows\system32\dllcache\l3codeca.acm
2009-03-22 11:25 . 2007-06-26 06:59 97,117 -----c--- c:\windows\system32\dllcache\mplayer2.hlp
2009-03-22 11:25 . 2004-08-05 13:00 36,640 -----c--- c:\windows\system32\dllcache\mplayer2.inf
2009-03-22 11:25 . 2006-12-28 20:01 19,569 --a------ c:\windows\[u]0/u03204_.tmp
2009-03-22 11:25 . 2007-06-26 07:00 5,971 -----c--- c:\windows\system32\dllcache\events.js
2009-03-22 11:25 . 2004-08-05 13:00 2,778 -----c--- c:\windows\system32\dllcache\mplogoh.gif
2009-03-22 11:25 . 2004-08-05 13:00 2,545 -----c--- c:\windows\system32\dllcache\mplogo.gif
2009-03-22 11:25 . 2007-06-26 06:59 1,885 -----c--- c:\windows\system32\dllcache\mplayer2.cnt
2009-03-22 11:24 . 2007-06-26 07:00 381,425 -----c--- c:\windows\system32\dllcache\copycd.wmv
2009-03-22 11:24 . 2008-04-14 03:34 294,912 -----c--- c:\windows\system32\dllcache\dlimport.exe
2009-03-22 11:24 . 2004-07-17 10:34 184,107 -----c--- c:\windows\system32\dllcache\compact.wmz
2009-03-22 11:24 . 2007-06-26 07:00 9,585 -----c--- c:\windows\system32\dllcache\controls.css
2009-03-22 11:24 . 2007-06-26 07:00 8,298 -----c--- c:\windows\system32\dllcache\contents.htm
2009-03-22 11:24 . 2007-06-26 07:00 6,878 -----c--- c:\windows\system32\dllcache\controls.js
2009-03-22 11:24 . 2004-08-05 13:00 999 -----c--- c:\windows\system32\dllcache\bktrh.gif
2009-03-22 11:24 . 2004-08-05 13:00 773 -----c--- c:\windows\system32\dllcache\cnth.gif
2009-03-22 11:24 . 2004-08-05 13:00 773 -----c--- c:\windows\system32\dllcache\cnt.gif
2009-03-22 11:24 . 2004-08-05 13:00 772 -----c--- c:\windows\system32\dllcache\cntd.gif
2009-03-22 11:24 . 2004-08-05 13:00 760 -----c--- c:\windows\system32\dllcache\cloapph.gif
2009-03-22 11:24 . 2004-08-05 13:00 717 -----c--- c:\windows\system32\dllcache\cloapp.gif
2009-03-22 10:32 . 2009-03-22 10:32 2,422 --a------ c:\windows\system32\wpa.bak
2009-03-22 10:02 . 2008-04-14 03:32 426,041 --a--c--- c:\windows\system32\dllcache\voicepad.dll
2009-03-22 10:02 . 2008-04-14 03:32 156,672 --a--c--- c:\windows\system32\dllcache\winzm.ime
2009-03-22 10:02 . 2008-04-14 03:32 156,672 --a--c--- c:\windows\system32\dllcache\winsp.ime
2009-03-22 10:02 . 2008-04-14 03:32 156,672 --a--c--- c:\windows\system32\dllcache\winpy.ime
2009-03-22 10:02 . 2008-04-14 03:32 86,073 --a--c--- c:\windows\system32\dllcache\voicesub.dll
2009-03-22 10:02 . 2008-04-14 03:33 79,360 --a--c--- c:\windows\system32\dllcache\winar30.ime
2009-03-22 10:02 . 2008-04-14 03:32 72,704 --a--c--- c:\windows\system32\dllcache\wingb.ime
2009-03-22 10:02 . 2008-04-14 03:33 65,536 --a--c--- c:\windows\system32\dllcache\winime.ime
2009-03-22 10:02 . 2004-08-05 13:00 48,256 --a--c--- c:\windows\system32\dllcache\w32.dll
2009-03-22 10:02 . 2004-08-05 13:00 41,600 --a--c--- c:\windows\system32\dllcache\weitekp9.dll
2009-03-22 10:02 . 2004-08-05 13:00 31,360 --a--c--- c:\windows\system32\dllcache\weitekp9.sys
2009-03-22 10:02 . 2004-08-05 13:00 28,288 --a--c--- c:\windows\system32\dllcache\xjis.nls
2009-03-22 10:00 . 2008-04-14 03:31 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll
2009-03-22 09:59 . 2004-08-05 13:00 1,677,824 --a--c--- c:\windows\system32\dllcache\chsbrkr.dll
2009-03-22 09:57 . 2004-08-05 13:00 16,384 --a--c--- c:\windows\system32\dllcache\isignup.exe
2009-03-22 09:57 . 2009-03-22 09:57 749 -rah----- c:\windows\WindowsShell.Manifest

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-28 11:12 794,656 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-28 11:08 11,312 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-27 21:57 --------- d-----w c:\program files\Fichiers communs\Adobe
2009-03-27 21:32 --------- d-----w c:\program files\Trend Micro
2009-03-27 17:03 --------- d-----w c:\program files\Java
2009-03-27 16:38 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-27 05:52 17,119 ----a-w c:\windows\system32\drivers\AegisP.sys
2009-03-25 20:10 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-25 19:50 --------- d-----w c:\program files\Launch Manager
2009-03-24 19:09 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-22 14:37 --------- d-----w c:\program files\Micro Application
2009-03-19 20:25 33,786 ----a-w c:\documents and settings\christian\Application Data\wklnhst.dat
2009-02-02 05:43 --------- d-----w c:\documents and settings\christian\Application Data\GlarySoft
2009-01-31 07:19 --------- d-----w c:\program files\CDex_170b2
2009-01-30 18:09 --------- d-----w c:\program files\CCleaner
2008-03-30 15:18 96,176 ----a-w c:\documents and settings\christian\Application Data\GDIPFONTCACHEV1.DAT
2008-08-15 07:33 122,880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2008-04-14 02:33 65,024 --sha-w c:\windows\system32\asycfilt.dll
2005-01-20 20:55 8 --sha-r c:\windows\system32\BCFCF81A7E.sys
2007-03-24 21:08 56 --sha-r c:\windows\system32\EEB141F368.sys
2008-03-29 15:29 9,552 --sha-w c:\windows\system32\KGyGaAvL.sys
2008-04-14 02:33 1,028,096 --sha-w c:\windows\system32\mfc42.dll
2004-08-05 12:00 57,344 --sha-w c:\windows\system32\mfc42loc.dll
1995-09-20 15:16 35,088 --sha-w c:\windows\system32\msjint32.dll
1995-09-20 15:13 977,680 --sha-w c:\windows\system32\msjt3032.dll
1995-09-20 15:16 23,824 --sha-w c:\windows\system32\msjter32.dll
2008-04-14 02:33 413,696 --sha-w c:\windows\system32\msvcp60.dll
2008-04-14 02:33 343,040 --sha-w c:\windows\system32\msvcrt.dll
2004-08-05 12:00 253,952 --sha-w c:\windows\system32\msvcrt20.dll
2008-04-14 02:33 551,936 --sha-w c:\windows\system32\oleaut32.dll
2008-04-14 02:33 84,992 --sha-w c:\windows\system32\olepro32.dll
2008-04-14 02:33 30,749 --sha-w c:\windows\system32\vbajet32.dll
1995-09-24 10:02 243,472 --sha-w c:\windows\system32\vbar2232.dll
1998-05-18 02:06 368,912 --sha-w c:\windows\system32\vbar332.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-21 344064]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2003-09-16 20480]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-05 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-05 688218]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-15 385024]
"EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [2004-10-15 356352]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2004-08-06 32768]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2004-11-11 49152]
"LMgrOSD"="c:\program files\Launch Manager\OSD.exe" [2004-07-26 204800]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2004-11-23 73728]
"PCMService"="c:\program files\Home Cinema\PowerCinema\PCMService.exe" [2005-03-09 118926]
"RemoteControl"="c:\program files\Home Cinema\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-08-25 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"Network Associates Error Reporting Service"="c:\program files\Fichiers communs\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"AGRSMMSG"="AGRSMMSG.exe" [2004-07-22 c:\windows\AGRSMMSG.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]
"SoundMan"="SOUNDMAN.EXE" [2004-01-02 c:\windows\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-05 44544]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BTTray.lnk - c:\program files\WIDCOMM\Logiciel Bluetooth\BTTray.exe [2004-11-29 569405]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-10-15 10:27 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\H:\[u]0/uautocheck autochk *

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"btwdins"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"MSConfig"=c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SoundMan"=SOUNDMAN.EXE
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe"
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"%WinDir%\\system32\\fxsclnt.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Network Associates\\VirusScan\\shcfg32.exe"=
"c:\\Program Files\\Network Associates\\VirusScan\\ScnCfg32.Exe"=
"c:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 Hotkey;Hotkey;c:\windows\system32\drivers\HOTKEY.sys [2008-05-10 9867]
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2009-03-03 58016]
S1 mailKmd;mailKmd; [x]
S1 Wbutton;Wbutton;c:\windows\system32\drivers\Wbutton.sys --> c:\windows\system32\drivers\Wbutton.sys [?]
S3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [2005-01-12 945152]
S3 flash;flash;c:\windows\system32\drivers\flash.sys [2008-05-10 7040]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-08-15 29744]
S3 K320bus;Sony Ericsson K320 driver (WDM);c:\windows\system32\drivers\K320bus.sys [2007-11-17 61504]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;c:\windows\system32\drivers\K320mdfl.sys [2007-11-17 9328]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;c:\windows\system32\drivers\K320mdm.sys [2007-11-17 97056]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\K320mgmt.sys [2007-11-17 88560]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;c:\windows\system32\drivers\K320obex.sys [2007-11-17 86368]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
IE: &Recherche AOL Toolbar - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Envoyer à &Bluetooth - c:\program files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
Trusted Zone: internet
Trusted Zone: mcafee.com
FF - ProfilePath - c:\documents and settings\christian\Application Data\Mozilla\Firefox\Profiles\2s9386tz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-28 12:10:57
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\.Default\Software\Autodesk\Autodesk Digital Signatures]
@DACL=(02 0000)

[HKEY_USERS\.Default\Software\HotkeyPanel\1]
@DACL=(02 0000)
"Name"="c:\\Program Files\\Launch Manager\\hotkey.html"

[HKEY_USERS\.Default\Software\HotkeyPanel\11]
@DACL=(02 0000)
"Name"="\"c:\\Program Files\\Launch Manager\\fn.exe\""
"NameDesc"="Launch Manager"

[HKEY_USERS\.Default\Software\HotkeyPanel\12]
@DACL=(02 0000)
"Name"="\"c:\\Program Files\\Launch Manager\\fn.exe\""
"NameDesc"="Launch Manager"

[HKEY_USERS\.Default\Software\HotkeyPanel\31]
@DACL=(02 0000)
"Name"="\"c:\\Program Files\\Outlook Express\\msimn.exe\""
"NameDesc"="E-Mail"

[HKEY_USERS\.Default\Software\HotkeyPanel\36]
@DACL=(02 0000)
"Name"="\"c:\\Program Files\\Internet Explorer\\iexplore.exe\""
"NameDesc"="WWW"

[HKEY_USERS\.Default\Software\Local AppWizard-Generated Applications\LaunchAp]
@DACL=(02 0000)

[HKEY_USERS\.Default\Software\Local AppWizard-Generated Applications\Wbutton]
@DACL=(02 0000)

[HKEY_USERS\.Default\Software\Macromedia\FlashPlayer]
@DACL=(02 0000)

[HKEY_USERS\.Default\Software\Macromedia\Shockwave 10]
@DACL=(02 0000)

[HKEY_USERS\S-1-5-21-3958462218-115887364-3908271126-1010\Software\Ahead\Nero - Burning Rom\Settings\NeroIsoListView]
@DACL=(02 0000)
@SACL=
"FILENAME"="0,120,0,1"
"FILESIZE"="1,90,1,1"
"FILETYPE"="2,60,0,1"
"FILEDATE"="3,70,0,1"
"FILEORIGIN"="4,150,0,1"
"FILEATTRIBUTE"="5,60,0,0"
"FILEPRIORITY"="6,80,0,0"

[HKEY_USERS\S-1-5-21-3958462218-115887364-3908271126-1010\Software\Local AppWizard-Generated Applications\LaunchAp\Settings]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-3958462218-115887364-3908271126-1010\Software\Local AppWizard-Generated Applications\MMDiag\Settings]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-3958462218-115887364-3908271126-1010\Software\Local AppWizard-Generated Applications\Wbutton\Settings]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-3958462218-115887364-3908271126-1010\Software\Microsoft\Internet Explorer\Default MHTML Editor\shell]
@DACL=(02 0000)
@SACL=

[HKEY_USERS\S-1-5-21-3958462218-115887364-3908271126-1010\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\ATI Technologies Inc.\Pilotes ATI]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Classes\Applications\PHOTOED.EXE\shell]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Classes\Software\RealNetworks\RealJukebox\1.0\Preferences\DisplayName]
@DACL=(02 0000)
@SACL=
@="RealPlayer"

[HKEY_LOCAL_MACHINE\software\Classes\Software\RealNetworks\RealJukebox\1.0\Preferences\MainApp]
@DACL=(02 0000)
@SACL=
@="c:\\Program Files\\Real\\RealPlayer\\realjbox.exe"

[HKEY_LOCAL_MACHINE\software\Microsoft\Advanced INF Setup\IE40.BrowseUI\RegBackup]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\Advanced INF Setup\IEHomePageInfo\RegBackup]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\10.0]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\7.0]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Monitors]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Monitors\//./DISPLAY1\[u]0/u,0,1280,768]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\services]
@DACL=(02 0000)
@SACL=
"NoServices"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Settings]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\ShimInclusionList\FIREFOX.EXE]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\UIPlugins\{292AE934-4F49-40bb-9E7E-6F6398ED9C31}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Plug-in Nero Fast CD-Burning"
"Description"="Graver votre CD"
"Capabilities"=dword:40000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{3FDF25EE-E592-4495-8391-6E9C504DAC2B}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}\\WMSET10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}\\wmset10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{60204BB3-7078-4F70-8F69-68297621941C}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{60204BB3-7078-4F70-8F69-68297621941C}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{60204BB3-7078-4F70-8F69-68297621941C}\\MPSTUB10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{60204BB3-7078-4F70-8F69-68297621941C}\\mpstub10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}\\MPCD10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}\\mpcd10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{DD90D410-1823-43EB-9A16-A2331BF08799}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{DD90D410-1823-43EB-9A16-A2331BF08799}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{DD90D410-1823-43EB-9A16-A2331BF08799}\\WMP10.inf"
"ExceptionCatalogName"=expand:"c:\\WINDOWS\\RegisteredPackages\\{DD90D410-1823-43EB-9A16-A2331BF08799}\\wmp10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\OptionalComponents\SwDir]
@DACL=(02 0000)
@SACL=
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\OptionalComponents\SwFlash]
@DACL=(02 0000)
@SACL=
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\Plugins\SCP\SCPTRANS]
@DACL=(02 0000)
@SACL=
"ProgID"="MsScp.SCPTRANS.1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows Media Device Manager\Plugins\SP\NeroBurnPlugin]
@DACL=(02 0000)
@SACL=
"ProgID"="MDNeroBurnPlugin.MDNeroBurnPlugin"

[HKEY_LOCAL_MACHINE\software\MozillaPlugins\@viewpoint.com/VMP\MimeTypes]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\MozillaPlugins\@viewpoint.com/VMP\Suffixes]
@DACL=(02 0000)
@SACL=
"mtx"=""
"mtz"=""
"mts"=""

[HKEY_LOCAL_MACHINE\software\Obsidian\Star Wars(tm) Knights of the Old Republic(tm) II: The Sith Lords(tm)]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Realtek Semiconductor Corp.\Realtek AC'97 Audio]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\ViaMichelin\ViaMichelin Navigation]
@DACL=(02 0000)
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1144)
c:\windows\system32\Ati2evxx.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll

- - - - - - - > 'lsass.exe'(1200)
c:\windows\system32\EntApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\Network Associates\VirusScan\Mcshield.exe
c:\program files\Network Associates\VirusScan\VsTskMgr.exe
c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Intel\Wireless\Bin\OProtSvc.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\system32\snmp.exe
c:\windows\system32\searchindexer.exe
c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\progra~1\Intel\Wireless\Bin\1XConfig.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\rundll32.exe
c:\progra~1\COMMON~1\X10\Common\X10nets.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\verclsid.exe
.
**************************************************************************
.
Heure de fin: 2009-03-28 12:16:04 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-03-28 11:15:56

Avant-CF: 5 783 957 504 octets libres
Après-CF: 5,750,374,400 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

Current=4 Default=4 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6
533 --- E O F --- 2009-03-23 06:13:57

J'ai toujours les memes symptomes.
Je clique, il se passe environ 10 à 15 secondes, comme si je n'avais pas cliqué, avant qu'il commence à chercher la page.

Mon cas est il desespéré??
J'aimerai tant éviter un réinstal avec formatage.

Bonjour,

BitDefender Online Scanner - Rapport virus en temps réel
Généré à: Sun, Mar 29, 2009 - 12:12:19
Info d'analyse
Fichiers scannés
163420
Infectés Fichiers
2
Virus Détectés
Adware.NaviPromo.Gen.4
1
Backdoor.Hupigon.HCU
1

Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.

Est ce rapport que tu souhaites?

BitDefender Online Scanner

Rapport d'analyse généré à: Sun, Mar 29, 2009 - 12:07:03

Voie d'analyse: C:\;D:\;E:\;F:\;

Statistiques

Temps

00:53:11

Fichiers

154191

Directoires


9187

Secteurs de boot


0

Archives


3033

Paquets programmes


10489

Résultats

Virus identifiés

2

Fichiers infectés

2

Fichiers suspects


0

Avertissements


0

Désinfectés


0

Fichiers effacés


2

Info sur les moteurs

Définition virus


2815918

Version des moteurs


AVCORE v1.7 (build 8314.19) (i386) (Sep 29 2008 17:19:14)

Analyse des plugins


17

Archive des plugins


45

Unpack des plugins


7

E-mail plugins


6

Système plugins


4







Paramètres d'analyse

Première action


Désinfecté

Seconde Action


Supprimé

Heuristique


Oui

Acceptez les avertissements


Oui

Extensions analysées


exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions




Analyse d'emails


Oui

Analyse des Archives


Oui

Analyser paquets programmes


Oui

Analyse des fichiers


Oui

Analyse de boot


Oui








Fichier analysé


Statut

C:\WINDOWS\system32\rygpszh.exe


Détecté avec: Adware.NaviPromo.Gen.4

C:\WINDOWS\system32\rygpszh.exe


Echec de la désinfection

C:\WINDOWS\system32\rygpszh.exe


Supprimé

D:\LOGICIELS\LOGICIEL_AUTOCAD2007\ACAD2007fra-1.bin=>Crack/Intro.exe


Infecté par: Backdoor.Hupigon.HCU

D:\LOGICIELS\LOGICIEL_AUTOCAD2007\ACAD2007fra-1.bin=>Crack/Intro.exe


Supprimé

D:\LOGICIELS\LOGICIEL_AUTOCAD2007\ACAD2007fra-1.bin


Echec de la mise à jour

========== FILES ==========
File/Folder C:\WINDOWS\system32\rygpszh.exe not found.
D:\LOGICIELS\LOGICIEL_AUTOCAD2007\ACAD2007fra-1.bin moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03292009_211300

Rapport Navilog1
Search Navipromo version 3.7.6 commencé le 29/03/2009 à 21:25:38,45

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 14.03.2009 à 18h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) M processor 1.70GHz )
BIOS : PhoenixBIOS 4.0 Release 6.0
USER : christian ( Administrator )
BOOT : Normal boot


Firewall : ZoneAlarm Firewall 7.0.483.000 (Activated)

C:\ (Local Disk) - NTFS - Total:46 Go (Free:5 Go)
D:\ (Local Disk) - NTFS - Total:36 Go (Free:2 Go)
E:\ (Local Disk) - FAT32 - Total:9 Go (Free:3 Go)
F:\ (CD or DVD)
G:\ (USB) - FAT - Total:991 Mo (Free:0 Go)
H:\ (USB) - FAT - Total:227 Mo (Free:0 Go)


Recherche executé en mode normal


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\christian\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Marion\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Maxime\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Papa\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\PROPRI~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\christian\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Marion\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Maxime\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Papa\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\christian\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Marion\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Maxime\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Papa\menudm~1\progra~1" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\christian\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\Marion\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\Maxime\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\Papa\locals~1\applic~1" *



*** Recherche fichiers ***



*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\christian\locals~1\applic~1" :


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" :


* Dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" :


* Dans "C:\DOCUME~1\Marion\locals~1\applic~1" :


* Dans "C:\DOCUME~1\Maxime\locals~1\applic~1" :


* Dans "C:\DOCUME~1\Papa\locals~1\applic~1" :


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :



*** Analyse terminée le 29/03/2009 à 21:32:43,85 ***

Probleme!!!

Navilog ne s'est pas bien déroulé
à l'étape GenericNaviSearch après le reboot -> accès refusé

Navilog planté et j'ai du fermer

Que dois je faire

Meme probleme pour navilog malgre la désactivation Viruscan