Avira Antivir : Installation impossible

############################## [ FindyKill V4.731 ]

# User : Aurélien (Administrateurs) # 047795520178
# Update on 30/05/09 by Chiquitine29
# Start at: 15:41:22 | 01/06/2009
# Website : http://pagesperso-orange.fr/NosTools/findykill.html

#               Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 117,19 Go (69,81 Go free) [HDD] # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque fixe local # 109,69 Go (94,44 Go free) [Windows 7] # NTFS
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque amovible
# J:\ # Disque amovible
# K:\ # Disque CD-ROM

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Prevx\prevx.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\RALINK\Common\RalinkRegistryWriter.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Prevx\prevx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\qgctvvj0e50v.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Aurélien\Application Data\drivers\winupgro.exe
C:\Documents and Settings\Aurélien\Aurélien.exe
C:\Documents and Settings\Aurélien\Application Data\m\flec006.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\TRENDnet\TEW-624UB_TEW-644UB\WlanCU.exe
C:\WINDOWS\System32\svchost.exe
C:\DOCUME~1\AURLIE~1\LOCALS~1\Temp\BNA.tmp
C:\WINDOWS\TEMP\BNC.tmp
C:\WINDOWS\system32\wbem\wmiprvse.exe
 
################## [ Processus infectieux stoppés ]  

"C:\Documents and Settings\Aurélien\Application Data\drivers\winupgro.exe"  (2184)
"C:\Documents and Settings\Aurélien\Application Data\m\flec006.exe"  (2716)
"C:\WINDOWS\system32\wintems.exe"  (11012)

################## [ Fichiers / Dossiers infectieux ]

Found ! C:\WINDOWS\system32\mdelk.exe 
Found ! C:\WINDOWS\system32\wintems.exe 
Found ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers" 
Found ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\downld" 
Found ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\srosa2.sys" 
Found ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\wfsintwq.sys" 
Found ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\winupgro.exe" 
Found ! "C:\Documents and Settings\Aur‚lien\Application Data\m" 
Found ! "C:\Documents and Settings\Aur‚lien\Application Data\m\data.oct" 
Found ! "C:\Documents and Settings\Aur‚lien\Application Data\m\flec006.exe" 
Found ! "C:\Documents and Settings\Aur‚lien\Application Data\m\list.oct" 
Found ! "C:\Documents and Settings\Aur‚lien\Application Data\m\shared" 
Found ! "C:\Documents and Settings\Aur‚lien\Application Data\m\srvlist.oct" 

################## [ Infected Temp Files ]

Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[1].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[2].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[3].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_1[1].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_1[2].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[1].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[2].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[3].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64[1].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64[2].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_1[1].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_1[2].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_3[1].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_3[2].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64[1].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_1[1].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_1[2].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_3[1].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\file[1].txt  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\mxd[1].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64[1].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64_1[1].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64_3[1].jpg  
Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\servernames[1].htm  
Found ! C:\DOCUME~1\AURLIE~1\LOCALS~1\Temp\7zO35.tmp\key_gen.exe  

################## [ Registre / Clés infectieuses ]

Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Local AppWizard-Generated Applications\key_gen  
Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Local AppWizard-Generated Applications\msnmsgr  
Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Local AppWizard-Generated Applications\winupgro  
Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\bisoft  
Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\DateTime4  
Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\FFC  
Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\MuleAppData  
Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Ubisoft  
Found ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\key_gen  
Found ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\msnmsgr  
Found ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S  
Found ! HKEY_CURRENT_USER\Software\bisoft  
Found ! HKEY_CURRENT_USER\Software\DateTime4  
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit" 
Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"  
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe" 
Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"  
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key" 
Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"  

# (!) HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
# (!) HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1 

################## [ Recherche dans supports amovibles]


################## [ Registre / Mountpoints2 ]

# -> Not found !  

################## [ ! Fin du rapport # FindyKill V4.731 ! ] 

Error allocating memory

############################## [ FindyKill V4.731 ]

# User : Aurélien (Administrateurs) # 047795520178
# Update on 30/05/09 by Chiquitine29
# Start at: 15:55:19 | 01/06/2009
# Website : http://pagesperso-orange.fr/NosTools/findykill.html

#               Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 117,19 Go (69,81 Go free) [HDD] # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque fixe local # 109,69 Go (94,44 Go free) [Windows 7] # NTFS
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque amovible # 1,89 Go (903,47 Mo free) [AURELIEN] # FAT
# J:\ # Disque amovible
# K:\ # Disque CD-ROM

############################## [ Active Processes ] 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\system32\LogonUI.EXE
C:\Program Files\Prevx\prevx.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\RALINK\Common\RalinkRegistryWriter.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\Prevx\prevx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Infected Files \ Folders ]

Deleted ! C:\WINDOWS\system32\mdelk.exe  
Deleted ! C:\WINDOWS\system32\wintems.exe  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\srosa2.sys"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\wfsintwq.sys"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\winupgro.exe"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\data.oct"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\flec006.exe"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\list.oct"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\srvlist.oct"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\downld"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\shared"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m"  

################## [ Infected Temp Files ]

Deleted ! C:\DOCUME~1\AURLIE~1\LOCALS~1\Temp\AutoRun.exe  
Deleted ! C:\DOCUME~1\AURLIE~1\LOCALS~1\Temp\7zO35.tmp\key_gen.exe  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[3].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_1[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_1[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[3].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_1[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_1[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_3[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_3[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_1[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_1[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_3[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\file[1].txt  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\mxd[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64_1[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64_3[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\servernames[1].htm  

################## [ Registry / Infected keys ] 

Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa   
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA   
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA   
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s   
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S   
Deleted ! HKEY_CURRENT_USER\Software\bisoft   
Deleted ! HKEY_CURRENT_USER\Software\DateTime4   
Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\key_gen   
Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\msnmsgr   
Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro   
Deleted ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\FFC   
Deleted ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\MuleAppData   
Deleted ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Ubisoft   
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"  
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"  
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"  

################## [ Cleaning Removable drives ] 

Deleted ! I:\autorun.inf  

################## [ Registry / Mountpoint2 ]

# -> Not found !  

################## [ States / Restarting of services ]  

# Services : [ Auto=2 / Request=3 / Disable=4 ]

# Ndisuio -> # Type of startup =3  
# EapHost -> # Type of startup =2  
# Ip6Fw -> # Type of startup =2  
# SharedAccess -> # Type of startup =2  
# wuauserv -> # Type of startup =2  
# wscsvc -> # Type of startup =2  
# Safe boot mode restored !  

################## [ Searching Other Infections ]

# Références de comparaison Bagle MD5 :

File ... : C:\Documents and Settings\Aur‚lien\Application Data\drivers\winupgro.exe
CRC32 .. : 1aeb07b8
MD5 .... : 0397d95f607289e7733d9ef221a5c6cd 
 
# -> Nothing found.
 
################## [ Corrupted files # Re-Installation required ] 
 
C:\APPS\RecordNow\Launch.exe
C:\Program Files\Avira\basic\avadmin.exe
C:\Program Files\Avira\basic\avcenter.exe
C:\Program Files\Avira\basic\avconfig.exe
C:\Program Files\Avira\basic\avgnt.exe
C:\Program Files\Avira\basic\avguard.exe
C:\Program Files\Avira\basic\avnotify.exe
C:\Program Files\Avira\basic\avscan.exe
C:\Program Files\Avira\basic\guardgui.exe
C:\Program Files\Avira\basic\licmgr.exe
C:\Program Files\Avira\basic\sched.exe
C:\Program Files\Avira\basic\update.exe
C:\Program Files\Avira\basic\wsctool.exe
C:\Program Files\Mozilla Firefox\uninstall\helper.exe

################################### [ Cracks / Keygens / Serials ]

# -> Nothing found !  

################## [ ! End of Report # FindyKill V4.731 ! ]

############################## [ FindyKill V4.731 ]

# User : Aurélien (Administrateurs) # 047795520178
# Update on 30/05/09 by Chiquitine29
# Start at: 15:55:19 | 01/06/2009
# Website : http://pagesperso-orange.fr/NosTools/findykill.html

#               Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 117,19 Go (69,81 Go free) [HDD] # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque fixe local # 109,69 Go (94,44 Go free) [Windows 7] # NTFS
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque amovible # 1,89 Go (903,47 Mo free) [AURELIEN] # FAT
# J:\ # Disque amovible
# K:\ # Disque CD-ROM

############################## [ Active Processes ] 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\system32\LogonUI.EXE
C:\Program Files\Prevx\prevx.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\RALINK\Common\RalinkRegistryWriter.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\Prevx\prevx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Infected Files \ Folders ]

Deleted ! C:\WINDOWS\system32\mdelk.exe  
Deleted ! C:\WINDOWS\system32\wintems.exe  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\srosa2.sys"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\wfsintwq.sys"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\winupgro.exe"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\data.oct"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\flec006.exe"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\list.oct"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\srvlist.oct"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\downld"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\shared"  
Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m"  

################## [ Infected Temp Files ]

Deleted ! C:\DOCUME~1\AURLIE~1\LOCALS~1\Temp\AutoRun.exe  
Deleted ! C:\DOCUME~1\AURLIE~1\LOCALS~1\Temp\7zO35.tmp\key_gen.exe  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[3].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_1[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_1[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[3].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_1[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_1[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_3[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_3[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_1[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_1[2].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_3[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\file[1].txt  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\mxd[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64_1[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64_3[1].jpg  
Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\servernames[1].htm  

################## [ Registry / Infected keys ] 

Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa   
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA   
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA   
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s   
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S   
Deleted ! HKEY_CURRENT_USER\Software\bisoft   
Deleted ! HKEY_CURRENT_USER\Software\DateTime4   
Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\key_gen   
Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\msnmsgr   
Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro   
Deleted ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\FFC   
Deleted ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\MuleAppData   
Deleted ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Ubisoft   
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"  
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"  
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"  

################## [ Cleaning Removable drives ] 

Deleted ! I:\autorun.inf  

################## [ Registry / Mountpoint2 ]

# -> Not found !  

################## [ States / Restarting of services ]  

# Services : [ Auto=2 / Request=3 / Disable=4 ]

# Ndisuio -> # Type of startup =3  
# EapHost -> # Type of startup =2  
# Ip6Fw -> # Type of startup =2  
# SharedAccess -> # Type of startup =2  
# wuauserv -> # Type of startup =2  
# wscsvc -> # Type of startup =2  
# Safe boot mode restored !  

################## [ Searching Other Infections ]

# Références de comparaison Bagle MD5 :

File ... : C:\Documents and Settings\Aur‚lien\Application Data\drivers\winupgro.exe
CRC32 .. : 1aeb07b8
MD5 .... : 0397d95f607289e7733d9ef221a5c6cd 
 
# -> Nothing found.
 
################## [ Corrupted files # Re-Installation required ] 
 
C:\APPS\RecordNow\Launch.exe
C:\Program Files\Avira\basic\avadmin.exe
C:\Program Files\Avira\basic\avcenter.exe
C:\Program Files\Avira\basic\avconfig.exe
C:\Program Files\Avira\basic\avgnt.exe
C:\Program Files\Avira\basic\avguard.exe
C:\Program Files\Avira\basic\avnotify.exe
C:\Program Files\Avira\basic\avscan.exe
C:\Program Files\Avira\basic\guardgui.exe
C:\Program Files\Avira\basic\licmgr.exe
C:\Program Files\Avira\basic\sched.exe
C:\Program Files\Avira\basic\update.exe
C:\Program Files\Avira\basic\wsctool.exe
C:\Program Files\Mozilla Firefox\uninstall\helper.exe

################################### [ Cracks / Keygens / Serials ]

# -> Nothing found !  

################## [ ! End of Report # FindyKill V4.731 ! ]

Logfile of random's system information tool 1.06 (written by random/random)
Run by Aurélien at 2009-06-01 19:21:45
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 73 GB (61%) free of 120 GB
Total RAM: 1023 MB (33% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:21:46, on 01/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\Prevx\prevx.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\RALINK\Common\RalinkRegistryWriter.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\TRENDnet\TEW-624UB_TEW-644UB\WlanCU.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Aurélien\Aurélien.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Prevx\prevx.exe
C:\Program Files\Astase\PowerBatch\PowerBatch.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Aurélien\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Aurélien.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.orbitdownloader.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ShoppingAdsHelper - {2C86C605-6081-D104-96F7-F765C20B22F1} - C:\Program Files\ShoppingAdsHelper\ShoppingAdsHelper-1.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [rgcrvvj0e50v] C:\WINDOWS\system32\qgctvvj0e50v.exe
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aurélien] C:\Documents and Settings\Aurélien\Aurélien.exe /i
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4924EA7F-F545-4641-ACFD-9F354E381BFD}: NameServer = 192.168.1.1
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\Prevx\prevx.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Update Service (gupdate1c987b7f1c21284) (gupdate1c987b7f1c21284) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Ralink Technology, Corp. - C:\Program Files\RALINK\Common\RalinkRegistryWriter.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 8400 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1170982658-3214024294-1526281595-1007.job
C:\WINDOWS\tasks\HDReg.job
C:\WINDOWS\tasks\Maintenance en 1 clic.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{412F16E1-ACC7-4245-A381-0FA2600B37FF}.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{4F425F12-6323-403E-A117-ADED1C0857E7}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C86C605-6081-D104-96F7-F765C20B22F1}]
ShoppingAdsHelper - C:\Program Files\ShoppingAdsHelper\ShoppingAdsHelper-1.dll [2009-02-15 618496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-04-23 937416]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Alcmtr"=ALCMTR.EXE []
"LVCOMSX"=C:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184]
"rgcrvvj0e50v"=C:\WINDOWS\system32\qgctvvj0e50v.exe []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"=C:\WINDOWS\system32\sti_ci.dll [2008-04-13 138240]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2008-12-02 3882312]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-11-03 204288]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"Aurélien"=C:\Documents and Settings\Aurélien\Aurélien.exe [2009-06-01 21016]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=
:\WINDOWS\syste

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispCPL"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoChangeAnimation"=0
"NoChangeKeyboardNavigationIndicators"=0
"NoThemesTab"=0
"NoStartMenuPinnedList"=0
"NoUserNameInStartMenu"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe"="C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe:*:Enabled:Render Manager"
"C:\Program Files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe"="C:\Program Files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile"
"C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe"="C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe:*:Enabled:umi"
"C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe"="C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:*:Enabled:Pinnacle VideoSpin"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe"="C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe:*:Enabled:Zoo Tycoon 2 Executable"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player"
"C:\WINDOWS\system32\rtcshare.exe"="C:\WINDOWS\system32\rtcshare.exe:*:Enabled:Partage de l'application RTC"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe"="C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe:*:Enabled:Assistance à distance - Windows Messenger et voix"
"E:\Program Files\eMule\emule.exe"="E:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Prevx\prevx.exe"="C:\Program Files\Prevx\prevx.exe:*:Enabled:ENABLE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1e918a05-4eb6-11de-a5c1-0014d15bcbdd}]
shell\AutoRun\command - interface.bat


======List of files/folders created in the last 1 months======

2009-06-01 19:16:27 ----D---- C:\rsit
2009-06-01 16:23:42 ----D---- C:\WINDOWS\LastGood
2009-06-01 16:11:38 ----D---- C:\Program Files\Trend Micro
2009-06-01 13:24:18 ----D---- C:\Program Files\Prevx
2009-06-01 13:22:55 ----D---- C:\Documents and Settings\All Users\Application Data\PrevxCSI
2009-06-01 13:22:51 ----A---- C:\WINDOWS\wininit.ini
2009-06-01 13:10:32 ----A---- C:\WINDOWS\system32\RaCoInst.dll
2009-06-01 13:10:16 ----D---- C:\Program Files\RALINK
2009-06-01 12:49:12 ----D---- C:\NVIDIA
2009-06-01 12:14:05 ----D---- C:\Program Files\RPG Maker VX
2009-06-01 11:51:59 ----A---- C:\WINDOWS\system32\HAL.dll
2009-06-01 11:48:12 ----D---- C:\Temp
2009-06-01 11:44:03 ----D---- C:\Program Files\Game_Maker5
2009-06-01 11:43:58 ----A---- C:\WINDOWS\GPInstall.exe
2009-06-01 11:26:33 ----A---- C:\WINDOWS\system32\sgcpvvj0e50v.dll
2009-06-01 11:26:30 ----A---- C:\WINDOWS\system32\nvrsk.dll
2009-06-01 11:18:29 ----D---- C:\Program Files\Game_Maker7
2009-06-01 10:58:05 ----D---- C:\WINDOWS\apppatch
2009-05-22 17:57:05 ----RA---- C:\WINDOWS\system32\lvcoinst.ini
2009-05-22 17:57:04 ----RA---- C:\WINDOWS\system32\LVUI2RC.dll
2009-05-22 17:57:04 ----RA---- C:\WINDOWS\system32\lvcoinst.dll
2009-05-22 17:57:03 ----RA---- C:\WINDOWS\system32\LVUI2.dll
2009-05-22 17:57:03 ----RA---- C:\WINDOWS\system32\lvcodec2.dll
2009-05-22 17:53:09 ----A---- C:\WINDOWS\system32\Lvkrn12n.dll
2009-05-22 17:53:09 ----A---- C:\WINDOWS\system32\LCamCpl.dll
2009-05-22 17:52:59 ----A---- C:\WINDOWS\system32\QCUI2.dll
2009-05-22 17:52:58 ----A---- C:\WINDOWS\system32\Ltwvc12n.dll
2009-05-22 17:52:58 ----A---- C:\WINDOWS\system32\ltkrn12n.dll
2009-05-22 17:52:58 ----A---- C:\WINDOWS\system32\ltimg12n.dll
2009-05-22 17:52:58 ----A---- C:\WINDOWS\system32\ltfil12n.DLL
2009-05-22 17:52:58 ----A---- C:\WINDOWS\system32\ltefx12n.dll
2009-05-22 17:52:57 ----A---- C:\WINDOWS\system32\LTDIS12n.dll
2009-05-22 17:52:56 ----A---- C:\WINDOWS\system32\lftif12n.dll
2009-05-22 17:52:56 ----A---- C:\WINDOWS\system32\lffax12n.dll
2009-05-22 17:52:56 ----A---- C:\WINDOWS\system32\LFCMP12n.DLL
2009-05-22 17:52:56 ----A---- C:\WINDOWS\system32\lfbmp12n.dll
2009-05-22 17:52:52 ----A---- C:\WINDOWS\system32\LQCUI2.dll
2009-05-22 17:46:31 ----A---- C:\WINDOWS\_delis32.ini
2009-05-22 17:45:52 ----R---- C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2009-05-22 17:43:38 ----D---- C:\Program Files\Messenger
2009-05-20 16:29:48 ----A---- C:\WINDOWS\system32\TUProgSt.exe
2009-05-20 16:29:47 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2009-05-20 16:29:45 ----A---- C:\WINDOWS\system32\TuneUpDefragService.exe
2009-05-20 16:29:44 ----D---- C:\Documents and Settings\Aurélien\Application Data\TuneUp Software
2009-05-20 16:29:07 ----D---- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2009-05-20 16:29:06 ----D---- C:\Program Files\TuneUp Utilities 2009
2009-05-20 16:27:26 ----SHD---- C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-09 10:30:54 ----A---- C:\WINDOWS\system32\SeCEdit.exe
2009-05-09 10:30:54 ----A---- C:\WINDOWS\system32\scedll.dll
2009-05-09 10:30:54 ----A---- C:\WINDOWS\system32\Rshx32_5.dll
2009-05-09 10:30:52 ----A---- C:\WINDOWS\system32\wsecedit.dll
2009-05-06 06:00:38 ----SHD---- C:\$RECYCLE.BIN
2009-05-06 05:41:47 ----RASH---- C:\BOOTSECT.BAK
2009-05-06 05:41:39 ----SHD---- C:\Boot
2009-05-05 20:56:49 ----D---- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
2009-05-05 20:56:29 ----D---- C:\Program Files\DAEMON Tools Toolbar
2009-05-05 20:56:24 ----D---- C:\Program Files\DAEMON Tools Lite
2009-05-05 20:56:16 ----D---- C:\Documents and Settings\Aurélien\Application Data\DAEMON Tools Lite
2009-05-05 19:19:42 ----A---- C:\WINDOWS\BcdLog.txt
2009-05-05 19:14:01 ----A---- C:\WINDOWS\system32\setupempdrv03.exe
2009-05-05 19:14:01 ----A---- C:\WINDOWS\system32\EuEpmGdi.dll
2009-05-05 19:14:01 ----A---- C:\WINDOWS\system32\BootMan.exe
2009-05-05 19:13:49 ----D---- C:\Program Files\EASEUS
2009-05-05 19:03:31 ----D---- C:\Documents and Settings\Aurélien\Application Data\DeepBurner
2009-05-05 19:03:18 ----D---- C:\Program Files\Astonsoft
2009-05-05 18:59:39 ----D---- C:\Program Files\winMd5Sum
2009-05-04 20:03:07 ----D---- C:\Documents and Settings\Aurélien\Application Data\YouUp
2009-05-04 20:02:26 ----D---- C:\Program Files\Ubisoft
2009-05-03 16:04:13 ----D---- C:\Program Files\i-Media
2009-05-03 16:04:13 ----A---- C:\WINDOWS\GOTO.INI
2009-05-03 16:04:08 ----D---- C:\Program Files\Goto
2009-05-03 15:36:26 ----D---- C:\Program Files\Capturino V2
2009-05-02 10:55:15 ----D---- C:\Documents and Settings\Aurélien\Application Data\tazti
2009-05-02 10:37:09 ----D---- C:\WINDOWS\Kiriasse Logiciels
2009-05-02 10:36:36 ----N---- C:\WINDOWS\Setup1.exe
2009-05-02 10:36:35 ----A---- C:\WINDOWS\ST6UNST.EXE

======List of files/folders modified in the last 1 months======

2009-06-01 19:21:32 ----D---- C:\WINDOWS\system32\drivers
2009-06-01 19:21:32 ----D---- C:\Program Files\Avira
2009-06-01 19:15:30 ----D---- C:\Program Files\Mozilla Firefox
2009-06-01 18:11:27 ----D---- C:\WINDOWS\Temp
2009-06-01 17:13:26 ----AD---- C:\WINDOWS\system32
2009-06-01 16:23:45 ----HD---- C:\WINDOWS\inf
2009-06-01 16:23:42 ----D---- C:\WINDOWS
2009-06-01 16:22:21 ----SHD---- C:\WINDOWS\Installer
2009-06-01 16:22:21 ----D---- C:\Config.Msi
2009-06-01 16:22:18 ----D---- C:\WINDOWS\WinSxS
2009-06-01 16:22:12 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2009-06-01 16:11:38 ----RD---- C:\Program Files
2009-06-01 16:03:09 ----RSD---- C:\WINDOWS\assembly
2009-06-01 16:03:09 ----D---- C:\WINDOWS\Microsoft.NET
2009-06-01 16:00:05 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-01 15:56:52 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-06-01 15:55:10 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-01 15:51:20 ----A---- C:\WINDOWS\system32\EDIT.INI
2009-06-01 13:12:33 ----D---- C:\WINDOWS\system32\CatRoot
2009-06-01 13:11:11 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-06-01 13:11:03 ----RSHD---- C:\WINDOWS\system32\dllcache
2009-06-01 13:10:32 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-06-01 13:10:15 ----HD---- C:\Program Files\InstallShield Installation Information
2009-06-01 13:00:21 ----D---- C:\Program Files\ma-config.com
2009-06-01 13:00:16 ----D---- C:\Documents and Settings\All Users\Application Data\ma-config.com
2009-06-01 12:36:34 ----ASH---- C:\BOOT.INI
2009-06-01 12:36:34 ----A---- C:\WINDOWS\win.ini
2009-06-01 12:36:34 ----A---- C:\WINDOWS\system.ini
2009-06-01 12:36:13 ----D---- C:\WINDOWS\pss
2009-06-01 12:24:52 ----D---- C:\Program Files\Windows Live
2009-06-01 11:32:00 ----D---- C:\Relevé AW
2009-06-01 11:27:57 ----D---- C:\WINDOWS\Minidump
2009-06-01 11:26:30 ----A---- C:\WINDOWS\system32\user32.DLL
2009-05-22 21:14:27 ----D---- C:\Program Files\World of Warcraft
2009-05-22 18:09:55 ----SD---- C:\WINDOWS\Tasks
2009-05-22 17:52:49 ----D---- C:\Program Files\Logitech
2009-05-20 21:44:49 ----D---- C:\Program Files\Windows Live Safety Center
2009-05-20 17:34:02 ----A---- C:\WINDOWS\imsins.BAK
2009-05-20 17:18:07 ----D---- C:\Program Files\adslTV
2009-05-20 17:18:00 ----D---- C:\Documents and Settings\Aurélien\Application Data\vlc
2009-05-20 17:17:40 ----D---- C:\Program Files\eMule
2009-05-20 17:14:02 ----D---- C:\Program Files\JkDefrag
2009-05-20 16:29:48 ----D---- C:\WINDOWS\system32\config
2009-05-20 16:24:43 ----D---- C:\Program Files\Messenger Plus! Live
2009-05-18 17:59:58 ----D---- C:\Program Files\ShoppingAdsHelper
2009-05-15 21:20:56 ----A---- C:\WINDOWS\orun32.ini
2009-05-09 10:32:13 ----D---- C:\WINDOWS\Prefetch
2009-05-09 10:30:54 ----D---- C:\WINDOWS\Help
2009-05-07 09:16:29 ----A---- C:\WINDOWS\system32\mrt.exe
2009-05-05 18:44:54 ----D---- C:\Documents and Settings\Aurélien\Application Data\Download Manager
2009-05-03 16:01:13 ----D---- C:\Mes Sites Web
2009-05-03 14:46:02 ----D---- C:\Argent
2009-05-03 08:37:11 ----D---- C:\WINDOWS\system32\LogFiles
2009-05-02 10:23:22 ----D---- C:\WINDOWS\Media

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
R1 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-04-30 8055584]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.7.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2009-06-01 21361]
R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [1999-09-10 25244]
R2 WLNdis50;WLan NDIS 5.0 I/O Control; C:\WINDOWS\system32\DRIVERS\wlndis50.sys [2008-01-23 20480]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2004-09-16 2257920]
R3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys [2005-05-27 22016]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
R3 Mtlmnt5;Mtlmnt5; C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys [2008-04-13 126686]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 QCMerced;Logitech QuickCam Communicate; C:\WINDOWS\system32\DRIVERS\LVCM.sys [2005-05-27 1317152]
R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt2870.sys [2008-06-10 580096]
R3 RTL8023;Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver; C:\WINDOWS\system32\DRIVERS\Rtlnic51.sys [2003-12-31 69504]
R3 Slntamr;SmartLink AMR_PCI Driver; C:\WINDOWS\system32\DRIVERS\slntamr.sys [2008-04-13 404990]
R3 SlWdmSup;SlWdmSup; C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys [2003-07-02 39348]
R3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720]
S2 amd64si;amd64si; \??\C:\WINDOWS\system32\drivers\amd64si.sys []
S2 port135sik;port135sik; \??\C:\WINDOWS\system32\drivers\port135sik.sys []
S2 systemntmi;systemntmi; \??\C:\WINDOWS\system32\drivers\systemntmi.sys []
S2 ws2_32sik;ws2_32sik; \??\C:\WINDOWS\system32\drivers\ws2_32sik.sys []
S3 as42ozlw;as42ozlw; C:\WINDOWS\system32\drivers\as42ozlw.sys []
S3 avshws;YouUp Simulated Hardware; C:\WINDOWS\system32\DRIVERS\youup.sys [2009-02-13 57344]
S3 Bridge;Pont MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552]
S3 BridgeMP;Miniport de pont MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552]
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys []
S3 epmntdrv;epmntdrv; \??\C:\WINDOWS\system32\epmntdrv.sys []
S3 EuGdiDrv;EuGdiDrv; \??\C:\WINDOWS\system32\EuGdiDrv.sys []
S3 HdAudAddService;Pilote de fonction Microsoft UAA pour Service High Definition Audio; C:\WINDOWS\system32\drivers\HdAudio.sys [2004-03-17 113664]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 Mtlstrm;Mtlstrm; C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys [2008-04-13 1309184]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NtMtlFax;NtMtlFax; C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys [2008-04-13 180360]
S3 RecAgent;recagent; \??\C:\WINDOWS\system32\DRIVERS\RecAgent.sys []
S3 RT73;Belkin USB Network Adapter; C:\WINDOWS\system32\DRIVERS\rt73.sys [2005-08-03 232192]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SlNtHal;SlNtHal; C:\WINDOWS\system32\DRIVERS\Slnthal.sys [2008-04-13 95424]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-03-05 36864]
S3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys []
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-06 132424]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 CLCapSvc;CyberLink Background Capture Service (CBCS); c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe [2005-05-11 221266]
R2 CSIScanner;CSIScanner; C:\Program Files\Prevx\prevx.exe [2009-06-01 4368952]
R2 CyberLink Media Library Service;CyberLink Media Library Service; C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe [2005-05-11 61440]
R2 GenericHidService;Generic Service for HID Keyboard Input Collections; c:\APPS\HIDSERVICE\HIDSERVICE.exe [2005-01-07 49152]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]
R2 RalinkRegistryWriter;Ralink Registry Writer; C:\Program Files\RALINK\Common\RalinkRegistryWriter.exe [2008-05-13 69632]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-05-19 240512]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2009-05-20 604416]
R2 UxTuneUp;TuneUp Extension de thème; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
R2 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S2 CLSched;CyberLink Task Scheduler (CTS); c:\APPS\Powercinema\Kernel\TV\CLSched.exe [2005-05-11 110672]
S2 gupdate1c987b7f1c21284;Google Update Service (gupdate1c987b7f1c21284); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-02-05 133104]
S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-09-18 163908]
S2 SLService;SmartLinkService; C:\WINDOWS\system32\slserv.exe [2008-04-13 73796]
S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2009-05-29 234864]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-05-20 361216]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]

-----------------EOF-----------------

ComboFix 09-06-04.06 - Aurélien 05/06/2009  7:31.2 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.1023.647 [GMT 2:00]
Lancé depuis: c:\documents and settings\Aurélien\Bureau\ComboFix.exe
 * Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\beep.sys
c:\windows\system32\nvrsk.dll
.
---- Exécution préalable -------
.
c:\documents and settings\Aurélien\Aurélien.exe
c:\windows\system32\azton.mt
c:\windows\system32\drivers\acpi32.sys
c:\windows\system32\drivers\beep.sys
c:\windows\system32\drivers\i386si.sys
c:\windows\system32\drivers\systemntmi.sys
c:\windows\system32\drivers\ws2_32sik.sys
c:\windows\system32\Ijl11.dll
c:\windows\system32\kr_done1
c:\windows\Temp\18.exe

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ACPI32
-------\Legacy_SYSTEMNTMI
-------\Legacy_WS2_32SIK
-------\Service_acpi32
-------\Service_systemntmi
-------\Service_ws2_32sik


(((((((((((((((((((((((((((((   Fichiers créés du 2009-05-05 au 2009-06-05  ))))))))))))))))))))))))))))))))))))
.

2009-06-03 10:50 . 2009-06-04 13:45	--------	d-----w-	C:\CLEUSB
2009-06-03 10:22 . 2009-06-03 10:22	2855	----a-w-	c:\windows\system32\choice.PIF
2009-06-03 10:21 . 2009-06-03 10:21	--------	d--h--w-	c:\windows\PIF
2009-06-02 14:24 . 2009-06-02 14:27	--------	d-----w-	C:\FindyKill
2009-06-02 14:19 . 2009-06-02 14:19	--------	d-----w-	c:\windows\system32\wbem\Repository
2009-06-02 14:19 . 2009-06-02 14:19	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2009-06-01 18:58 . 2009-06-01 18:58	--------	d-----w-	c:\documents and settings\All Users\Application Data\TuneUp Software(2)
2009-06-01 18:53 . 2009-06-02 15:11	--------	d-----w-	c:\program files\Glary Utilities
2009-06-01 18:41 . 2009-06-02 14:18	--------	d-----w-	c:\program files\TuneUp Utilities 2009(2)
2009-06-01 17:16 . 2009-06-01 17:16	--------	d-----w-	C:\rsit
2009-06-01 14:11 . 2009-06-01 14:11	--------	d-----w-	c:\program files\Trend Micro
2009-06-01 11:24 . 2009-06-02 14:20	--------	d-----w-	c:\program files\Prevx
2009-06-01 11:22 . 2009-06-02 14:19	--------	d-----w-	c:\documents and settings\All Users\Application Data\PrevxCSI
2009-06-01 11:12 . 2009-06-01 11:12	21361	----a-w-	c:\windows\system32\drivers\AegisP.sys
2009-06-01 11:10 . 2008-06-10 19:52	438272	----a-w-	c:\windows\system32\RaCoInst.dll
2009-06-01 11:10 . 2008-06-16 12:57	4096	----a-w-	c:\windows\system32\drivers\rt2870.bin
2009-06-01 11:10 . 2008-06-05 21:28	11783	----a-w-	c:\windows\system32\RaCoInst.dat
2009-06-01 11:10 . 2009-06-01 11:10	--------	d-----w-	c:\program files\RALINK
2009-06-01 10:49 . 2009-06-01 11:08	--------	d-----w-	C:\NVIDIA
2009-06-01 10:14 . 2009-06-01 10:16	--------	d-----w-	c:\program files\RPG Maker VX
2009-06-01 09:48 . 2009-06-01 09:48	--------	d-----w-	C:\Temp
2009-06-01 09:44 . 2009-06-01 09:46	--------	d-----w-	c:\program files\Game_Maker5
2009-06-01 09:43 . 2009-06-01 09:43	796672	----a-w-	c:\windows\GPInstall.exe
2009-06-01 09:26 . 2009-06-01 09:26	118784	----a-w-	c:\windows\system32\sgcpvvj0e50v.dll
2009-06-01 09:26 . 2009-06-02 14:54	579584	----a-w-	c:\windows\system32\dllcache\user32.dll
2009-06-01 09:26 . 2009-06-01 09:26	80191	----a-w-	c:\windows\system32\qgctvvj0e50v.exe
2009-06-01 09:18 . 2009-06-01 09:38	--------	d-----w-	c:\program files\Game_Maker7
2009-06-01 08:58 . 2009-06-05 05:33	--------	d-----w-	c:\windows\apppatch
2009-05-22 15:57 . 2005-05-27 09:36	372736	----a-r-	c:\windows\system32\LVUI2RC.dll
2009-05-22 15:57 . 2005-05-27 09:31	22016	----a-r-	c:\windows\system32\drivers\LVUSBSta.sys
2009-05-22 15:57 . 2005-05-27 09:19	106496	----a-r-	c:\windows\system32\lvcoinst.dll
2009-05-22 15:57 . 2005-05-27 09:29	204800	----a-r-	c:\windows\system32\LVUI2.dll
2009-05-22 15:57 . 2005-05-27 09:26	204800	----a-r-	c:\windows\system32\lvcodec2.dll
2009-05-22 15:57 . 2005-05-27 09:32	1317152	----a-r-	c:\windows\system32\drivers\lvcm.sys
2009-05-22 15:57 . 2005-05-27 09:23	2180096	----a-r-	c:\windows\system32\drivers\lvsvf2.sys
2009-05-22 15:53 . 2005-06-08 13:12	462848	----a-w-	c:\windows\system32\LCamCpl.dll
2009-05-22 15:53 . 2005-06-08 12:31	215552	----a-w-	c:\windows\system32\Lvkrn12n.dll
2009-05-22 15:52 . 2005-06-08 12:41	466944	----a-w-	c:\windows\system32\QCUI2.dll
2009-05-22 15:52 . 2005-06-08 12:31	856064	----a-w-	c:\windows\system32\Ltwvc12n.dll
2009-05-22 15:52 . 2005-06-08 12:31	406016	----a-w-	c:\windows\system32\ltkrn12n.dll
2009-05-22 15:52 . 2005-06-08 12:31	207872	----a-w-	c:\windows\system32\ltefx12n.dll
2009-05-22 15:52 . 2005-06-08 12:31	164864	----a-w-	c:\windows\system32\ltimg12n.dll
2009-05-22 15:52 . 2005-06-08 12:31	131072	----a-w-	c:\windows\system32\ltfil12n.DLL
2009-05-22 15:52 . 2005-06-08 12:31	259072	----a-w-	c:\windows\system32\LTDIS12n.dll
2009-05-22 15:52 . 2005-06-08 12:31	141312	----a-w-	c:\windows\system32\lftif12n.dll
2009-05-22 15:52 . 2005-06-08 12:31	78336	----a-w-	c:\windows\system32\lffax12n.dll
2009-05-22 15:52 . 2005-06-08 12:31	328704	----a-w-	c:\windows\system32\LFCMP12n.DLL
2009-05-22 15:52 . 2005-06-08 12:31	30720	----a-w-	c:\windows\system32\lfbmp12n.dll
2009-05-22 15:52 . 2005-06-08 12:38	90112	----a-w-	c:\windows\system32\LQCUI2.dll
2009-05-22 15:45 . 2009-05-22 15:45	81920	------r-	c:\windows\bwUnin-6.1.4.68-8876480L.exe
2009-05-20 14:29 . 2009-05-20 14:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\TuneUp Software
2009-05-20 14:29 . 2009-06-02 15:11	--------	d-----w-	c:\program files\TuneUp Utilities 2009
2009-05-20 14:27 . 2009-05-20 14:27	--------	d-sh--w-	c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-09 08:30 . 1998-09-30 10:26	49936	----a-w-	c:\windows\system32\SeCEdit.exe
2009-05-09 08:30 . 1998-09-30 10:24	242448	----a-w-	c:\windows\system32\scedll.dll
2009-05-09 08:30 . 1998-03-31 14:37	29968	----a-w-	c:\windows\system32\Rshx32_5.dll
2009-05-09 08:30 . 1998-10-09 12:17	384784	----a-w-	c:\windows\system32\wsecedit.dll
2009-05-06 13:23 . 2009-05-06 13:23	--------	d-----w-	c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-04 16:46 . 2009-02-27 14:07	--------	d-----w-	c:\program files\ShoppingAdsHelper
2009-06-03 10:22 . 2002-12-22 12:36	5175	----a-w-	c:\windows\system32\choice.exe
2009-06-02 15:05 . 2009-02-05 17:33	--------	d-----w-	c:\program files\Google
2009-06-02 14:54 . 2004-08-16 15:41	579584	----a-w-	c:\windows\system32\user32.dll
2009-06-02 14:29 . 2009-06-02 14:29	69	----a-w-	C:\asap.tmp
2009-06-02 14:28 . 2004-08-16 15:41	94526	----a-w-	c:\windows\system32\perfc00C.dat
2009-06-02 14:28 . 2004-08-16 15:41	536002	----a-w-	c:\windows\system32\perfh00C.dat
2009-06-01 18:57 . 2009-05-01 07:49	--------	d-----w-	c:\program files\Avira
2009-06-01 11:24 . 2009-06-02 14:15	208452	----a-w-	c:\windows\pchealth\helpctr\Config\Cache\Personal_32_1036.dat
2009-06-01 11:10 . 2009-01-17 23:08	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-06-01 11:00 . 2009-04-29 15:50	--------	d-----w-	c:\program files\ma-config.com
2009-06-01 11:00 . 2009-04-29 15:50	--------	d-----w-	c:\documents and settings\All Users\Application Data\ma-config.com
2009-06-01 10:24 . 2009-01-18 08:48	--------	d-----w-	c:\program files\Windows Live
2009-05-22 19:14 . 2009-04-19 13:40	--------	d-----w-	c:\program files\World of Warcraft
2009-05-22 15:52 . 2009-02-13 17:32	--------	d-----w-	c:\program files\Logitech
2009-05-20 19:44 . 2009-02-07 13:09	--------	d-----w-	c:\program files\Windows Live Safety Center
2009-05-20 15:18 . 2009-02-27 14:47	--------	d-----w-	c:\program files\adslTV
2009-05-20 15:17 . 2009-02-27 08:12	--------	d-----w-	c:\program files\eMule
2009-05-20 15:15 . 2009-05-04 18:02	--------	d-----w-	c:\program files\Ubisoft
2009-05-20 15:14 . 2009-01-18 17:47	--------	d-----w-	c:\program files\JkDefrag
2009-05-20 14:24 . 2009-01-28 07:03	--------	d-----w-	c:\program files\Messenger Plus! Live
2009-05-06 03:30 . 2009-05-05 18:56	--------	d-----w-	c:\program files\DAEMON Tools Lite
2009-05-05 18:56 . 2009-05-05 18:56	--------	d-----w-	c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-05-05 18:56 . 2009-05-05 18:56	--------	d-----w-	c:\program files\DAEMON Tools Toolbar
2009-05-05 17:13 . 2009-05-05 17:13	--------	d-----w-	c:\program files\EASEUS
2009-05-05 17:03 . 2009-05-05 17:03	--------	d-----w-	c:\program files\Astonsoft
2009-05-05 16:59 . 2009-05-05 16:59	--------	d-----w-	c:\program files\winMd5Sum
2009-05-05 15:34 . 2009-05-05 15:34	721904	----a-w-	c:\windows\system32\drivers\sptd.sys
2009-05-03 14:04 . 2009-05-03 14:04	--------	d-----w-	c:\program files\i-Media
2009-05-03 14:04 . 2009-05-03 14:04	--------	d-----w-	c:\program files\Goto
2009-05-03 13:36 . 2009-05-03 13:36	--------	d-----w-	c:\program files\Capturino V2
2009-05-02 08:36 . 2009-05-02 08:36	253952	------w-	c:\windows\Setup1.exe
2009-05-02 08:36 . 2009-05-02 08:36	74752	----a-w-	c:\windows\ST6UNST.EXE
2009-05-01 17:35 . 2009-05-01 17:35	--------	d-----w-	c:\program files\SoundSpectrum
2009-05-01 16:56 . 2009-05-01 16:56	--------	d-----w-	c:\program files\Buka
2009-05-01 08:02 . 2009-05-01 08:02	4212	---ha-w-	c:\windows\system32\zllictbl.dat
2009-05-01 08:01 . 2009-05-01 08:01	--------	d-----w-	c:\program files\Zone Labs
2009-04-30 20:02 . 2009-04-30 20:02	663552	----a-w-	c:\windows\system32\nvcuvid.dll
2009-04-30 20:02 . 2009-04-30 20:02	1579630	----a-w-	c:\windows\system32\nvdata.bin
2009-04-30 20:02 . 2009-04-30 20:02	1314816	----a-w-	c:\windows\system32\nvcuvenc.dll
2009-04-30 20:02 . 2008-09-17 22:55	806912	----a-w-	c:\windows\system32\nvapi.dll
2009-04-30 20:02 . 2008-09-17 22:55	1720320	----a-w-	c:\windows\system32\nvcuda.dll
2009-04-30 20:02 . 2005-08-23 19:55	457248	----a-w-	c:\windows\system32\nvudisp.exe
2009-04-30 20:02 . 1979-12-31 22:00	9994240	----a-w-	c:\windows\system32\nvoglnt.dll
2009-04-30 20:02 . 1979-12-31 22:00	8055584	----a-w-	c:\windows\system32\drivers\nv4_mini.sys
2009-04-30 20:02 . 1979-12-31 22:00	5896320	----a-w-	c:\windows\system32\nv4_disp.dll
2009-04-30 20:02 . 1979-12-31 22:00	143360	----a-w-	c:\windows\system32\nvcodins.dll
2009-04-30 20:02 . 1979-12-31 22:00	143360	----a-w-	c:\windows\system32\nvcod.dll
2009-04-30 18:54 . 2009-04-30 18:54	--------	d---a-w-	c:\documents and settings\All Users\Application Data\rkfree
2009-04-30 18:54 . 2009-04-30 18:54	--------	d-----w-	c:\program files\rkfree
2009-04-30 15:09 . 2009-04-30 15:05	--------	d-----w-	c:\program files\iPod
2009-04-30 15:09 . 2009-04-30 15:05	--------	d-----w-	c:\program files\iTunes
2009-04-30 15:05 . 2009-04-30 13:09	--------	d-----w-	c:\program files\iPod(2)
2009-04-30 15:05 . 2009-04-30 13:09	--------	d-----w-	c:\program files\iTunes(2)
2009-04-30 15:05 . 2009-04-02 15:22	--------	d-----w-	c:\program files\Fichiers communs\Apple
2009-04-28 17:55 . 2009-04-28 17:49	--------	d-----w-	c:\program files\Orbitdownloader
2009-04-26 22:42 . 2005-08-23 19:55	457248	----a-w-	c:\windows\system32\NVUNINST.EXE
2009-04-26 17:40 . 2009-04-07 15:26	--------	d-----w-	c:\program files\XWindowsDock
2009-04-26 17:08 . 2009-01-24 13:31	--------	d-----w-	c:\documents and settings\Catherine\Application Data\gtk-2.0
2009-04-26 16:43 . 2009-04-26 16:43	--------	d-----w-	c:\documents and settings\Catherine\Application Data\Wings3D
2009-04-26 15:08 . 2009-04-26 15:08	--------	d-----w-	c:\program files\Bonjour
2009-04-26 14:52 . 2009-04-26 14:51	--------	d-----w-	c:\documents and settings\Catherine\Application Data\Apple Computer
2009-04-26 14:51 . 2009-04-26 14:50	--------	d-----w-	c:\program files\QuickTime
2009-04-26 12:01 . 2009-04-26 12:01	--------	d-----w-	c:\documents and settings\Catherine\Application Data\Bump Technologies, Inc
2009-04-25 13:27 . 2009-04-25 13:27	--------	d-----w-	c:\documents and settings\All Users\Application Data\WLInstaller
2009-04-24 18:22 . 2009-01-18 09:48	71616	----a-w-	c:\documents and settings\Catherine\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-24 17:35 . 2009-03-29 05:28	--------	d-----w-	c:\program files\MSECache
2009-04-24 15:33 . 2009-02-14 14:49	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-04-23 10:44 . 2009-04-23 10:44	--------	d-----w-	c:\documents and settings\Catherine\Application Data\CyberLink
2009-04-22 16:07 . 2009-04-22 11:46	--------	d-----w-	c:\program files\Morgan
2009-04-22 16:02 . 2009-01-18 17:06	--------	d-----w-	c:\program files\OpenOffice.org 3
2009-04-22 13:06 . 2009-02-13 09:58	--------	d-----w-	c:\program files\Microsoft Picture It! PhotoPub
2009-04-20 17:22 . 2009-02-14 09:59	--------	d-----w-	c:\program files\Styler
2009-04-20 17:21 . 2009-03-01 12:28	--------	d-----w-	c:\program files\Safari
2009-04-20 17:21 . 2009-04-04 12:33	--------	d-----w-	c:\program files\Opera
2009-04-20 17:20 . 2009-01-19 06:01	--------	d-----w-	c:\program files\Nvu
2009-04-20 17:20 . 2009-03-22 09:26	--------	d-----w-	c:\program files\Mozilla Thunderbird
2009-04-20 17:18 . 2009-01-18 08:36	--------	d-----w-	c:\program files\Dofus
2009-04-20 17:17 . 2009-03-22 15:20	--------	d-----w-	c:\program files\AVS4YOU
2009-04-20 17:17 . 2009-03-22 15:20	--------	d-----w-	c:\program files\Fichiers communs\AVSMedia
2009-04-19 13:43 . 2009-04-19 13:43	--------	d-----w-	c:\program files\Fichiers communs\Blizzard Entertainment
2009-04-19 07:02 . 2009-04-18 12:41	--------	d-----w-	c:\program files\EA GAMES
2009-04-18 13:02 . 2009-04-18 13:02	107888	----a-w-	c:\windows\system32\CmdLineExt.dll
2009-04-11 05:32 . 2009-04-11 05:32	--------	d-----w-	c:\program files\HooTech
2009-04-10 16:27 . 2009-02-16 14:20	--------	d-----w-	c:\program files\Fichiers communs\DVDVideoSoft
2009-04-10 16:18 . 2009-04-03 04:48	664	----a-w-	c:\windows\system32\d3d9caps.dat
2009-04-09 15:36 . 2009-04-09 15:36	--------	d-----w-	c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-02 14:29 . 2009-04-02 14:29	75048	----a-w-	c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-30 18:21 . 2009-03-22 13:20	1	----a-w-	c:\documents and settings\Catherine\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-03-30 08:32 . 2009-05-01 07:49	96104	----a-w-	c:\windows\system32\drivers\avipbb.sys
2009-03-28 11:36 . 2009-03-28 11:36	74240	----a-w-	c:\windows\system32\taskkill.exe
2009-03-24 14:07 . 2009-05-01 07:49	55640	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-03-19 14:32 . 2009-04-02 15:25	23400	----a-w-	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-19 14:32 . 2009-03-19 14:32	23400	----a-w-	c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 12:03 . 2009-05-05 17:14	1907712	----a-w-	c:\windows\system32\BootMan.exe
2009-03-08 02:34 . 2004-08-16 15:41	914944	----a-w-	c:\windows\system32\wininet.dll
2009-03-08 02:34 . 2004-08-16 15:40	43008	----a-w-	c:\windows\system32\licmgr10.dll
2009-03-08 02:33 . 2004-08-16 15:40	18944	----a-w-	c:\windows\system32\corpol.dll
2009-03-08 02:33 . 2004-08-16 15:41	420352	----a-w-	c:\windows\system32\vbscript.dll
2009-03-08 02:32 . 2004-08-16 15:39	72704	----a-w-	c:\windows\system32\admparse.dll
2009-01-27 01:34 . 2009-01-27 01:34	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-01-27 01:34 . 2009-01-27 01:34	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-06-02 209153]
"Connexion internet"="c:\program files\TRENDnet\TEW-624UB_TEW-644UB\WlanCU.exe" [2008-06-26 344064]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="c:\windows\system32\sti_ci.dll" [2008-04-13 138240]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe [2009-6-1 1585152]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeAnimation"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"EmailChecker"=c:\apps\EmailChecker\ech.exe
"nwiz"=nwiz.exe /install
"Raccourci vers la page des propriétés de High Definition Audio"=HDAudPropShortcut.exe
"PCMService"="c:\apps\Powercinema\PCMService.exe"
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"SoundMan"=SOUNDMAN.EXE
"ACTIVBOARD"=c:\apps\ABoard\ABoard.exe
"AlcWzrd"=ALCWZRD.EXE
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
"rkfree"="c:\program files\rkfree\rkfree.exe" /b
"PHIME2002ASync"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"PHIME2002A"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"rgcrvvj0e50v"=c:\windows\system32\qgctvvj0e50v.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"39755:TCP"= 39755:TCP:emule1
"39765:UDP"= 39765:UDP:emule2
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\RALINK\Common\RalinkRegistryWriter.exe [01/06/2009 13:13 69632]
R2 WLNdis50;WLan NDIS 5.0 I/O Control;c:\windows\system32\drivers\WLNdis50.sys [24/01/2009 19:37 20480]
R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [24/01/2009 19:36 580096]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [01/05/2009 09:49 108289]
S2 gupdate1c987b7f1c21284;Google Update Service (gupdate1c987b7f1c21284);c:\program files\Google\Update\GoogleUpdate.exe [05/02/2009 19:34 133104]
S3 avshws;YouUp Simulated Hardware;c:\windows\system32\drivers\youup.sys [13/02/2009 11:45 57344]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [05/05/2009 19:14 8704]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [05/05/2009 19:14 3072]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [29/05/2009 17:13 234864]
.
Contenu du dossier 'Tâches planifiées'

2009-06-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-06-05 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-06-02 09:50]

2009-06-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1170982658-3214024294-1526281595-1007.job
- c:\documents and settings\Catherine\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-03 16:30]

2009-06-03 c:\windows\Tasks\HDReg.job
- c:\apps\HDReg\HDRegRem.exe [2005-08-23 08:14]

2009-06-05 c:\windows\Tasks\User_Feed_Synchronization-{412F16E1-ACC7-4245-A381-0FA2600B37FF}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]

2009-06-04 c:\windows\Tasks\User_Feed_Synchronization-{4F425F12-6323-403E-A117-ADED1C0857E7}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
- - - - ORPHELINS SUPPRIMES - - - -

SafeBoot-procexp90.Sys


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://search.orbitdownloader.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
TCP: {4924EA7F-F545-4641-ACFD-9F354E381BFD} = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Aurélien\Application Data\Mozilla\Firefox\Profiles\1zh05mm6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - component: c:\documents and settings\Aurélien\Application Data\Mozilla\Firefox\Profiles\1zh05mm6.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-05 07:35
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,88,8b,32,2d,d2,
   84,eb,10,c8,28,51,af,b0,29,a3,98,41,ab,17,d5,2d,62,a6,b3,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,d5,2c,76,a7,47,
   75,7d,54,71,3b,04,66,8b,46,0d,96,01,f3,24,76,37,aa,5e,42,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,6e,72,b7,25,12,
   b7,50,4b,25,da,ec,7e,55,20,c9,26,20,d4,08,c3,a8,29,b3,ee,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,5e,52,8a,58,94,
   d0,5f,76,3e,1e,9e,e0,57,5a,93,61,33,09,f8,b4,13,cb,7a,5a,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:e9,02,6c,fa,fb,1d,47,57,1b,e3,16,4f,2c,
   fb,77,94,cd,44,cd,b9,a6,33,6c,cd,b1,c9,7a,f4,3d,ba,43,17,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,ff,66,96,54,55,
   6d,dc,74,b0,18,ed,a7,3f,8d,37,a4,71,80,b1,d7,9f,70,a8,c4,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,e3,6d,40,75,9c,
   a7,1d,7e,31,77,e1,ba,b1,f8,68,02,cc,b9,2f,b6,87,aa,76,eb,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,df,4c,22,5a,44,
   41,9b,aa,83,6c,56,8b,a0,85,96,ab,12,3f,74,90,40,d5,b3,c9,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,2c,7d,02,96,c0,
   c0,47,4b,51,fa,6e,91,28,9e,14,cc,00,ac,d7,f1,4c,f1,a9,9b,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,ae,83,ed,85,3d,
   f6,19,ea,b1,cd,45,5a,a8,c4,f8,b9,1d,84,37,b1,59,6f,8d,f4,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,f8,f8,4c,88,05,
   7f,1a,94,e3,0e,66,d5,eb,bc,2f,6b,64,69,ec,2e,bf,a8,2d,c3,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,a4,ab,d1,02,0d,
   3b,fd,ab,fa,ea,66,7f,d4,3b,6b,70,4a,fb,e8,40,62,58,ec,a9,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(3488)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe
c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\apps\HIDSERVICE\HidService.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\apps\Powercinema\Kernel\TV\CLSched.exe
c:\windows\system32\wscntfy.exe
c:\program files\Windows Live\Contacts\wlcomm.exe
.
**************************************************************************
.
Heure de fin: 2009-06-05  7:37 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-06-05 05:37

Avant-CF: 75 686 596 608 octets libres
Après-CF: 75 749 502 976 octets libres

416	--- E O F ---	2009-05-31 17:10